Huawei P10 CVE-2017-8890 bootloader-unlock research

This repository documents an owner-authorized research project that ported CVE-2017-8890 to one Huawei P10 firmware, converted the kernel use-after-free into arbitrary kernel read/write and temporary root, reconstructed Huawei's NVE journal, installed a replacement bootloader credential through the legitimate NVE driver, and verified that fastboot accepted the chosen plaintext code.

The tested target was:

• Huawei P10 VTR-L29, C432 region
• firmware VTR-L29C432B151
• Android 7.0 / EMUI 5.1
• kernel 4.1.18-gbed9f04
• security patch level 2017-05-05

This is not a universal P10 unlocker. The included kernel profile contains absolute addresses for that exact build. Using it on another kernel can panic the phone and may corrupt persistent storage. Firmware upgrades can also change the profile even when the marketing model is unchanged.

The complete, public-safe narrative is available as the PDF report.

Result

The successful chain was:

CVE-2017-8890 multicast UAF
  -> controlled overlap with ip_mc_socklist
  -> forced RCU grace period in the exploit's address space
  -> AArch64 JOP arbitrary store
  -> ptmx_fops.check_flags temporarily redirected
  -> address limit widened to KERNEL_DS
  -> pipe-based arbitrary kernel read/write
  -> check_flags restored
  -> current task credentials and SELinux SID patched
  -> protected NVME partition acquired
  -> replacement SHA-256 verifier written with /dev/nve0
  -> complete 128 KiB generation read back and compared
  -> controlled reboot
  -> fastboot unlock accepted the chosen plaintext

The bootloader credential survived a later official Android 8 / EMUI 8 upgrade even though the bootloader relocked, and the same chosen plaintext unlocked it again. This indicates that the credential lives in persistent device NVE data rather than in the Android system or boot image.

Start here

1. Read SAFETY.md.
2. Confirm the exact firmware and kernel listed above.
3. Read docs/exploit-development.md to understand why the original public exploit was not immediately reliable.
4. Follow docs/reproduction.md in order.
5. Do not perform the persistent-write stage until temporary root, a complete NVME backup, offline candidate validation, and recovery planning have all succeeded.

Repository layout

exploit/CVE-2017-8890/1003/  modified exploit implementation
utils/                       GPLv3 androotzf support code
jni/                         Android NDK build files
tools/p10_nve_journal.py     read-only inspector and offline candidate builder
docs/exploit-development.md  technical exploit journey
docs/nve-format.md            Huawei NVE journal and credential semantics
docs/reproduction.md         staged reproduction procedure
report/                       redacted long-form PDF

No compiled exploit, firmware image, partition dump, boot image, proprietary commercial utility, unlock code, device identifier, or device-derived credential digest is included.

Upstream and licensing

The exploit began with the GPLv3 idhyt/androotzf implementation at commit 63dfe5556e1a8cdbf6a2d3dd0ee929b07bfb48b7. This repository retains the upstream copyright notices and GPLv3 license. The P10 B151 reliability, diagnostic, kernel-read/write, temporary-root, partition-dump, and guarded NVE transaction changes are identified as modifications made during this research project in July 2026.

See NOTICE.md for attribution and modification details.

Responsible use

Use this work only on hardware you own or are explicitly authorized to test. Bootloader unlocking erases userdata. The exploit deliberately corrupts kernel objects and normally causes a later cleanup panic unless it reaches a controlled reboot path. There is no warranty and no guarantee of recovery.