[Motorola Droid X2] mostKnownUnknown:
I downloaded it and opened it. It seems like the development code to build the DX2 kernel. But if you are looking a way to defeat the signature checking, I don't think you'll find it here.

Basically the bootloader does the signature checking. Since the memory space is broken into partitions, the bootloader knows (somehow) which partitions are signed and does the signature check on only those partitions. If Moto needed to flash a signed partition, they build that partition normally and then sign it.

For example, both the kernel and ramdisk are held in the boot partition which is signed. The ramdisk holds the init. The /system folder is held in the system partition which is not signed. This explains why we can change anything in the /system folder once we have root without too much worry. If you try to change anything in the boot partition (kernel or ramdisk), you instantly fail the bootloader's signature check. Same thing goes for the recovery partition. This is why we have things like bootstrap recovery and 2nd-init which places those items in the system partition to make up for the fact that we can't access those two partitions.

This is why I get sometimes annoyed because people don't know why they want an unlocked bootloader. There are a number of partitions that are locked because of the signature. But the ones we really care about are the boot and recovery partitions. I think we could care less about whether we have an unlocked bootloader as long as there is a way to access those partitions. Basically with the 2nd-init development, the only we can't do right now is a custom kernel (and thus no overclock *sadface*) and true CWM recovery (pushbutton bootup recovery and not this recovery after OS is loaded).

From my CDT table post (http://xdaforums.com/showthread.php?t=1205527), we know where the bootloader is on the phone (/dev/block/mmcblk0p1). We also know what partitions are signed and where the signatures are. There are still a number of questions unanswered and a number of ways to explore in defeating the bootloader lock. Here are a few thoughts in my head:

1. Find the command force unlock fuse to be set (unlock command outside of the bootloader fastboot)

2. Trick the bootloader to not check the unlock fuse and always report the phone as unlocked

3. Trick the bootloader never to run the signature checking code

4. Trick the bootloader to assume that the boot and recovery partitions are "regular" partitions and not signed ones

5. Find a flaw in the signature such that you can sign the partition as if you are Moto

My only recommendation is work on partitions outside of the bootloader. If you mess around with the bootloader partition and make a mistake, you are basically screwed with a hard brick. This is why approaches #2 and #3 is soo tricky. The good thing is that in my investigations, if you fail a signature check outside of the bootloader partition, the bootloader instantly puts you in a state to run RSD upon startup and you can SBF out of it. If you are looking at signature defeating strategies, I recommend messing with the recover partition signature. It is not in the main boot order and if you can boot up without error, you've defeated the signature check. It shouldn't be hard to transfer that exploit to the boot partition.

Sorry btw for the longish rant. I'm just glad that some people are interested in tackling this bootloader problem and that those people are not interested in flaming people on forums. :)

- mostKnownUnknown