MediaTek (MTK) chipsetlarida (masalan, Redmi 9A / Helio G25) ishlovchi qurilmalar apparat darajasidagi raqamli forensic (DFIR) tahlilda muhim nishon hisoblanadi. Ushbu maqolada MediaTek BootROM (BROM) rejimidan foydalangan holda qurilmaning to'liq userdata.img bo'limini jismoniy dump qilish, Android Gatekeeper himoyalangan credential materiallarini ajratish va offline pattern tahlilini amalga oshirish metodologiyasini ko'rib chiqamiz.

**Muhim Eslatma & Huquqiy Doira** Ushbu tadqiqot raqamli ekspertiza (Digital Forensics) va apparat xavfsizligi tahlili uchun mo'ljallangan. Faqat `printgpt`, `r` va `rl` buyruqlaridan foydalanilsa, telefonning flesh xotirasi o'zgarmasdan qoladi (Forensic Read-Only Acquisition).

0. macOS Muhitini Tayyorlash

macOS (Apple Silicon / Intel) muhitida USB drayverlari va Python bog'liqliklarini sozlaymiz:

BASHCOMMAND / CODE
# 1. Homebrew paket menejeri orqali asosiy drayverlarni o'rnatish
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install macfuse openssl libusb python@3.9

(Eslatma: macfuse tizim kengaytmasi o'rnatilgach, Mac qayta ishga tushirilishi kerak).

MTKClient repozitoriyasini o'rnatish:

BASHCOMMAND / CODE
git clone https://github.com/bkerler/mtkclient
cd mtkclient
python3.9 -m venv mtk_venv
source mtk_venv/bin/activate

# Bog'liqliklar va Capstone disassembler
pip3 install --pre --no-binary capstone capstone
pip3 install PySide6 libusb
pip3 install -r requirements.txt

# Asbob tayyorligini tekshirish
python mtk.py --help

1-Qadam: BROM Rejimi & GPT Bo'limlar Jadvali

MediaTek BootROM rejimi apparat darajasida UART/USB orqali to'g'ridan-to'g'ri xotira bilan ishlash imkonini beradi.

BASHCOMMAND / CODE
cd ~/mtkclient
source mtk_venv/bin/activate

# GPT partition jadvalini o'qish
sudo python mtk.py printgpt
  1. Qurilmani ulash: Redmi 9A o'chirilgan holatida Ovoz balandligini oshirish (+) va Ovoz balandligini pasaytirish (-) tugmalarini bir vaqtda bosib turing.
  2. USB kabelni Mac'ga ulang. MTKClient apparat identifikatorlarini (0e8d:0003 MTK USB Port) aniqlashi bilan tugmalarni qo'yib yuboring.
  3. Natijada xotiradagi bo'limlar xaritasi (userdata, boot, system, metadata) namoyon bo'ladi.
**Troubleshooting:** Agar handshake xatosi yuz bersa, faqat `Ovozni pasaytirish (-)` tugmasi bilan yoki USB-A to Type-C to'g'ridan-to'g'ri kabel orqali qayta urinib ko'ring.

2-Qadam: Userdata Bo'limining Bit-by-Bit Jismoniy Dumpini Olish

BROM protokoli orqali foydalanuvchi ma'lumotlari joylashgan bo'limni o'qiymiz:

BASHCOMMAND / CODE
sudo python mtk.py r userdata userdata.img

Bu buyruq Mac'da userdata.img nomli to'liq disk tasvirini (raw image) hosil qiladi. Jarayon davomida apparatga yozish buyrug'i yuborilmaydi (Read-Only).

(To'liq barcha xotira bo'limlarini dump qilish uchun):

BASHCOMMAND / CODE
sudo python mtk.py rl dump_folder

3-Qadam: Android Gatekeeper & Credential Materiallarini Ajratish

Android 10+ tizimlarida qulf patterni eski Android versiyalaridagi oddiy SHA-1 gesture.key faylida saqlanmaydi. Zamonaviy AOSP arxitekturasida Gatekeeper TEE (TrustZone) komponenti qo'llaniladi:

  1. userdata.img tasvirini tahlil qilish vositasi (testdisk, photorec yoki ext4/f2fs forensic mount) yordamida ochamiz.
  2. Credential artefaktlarini quyidagi yo'llardan ajratib olamiz:
    • /data/system/gatekeeper.pattern.key (Scrypt / TEE derivatsiya blobi)
    • /data/system/gatekeeper.password.key
    • /data/system/locksettings.db (SQLite konfiguratsiyasi va SID ma'lumotlari)
    • /data/system/users/0/spblob/ (Synthetic Password kalitlari)

4-Qadam: Offline Pattern Rekonstruktsiyasi & Brute-Force

Ajratib olingan gatekeeper.pattern.key tarkibida Gatekeeper versiyasi, Salt va kalit xeshi saqlanadi:

  • Android 9/10 Gatekeeper scrypt parametrlari: N=16384, r=8, p=1.
  • 3x3 panjaradagi patternlar jami 389,112 ta mumkin bo'lgan kombinatsiyani tashkil qiladi.
  • Python asosidagi offline tahlil skripti orqali 4–9 nuqtali pattern kombinatsiyalari xotiradagi xesh bilan solishtiriladi va bir necha soniya ichida aniq ketma-ketlik (masalan: 0-1-2-5-8) aniqlanadi.

📚 Texnik Manbalar & Havolalar

  1. MTKClient Research Tool: github.com/bkerler/mtkclient (B. Kerler)
  2. Android Open Source Project (AOSP) Gatekeeper Architecture: source.android.com/docs/security/features/authentication/gatekeeper
  3. NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics, National Institute of Standards and Technology.
  4. MITRE ATT&CK: Technique T1200 (Hardware Additions) & T1003 (OS Credential Dumping).
  5. MediaTek BootROM Bypass Research: CVE-2020-0069 (Cmdq driver privilege escalation & SLA/DAA bypass).