I have stumbled upon an old mobile phone of mine, wondering what data it still has on it after all these years. It is an old Sony Xperia Z1 Compact. I have plugged in the appropriate USB cable and it was still able to charge the battery. When I powered it on, it asked the PIN. I figured I could easily remembered the PIN, but in this case I was wrong. It did not accept any of the usual PINs I tend to use for my mobile phones.
This led me to think: “I just need to put the device in recovery mode and just reset it. Easy right?” Well I was wrong. It did not allow me to place it in recovery mode. Maybe I was doing something wrong with the button presses, but the only mode it went into was the Fastboot mode. ADB was also not a feasible option as it need to have the device unlocked to accept the connection.
Fastboot gave me a few options to fiddle with, but it did not allow me to flash the device as the bootloader was locked. To unlock the bootloader, you need the IMEI number. You would think that would be easy to get, right? Well I lost the box it came with and could not get the number by typing in *#06# the Emergency contact text box. Seems that I have an Android version without that bug.
Now I am still stuck with an old locked phone. This led me to think that now I will need to bruteforce the PIN. Ok lets Google ‘android pin bruteforcer`. There are results!
Android-PIN-Bruteforce from urbanadventurer pops up and seems like the ideal solution. But it requires me to have another rooted mobile phone and an OTG cable. I don’t have another phone to root and I don’t have time to source an OTG cable. There should be a simpler solution!
Enter Android Open Accessory Protocol. A protocol not very well known, but from my research it seems it could do the job. This protocol allows you to turn anything into an accessory which can interact with your Android phone. Just note, not all Android phones support this protocol, but in my case it has.
There are very few examples of how this protocol has been used with various devices and it is very implementation specific as well. There are a few repositories on GitHub, which has implementations where this protocol is used, but only this repository from Tryanks gave me some glimmer of hope that my idea is possible!
I have cloned the repository and started to fiddle with the code written in Golang. I was clueless of what is actually happening underneath. Therefore I started to investigate the USB traffic using Wireshark to get closer to the actual packets being sent back and forth.
After a while I realised that one can interact with the Android device using HID events. This was only possible after I have figured out what the HID Report Descriptor should be (bunch of bytes sent to the Android device to configure the protocol)
This is when I created a script based on Tryanks project and made a PIN bruteforcer for Android. There are some problems with the script, not due to bugs but due to the nature of the AOA protocol being asynchronous and not reliable.
Check out my writeup and code for this PIN bruteforcer here: https://github.com/jeanbritz/go-android-bruteforce-pin
This is my story so far. I have not been able to get the PIN to unlock my old Sony phone. Will provide an update once I have unlocked the phone 🙂
