Skip to content

OTA

Jump to bottom
superturtlee edited this page Apr 26, 2026 · 3 revisions

小米与一加系统更新安全警告 / Xiaomi & OnePlus System Update Security Warning

小米 / Xiaomi

目前小米在 300 修复了 GBL 漏洞，但是截止 306，XBL 都有启动旧版 abl 来间接加载 EFISP 的能力。
Currently, Xiaomi fixed the GBL vulnerability in version 300, but as of version 306, XBL retains the ability to boot an old version of abl to indirectly load EFISP.

OTA 方式 / OTA method:
OTA 模块（release 里）在重启前使用模块刷写一次旧版本 abl，只要 abl 的 anti-rollback 版本不变，理论上可以一直使用。
The OTA module (in release) flashes an old abl version once before reboot. As long as the abl's anti-rollback version remains unchanged, it can theoretically be used continuously.

⚠️ 严重风险 / Critical risk:
一旦 abl avb 版本变化，该方法会黑砖。
If the abl avb version changes, this method will cause a hard brick.

建议 / Recommendation:

  • 使用雹冻结系统更新 / Use Hail to freeze system updates
  • 非必要 / 主力机器不要更新 (重复4次)
  • 非必要 / 主力机器不要更新 (重复4次)
  • 非必要 / 主力机器不要更新 (重复4次)
  • 非必要 / 主力机器不要更新 (重复4次)
    Do NOT update unless necessary / on a primary device (repeated 4 times)
    Do NOT update unless necessary / on a primary device (repeated 4 times)
    Do NOT update unless necessary / on a primary device (repeated 4 times)
    Do NOT update unless necessary / on a primary device (repeated 4 times)
  • 如果一定更新，请确保检查 abl 的 anti-rollback 版本，或等待前人测试过
    If you must update, ensure you check abl's anti-rollback version, or wait for others to have tested it

版本信息 / Version info:

  • 修复加载 efisp 的 abl 版本：OS3.0.300
    Fixed abl version (loading efisp): OS3.0.300
  • 当前测试最高使用模块成功更新版本：3.0.306
    Highest version successfully updated using the module in testing: 3.0.306

一加 / OnePlus

目前暂未修复漏洞，但是鉴于之前熔断事件，依旧建议使用雹冻结系统更新。
The vulnerability is not yet fixed, but given the previous "fuse" incident, it is still recommended to use Hail to freeze system updates.

⚠️ 警告 / Warnings:

  • 非必要 / 主力机器不要更新 (重复4次)
    Do NOT update unless necessary / on a primary device (repeated 4 times)
  • 如果一定更新，请确保检查 abl 的 anti-rollback 版本，或等待前人测试过，或确认新版本 GBL 漏洞未修复
    If you must update, ensure you check abl's anti-rollback version, wait for others to have tested it, or confirm that the new version still has the GBL vulnerability
  • 也可使用模块 OTA / You can also use the module for OTA

版本信息 / Version info:

  • 版本 761 修复 version 761 is fixed

关于未来熔断 anti-rollback 版本 / Regarding future "fuse" of abl anti-rollback versions

如果后续真的开始熔断 ABL anti-rollback 版本，建议直接放弃更新，或者只更新 HLOS。
If abl anti-rollback versions are really being fused in the future, it is recommended to abandon updates entirely, or only update HLOS.

提取 HLOS 方法 / How to extract HLOS:

  1. 解压 payload.bin 到 images 目录
    Extract payload.bin to the images directory

  2. 使用以下脚本检查 images 目录下的文件是否包含 AVB0 头，如果包含则认为是 HLOS，否则认为是非 HLOS
    Use the following script to check if files in the images directory contain the AVB0 header. If yes, it is considered an HLOS image; otherwise non-HLOS.

#!/usr/bin/env python3
img_dir = "./images"
import os
for img in os.listdir(img_dir):
    with open(os.path.join(img_dir, img), "rb") as f:
        if b"AVB0" in f.read():
            print(f"{img} is an hlos image")
  1. 使用 fastboot 刷写这些分区
    Flash these partitions using fastboot

关于模块 / About the module

模块只有中文，作者懒得搞多语言了，见谅。国外用户可以使用屏幕翻译功能。
The module is only in Chinese. The author is too lazy to add multiple languages, sorry. International users can use screen translation features.

Clone this wiki locally