Field Notes

source

Demystifying phone unlocking tools

StatusStableUpdatedStands on1 sourceSupportsnotes

“Demystifying phone unlocking tools: A technical overview” is a May 2026 research post by Osservatorio Nessuno, an Italian digital-rights nonprofit, written up from a private presentation delivered to the Freedom of the Press Foundation and others. The saved copy preserves the rendered page. It is the clearest public technical account of how commercial forensic tools actually compromise phones, built on Quarkslab’s published research, Amnesty’s exploit analyses, and Cellebrite’s own leaked support matrices.

What it is evidence for

  • The BFU attack anatomy: boot-chain or vendor-download-mode exploitation, TEE patching of Gatekeeper, Keymaster intermediate extraction, and offline brute force against the scrypt-plus-AES-GCM oracle — demonstrated by Quarkslab end to end on Samsung devices running TEEGRIS.
  • Why a secure element changes the attack: Weaver’s secret stays in a separate chip, so brute force stays online and throttled — “this is why brute-force capabilities are generally not available for Pixel devices with Titan M” in Cellebrite’s own matrices.
  • The AFU reality: after first unlock the lock screen “is just UI,” and the practical attack surface is the roughly 200 kernel drivers reachable over USB (the Serbia exploit used three USB driver CVEs), which is why GrapheneOS’s USB-C lockdown and iOS USB Restricted Mode matter — and why CVE-2025-24200, a logic bug that re-enabled USB data on locked iPhones, mattered just as much.
  • Forensic-vendor adaptation: Cellebrite “Safeguard Mode” and Magnet “GrayKey Preserve” exist specifically to defeat the iOS inactivity reboot.

Limitations

The piece is a secondary synthesis, explicitly built on Quarkslab, Amnesty, and GrapheneOS sources, so its claims inherit those sources’ scopes; it is an advocacy organization with a stated position that these tools “simply shouldn’t commercially exist,” though the technical content is independently checkable. Its Samsung characterization (“partial protection, varying by model”) is less precise than the Inseyets 10.0 update data cited in Samsung Knox.

Placement

Cited by Cellebrite, Mobile operating system security comparison, Offline brute-force resistance of phone disk encryption, and Samsung Knox; it is the vault’s primary reference for how forensic extraction works mechanically.

Built on 1 source (1 external).

Working out connections…