yashsingh1/xdaforums huggingface dataset:
[Motorola Atrix 2] darkowler:
http://www.atrixforums.com/forum/atrix-2-hacks/7996-project-bootloader-unlock-ics.html
[Motorola Atrix 2] Maribou:
Project cheesecake has already been covered here. I am pretty sure it has been abandonded as well.
[Motorola Atrix 2] Apex:
This had not near as much to do with the bootloader as it did with discovering a leaked version of ICS for our device - at least that was my (and other's understanding). If we happened upon a leaked update that included an unlocked BL, then we would have scored. However, the app provided us a couple of different leaks that took us from GB to ICS. Needless to say, the BL lock down on the A2 has been something that has been thoroughly investigated, experimented with, and continually sought after and worked on. There really hasn't been anything said, asked, suggested or otherwise that hasn't been explored already, so the need to worry about it is pretty futile at this point in the game. Just saying, since there seems to still be folks emerging within the forum that just don't know where things stand...
[Motorola Atrix 2] jimbridgman:
Yeah this is:

1) covered on page one of this same thread, as well as here:

http://xdaforums.com/showthread.php?t=1840826

2) I am so tired of people not reading and searching first, Please next time do a little research here on our form before posting things like this, it just makes you and others look lazy.

No insult meant here, just saying that that project cheesecake was found by us over a year ago now, and why this thread was created in the first place.

I think Apex_Strider said it pretty well, except that I have not given up on unlocking the BL just yet, I have a new thing that I am cooking up right now, but as I mentioned I am at a standstill until I can get a good rootkit created for this phone, and I have been running into some odd issues with that right now, but I will get past it and see if can boot to mbmloader from the sdcard and then boot into the rooted kernel that shows the device as an NS device, and flash the NS bootloader we have for ICS.
[Motorola Atrix 2] atrix2man:
Ive done some research and was wondering if all possiblilties have been tested yet.?
[Motorola Atrix 2] snowplow:
Yeah, Jimbridgman has tried just about every possible approach without success. Take a look at the last couple pages of this thread: http://xdaforums.com/showthread.php?p=38104657
[Motorola Atrix 2] atrix2man:
Well its up to motorola now...doubt they will hand it over..
[Motorola Atrix 2] shubham412302:
I think we must sign a petition for getting our bootloader unlocked or we must figure out the key for each of the imei.

we must crack out the method to get the key.

there must be some calculation which Motorola may be using to generate the key for each device.

that key is use her

fastboot oem unlock key.

its just like sony
[Motorola Atrix 2] jimbridgman:
Nope sorry..... the fastboot oem unlock command is not even runnable on our phone, we tried that long ago.... just run fastboot oem unlock and see what it says.

The key is either a 512 bit or 1024 bit RSA key cypher, and unless you know someone at motorola that will hand it over to you, you will have to get a supercomputer to run for some 5K hours to crack that signature, and even then we still may not be able to flash the modified bootloader with the proper key/cypher, because it is the efuses that tell the bootloader if we have an HS or an NS device (you have to have the phone show as an NS device before the NS "non-secure" bootloader will even flash), even from CWM with no signature or cypher. We tried that already.

The only way(s) is to bribe a moto employee, or flip the efuses to show the device as an NS device, if might happen as I mentioned a million times now with a root kit and booting from the sdcard with mbmloader on the sdcard.... google all that...

Again, we/I have tried just about every way there is to get this unlocked, yes we even did the petition a very long time ago, look here:

http://xdaforums.com/showthread.php?t=1472137&highlight=petition

This was posted well over a year ago, and a ton of people signed it, and look at what that got us.... that stupid unlock website from motorola, and the a2 is not even included.

I would say as old as this phone is, that it is not getting unlocked, especially since I am only in here part time, and can not try anymore bootloader unlock tricks since my a2 was sold. I can borrow it from the person who bought it, but I can not risk bricking it since it has no warranty anymore, and he uses it for a makeshift desktop with the GB ubuntu webtop and the HD dock that I sold him.
[Motorola Atrix 2] mtnlion:
Nexus is soooo much easier
[Motorola Atrix 2] shardul.phatak:
this may be the dumbest question

how motorola can change the bootloader version while upgrading to ICS from GB ?
[Motorola Atrix 2] pOOBAH1973:
By just flashing a new bootloader which is included in the update.
[Motorola Atrix 2] jimbridgman:
By using an encrypted signature that the stock recovery can read. This can be pulled out and flashed with CWM as well if you know which partition to flash it to.... now it will NOT let you flash the unlocked bootloader version (NS) without the phone showing it is an NS device. There is a file in /proc that shows if you have an NS or an HS device. The NS vs HS is so that they could release a developer version of the A2 if they wanted, so they set up all the ground work, but will not sell the dev versions to ANYONE... I asked a friend I know that used to work at the corporate site for moto.
[Motorola Atrix 2] RAD7:
So near yet so far.....so there is a devlp edition A2 within the company domain only?? I have read a couple of times on our forum ever since the JB leak from people that the Chinese guys have a in thing with Moto (whatever that means) & also the fact that within the last month the chinese fan site guys have released 4 JB ROM's back to back so this phone is yet hot there though it is dead for the rest of the world, one can only hope they release a cracked bootloader using these contacts.

I hate flogging a dead horse but I'm gonna be using this phone for a longer time until all the Gen nxt phones come down with their insane pricing. We don't have a phone contract trade switch phone pricing blessing here nor do we get easy replacements like the US, so.... I don't know much about what can be achieved still using Cheesecake in specific for this Chinese JB official leak but from whatever limited knowledge I have about cheesecake I u/s sometimes a non secure file floats around which is grabbed by someone lucky on cheesecake, correct? so if china is still hot with this phone just wonder if cheesecake should help yet still?? Sorry to be a bore :)
[Motorola Atrix 2] m.syahril.niezam:
What about bribing?

Well, just out of the blue here... :D :D :D :D

Why don't we just used the bounty to bribe MOTO Employee to give the information on unlocking the phone... :p :p :p :p

BRIBE !! BRIBE !! BRIBE !! BRIBE !! BRIBE !! BRIBE !! BRIBE !! BRIBE !! BRIBE !!

HAHA...
[Motorola Atrix 2] Ravikirancg:
You got contacts? If so sure.. Why not.. You just need to get the certificates and the signing tool.

---------- Post added at 12:41 PM ---------- Previous post was at 12:37 PM ----------

Hey, can you confirm that both ns and hs bootloaders look for the same thing from efuse? I mean, assuming we somehow manage to flash the file properly, if the ns expects something else from efuse compared to hs, well that would hard brick the device..
[Motorola Atrix 2] jimbridgman:
Ok, so it is more complex than all that.

The phone looks at boot to the efuse to see if it should be an NS or HS device, this is then reflected in one of the files in /proc which is just read from the value in the efuse. To make it all work, you would need to boot from the sdcard, and boot to a boot image on the sdcard with a root kit that will have a fake "efuse" value populated or "overwritten" from the efuse, then flash the NS to the device's partition, but then you would need to find a way to make that stick on EVERY boot/reboot, and unless someone can make a change to the efuse itself, then this is another lost cause.

I got as far as making the root kit and flashing the NS bootloader, but on the next boot, it sensed from the efuse that it was an HS device and hardbricked, as with most of my other attemepts to make changes to the BL or relatives of the bootloader.

I really hate to say it, but trying to unlock this thing is a lost cause. I have said this for a while now, and unless others are willing to brick in attempts to unlock this thing (all 9 or so attempts ended up in hardbricks for me), there really is not a way I can see to get around reprogramming the efuses, and that was more trouble than it was worth after taking a look at it at the AT&T labs with a few other "experts".
[Motorola Atrix 2] hankbizzo5:
It just make me think there have been some devices I have owned where the E-fuse is jumped..... I know that in some cases the e-fuse is located in a place like under the cpu..... So just to find it would take some high tech equipment..... I have made a few attempts to use some of the equipment where I work but to get access to a big $ piece of equipment for something like this is not easy.....
[Motorola Atrix 2] PRichardson:
UEFI Secure Boot for Android (is this M$, or Motorola??)

Hey Jim!,

Hope all is well bud, been really busy lately with work.

I thought I would chime in here with a comment carbon dated to the early to middle epoch of this thread, when ideas were still being tossed wrecklessly like good beer by drunken soldiers!

Before the most recently vetted workaround by the Linux Foundation, strategies discussed here related to cryptographic signed/encrypted bootloaders for Android (specifically, our signed A2 loader), seemed [in a very fuzzy way] somehow analogous to the Win 8 hate crimes, and resultant humanitarian efforts to minimize that damage --> including Kexec loading of other kernels, shim-inspired strategies, and anything else imaginable (literally).

In the off-chance workarounds are developed, there are alternatives available to passively laying spread eagle for the sweaty fat OTAs coming down the pipe which, as you know, is the most likely opportunity for a dark villain to ram his eFuse change down your throats, and prevent downgrades to prior ROM versions (and thus, half your options for hacking). Granted, you'd have to actually "accept" it, but you may still want to consider PRE-cautions, rather than everoot-keeping-root stuff (IMHO).

~p

:eek:
[Motorola Atrix 2] Apex:
No idea what you just spoke of, Paul, but damn nice to see you back on here! (not near as colorfully spoken as you, but nonetheless...) :cool:
[Motorola Atrix 2] jimbridgman:
Hey, long time no see.

The Linux foundation work around with shim, that you are speaking of will only apply to devices that have an UEFI BIOS, so that will not work with any android device right now, since none of them have a UEFI BOIS on then, and they all use some other form of the android bootloader.

And yes I would agree that doing some kind of update block, or turning off the update checks is probably the safest thing for EVERYONE to do here, if they EVER want a chance to unlock the bootloader, because we have seen with every update comes more challenges with the bootloader and the ability to go back is usually lost.
[Motorola Atrix 2] shubham412302:
all new moto phones got bootloader unlocked but not ours

http://www.droidrzr.com/index.php/topic/15008-motorola-bootloaders-cracked/
[Motorola Atrix 2] jimbridgman:
Rather than getting bothered by this, why not contact Dan Rosenberg and ask what he did, and how, and then see if it can be done on the Atrix2. That is what I did with some of the bootloader testing that I did, was take ideas others used on another phone and see if I could get it work on the A2.
[Motorola Atrix 2] quasihellfish:
This is what he did to unlock the Atrix HD, Razr HD, and Razr M (direct from the guy that did it):

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html
[Motorola Atrix 2] chan32167:
http://www.androidpolice.com/2013/0...la-droid-razr-hd-maxx-hd-razr-m-and-atrix-hd/

according to AP, Atrix 2 cant be unlocked with this method as it doesnt use the same chipset
[Motorola Atrix 2] Ravikirancg:
I had hopes till I read this
[Motorola Atrix 2] atrix2man:
Ive always heard of the Atrix HD being more locked down than the atrix 2. Obviously not..oh well. Kexec has arrived for us..so be patient. New better roms are on the way.
[Motorola Atrix 2] snowplow:
I may have misread the article, but wasn't the actual exploit found in qualcomm's TrustedZone implementation? Either way, wont help us sadly. It also sounded like a future software update from moto could flip a qfuse and permanently disable bootloader unlocking in spite of this flaw... wanna make bets? :p
[Motorola Atrix 2] shubham412302:
Take a look here.

Motorola milestone 2 got boot loader unlocked.

It also has omap chipset

http://xdaforums.com/showpost.php?p=40135678&postcount=443
[Motorola Atrix 2] atrix2man:
are our chip sets the same?
[Motorola Atrix 2] iamezio:
No , the milestone 2 has a OMAP3630 , our A2 uses OMAP4430.
[Motorola Atrix 2] shubham412302:
But the method can be same
[Motorola Atrix 2] atrix2man:
Its worth a try right?
[Motorola Atrix 2] shubham412302:
Yes
[Motorola Atrix 2] Ravikirancg:
thats a fairly recent post.. and the guy who did it hasnt yet written as to how he achieved it.. once he does maybe we can look at it and try..
[Motorola Atrix 2] jimbridgman:
No it will not, the architecture and instruction set are totally different. We need to find a way to do it that applies to the A2 or the razr, or possibly even the bionic. Any other phone processes will NOT work for this phone, so don't even think about it.... Trust me I have tried so many different ideas to crack this thing it is not even funny including things that should not have even been attempted on this phone, just to see... I will say that I sacrificed 9 phones for the community, trying to unlock the bootloader. I thank AT&T for accepting the return of each "broken" phone that just died while charging last night... LOL.
[Motorola Atrix 2] htchd2fix:
.............. I thank AT&T for accepting the return of each "broken" phone that just died while charging last night... LOL. ......

:):):):laugh:

hey Jim how about atrix hd metod???

thanx
[Motorola Atrix 2] snowplow:
Although that was directed at Jim, I don't think he'll mind me answering: it is the same problem as above - the Atrix HD uses a completely different chipset than the Atrix 2. The exploit which was used to unlock the AHD bootloader takes advantage of some security holes which are specific to the qualcomm chipset and their secure kernel implementation... read about it in depth here: http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html
[Motorola Atrix 2] demencia89:
Do you guys think we might get an answer from motorola now that Google runs it? Should we spam google and motorola for an unlocked BL?
[Motorola Atrix 2] CM-PRo:
Let's not get ahead of ourselves. We've just got the kexec working for all which is great for the Atrix 2 community. Google owning Motorola doesn't make much of a difference, especially on a phone that has been discontinued like ours and i don't think they'd give a **** if we spammed them for an unlocked BL.

Cheers,

z
[Motorola Atrix 2] mtnlion:
Been done already. Didn't help at all.
[Motorola Atrix 2] demencia89:
I see.. Is it something hard for them to do? Or is it they just dont give a ****? .. Idk why I feel that with the correct words to the correct person might get us an unlocked BL.
[Motorola Atrix 2] iamezio:
Hard for them ? probably not .. is it something that they will do ? definitely no .
[Motorola Atrix 2] Semseddin:
Hello Jim,

I think i've found some RSA key files signed by motorola posted here. Please take a look.

http://xdaforums.com/showthread.php?t=2399597

Post#35
[Motorola Atrix 2] RAD7:
Appreciate Semseddin for taking the cue in the other thread :good:
[Motorola Atrix 2] jimbridgman:
Hey, I took a look at those signatures and tried to see what was up with them. It looks like those are the kernel signatures that the bootloader uses to check the kernel for the razr to boot that kernel. This would be a perfect thing to let has code know about, so he can use these with kexec, if he hasn't already got them.

Sadly I can't see these doing much good with the bootloader unlock, as this key does not match the signatures contained in the HS or NS bootloader.

Nice find though.
[Motorola Atrix 2] atrix2man:
http://www.xda-developers.com/andro...gn=Feed:+xda-developers/ShsH+(xda-developers)
[Motorola Atrix 2] Zoide_:
That's great news, but I don't think it would make any difference for the Atrix 2, since it's not a "developer phone".
[Motorola Atrix 2] iamezio:
That doesn't change a thing about our POS phone , they won't do anything to open the bootloader on a 2 year old phone , especially after they said a few times they won't unlock the bootloader on the RAZR and A2 .

I like My n7 so much , nexus gives you so much freedom , and unlocking the bootloader comes to one fastboot command ..
[Motorola Atrix 2] joe ferreira:
this file doesn't have a bootloader in it :(

We are normally looking for a file called ap20bl.img on the atrix 1.

If moto continues the same patching process this will be the file that contains a unlock inside the update.zip normally with this file is also a bp.img

when I looked before for the atrix... I opened the ap20bl.img with notepad ++ and searched for the keyword unlock.

when in the image you should be able to see text something like the following...

Device is now unlocked

you will find lots of other stuff in the file around that area but this is basically the function that has to verified.

basically it will resemble the text you see when you actually unlock the bootloader...

like this
[Motorola Atrix 2] dasfiend:
I found the file /cache/recovery/last_log , which you can get to if you're rooted and adb shell in (you can chmod the /cache directory so you can use adb pull or copy {'cp' in linux} the log somewhere you do have access without root). You'll have to chmod the copied file first, as iirc all the files in /cache are 750 I think? well definitely 0 in the "universe" column and that's what matters for this conversation. To learn about chmod permission, check this article.

Does anyone have detailed info on what that log file is truly logging? Other than the obvious from the path and filename, I don't know anything about it.
[Motorola Atrix 2] joe ferreira:
this part of the updater-script is very interesting

ui_print("updating STE BP ..");

assert(

package_extract_dir("steflash", "/tmp/steflash"),

motorola.steflash("/tmp/steflash"),

delete_recursive("/tmp/steflash"));

I have looked at all the files including the ramdisk.ddb.extent_XXXXXXXXXX files and do not see anything of value for a bootloader unlock.

some of these file might be useful to someone that understands the sim-unlock process though.
[Motorola Atrix 2] jimbridgman:
Yeah that is the exact same thing I keep finding in most of these updates that they have been sending.

Jim
[Motorola Atrix 2] moofree:
I've noticed that sometimes the updater will continue to connect to the previously selected server sometimes even after you change the setting with cheesecake

That update that supposedly came from the production server might've come from one of the staging servers instead.

If the wifi goes down while it's downloading from the staging server, chances are upon restoration, it'll be pointed to the new setting (ie: the production server) and the download will fail.

You can see which server is being connected to if you keep an eye on logcat

(grep for blurdev)
[Motorola Atrix 2] fire159:
thx jimmy

make atrix 2 bootloader unlock
[Motorola Atrix 2] joe ferreira:
ap20bl.img explained...

the tegra2 is the ap20 this file has the tegra2 bl (bootloader) image.

the unlock will be in a update.zip that has this file in it.

It has been this way in every moto tegra2 based unlock so far.

kal el will be ap30bl.img from what I have been reading in the technical documents.
[Motorola Atrix 2] Pirateghost:
but this device isnt tegra....same method still applies?
[Motorola Atrix 2] joe ferreira:
oops lol.

well when a tegra 3 moto phone comes out then that will apply.

:p

we need more people in here trying to hit the blur servers.....

daily updates from all atrix 2 owners in the xda community....
[Motorola Atrix 2] cheetablaze:
Just checked the servers, didn't find anything actually? Previous A2 found what everybody else saw. Not this phone interestingly....
[Motorola Atrix 2] dasfiend:
I checked every server between 1:45pm and 2:15pm CST and either couldn't reach the server or it said no updates available.
[Motorola Atrix 2] bubb18:
I was just messing around, and i got 55.13.16 rerooted again
[Motorola Atrix 2] dasfiend:
Di you install it successfully? If do, did you do anything special?
[Motorola Atrix 2] bubb18:
No, i didn't do anything special to install it, just pointed the recovery to it and it installed fine

as far as root, the one click in the dev section didnt work, but i ran gingerbreak and that at the same time and it worked
[Motorola Atrix 2] jimbridgman:
There are several of us who do this daily. The issue though has been that people have been applying the updates rather than getting them out there for us to look at. I have found about 7 updates and none of them have anything but the production bootloader in the zip file and the .img files.

Jim
[Motorola Atrix 2] dasfiend:
I can't be 100% sure, but it seems to me that once I get a server that's "taking longer than expected" I can't actually switch servers anymore until I reboot (or maybe it's a really really long timeout that I haven't hit yet). They will all just say that same message, even prod.
[Motorola Atrix 2] koriflame:
I'd participate if i knew EXACTLY what I was doing... >.<
[Motorola Atrix 2] moofree:
My experience has been the same. It's ok if you get the three options setup/retry/skip, but if you get that other message, it gets stuck. The message does say something about it continuing in the background so that's probably what's happening.

I've tried airplane mode and such to no avail. There might be a process we can kill...
[Motorola Atrix 2] JRW 28:
Me too, willing to help in any way!
[Motorola Atrix 2] dasfiend:
I got another hit, still listed as 55.13.20 , but has a different md5sum from my previous one. I don't know if it matters, but this time it also asked me if I wanted to download it over wifi and cellular or just wifi.

I renamed my older file .old, and the new one (same file name as the old one used to be) is now available here

md5:

2c3c6cab433c2030e338eab09898d01c

I notice there's a prologue_loader.ldr and production_loader.ldr inside the "setflash" directory, are those useful?
[Motorola Atrix 2] JRW 28:
Great gonna grab a few files and see if we can get a sbf out of them
[Motorola Atrix 2] svtfmook:
instead of an sbf, look at the update script and see how it's flashed. it's most likely and update.zip that flashed through the recovery.

if we can find the update.zip, then we wouldn't need an sbf until bootloader is unlocked.
[Motorola Atrix 2] JRW 28:
From what I've looked at just on my phone it looks to be just a patch. Not a full update. I'm gonna compare a few files that we have to the patch and if they are different pass them to daywalker04. HE is the one helping us look for the sbf not ME. Wish I knew how to though! There are a few files in here that look suspicious so if you or someone else knows what they are doing it might be of some use. It will be a while before I get home so I can break it apart though.