[Atrix 4G General] PanNet:
Hi,

Have you diagram of the factory cable? Can you share it?

Ok, here is useful information: http://newworld2.net/pdls/olyphotos/FAC_CAB.jpg

Guide for a 3-in-1 cable:

1. Solder rigid copper wires on PIN 1, 4 and 5.

2. Drill 3 holes in your USB to MicroUSB adapter for making the rigid wires to pass through.

3. Connect PIN4 to PIN1 (externally :D) for FACTORY CABLE or PIN4 to PIN5 for OTG CABLE (for USB HUBs and USBHost functionalities). Don't connect anything for normal USB cable for USBSync/ADB etc.

Nvflash - Yes it exists on our devices, yes it can be accessed , yes you need a Dev. cable to do so. Yes using it theoretically we could re flash our devices with unsecured images , yes with it I could make our devices free , How ever this all being said there is a problem currently, and that is that its is signed with a sbk value, this value is unknown to us it is a AES key and is in this format 0x00000000 00000000 00000000 00000000. With out knowing the value of this key anything anyone wants to tell you about nvflash is complete and entire BS!! You can not even read from the device, any command that is sent via nvflash will return an error and than disable the connection to the device in order to prevent a brute force attack.

It has to be more complicated than that. Both the Droid and Milestone run the OMAP 3430 chipset and you can't just flash the Droid bootloader onto a Milestone.

Actually, you can just flash the Droid bootloader onto a Milestone. A number of developers tried exactly that about a year ago and found incompatibility issues with them, apparently due to the CDMA/GSM differences because part of the baseband radio code was in the bootloader. Their phones weren't completely bricked, they just had to use RSDLite to reflash a Milestone bootloader to get it working happily again.

With that said, it is a little more complicated with the Tegra2. I'm registered with NVIDIA's Tegra2 dev zone and have been going through the SDK for a good part of this evening.

Flashing is done using a tool called "nvflash" which takes a command line parameter of "sbk" (Secure Boot Key) example value "0x00000000 00000000 00000000 00000000"

Another interesting bit I've found while searching through hundreds of files is a function called "NvDdkAesClearSecureBootKey" with a description of the following:

* Overwrite Secure Boot Key (SBK) in AES key slot with zeroes.

After this operation has been completed, the SBK value will no longer be accessible for any operations until after the system is rebooted. Read access to the AES key slot containing the SBK is always disabled.

So basically, the system is designed never to allow users to read the AES key, however there seems to be an override to reset it to the default value (possibly just temporarily – but hopefully that's all that's needed to rewrite the bootloader.)

What would be really nice to know is what "system information" nvflash spits out when run on an Atrix.

On a ViewSonic G-Tab we see something like this:

System Information:

* chip name: t20

* chip id: 0x20 major: 1 minor: 3

* chip sku: 0x8

* chip uid: 0x171440094240f357

* macrovision: disabled

* hdcp: enabled

* sbk burned: false

* dk burned: false

* boot device: nand

* operating mode: 3

* device config strap: 0

* device config fuse: 0

* sdram config strap: 0

Note the "sbk burned: false" which is because there's no secure boot key set on the ViewSonic.

I think we just have to wait and see if the SBK is set on the international version of the Atrix, and if it is then we'll need to explore the reset method I mentioned above.

So, honestly, probably there is no possibility to recovery e.g. my atrix.