yashsingh1/xdaforums huggingface dataset:
[Defy General] dlhxr:
i don't think that sbf is unlocked bl for m2. from the original post, the locked m2 have locked bl after flashing this sbf and the unlocked one have unlocked bl after flashing.

so it is just a newer bootloader for m2

---------- Post added at 01:52 PM ---------- Previous post was at 01:47 PM ----------

maybe we can make some hypothesis here from above and with @t0desicy's selfless work(modified FBFlash.dll and bricked defy)

for defy, the rsd will remain the fastboot when flashing with recognised 'se' defy and it will erase or block the fastboot mode with recognised 's' defy.

so if we can stop rsd erasing or blocking fastboot mode and make our defy boot at the same time, it would be very useful for unlocking bl.
[Defy General] balika01:
if you unpack it you will see lot of "bootloader fastboot mode" in CG30! it unlocked
[Defy General] dlhxr:
how to unpack it? i use MotoAndroidDepacker and have a CG30.smg, but i can't continue unpacking.

if the sbf is unlocked, it means the milestone 2 is unlocked now?!!!
[Defy General] balika01:
open whit hexeditor

yes, unlocked , but now buggy and boot only whit pc (load kernel whit fastboot)
[Defy General] coelho_:
I try it...I decompile a sbf version 2.3.6 and I place the CG30 in the file....I complile and flash but rsdlite dont flash the group 30
[Defy General] free2live:
That.s bcz defy bl is no cg30 but cg63 if I'm not mistaking
[Defy General] free2live:
You flashed to defy???
[Defy General] balika01:
try whit offical sbf whitout CG32
[Defy General] coelho_:
there no group 63
[Defy General] balika01:
no, we speak milestone 2
[Defy General] sonyc2011:
You flash the sbf to your defy?

Just read your post:)
[Defy General] balika01:
http://xdaforums.com/showpost.php?p=21947233&postcount=800 :mad::mad::mad::mad:
[Defy General] coelho_:
Fail :o........phone failed initial security verification cheks. HAB error 0x8D

he say that when I want flash a sbf normaly

---------- Post added at 02:58 PM ---------- Previous post was at 02:52 PM ----------

I think I brick my phone to

edit : it's all right reboot normaly after 2 flash
[Defy General] free2live:
Defy or MS2?
[Defy General] coelho_:
on my defy
[Defy General] free2live:
Uffff... Good you got it back working :)
[Defy General] royale1223:
I had a long talk with mbm yesterday. (FYI He is a person and he made sbf_flash)

He told me that fastboot flash in RSD lite is for newer phones, not for defy. He told me some stuff about the signature checking.

1) The actual public key is not stored in CPU.

2) It is stored in bl.

3) What CPU stores is only the sha1 of the public key.

4) CPU looks for the public key in bl, verifies it with the sha1, verifies the bl using public key, bl does the rest of signature checks.

5) bl can be modified, but it'll fail to pass the signature check.

What I purpose:

1) Extract public key from bl.

2) Generate it's sha1.(or just get sha1 from CPU, don't know if it's possible btw.)

3) That should be the sha1 stored in CPU.

4) Brute force sha1.

a) We are looking for a RSA keypair.

b) sha1 of it's public key should be sha1 from step 3.

c) This will take only less time because, sha1 is only 160 bit, collisions and availability of rainbow tables.

5) I assume we have the keypair now.

6) Design/modify bl to bypass signature checks.

6) Modify bl and add public key.

8) Sign it with our keypair.

9) Flash it.
[Defy General] coolzarjun:
^ you're da man :)

Sent from my DEFY
[Defy General] hrk:
There is a flaw in your reasoning.

The sha1 of the public key will not help/allow you to discover the private key, no matter how "brute" force you apply. It is a signature of the public key, it has no informarion whatsoever about the private key.

From what you posted, it's only used to verify the public key found in the bl to detect and avoid tampering.

You "just" need to replace the sha1 in the CPU with the sha1 of a new public key (in a new key pair shared with the world), then replace the public key in the bl.

Is it possible to replace the sha1 in the CPU? If you can't, I doubt you can do anything else with the keys.
[Defy General] Febernacke:
if the CPU only verify sha1 of the public key it Can be possible to write a custom bl with motorolas pk at the correct offset. the cpu will find correct pk and the bl will run and just ignore the pk.

but i think it is more stuff in the way...
[Defy General] viper.:
Welcome to the Bootloader discussion board

Take a look

http://xdaforums.com/showpost.php?p=21975431&postcount=76
[Defy General] royale1223:
First of all you are not understanding my reasoning. I'm talking about generating a lot of RSA key pairs so that one on the public keys match the sha1. Not the other way around. We are not attacking RSA here, we are attacking sha1.

No it's impossible to modify the sha1 in CPU, it's hardwired.
[Defy General] royale1223:
You are forgetting about the signature check on the bl.
[Defy General] pulser_g2:
So you are looking for a hash collision? Ie. You are going to try and generate a keypair which has the same public key sha1 sum?

Not too sure that is going to work unfortunately, as sha1 is fairly good against collisions.
[Defy General] free2live:
+1 . Anyway we don't have enough computers to do it and even if we did it will take most probably a couple of months. After unlocking someone will have to write a new bl and new kernels. Maybe it will be done by the end of the year. Or not.
[Defy General] scholbert:
stop hunting keys...

Hi again,

please... i really don't want to destroy all illusions, but this is history repeating.

There'd been extensive discussion about all this key cracking and collision searching about a year ago in the Milestone section.

In the end people flamed and cheated others and there'd been a really annoying discussion if it all would work out and how...

Even if people find a collision on the sha1 it would be hard part to:

1. tweak mbmloader to work properly

2. generate a matching key without knowing which parts are summed up for sha1

3. put everything in place without knowing if it affects other parts

If you ask for my opinion, there's only one solution for Defy:

Use the existing code and examine how the devices got unlocked by using the same codebase (mbmloader & mbm did not change!!!).

Change mbmloader and keys is a no go.

Again... and as i already posted locked and unlocked bootcode is obviously the same binary, with the exception of the bytes i marked in that post.

In my conclusion these bytes are not covered under the sha1 checksum otherwise things won't work out this way (normaly different content in the chain would break checksum).

Also i mentioned different offset of mbm and mbmbackup... so i guess this is just related to eMMC. From what i suspect, this might be a side-effect of the eMMC organizing data.

So maybe the zero block's are simply unused, but to be honest i'm not sure about that.

I also read through the whole thread to understand what epsylon3 had done with the efuse bits. There's obviously some correlation to the efuse byte setting in mbmloader. Maybe there's also some interaction with the bytes i found.

Maybe not! :rolleyes:

Anyway, someone should spent some more time on disassembly of mbmloader, read anything on droid-devleopers.org and search milestone-modding IRC logs.

I hope you got me right ;)

Best regards,

scholbert
[Defy General] adi4motion:
The best sollution (in my opinion) though I don't know anything about the programming behind this, seems to be enabling engineering mode. We know we have it, we know it can be done... it's a BIG matter of how... the other ideas are in the field of "may work"....
[Defy General] scholbert:
Yes, that's what i said... of course maybe with a little more technical confusion :p

Regards,

scholbert
[Defy General] linbi4706:
are you have to test the unlock defy MMCBLK dump?

https://docs.google.com/spreadsheet...ZEtleGNZQ1llclE&single=true&gid=0&output=html

the unlock mbmloader is Different to the lockdefy

---------- Post added at 11:46 AM ---------- Previous post was at 11:45 AM ----------

any one can tell me what tools can flash mbmloader?

i use the rsd but no any sbf can incloud CG63.smg

SAME FOR CG30/CG55
[Defy General] ofmb:
Hey scholbert!

Thanks for all the info you give us!

And I'd like to get your advice - don't you think that capturing the flashing process of rsd and analyzing the differences between un/locked bl would be easier that reversing the mbm?

See my privious posts, got it all written there.

Thanks again :)
[Defy General] leodfs:
Even with a collision on sha1, people forget of one small detail on realm of cryptography: salt.
[Defy General] scholbert:
Hi guys!

Yes, that's what i'm speaking of... there are three different bytes in mbmloader:

http://xdaforums.com/showpost.php?p=21915801&postcount=779

But the main code (ARM executables) is the same!!

There must be a kind of software switch to enable engineering mode using the same bootcode... and these three bytes are are involved in switching i'm pretty sure!

Anyway thanks a lot for this CG table... night be very useful.

As i see there are the offsets in RAM as well (column 6), is this right?

No i don't know.

Yes sure, that's what i tried to say :rolleyes:

Further disassembly of the mbmloader code would help in understanding the function of the three bytes i found and linbi4706 also refers to indirectly.

This table might be quite useful!!!

Yeah agreed 100%, it's too evil to succeed :p

Regards,

scholbert
[Defy General] linbi4706:
http://xdaforums.com/show...&postcount=157

Full dump from a unlocked defy

and you can see the Epsylon3 post in this post .He has test get eng-mode and some test.
[Defy General] r3flux:
#opmosh

Looks like #opmosh is starting to work?

http://developer.motorola.com/produ...v&utm_medium=ecommpartner&utm_source=visitmde
[Defy General] erpato:
August or september 2012... xD
[Defy General] adi4motion:
It's about razr developer device...no news for us...
[Defy General] leodfs:
@linbi4706: Your link is wrong brow.

@r3flux: I just lost all my hopes on official help from motorola for unlock defy, reading that. They took almost one year to make official that razr e xoom will have a "special edition" that come with unlocked BL. They are doing the game of: "What? do you want unlocked bl? wait a minute(year)... ok there you go, you can buy those... what ? did you want your model unlocked? didn't understand that... too bad". :mad:
[Defy General] erpato:
We should do, everyday put the same comments in the facebook page of motorola. Spammcomment!!!!!!!!
[Defy General] popcorn1122:
http://community.developer.motorola...to-the-Bootloader-discussion-board/td-p/22108

We all can request Motorola to unlock Bootloader on above link.
[Defy General] sonyc2011:
We will have an unlock bootloader when we gonna chenge our phones.

Motorola is a big corporation that invest lots of money in the security of the software, it seems that more than software development.

They have lots of experience from past and cover the exploits.

The problems whit the gsm operators is that gsm networks can hack (read this) and this why the bootloader loked and they tell that they will talk whit the gsm operators.

By the end of the year I hope to chenge my phone and I will be more carrefoul what I wasteing money. Defy is the second android phone (1st was the G1) and now i know better what i want.

I am not saying that Defy is a bad phone (it is the best on this price) but because moto locked the bootloader and they are not supporting devices after a real quick period of time compared to other manufacturers for me moto is out of the list for my next supersmartphone.

Is just my opinion.

Peace
[Defy General] cloogshizer:
Yes, we can. But please, don't spam the thread with one line posts like "unlock bootloader!!11!" or such. I don't think that will help us in any way.

The nature of the Moto-dev thread is that it is targeted to developers or ppl acting as devs. I fear that comments from consumers simply complaining but not giving any reason as to "why" they should unlock their phone's bootloaders will not have a heavy weight.
[Defy General] walter79:
Chinese rom 4.5.3-109-DHT-14 has different Linux Boot Loader. It is version 2.

I can`t flash it on my defy because i never flashed a 2.3.6 full sbf.

Could someone test it if it works.

http://www.4shared.com/file/3sFvPs1z/firmware.html

It is CG33.smg and CG34.smg in one sbf. Both have version 2.
[Defy General] erpato:
I can flash it but. it's dangerous?
[Defy General] walter79:
Did not work. free2live tested it.

And if you flash full 4.5.3-109-DPP-14 you can only downgrad to sbf with BL6.
[Defy General] free2live:
i already did..bootloader error for me. i'm bl6.. you can flash ..make a fixed sbf of the one you are now just in case....if you get bootloader error just flash the fixed one and you'll be back on your rom
[Defy General] erpato:
Don´t work T.T
[Defy General] t0desicy:
I just leave this here.

EDIT: This is for you:

http://i.imgur.com/r7Ejg.jpg
[Defy General] brajesh.sharma87:
I wud like to thank u a hundered times. whether or not we get success, ur contribution towards our defy will alwayz be remembered. you never lose. Thanx man.
[Defy General] t0desicy:
Well, as long as you are not saying it ironically, you don't need to say thanks, I am doing it for the community, I do not own a defy anymore, it's bricked. as [mbm] said, I probably will not be able to restore it.
[Defy General] 57op:
Nice try. I'm really sorry for your defy!

P.S. Is Boromir in the picture? :p
[Defy General] shaggy1965:
Hi - have you been able to root your Defy + and if so how did you do it? I can't find a superoneclick that works with it
[Defy General] protozeloz:
Don't use the default method use gingerbreak or another method. Maybe this helps I haven't tried defy + but GB on defy
[Defy General] walter79:
p3a_jordan_umts_jordan_china-user-2.3.4-4.5.3-66-62-test-keys-ChinaRetail-CN-extracted

31.01.2012 00:11 10.240 CG31.smg
31.01.2012 00:11 12.288 CG32.smg
31.01.2012 00:11 8.953.856 CG33.smg
31.01.2012 00:11 4.096 CG34.smg
31.01.2012 00:11 3.153.920 CG35.smg
31.01.2012 00:11 342.493.184 CG39.smg
31.01.2012 00:11 274.432 CG42.smg
31.01.2012 00:11 3.145.728 CG45.smg
31.01.2012 00:11 3.508.224 CG47.smg
31.01.2012 00:11 8.192 CG61.smg
31.01.2012 00:11 2.048 CG64.smg
31.01.2012 00:11 12.288 CG65.smg
31.01.2012 00:11 8.172 firmware.hmg
31.01.2012 00:11 315.392 RAMDLD.smg

Normal SBF depacked (4.5.1-134-DFP-139)

31.01.2012 00:15 18.432 CG31.smg
31.01.2012 00:15 133.120 CG32.smg
31.01.2012 00:15 14.419.968 CG33.smg
31.01.2012 00:15 18.432 CG34.smg
31.01.2012 00:15 8.388.608 CG35.smg
31.01.2012 00:16 342.624.256 CG39.smg
31.01.2012 00:16 274.432 CG42.smg
31.01.2012 00:16 3.147.776 CG45.smg
31.01.2012 00:16 8.388.608 CG47.smg
31.01.2012 00:16 524.288 CG61.smg
31.01.2012 00:16 18.432 CG64.smg
31.01.2012 00:16 18.432 CG65.smg
31.01.2012 00:15 8.172 firmware.hmg
31.01.2012 00:15 315.392 RAMDLD.smg
[Defy General] linbi4706:
hi every one

from the chinese forum one pople Brick the mb860.

he make a eng usb Line

link the Brick 860,the pc can find the orther devices Different the Usual flash

i Search it ,the eng usb Line Is true.

maybe can help ep3 repair brick defy,and help us to unlock.

my english is very cheep

I hope someone better to translate

http://bbs.gfan.com/android-2122024-1-1.html
[Defy General] walter79:
http://translate.google.com/translate?=zh-CN&tl=en&u=http://bbs.gfan.com/android-2122024-1-1.html
[Defy General] linbi4706:
i find the eng usb line make Method

:D you can test
[Defy General] sonyc2011:
There is a new way i think?! 1 is linked to 4 and 1 in the same time.
[Defy General] hackergnome:
And that makes Motorola Factory Cable which can make RSS flash sbf w/o a battery in the phone so no 'battery Low cannot flash' (or whatever that is)error...

Wonder what this has to do with bl unlock...
[Defy General] mearoth:
I'm not sure, but in theory as far as omap is concerned it could alter the boot order if connected to the right omap pins. of course also only if omap in HS mode allows this (which i can hardly believe - but on the other hand: why should motorola not want to have a handy backdoor for truly bricked devices).

perhaps I can get my hands on a damaged defy to dismount it completely and see where everything is connected...
[Defy General] keewanchoapsss:
As I remember, on my old LG GT540, the bootloader was stock like ours, locked as stock. But after the flashing of the .KDZ fastboot rom it bacame unlocked. However, this did mean that we could not downgrade to any rom without fastboot. Now, I know you've looked in to this and tried it with many errors. But an .SBF with fastboot should do the same job shouldn't it? So why is it that this rom is full of errors when you flash it? I'm confused slightly. There doesn't seem to be a good explanation for it
[Defy General] scholbert:
FYI

Hi,

i found some more information about the 3 different bytes in the raw dumps.

See my post a few days ago:

http://xdaforums.com/showpost.php?p=21915801&postcount=779

Epsylon3 started some disassembly of mbmloader and i stumbled over his post.

Read my post and see his disassembly here:

https://gist.github.com/1624247#L3645

locked device:

signer_info DCB 0x7C,0xCA,0x8B,0x4C, 0, 0, 0, 0
DCB 0xD2,0x21, 0, 0, 0, 0, 0, 0
DCD 0

unlocked device:

signer_info DCB 0xC5,0xAC,0x8B,0x4C, 0, 0, 0, 0
DCB 0xCC,0x21, 0, 0, 0, 0, 0, 0
DCD 0

Obviously the "mystery bytes" are part of the last key signature just before mbmloader ARM code starts.

In fact i don't know what the effect of this different signer_info is or what it does when it is verified inside mbmloader/mbm code.

Maybe some of you might draw the right conclusions.

Perhaps it marks this key as signed for engineering :confused:

EDIT:Just an addon to make your mind blowing...

http://droid-developers.org/wiki/Cryptography

Whatever i guess you'll have to digg in the code yourself or hijack some Motorola employees to find out :D

...or you find some Evel Knievel who might try to flash the mbmloader section from the dump to his device :p

Good luck!

scholbert
[Defy General] bone101:
please delete
[Defy General] glycolysis:
All of the SBFs have fastboot, however all SBFs verify that the Defy is in engineering or unsecured mode before allowing fastboot. There are no known signed SBFs with fastboot enabled for secured devices.
[Defy General] linbi4706:
maybe you can see the mbm hex I compared the MD5 the unlock defy mbm is Different form my lock one.

and in

http://and-developers.com/boot:boot_chain

i find the OMAP3630 BootROM bin

I think the 16m bin is flash in OMAP boot ROM and yaffs backup isn't incloud it

:(

maybe we need Contact and-developers to help us how can dump it in the unlock defy.

This webpage contains a lot of MBM mbmloader information, you can have a look

and the smgver.exe is Personal development ？ this tools can see the bl level

How it works?

in unlock defy Extract the cdt to see level is not found!

but it flash the rom is normal bl5 rom
[Defy General] scholbert:
I'm a bit tired to repeat myself all the time.

I got some raw dumps from some nice guys here at this thread.

I got three dumps from locked and three dumps from unlocked phones.

I concentrated on the first blocks and had to trust the sources.

I did not compare the whole image inside the defy, bacause this made no sense to me.

I compared raw dumps from the block device, not the partitions.

Concerning boot code i realized that:

1. mbmloader (1st stage loader on eMMC) differs in three bytes

2. mbm (2nd stage loader on eMMC) is the same

Basically the ARM executables are the same for locked and unlocked.

Of course there will be different MD5 checksums for mbmloader because of the three different bytes.

The MD5 of mbm should be the same though.

I made a binary comparison and basically there's no difference apart from the signer_info in mbmloader section. I already mentioned that.

That's it!

I know all these pages... more updated one here:

http://www.droid-developers.org/wiki/Booting_chain

This file (OMAP3630 BootROM bin) is OTP ROM content inside OMAP3630 and usualy is the same in quite a row of devices (at least OMAP36xx).

These very first booloader is factory programmed by Texas Instruments during manufacturing and can not be re-programmed or deleted.

I advice you to read the OMAP3630 hardware reference manual.

The OTP boot ROM has a fixed offset in the OMAP3630 memory map.

You may dump it with direct memory dump at this address.

You need to be root and you'll have to write a little C program working as a memory dumper.

This is all basic stuff and you might find a lot in the www.

Search for memory mapped I/O or memory dumper for ARM.

So you flashed the unlocked dump files to your phone, or what :confused:

Sorry, but I guess i don't understand what you are trying to say.

Obviously i know there's a lot information about mbmloader.

There're even some nice guys who made a disassembly :D

I never used the smgver.exe, but i guess someone has written it to look for some version strings or key signatures in the firmware files.

Whatever, i guess i am not able to help you out in digging out the secrets of the Motorola security mechanism or how this tool works.

Try to find the author and contact him ;)

Cheers,

scholbert
[Defy General] Kaffeekranz:
Let's say I'd be willing to do so:

Would you mind providing me with a ready-to-flash zip file?

I'm thinking about flashing back to an officially supported rom (warranty, probably gone anyways afterwards, barghs) and just trying my luck with the 3 modified bytes as there seems to be no progress here besides your (!) initiative, Scholbert.

No guarantees, I'm just thinking about it and having the means to help would certainly encourage us non-developers. ;)
[Defy General] royale1223:
That was the id-vcc mod. This seems to be new.
[Defy General] Kaffeekranz:
Actually he's right. Just google for "motorola factory cable" and you will find results from last summer documenting exactly this pinout.

Just have a look at this: http://www.droidforums.net/forum/droid-labs/146492-how-why-make-your-own-motorola-factory-cable.html

Here's an excerpt from what this cable can do:
[Defy General] Eramix3:
Work? http://shop.teamblackhat.info/Factory-style-programming-cable-for-Motorola-FactCable.htm
[Defy General] Kaffeekranz:
It probably would, but paying 40$ for something you could solder yourself.. meh.
[Defy General] Cypok:
Ofcourse it works. But this cable is useless for our problem, it only helps to flash the phone without battery.

IMHO, now we have

only two real working ways to unlock defy's BL:

1. Break Defy, send to service center and receive it back with an SE status :confused:

2. Write the full dump of an unlocked Defy to own device by JTAG.

I hope our developers (Epsylone, Quarx, etc.) can solve this problem in the future and create third easy way.

P.s.: Sorry my poor english.
[Defy General] mearoth:
JTAG is disabled by the CPU in HS mode. But i also believe that we do not need it.

I only think we are missing a small but essential part for putting the puzzle together.

EDIT:

I'm currently working through the OMAP reference, to get a full view of the picture. The thing is that, all I can find is the public version of the hardware reference which discribes only all about GP devices. Scholbert mentioned something like he had a link to the OEM variant:

@Scholbert:So if you could give us the OEM variant, it would be great. I really would like to investigate deeper into the matter.

cheers

Mearoth
[Defy General] pss214:
hi, i have a BRICKED defy with CG 6... the phone has a black screen when a try to turn it on..

help please :(