## https://sploitus.com/exploit?id=2ADDE60C-30DB-5AE1-97AB-5723CD2390A0
# Huawei P10 CVE-2017-8890 bootloader-unlock research
This repository documents an owner-authorized research project that ported
CVE-2017-8890 to one Huawei P10 firmware, converted the kernel use-after-free
into arbitrary kernel read/write and temporary root, reconstructed Huawei's
NVE journal, installed a replacement bootloader credential through the
legitimate NVE driver, and verified that fastboot accepted the chosen
plaintext code.
The tested target was:
- Huawei P10 VTR-L29, C432 region
- firmware VTR-L29C432B151
- Android 7.0 / EMUI 5.1
- kernel `4.1.18-gbed9f04`
- security patch level 2017-05-05
This is not a universal P10 unlocker. The included kernel profile contains
absolute addresses for that exact build. Using it on another kernel can
panic the phone and may corrupt persistent storage. Firmware upgrades can
also change the profile even when the marketing model is unchanged.
The complete, public-safe narrative is available as
[the PDF report](report/huawei-p10-bootloader-unlock-journey.pdf).
## Result
The successful chain was:
```text
CVE-2017-8890 multicast UAF
-> controlled overlap with ip_mc_socklist
-> forced RCU grace period in the exploit's address space
-> AArch64 JOP arbitrary store
-> ptmx_fops.check_flags temporarily redirected
-> address limit widened to KERNEL_DS
-> pipe-based arbitrary kernel read/write
-> check_flags restored
-> current task credentials and SELinux SID patched
-> protected NVME partition acquired
-> replacement SHA-256 verifier written with /dev/nve0
-> complete 128 KiB generation read back and compared
-> controlled reboot
-> fastboot unlock accepted the chosen plaintext
```
The bootloader credential survived a later official Android 8 / EMUI 8
upgrade even though the bootloader relocked, and the same chosen plaintext
unlocked it again. This indicates that the credential lives in persistent
device NVE data rather than in the Android system or boot image.
## Start here
1. Read [SAFETY.md](SAFETY.md).
2. Confirm the exact firmware and kernel listed above.
3. Read [docs/exploit-development.md](docs/exploit-development.md) to
understand why the original public exploit was not immediately reliable.
4. Follow [docs/reproduction.md](docs/reproduction.md) in order.
5. Do not perform the persistent-write stage until temporary root, a complete
NVME backup, offline candidate validation, and recovery planning have all
succeeded.
## Repository layout
```text
exploit/CVE-2017-8890/1003/ modified exploit implementation
utils/ GPLv3 androotzf support code
jni/ Android NDK build files
tools/p10_nve_journal.py read-only inspector and offline candidate builder
docs/exploit-development.md technical exploit journey
docs/nve-format.md Huawei NVE journal and credential semantics
docs/reproduction.md staged reproduction procedure
report/ redacted long-form PDF
```
No compiled exploit, firmware image, partition dump, boot image, proprietary
commercial utility, unlock code, device identifier, or device-derived
credential digest is included.
## Upstream and licensing
The exploit began with the GPLv3
[idhyt/androotzf](https://github.com/idhyt/androotzf) implementation at commit
`63dfe5556e1a8cdbf6a2d3dd0ee929b07bfb48b7`. This repository retains the
upstream copyright notices and GPLv3 license. The P10 B151 reliability,
diagnostic, kernel-read/write, temporary-root, partition-dump, and guarded
NVE transaction changes are identified as modifications made during this
research project in July 2026.
See [NOTICE.md](NOTICE.md) for attribution and modification details.
## Responsible use
Use this work only on hardware you own or are explicitly authorized to test.
Bootloader unlocking erases userdata. The exploit deliberately corrupts
kernel objects and normally causes a later cleanup panic unless it reaches a
controlled reboot path. There is no warranty and no guarantee of recovery.