yashsingh1/xdaforums huggingface dataset:
[Motorola Droid X2] naviathan:
The version number I believe use Verizon's version, i.e. 1.2.380. It's been a while since I had to do it, but if you look in the build.prop you should be able to identify the string to be changed.
[Motorola Droid X2] 0vermind:
Anyone been checking lately?
[Motorola Droid X2] naviathan:
I looked around a bit today and didn't find anything new from the 406 version. Didn't try to change my build.prop and check other versions yet.
[Motorola Droid X2] singlesword:
I was searching online and found this on sourceforges website. Not sure if it helps since I found it while on my phone and can't check the files yet.

http://sourceforge.net/projects/mb870.motorola/files/Droidx2_VZW/DTN_117.15/
[Motorola Droid X2] naviathan:
It appears to be the Android source to build a base system for a DX2, but without the unlocked bootloader, it's useless. Even if you could get it on the phone, it wouldn't boot.

---------- Post added at 09:38 AM ---------- Previous post was at 09:37 AM ----------

Also, isn't the Tegra2 an Omap4 processor?
[Motorola Droid X2] ashclepdia:
I posted that sourceforge thing a while ago...nothing came of it...

I thought omap. was made by Texas instruments and tegra by nvidia
[Motorola Droid X2] Staggo:
Yeah, Texas Instruments designs the OMAP processors and nVidia designs the Tegra processors. Both use ARM Cortex series cores though.

Also, it doesn't seem to be the full kernel source. If it was, we'd be able to create modules for it once we get full 2nd-init support.
[Motorola Droid X2] naviathan:
There's two kernel sources there and they look large enough to be complete. But again, without unlocking the bootloader we're not going to be able to do anything with it anyway.

---------- Post added at 02:08 PM ---------- Previous post was at 02:00 PM ----------

I was skimming through the system_Core.tgz file and there's a script under /system_core/system/core/fastboot/ called genkey.sh. I wonder if this script could generate valid keys to insert a new kernel?

---------- Post added at 02:09 PM ---------- Previous post was at 02:08 PM ----------

Contents of genkey.sh:

#!/bin/bash

if [ $# -ne 2 ]
then
echo "Usage: $0 alias \"pass phrase\""
exit -1
fi

# Generate a 2048 bit RSA key with public exponent 3.
# Encrypt private key with provided password.
openssl genrsa -3 -out $1.pem -passout pass:"$2" 2048

# Create a self-signed cert for this key.
openssl req -new -x509 -key $1.pem -passin pass:"$2" \
-out $1-cert.pem \
-batch -days 10000

# Create a PKCS12 store containing the generated private key.
# Protect the keystore and the private key with the provided password.
openssl pkcs12 -export -in $1-cert.pem -inkey $1.pem -passin pass:"$2" \
-out $1.p12 -name $1 -passout pass:"$2"

rm $1.pem
rm $1-cert.pem

There's even a file called engineering_key.p12
[Motorola Droid X2] xawen:
Would you mind posting (or PMing) that file? That's a pkcs keystore that (judging by the script) contains a private key for...something.

I've got a few dozen cores I'd like to throw at it with a particular program from sourceforge. It'll probably take a year to complete...but can't hurt right?

----Edit----

NM, found the file you're talking about. If anyone thinks this is worthwhile and wants to coordinate efforts, drop me a PM.

----Edit 2----

This file is the same in all the versions of the source they have posted on Sourceforge. I think there's a very good chance the (or one of several?) private signing key for the boot code is in that p12 store. Unfortunately, if they were generated by that script, both the key and the store are password protected (good news, it's by the same password).

I'm running it through a pkcs tool on sourceforge, but I'm only doing about 900k combinations a minute. At that rate...well lets just say it will take a while. If anyone else has any tips on decrypting that file, I'd love to hear them.
[Motorola Droid X2] naviathan:
A few dozen cores? Now my interest is really peaked, what kind of system(s) do you have to play with?
[Motorola Droid X2] xawen:
I've got access to a 15 node cluster that's pretty good at these kinds of things. Unfortunately, it's a bit older (retired) and isn't getting through the iterations as fast as I'd hoped. I can say for sure that the key store password is not 1, 2, 3 or 4 characters and 5 is looking unlikely.

Given that that p12 file is the same across all the versions of the source they posted on sourceforge, I really think there's a chance it's got a valid signing key inside. Without some luck, I'm just not smart enough to find my way into it in a reasonable amount of time. After 5 characters, it's going to start to take a LOT of time to get through all the possbile combos.

If anyone's got a suggestion for decrypting a password protected OpenSSL PKCS#12 file, we may actually have something worth looking at.
[Motorola Droid X2] naviathan:
Sounds like you're trying to brute force the passphrase. I'm not sure that's going to yield a lot of results, but it would be great if it did.

A 15 node cluster would be fun to play with. Is it a Beowulf cluster?
[Motorola Droid X2] xawen:
That's the idea...I figured maybe we'd get lucky and some dev set the password to abc or something. We're up to about 890 million attempts...so no love there.

Nah, it's just a Linux HPC cluster with 15 (what used to be) pretty powerful machines. It got retired and replaced with a more modern rig, so it's usually not doing much. I'll leave this running until someone kicks me off. Unfortunately I didn't think far enough ahead to write the workload to be pausable :rolleyes:

I was kind of hoping someone with a bit more calculus kung-fu would step in and suggest a better way to decrypt that file... At the very least, if anyone has a good dictionary file they can take a swing at it too.

That file is just too tempting. Just 2.5KB and probably contains the magic digits we need...
[Motorola Droid X2] ashclepdia:
I wonder if there are any mathematics forums or something related to what you are doing type of forums out there that we could go ask for some help at.

I would need to know what exactly you would be needing help with or what you would need that person to do if im gonna go scanning other forums looking for someone who can help.
[Motorola Droid X2] xawen:
The math people may laugh and tell us it's impossible...but maybe there's a known vulnerability in OpenSSL that can help...

Anyway, here's the short version...or as short as I can make it :D

Naviathan found two things in the source that Moto posted.

1) A script that uses OpenSSL to generate a private signing key (2048 bit RSA) and a certificate for the key. The script then stores both in a PKCS#12 store. All three files (key, cert and store) are password protected by the same password. The output is a single p12 store file, the key and cert are deleted since they're now in the store.

2) A p12 file named engineering_key.p12. This is an output file from the script and has a name that makes it appear to be a key used by the engineering team to sign boot code. This theory is reinforced by the fact that this same file (identical contents) shows up in all of the sources Moto posted.

The script can't do anything to help us except tell us what is in the p12 file. The core question: is there any way other than brute force to determine (crack/decrypt/whatever) the password on a PKCS#12 file and retrieve a key and certificate stored inside?
[Motorola Droid X2] jsplace:
Milestone users tried bruteforcing that key with A LOT of processing power, after a good long time they got absolutely nowhere :(
[Motorola Droid X2] naviathan:
My thought on the whole thing is why not just generate our own key and cert with the script? Maybe it's not a matter of cracking the existing key, but generating our own key, essentially self signing it. Back in the original Droid days kernels and such were signed by voles not motorola or verizon. I always wondered how they signed their own keys when building ROMs and kernels.
[Motorola Droid X2] xawen:
The script is super easy to use. You just need a linux box with OpenSSL installed. I made one with an easy password last night just to test the brute force program.

To test, you'd need to compile the rest of that code, sign it with your key and roll it into an update.zip. I have no idea what it would take to compile the rest of that though.

Does anyone know if any of the devs have tried booting a kernel just signed with any random 2048 bit RSA key? I assume the bootloader has a set of public keys that match up with a specific set of private keys...but I haven't actually read that anywhere. It would be pretty dumb if that wasn't the case though.

But people much smarter than me have been stumped by this, so I'd be amazed if it was that easy. I just don't know if there's some way to break that password that won't require a few thousand years of computing time ;)

Yeah, once I got past the easy passwords I knew it was headed that way. The number of possible combinations is ridiculously huge.
[Motorola Droid X2] Zues532:
Is there any way to start a distributed computing project to work on the bruteforce? I'd be happy to add what computing power I have if I could.
[Motorola Droid X2] LordRalh3:
I remember when that kind of thing was really popular, "donating " idle processing power for running biological analysys and such looking for cures for cancer and such, if someone was to set up something like that for this i bet it wouldn't take a month with how many idle cpus this bunch of people could put forth, im sure im not alone in owning multiple machines

from my X2 roaming the north
[Motorola Droid X2] IDMA.DROID.X2:
Is it donating like setting up your comp at home and have it work, it mail your comp to a dev or someone?
[Motorola Droid X2] xawen:
It's possible, but it's a ton of work to get going. We'd have to have a lot of interest to make it worthwhile. Put it this way...the current run I have going is set to try combinations of the 95 characters easily used on an American keyboard (maybe a bad assumption, but gotta start somewhere). At the current rate on my baby cluster it would take something like 15,000 years to try every combination from 1 to 15 characters long. I may have been off by a 0 when I did the math, but when I saw the exponents start to show up I didn't really care :) At this point, I'm just letting it run to make sure it's not some short basic password.

In order to get that number down to anything even close to reasonable, we'd need a massive amount of horsepower. Brute force is likely going to be a lost cause. If someone has a comprehensive dictionary file, that would be worth a run...but straight brute force just has too much ground to cover.
[Motorola Droid X2] (aq):
I was reading the forum earlier today and was thinking about the idea of tons of people sharing their computers to crack the key. So I work in a graphics lab and there are 30 i5 quad core imacs. I started to wonder if parallel computing was used to crack the key, and all the computers were exactly the same and the internet connection was exactly the same how long would it take. As stated earlier it would take a while. So Is there any way to figure out how many computers would be needed to crack it in a specific amount of time?

so say all the system specs are the same

Intel i7 920

12mbps internet connection

and all systems participate for 30 days

Is there an algebraic equation that can be made to figure out the amount of systems needed to do it? If it can be solved in an equation, and that amount of systems were able to participate then the key could be cracked in 30 days. And possibly less if say 8-12 core set ups were in the mix. It could end up being a ridiculous amount of systems needed but maybe something to think about.
[Motorola Droid X2] xawen:
It depends entirely on how fast 1 computer can tick through 1cycle of the calculation, and how many possible cycles you need to get through.

To give you an idea...with the algorithm I'm running now, I'm getting through about 12,100 attempts per second. The character set I'm using is the 95 characters easily typed on the American keyboard. I'm looking for any password containing those characters from 1 to 15 characters long. So the number of possible combinations is:

(95^1)+(95^2)+(95^3)+(95^4)+...+(95^15) = really (really) big number

Divide that by 12,100 and you'll see how many seconds it would take my setup to complete the entire set. I guess you could divide that whole thing in half to get an average since who knows where in the set the password actually is (if it even is in there)...but the number is still laughably huge.

I was just hoping there was a smarter way to go at it...this is kind of like leaning on a brick wall and waiting for it to fall over.
[Motorola Droid X2] LordRalh3:
It would be setup in your own house running the program, no need to mail anything

from my X2 roaming the north
[Motorola Droid X2] IDMA.DROID.X2:
Then I'm up for helping out! Just let me know what I need to do it to set it up and I will! :)
[Motorola Droid X2] CadenH:
Same. I only have a i3 laptop but at least its something.
[Motorola Droid X2] naviathan:
CPUs are old hat. The new wave of shared processing is using GPUs. Gamers recently cracked some special molecular code that scientists had been working on for years. As always the entertainment industry drives technology advances far faster than scientific discovery. It's like saying "Since I'm not playing a game right now I may as well contribute to science" or "Science has to wait, I have a dungeon raid in WoW to get to!". Seems backwards when you think about it, but it's the way our societies have evolved unfortunately.
[Motorola Droid X2] collingall:
This is true, I have a gamming PC at home with 3200 parallel processing cores (twin 5970s). Something like that can aid a ton in cracking this.
[Motorola Droid X2] naviathan:
One day you won't have a processor anymore. They'll find a way to dump all the hard core processing tasks onto the GPU and you'll end up replacing the "processor" to upgrade both video and processing, similar in respect to the AMD APU setup.
[Motorola Droid X2] Staggo:
I hate to be the pessimist, but even with modern day gpu's crunching through possible codes, we're looking at a 2048 bit RSA Key. Checking every permutation possible, you are looking at 2^2048 possible combinations. That's freaking HUGE. Like so huge you'd need a full screen of numbers just to display it(or a bit more). Not to mention that not only are you looking at that many combinations, but you have to find the cipher for the RSA algorithm. It's just not reasonable to expect that this is going to yield anything.

You are better off writing to Google/Motorola/Verizon requesting the boot loader to be unlocked.

Sorry. I'm suffering with you guys too.
[Motorola Droid X2] xawen:
Actually, it's crunching through the possible passwords on the PKCS store...not the key itself. The search space is still massive, but it's likely much smaller than trying to break the key. The important part is that we have a key in a PKCS store with a known format. I was hoping someone out there knew of a weakness in the implementation that would allow us to retrieve the contents.

I agree that brute force is probably not going to produce anything...even for just the password. I just wanted to let it run through all passwords 5 characters and less in case some developer set an easy password. That run will be done in a few more days.

I still think it's worth a run with a good dictionary file (numbers and character variants of words) if anyone has one. But that's also a long shot at best.
[Motorola Droid X2] Staggo:
Oh I missed that, I see that you mentioned that already. My apologies. I still think the original Cheesecake idea is what we need to focus on- Chances are slim, but if it worked for other devices, why not ours. Although, I haven't noticed a change in #s for a few days :(.
[Motorola Droid X2] T3HBR1AN:
Restored my Cheesecake ROM a few minutes ago and hit the servers. I didn't get anything.

Sent from my Eclipsed and ICS themed X2.
[Motorola Droid X2] litetaker:
I would like to know if there are any updates with the Cheesecake project! I really wish a lucky dude gets hold of a leaked update which unlocks the bootloader!!! :D

Anyway, I am currently rooted and I have Liberty installed. Everything on Liberty is just the way I like it. But I do want to help this project. Unfortunately, the only way to run the Cheesecake app is to be unrooted and on Stock firmware. I reaaaalllly like my Liberty setup and I don't want to lose it. Is there a way to do this, so that I can switch between Stock and Liberty at will?

I heard of the Nandroid... what does it do? Will I loss the progress in my games I am playing if I use Nandroid and restore to OTA 2.3.4 and then go back to Liberty later? Will I loss my customizations (including scripts/launcher layout etc?)

I really wish to help out, but if I can not recover my game progress and other settings after restoring to Liberty using Nandroid, then unfortunately, I can't help out here :(

Please clarify my doubt. Thanks!
[Motorola Droid X2] hitman_dreams:
A nandroid does a backup of everything. When you restore, it will be as you left it (think of it as an image). So if you go to stock then back to your backup and continue your games, be sure to backup again before switching back to stock. Also, I would move a copy of your backups to your computer just in case something happens and it gets overwritten or reformatted. Good hunting :)
[Motorola Droid X2] T3HBR1AN:
So maybe this is just me being paranoid or something but doesnt it seem like at some point Moto would get smart and change their servers around? I mean they obviously have an idea whats going on with Project Cheesecake. Its slightly arrogant of us to think we're sneaking under their radar. Haha.
[Motorola Droid X2] aceoyame:
They know all about it. They cannot change the way the server are arranged because of how long blur has persisted. It would break the updates to all their phones if they did.
[Motorola Droid X2] T3HBR1AN:
Ah ok that makes sense. Thanks.
[Motorola Droid X2] motcher41:
I am interested in doing cheesecake again but this needs to have some kind of clarity to it. Is there a way we can put in the OP what versions have been checked for a unlock and have a certain person to send an upload link to...to check it? Last time I gave up looking cuz I couldnt figure out what to do what my updates or if they had been checked already.
[Motorola Droid X2] motcher41:
I went cheesecaking as 2.3.4 today and the only update from 2.3.4 to 2.3.5 that I could find was 413 on the qa 3 server

412 OTA was nowhere to be found....thought it was interesting.
[Motorola Droid X2] aceoyame:
Has anyone tried searching with 2.3.5 on the phone? The updates go from a specific verison only, it could be that internally they have one to jump from 2.3.5, or even 2.3.3 (I am not sure what the last official release was). 2.3.4 looks to be a dead end at this point if they haven't made an update in awhile.
[Motorola Droid X2] skwoodwiva:
see my: all 235 otas...

Not in a while. Which 235 would you start with?
[Motorola Droid X2] aceoyame:
The latest stable, and from there if nothing found... latest of the latest you can find. I am getting curious that they might be jumping straight to 4.0 it looks like.... no stable 100% 2.3.5, no updates added to the list in awhile, Motorola is pushing the update to almost everything made this year, makes sense
[Motorola Droid X2] motcher41:
Last update before I couldn't root abymore was build 406
[Motorola Droid X2] aceoyame:
From memory you don't need to root using project cheesecake... also have you tried any of the rooting methods from the bionic and the newer devices.
[Motorola Droid X2] motcher41:
Cheesecake app needs superuser permissions though. So root would be e needed to use it. Although after the first 2.3.5 update I didn't need the app until I got to 406 and it didn't work...tried to reinstall and nothing then checked root and root was gone so I tried zergrush v3 and it wouldn't give it root either. Irk just where I ended up I guess.
[Motorola Droid X2] aceoyame:
Yeah because it's editing an xml file in /system/ I am pretty sure if you edit the update zip and remove the format to /system/ from the edify script you could push the server you want to test in the xml file before you install the rom and then update. I can post a writeup on how to do it. You would need to likely clear cache/data and also

You would need to flash the rom in BSR though since you would break the rom signature by modifying edify. It wouldn't affect the kernel image signatures though (important)

Also has anyone tried simply changing your build fingerprint on 2.3.4 to 2.3.5's (the version you want to set it as being)? Those edify scripts have an assert against it, and I am almost 100% certain that is how Moto's update servers poll what version we are running.

So I would say we have two ways to check then.
[Motorola Droid X2] zakth:
Can we add a list of versions already found for quick reference? Went through all of them today but only found 413, but the system version shows 1.3.380 which matches what I already have.
[Motorola Droid X2] aceoyame:
Then they've been changing the kernel this whole time but not touching blur. This really sounds like they were ramping this device up for ICS... Just a matter of time till we find a release out there for it. Might take several months but that is my prediction
[Motorola Droid X2] motcher41:
406 is that last one I found 2.3.4 to 413 to two small patches then a "test build" 406

The kernel on it was 00006
[Motorola Droid X2] naviathan:
So I take it nothing new has been found out there?

Can anyone get their hands on a build.prop from a dev phone? Any dev phone, not just an X2, I want to check the differences in the version scheme. When you do a check for updates part of the information sent to the server is the build version in the build.prop. You can change this version to an older update, restart the phone then check updates again and it will give you whatever the next one up is. If we can find the necessary scheme for dev phones we can trick the server into giving us developer releases and maybe an unlocked bootloader.
[Motorola Droid X2] ashclepdia:
I would think someone on freenode channel #motomagic would be able to help u with this more than we could.

If it was even possible to do.
[Motorola Droid X2] aceoyame:
He should speak to P3droid for more info about that. I know he recently had a dev D2G and X for sale. Hopefully he did a rip of them before he sold them.
[Motorola Droid X2] tech.kyle:
I find that choosing a different server and reopening the cloud picker will still show "master-blur.svcmot.com" as the chosen one, but it appears to be checking the one I select regardless.

Also, I tried visiting the entire list of servers in my browser just to see what it would give me. Below are my results.

master-lab.blurdev.com	crossdomain.xml Mar 31 2011
master-demo.blurdev.com	503
master-dev.blurdev.com	crossdomain.xml Jul 7 2011
master-qa1.blurdev.com	503
master-qa2.blurdev.com	crossdomain.xml Feb 24 2011
master-qa3.blurdev.com	crossdomain.xml Mar 4 2011
master-qa4.blurdev.com	-nonexistant domain-
master-staging1.blurdev.com	-nonexistant domain-
master-sdc1.svcmot.com	20111129.0636 - chef-stable.release.37 - nov 29 2011
master-blur.svcmot.com	20111129.0636 - chef-stable.release.37 - nov 29 2011
master-homer.blurdev.com	-down-
master-bart.blurdev.com	-down-
master-lisa.blurdev.com	-nonexistant domain-
master-maggie.blurdev.com	crossdomain.xml Apr 12 2011
master-bqa1.blurdev.com	-down-
master-bqa2.blurdev.com	-down-
testcloud01-sdc1.blurdev.com	crossdomain.xml Jul 11 2011
master-devtest.blurdev.com	-down-
[Xoom Q&A, Help & Troubleshooting] jasim310:
please help.

I would like to know where I can find my received SMS on my xoom MZ601.

It looks to me that they deleted immediately after reading.

thanks
[Xoom Q&A, Help & Troubleshooting] burden010:
What app are you using?