# Modification LK.bin to erease Orange state and confirmation boot ## Bypass Confirmation Boot

Tool necessary : Ghidra Download and install here : https://github.com/NationalSecurityAgency/ghidra

### Open file lk.bin in Ghidra - File --> new project - Non-Shared Project --> Next [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/OUWNZMBFIDbozxmz-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/OUWNZMBFIDbozxmz-image.png) - Give a name to your project --> Next [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/LlmdpAQReR254quV-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/LlmdpAQReR254quV-image.png) - File --> import File - Import File lk.bin you want patch [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/1r1RwrWd1osSt6Or-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/1r1RwrWd1osSt6Or-image.png) - Select Langage --> ARM v7 | 32 | little | default [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/u66IH5m0lfX9Lp8J-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/u66IH5m0lfX9Lp8J-image.png) [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/IiSdzUsjSePWuIY6-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/IiSdzUsjSePWuIY6-image.png) - Double click on file [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/WxiTWehYFilimOFE-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/WxiTWehYFilimOFE-image.png) - respond yes to analyzed [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/9IMNxZoha1ayKytD-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/9IMNxZoha1ayKytD-image.png) - We will get [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/gLUlnYWq6AaV4wWX-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/gLUlnYWq6AaV4wWX-image.png) - Search --> for String [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/EkVd1sOzqG6656Nl-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/EkVd1sOzqG6656Nl-image.png) - continue with clicking on Search [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/hjMH0sWekT9vMqhi-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/hjMH0sWekT9vMqhi-image.png) - ##### type "dm-verity corruption" on filter [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/U9l7jjGdvsWEAHXC-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/U9l7jjGdvsWEAHXC-image.png) - ##### One final will find --> click on line find [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/XLVpM9PW4LrGKLPs-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/XLVpM9PW4LrGKLPs-image.png) - ##### this will give [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/feirpxAnhYSlmxai-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/feirpxAnhYSlmxai-image.png) - ##### Go to the fonction who call the string "dm-verity corruption" with double click on hexa (FUN\_00056c40:00056c8e) [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/zkMVTbPBIANuSynd-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/zkMVTbPBIANuSynd-image.png) - ##### This will give [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/t80el8NmnDisWeSN-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/t80el8NmnDisWeSN-image.png) - ##### We get the fonction we need on right [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/JVSfPsWGzd8dXH3Y-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/JVSfPsWGzd8dXH3Y-image.png) - ##### The fonction who call string dm-verity is highlighted [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/zvTGlw5g1ht5g9MW-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/zvTGlw5g1ht5g9MW-image.png) - ##### We can understand if the boot not start correctly the var [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/NXwxd89jwewLVRhD-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/NXwxd89jwewLVRhD-image.png) and give [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/e0cGgn3ZKqa91Adf-image.png) ](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/e0cGgn3ZKqa91Adf-image.png) so the first an green is if boot is corectly and an red if we got an error [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/2V7vNSfYCloj57py-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/2V7vNSfYCloj57py-image.png) - ##### We therefore need to modify one of these variables so that it is no longer used in the function. [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/NXwxd89jwewLVRhD-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/NXwxd89jwewLVRhD-image.png) or [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/e0cGgn3ZKqa91Adf-image.png) ](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/e0cGgn3ZKqa91Adf-image.png) - ##### In the function, if we click on the desired variable, we move to the line where it is in the file. [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/h9ylOZNXwlV5tj0k-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/h9ylOZNXwlV5tj0k-image.png) - ##### Right Click on line --> Patch instruction - ##### Change value of condition [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/13Vk9ntqox0HdfpX-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/13Vk9ntqox0HdfpX-image.png) - ##### We can do like this [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/5X7sScecDlKV84YO-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/5X7sScecDlKV84YO-image.png) [![image.png](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/scaled-1680-/C8nwav5rZgAFK2T8-image.png)](https://wiki.mira-ceti.ovh/uploads/images/gallery/2024-04/C8nwav5rZgAFK2T8-image.png) - ##### After this we can save file quit - ##### For export with menu project - ##### Right click on file --> select export - ##### You can choose Format Original File ### Find the warning string [https://github.com/R0rt1z2/lkpatcher](https://github.com/R0rt1z2/lkpatcher) [https://lkpatcher.r0rt1z2.com/](https://lkpatcher.r0rt1z2.com/) [https://blog.r0rt1z2.com/patch-mediatek-bootloader-images-lk.html](https://blog.r0rt1z2.com/patch-mediatek-bootloader-images-lk.html)