Reverse-engineering the used in Kirin chipsets (e.g., Kirin 980/990) to understand how xloader vulnerabilities like CVE-2021-22429 were exploited.
Aside from sharing an identical name, the malicious software application shares no functional or architectural ties to Huawei’s silicon-level secondary bootloader stage.
In this state, custom xloader images can be flashed directly to volatile RAM. Because these images run entirely within RAM, temporary diagnostic commands can be executed—such as disabling the FBLOCK security flag—allowing users to read or generate an unlock key without bricking the non-volatile physical storage partitions. Distinguishing Component from Malware
