Skip to content

darknight1050/quest-bootloader-unlocker

Repository files navigation

Quest Bootloader Unlocker

This can unlock the bootloader on the Quest 1/2 if it still runs an old version.

Latest vulnerable version is 16476800118700000 (29.0.0.65.370.289987413) from May 9 2021 for Quest 2 and 16476800119700000 (29.0.0.66.370.290246252) from May 10 2021 for Quest 1.

It uses CVE-2021-1931 a buffer overflow in fastboot that got fixed in this commit.
This blogpost by Christopher Wade is about the discovery of this vulnerability.

Using the vulnerability this tool patches the signature checks for unlocking the bootloader and then unlocks it.
The bootloader binary can be extracted with extract_android_ota_payload and then uefi-firmware-parser on the abl.img