|
| 1 | +# MediaTek bl2_ext Secure-Boot Bypass (EL3 Code Execution) |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +This page documents a practical secure-boot break on multiple MediaTek platforms by abusing a verification gap when the device bootloader configuration (seccfg) is "unlocked". The flaw allows running a patched bl2_ext at ARM EL3 to disable downstream signature verification, collapsing the chain of trust and enabling arbitrary unsigned TEE/GZ/LK/Kernel loading. |
| 6 | + |
| 7 | +> Caution: Early-boot patching can permanently brick devices if offsets are wrong. Always keep full dumps and a reliable recovery path. |
| 8 | +
|
| 9 | +## Affected boot flow (MediaTek) |
| 10 | + |
| 11 | +- Normal path: BootROM → Preloader → bl2_ext (EL3, verified) → TEE → GenieZone (GZ) → LK/AEE → Linux kernel (EL1) |
| 12 | +- Vulnerable path: When seccfg is set to unlocked, Preloader may skip verifying bl2_ext. Preloader still jumps into bl2_ext at EL3, so a crafted bl2_ext can load unverified components thereafter. |
| 13 | + |
| 14 | +Key trust boundary: |
| 15 | +- bl2_ext executes at EL3 and is responsible for verifying TEE, GenieZone, LK/AEE and the kernel. If bl2_ext itself is not authenticated, the rest of the chain is trivially bypassed. |
| 16 | + |
| 17 | +## Root cause |
| 18 | + |
| 19 | +On affected devices, the Preloader does not enforce authentication of the bl2_ext partition when seccfg indicates an "unlocked" state. This allows flashing an attacker-controlled bl2_ext that runs at EL3. |
| 20 | + |
| 21 | +Inside bl2_ext, the verification policy function can be patched to unconditionally report that verification is not required. A minimal conceptual patch is: |
| 22 | + |
| 23 | +```c |
| 24 | +// inside bl2_ext |
| 25 | +int sec_get_vfy_policy(...) { |
| 26 | + return 0; // always: "no verification required" |
| 27 | +} |
| 28 | +``` |
| 29 | +
|
| 30 | +With this change, all subsequent images (TEE, GZ, LK/AEE, Kernel) are accepted without cryptographic checks when loaded by the patched bl2_ext running at EL3. |
| 31 | +
|
| 32 | +## How to triage a target (expdb logs) |
| 33 | +
|
| 34 | +Dump/inspect boot logs (e.g., expdb) around the bl2_ext load. If img_auth_required = 0 and certificate verification time is ~0 ms, enforcement is likely off and the device is exploitable. |
| 35 | +
|
| 36 | +Example log excerpt: |
| 37 | +
|
| 38 | +``` |
| 39 | +[PART] img_auth_required = 0 |
| 40 | +[PART] Image with header, name: bl2_ext, addr: FFFFFFFFh, mode: FFFFFFFFh, size:654944, magic:58881688h |
| 41 | +[PART] part: lk_a img: bl2_ext cert vfy(0 ms) |
| 42 | +``` |
| 43 | +
|
| 44 | +Note: Some devices reportedly skip bl2_ext verification even with a locked bootloader, which exacerbates the impact. |
| 45 | +
|
| 46 | +## Practical exploitation workflow (Fenrir PoC) |
| 47 | +
|
| 48 | +Fenrir is a reference exploit/patching toolkit for this class of issue. It supports Nothing Phone (2a) (Pacman) and is known working (incompletely supported) on CMF Phone 1 (Tetris). Porting to other models requires reverse engineering the device-specific bl2_ext. |
| 49 | +
|
| 50 | +High-level process: |
| 51 | +- Obtain the device bootloader image for your target codename and place it as bin/<device>.bin |
| 52 | +- Build a patched image that disables the bl2_ext verification policy |
| 53 | +- Flash the resulting payload to the device (fastboot assumed by the helper script) |
| 54 | +
|
| 55 | +Commands: |
| 56 | +
|
| 57 | +```bash |
| 58 | +# Build patched image (default path bin/[device].bin) |
| 59 | +./build.sh pacman |
| 60 | +
|
| 61 | +# Build from a custom bootloader path |
| 62 | +./build.sh pacman /path/to/your/bootloader.bin |
| 63 | +
|
| 64 | +# Flash the resulting lk.patched (fastboot required by helper script) |
| 65 | +./flash.sh |
| 66 | +``` |
| 67 | + |
| 68 | +If fastboot is unavailable, you must use a suitable alternative flashing method for your platform. |
| 69 | + |
| 70 | +## Runtime payload capabilities (EL3) |
| 71 | + |
| 72 | +A patched bl2_ext payload can: |
| 73 | +- Register custom fastboot commands |
| 74 | +- Control/override boot mode |
| 75 | +- Dynamically call built‑in bootloader functions at runtime |
| 76 | +- Spoof “lock state” as locked while actually unlocked to pass stronger integrity checks (some environments may still require vbmeta/AVB adjustments) |
| 77 | + |
| 78 | +Limitation: Current PoCs note that runtime memory modification may fault due to MMU constraints; payloads generally avoid live memory writes until this is resolved. |
| 79 | + |
| 80 | +## Porting tips |
| 81 | + |
| 82 | +- Reverse engineer the device-specific bl2_ext to locate verification policy logic (e.g., sec_get_vfy_policy). |
| 83 | +- Identify the policy return site or decision branch and patch it to “no verification required” (return 0 / unconditional allow). |
| 84 | +- Keep offsets fully device- and firmware-specific; do not reuse addresses between variants. |
| 85 | +- Validate on a sacrificial unit first. Prepare a recovery plan (e.g., EDL/BootROM loader/SoC-specific download mode) before you flash. |
| 86 | + |
| 87 | +## Security impact |
| 88 | + |
| 89 | +- EL3 code execution after Preloader and full chain-of-trust collapse for the rest of the boot path. |
| 90 | +- Ability to boot unsigned TEE/GZ/LK/Kernel, bypassing secure/verified boot expectations and enabling persistent compromise. |
| 91 | + |
| 92 | +## Detection and hardening ideas |
| 93 | + |
| 94 | +- Ensure Preloader verifies bl2_ext regardless of seccfg state. |
| 95 | +- Enforce authentication results and gather audit evidence (timings > 0 ms, strict errors on mismatch). |
| 96 | +- Lock-state spoofing should be made ineffective for attestation (tie lock state to AVB/vbmeta verification decisions and fuse-backed state). |
| 97 | + |
| 98 | +## Device notes |
| 99 | + |
| 100 | +- Confirmed supported: Nothing Phone (2a) (Pacman) |
| 101 | +- Known working (incomplete support): CMF Phone 1 (Tetris) |
| 102 | +- Observed: Vivo X80 Pro reportedly did not verify bl2_ext even when locked |
| 103 | + |
| 104 | +## References |
| 105 | + |
| 106 | +- [Fenrir – MediaTek bl2_ext secure‑boot bypass (PoC)](https://github.com/R0rt1z2/fenrir) |
| 107 | + |
| 108 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments