: Device boots with verified boot disabled, no user data wipe (unlike fastboot oem unlock ). Any boot/recovery image can be flashed. 5. Impact Assessment | Bypass Method | Persistence | Key Extraction | User Data Wipe Required | OEM Patch Availability | |---------------|-------------|----------------|--------------------------|------------------------| | BootROM USB (mtkclient) | Permanent | Yes (eFuse/RPMB) | No | None (ROM bug) | | Preloader sig overflow | Permanent | Partial (TEE keys) | No | Yes (preloader update) | | DA imposter | Session-only | Yes | No | Workaround only | | Debug interface | Permanent | Full (RPMB) | No | Blow eFuses (rare) |

: The preloader checks the signature of the Little Kernel (LK) bootloader using a stored public key. However, due to an integer overflow in the signature length field (or improper handling of malformed headers), the preloader may treat an unsigned image as valid.

| Component | Role | Security Mechanism | |-----------|------|---------------------| | | First-stage immutable code | eFuse-based secure boot (RSA-2048/SHA-256) | | Preloader | Second-stage loader | Signature verification of next stage (LK/TEE) | | TEE (TrustZone) | Secure world OS (Kinibi/Trustonic) | Secure storage, cryptographic ops | | Secure Boot | Chain of trust from ROM to kernel | Image signing via OEM keys | | DA (Download Agent) | Flash programming mode (Preloader/BROM) | Signed DA required; anti-rollback via eFuses |