Skip to content
BranchesTags
 
 

Repository files navigation

GBL Root Canoe

项目简介

gbl_root_canoe 是一个基于 EDK2 的工作区，用于修补高通 ABL（Android Bootloader）内的 EFI 程序，目标是让骁龙 8 Gen 5 / 8 Elite (Gen 5) 设备支持多套可切换的启动流程，原项目地址：https://github.com/superturtlee/gbl_root_canoe 。

项目利用 GBL（Generic Bootloader Loader）漏洞，让真实 ABL 从原始 efisp 分区加载内嵌的 superfastboot BDS。BDS 是一个自包含的启动管理器：它自带 FAT32 / 只读 ext4 驱动，扫描兼容分区上的启动项，提供启动菜单、文件浏览器和 fastboot 入口，并能链式加载不同的 ABL 变体进入 Android。

在 targets/toolkit_linux 中，项目同时产出两个 ABL 变体，对应两种启动流程：

  • Normal Boot（ABL_normal.efi） —— 真实状态透传
  • Fake Locked Boot（ABL_fake_locked.efi） —— 假回锁

启动链路总览

开机 → XBL → 真实 ABL（abl 分区）
                  │
                  │ GBL 漏洞：加载 efisp 分区上的 EFI 镜像
                  ▼
          superfastboot BDS（BDS.efi，原始刷入 efisp 分区）
                  │
                  ├─ 无音量上键 → 自动启动上次保存的默认项（无默认项则进菜单）
                  ├─ 按住音量上键 → 启动菜单
                  │     ├─ Normal Boot      → ABL_normal.efi      → 真实状态透传
                  │     ├─ Fake Locked Boot → ABL_fake_locked.efi → Android 认为 Locked
                  │     ├─ Tools 子菜单     → Reboot / BL / ARB 工具
                  │     ├─ Enter Fastboot   → superfastboot（BDS 自带 fastboot）
                  │     └─ EFI Program Selector → 浏览并临时启动任意 .efi
                  ▼
              Android

启动流程详解

流程 A：官方 ABL 直接启动（未安装本项目）

真实 ABL 按官方逻辑直接引导 Android。

  • 完全原厂行为，无任何状态修改。
  • 解锁设备开机显示橙色警告（OPlus：Orange State）。
  • 官方 ABL 无法进入 fastboot 和 fastbootd 模式。

流程 B：BDS 链式启动（本项目）

真实 ABL 通过 GBL 漏洞加载 BDS，由 BDS 接管启动。

  • 开机按住音量上键随时进入启动菜单；无按键时自动启动上次选择的项（选择会被持久化到 efisp 分区尾部的原始扇区，不受文件系统重写影响）。
  • 支持双启动模式切换；菜单还提供 fastboot、EFI 文件浏览器、关机/重启、工具子菜单。
  • 链式加载时会临时绕过 UEFI Security/Security2 验证，因此可以加载任意 EFI 镜像（前提是设备已解锁、用户显式选择）。
  • 每个启动项可附带 DRIVER.LIST 预加载 UEFI 驱动。

流程 B1：Normal Boot（真实状态透传）

对应 ABL_normal.efi，在原厂 ABL 基础上仅叠加必要补丁：

  • GBL patch（efisp→nulls）：防止链式加载的 ABL 再次进入 GBL 加载路径（避免 BDS→ABL→BDS 递归）。
  • OPlus 去黄字：禁用 Orange State 警告显示。
  • OPlus forceenablefastboot：绕过非官方解锁的 fastboot 验证，强制 fastboot 可用。

特点：

  • 完全透传真实 Bootloader 状态：不修改 androidboot.flash.locked、ro.boot.flash.locked、androidboot.verifiedbootstate、AVB 状态、bootconfig、kernel command line。
  • 真实 Locked → flash.locked=1、verifiedbootstate=green；真实 Unlocked → flash.locked=0、verifiedbootstate=orange。
  • 不强制解锁、不伪造任何状态；适合需要官方状态兜底或官方 fastboot 的场合。

流程 B2：Fake Locked Boot（假回锁）

对应 ABL_fake_locked.efi，保留原项目全部补丁逻辑：

  • GBL patch。
  • ADRL 重定向：androidboot.vbmeta.device_state 的 "unlocked" 字符串引用改写为 "locked"。
  • 启动状态强制：锚点指令改写 + 锁状态全局变量的读/写中性化（来源改为常量、写回改为 WZR）。
  • OPlus 去黄字 + forceenablefastboot。

特点：

  • 真实 Unlocked 设备启动后，Android 认为设备已锁定（flash.locked=1、verifiedbootstate=green）。
  • 行为与补丁前版本一致，兼容性保持不变。
  • 注意：假回锁不改变 TEE 侧真实身份；TEE 状态不一致时设备会拒绝下发 data key，数据不可访问。

流程 B3：Superfastboot（BDS 自带 fastboot）

从启动菜单选择 Enter Fastboot 进入，独立于 ABL 的锁状态。

  • 支持 fastboot boot xxx.efi（临时启动、不刷入）、flash、erase、reboot 等。
  • 回锁/解锁行为：fastboot flashing lock 触发数据清除；fastboot flashing unlock / unlock_critical 不触发数据清除。
  • 若 TEE 状态与 BL 状态不一致，设备会拒绝下发 data key。

流程特点对比

流程 Android 看到的锁状态 补丁范围 适用场景
Normal Boot 真实透传 GBL + OPlus UX 官方状态兜底、官方 fastboot
Fake Locked Boot Locked 全部（含状态伪造） 隐藏解锁状态
Superfastboot 与 ABL 状态无关 BDS 自身 fastboot 刷写 / 回锁操作

注：OPlus 两个补丁按字符串/指令模式匹配，部分 ABL 版本不命中时会自动跳过并在日志中提示 Warning，不影响对应流程的可用性。

文件说明

  1. BDS.efi：superfastboot BDS，原始刷入 efisp 分区。
  2. ABL_normal.efi：Normal Boot 变体（toolkit_linux）。
  3. ABL_fake_locked.efi / boot.efi：Fake Locked Boot 变体（toolkit_linux / 模块与其他 toolkit）。
  4. ABL_original.efi：原始未破解 ABL，仅用于分析，不要刷入。
  5. BOOTENTRIES：启动项列表，<名称>:<相对 efisp/ 的路径>，支持 % 子菜单与 $ 非默认标记。

GBL Root Canoe (English)

Project Overview

gbl_root_canoe is an EDK2-based workspace for patching the EFI applications inside Qualcomm ABL (Android Bootloader) images, bringing switchable boot flows to Snapdragon 8 Gen 5 / 8 Elite (Gen 5) devices.

It leverages the GBL (Generic Bootloader Loader) vulnerability so the real ABL loads an embedded superfastboot BDS from the raw efisp partition. The BDS is a self-contained boot manager: it embeds FAT32 / read-only ext4 drivers, scans compatible volumes for boot entries, and provides a boot menu, a file browser and a fastboot entry, then chains to different ABL variants to boot Android.

In targets/toolkit_linux, the project produces two ABL variants for two boot flows:

  • Normal Boot (ABL_normal.efi) — real state passthrough
  • Fake Locked Boot (ABL_fake_locked.efi) — fake re-lock

Boot Chain Overview

Power on → XBL → Real ABL (abl partition)
                  │
                  │ GBL vulnerability: load the EFI image on the efisp partition
                  ▼
          superfastboot BDS (BDS.efi, flashed raw to the efisp partition)
                  │
                  ├─ no Volume Up → auto-boot the last saved default (menu if none)
                  ├─ hold Volume Up → boot menu
                  │     ├─ Normal Boot      → ABL_normal.efi      → real state passthrough
                  │     ├─ Fake Locked Boot → ABL_fake_locked.efi → Android sees Locked
                  │     ├─ Tools submenu    → Reboot / BL / ARB tools
                  │     ├─ Enter Fastboot   → superfastboot (BDS built-in fastboot)
                  │     └─ EFI Program Selector → browse & temp-boot any .efi
                  ▼
              Android

Boot Flows

Flow A: Stock ABL direct boot (without this project)

The real ABL boots Android through the stock path.

  • Purely stock behavior, no state modification.
  • Unlocked devices show the orange warning at boot (OPlus: Orange State).
  • The stock ABL cannot enter fastboot and fastbootd modes.

Flow B: BDS chained boot (this project)

The real ABL loads the BDS through the GBL vulnerability; the BDS takes over.

  • Hold Volume Up at power-on to open the boot menu; without a key the last selected entry is booted automatically (the selection is persisted in raw sectors at the tail of the efisp partition, surviving file-system rewrites).
  • Supports switching between the two boot modes; the menu also offers fastboot, an EFI file browser, power off/restart and a tools submenu.
  • The UEFI Security/Security2 protocols are temporarily bypassed for the chained load, so arbitrary EFI images can be launched (by design: the device is unlocked and the user chose the image explicitly).
  • Each entry may preload drivers via a DRIVER.LIST beside it.

Flow B1: Normal Boot (real state passthrough)

ABL_normal.efi, built from the stock ABL plus only the necessary patches:

  • GBL patch (efisp→nulls): stops the chained ABL from re-entering the GBL load path (avoids BDS→ABL→BDS recursion).
  • OPlus orange-warning removal: disables the Orange State warning.
  • OPlus forceenablefastboot: bypasses the unlock verification gate so fastboot is always available.

Characteristics:

  • Fully transparent real bootloader state: androidboot.flash.locked, ro.boot.flash.locked, androidboot.verifiedbootstate, AVB state, bootconfig and the kernel command line are untouched.
  • Real Locked → flash.locked=1 / verifiedbootstate=green; real Unlocked → flash.locked=0 / verifiedbootstate=orange.
  • Never forces unlock and forges nothing; suited for stock-state fallback or stock fastboot.

Flow B2: Fake Locked Boot (fake re-lock)

ABL_fake_locked.efi, keeping the full original patch set:

  • GBL patch.
  • ADRL redirect: the androidboot.vbmeta.device_state "unlocked" string reference is rewritten to "locked".
  • Boot-state forcing: anchor instruction rewrite plus read/write neutralization of the lock-state global variable (source replaced by a constant, stores rewritten to WZR).
  • OPlus orange-warning removal + forceenablefastboot.

Characteristics:

  • A physically unlocked device boots with Android seeing the device as locked (flash.locked=1 / verifiedbootstate=green).
  • Behavior matches the pre-modification version; compatibility is preserved.
  • Note: fake re-lock does not change the TEE identity; if the TEE state is inconsistent, the device refuses to issue the data key.

Flow B3: Superfastboot (BDS built-in fastboot)

Entered from the boot menu (Enter Fastboot); independent of the ABL lock state.

  • Supports fastboot boot xxx.efi (temp boot without flashing), flash, erase, reboot, etc.
  • Lock/unlock behavior: fastboot flashing lock triggers a data wipe; fastboot flashing unlock / unlock_critical do not.
  • If the TEE state is inconsistent with the BL state, the device refuses the data key and data becomes inaccessible.

Flow Comparison

Flow Lock-state seen by Android Patches Use case
Normal Boot real passthrough GBL + OPlus UX stock-state fallback / stock fastboot
Fake Locked Boot Locked full set (incl. state forging) hiding the unlocked state
Superfastboot independent of ABL state BDS itself fastboot flashing / lock operations

Note: the two OPlus patches match by string/instruction patterns; when an ABL build does not contain them they are skipped automatically with a Warning in the log, without affecting the flow.

File Reference

  1. BDS.efi: superfastboot BDS, flashed raw to the efisp partition.
  2. ABL_normal.efi: Normal Boot variant (toolkit_linux).
  3. ABL_fake_locked.efi / boot.efi: Fake Locked Boot variant (toolkit_linux / module and other toolkits).
  4. ABL_original.efi: original unpatched ABL; for analysis only, do not flash.
  5. BOOTENTRIES: boot entry list, <name>:<path relative to efisp/>; supports % submenus and $ no-default markers.

About

No TrickyStore on Canoe

Resources

Readme
License
Activity

Stars

2 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages