yashsingh1/xdaforums huggingface dataset:
[Defy General] ofmb:
Probably I wasn't clear:

Unlocked reference device helps a lot in developing kexec.

Debugging, kernel parameters and so

So I guess that until kholk manages to run a custom kernel on a locked bl device,

It'll be too hard to dev on regular defy.
[Defy General] devilthehellraiser:
Project officially dead.............
[Defy General] Kaffeekranz:
; TI OMAP 3630 Blank flash ;Shadow

%MotDevF.DeviceDesc% = MotDev.NoCfg.INSTALL, USB\VID_0451&PID_D00E

; TI OMAP 3630 Flash

%MotDevF.DeviceDesc% = MotDev.INSTALL, USB\VID_22B8&PID_4280

Nothing of importance, but TI OMAP 3630 Blank flash seems to be the name Moto has given the device in this state.

Thats just an excerpt from motodrv.inf.

/e

Inserting your module just gives me a black screen for 2 seconds and a normal reboot afterwards (phone still shows up with it's normal drivers).

Seems to be the right behaviour, if I'm lacking the MLO file, right? Gives you nothing to go on, nonetheless.
[Defy General] eiyee:
Hi Kaffeekranz,

Could you share kernel version running on your device? My tests were on 2.6.32.9-gbdd614e #1 PREEMPT Thu Sep 29 09:13:04 CDT 2011 armv7l GNU/Linux running on Defy+. I wonder if this makes a difference.

The code should make it boot from USB first, three times (IIRC), then MMC. What actually happens on my device is that it gets stuck in USB boot mode, starting over each 3 seconds. Guessing into the blue :) Is the phone (mostly) idle when you insmod? Perhaps there is a flush missing or one of the sleeps which made no difference on my device are actually required.
[Defy General] ofmb:
Hey eiyee,

Since it's a new direction I'd suggest you open a new thread for that.

Then you'd be able to ''operate'' and manage efforts more easily.

Cheers
[Defy General] Kaffeekranz:
Mine's 2.6.32.9-gb08c3c8 #1 PREEMPT Fri Jun 3 11:40:33 CST 2011 armv7l GNU/Linux, it's the standard kernel for our "Froyo" CM9 builds around here, IIRC.

I'm using a normal defy, as you can see.

As for your question about idling: I'm running insmod via the terminal emulator, but that hasn't really been a problem until now.

/e

Alright, I've tried it via adb and it "works". I can see it as being recognized as Motorola Flash Interace, but it connects and disconnects every second, just like it did for you.

RSD Lite recognizes the phone in this short period of time as Blank Omap 3630.

As for the TI Flash Tool, I wouldn't know what to do, as there seem to be only options for erasing certain blocks and applying others and both don't sound exactly safe if I don't know what I'd be flashing.

Also there's know way to know whether the phone's being recognized by the tool, other than trying to flash something.

/e2

I've found some reports regarding the pandaboard where the device would constantly try to (r)enumerate and it was due to the usb cable that not supplying enough power.

Are these reconnects supposed to be there, or would it be worth a try to use a Motorola Factory Cable/Y-usb cable while being in USB boot mode? Eppy built one for himself IIRC (moto factorycable that is, and he seems to have thanked you for your post above, so he must to be around).

But I'm just talking out'a my as* here.
[Defy General] unrafa:
insmod: init_module './Pboot-defy-2.6.32.ko' failed (File exists)
[Defy General] GodSlayer:
I managed somehow to f*ck up my phone so badly it was recognized in RSD Lite as "TI OMAP 3630 Flash Interface".

Or that's not what we're looking for?
[Defy General] Epsylon3:
if you need a signed partition, try one of the kernel present in the SBF... well no log seems really possible except if there is a way to change the kernel cmdline... but there is the kpanic report on segfault... which should work if the kernel is loaded

EDIT: do you have the module sources ?? i think its some register write to cpcap or to the SOC

Bus 001 Device 023: ID 0451:d00e Texas Instruments, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.10
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 255 Vendor Specific Subclass
bDeviceProtocol 255 Vendor Specific Protocol
bMaxPacketSize0 64
idVendor 0x0451 Texas Instruments, Inc.
idProduct 0xd00e
bcdDevice 0.00
iManufacturer 33 Texas Instruments
iProduct 37 OMAP3630
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 pbc
bmAttributes 0xc0
Self Powered
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 2 pbi
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Status: 0x0001
Self Powered

http://dl.dropbox.com/u/31689596/USB/motoflash.html

http://dl.dropbox.com/u/31689596/USB/motdev.html

When RSDLite is set in mode TI Blank Flash, the USB device stop to be reset... and stay in this mode
[Defy General] eiyee:
Hi all,

Thanks for confirmation! Yes, it is supposed to reconnect like this. The ROM has a 3 second timeout and if it doesn't receive an USB command in time will just start again (described on droid developers wiki or in TRM, I can't remember right now).

Sure, please look here http://pastebin.com/ciarnDda. I just monkey patched this chunk into module init of the sec driver.

I think you are right, the GLOBAL_REG_PRM should belong to cpcap.

Perhaps try rmmod sec before? The module is based on sec driver (just because it was convenient and inspired by Epsylon3) so the module will refuse to load if the sec driver is already loaded.

I think this is mostly expanding on the previous findings, so it could make sense to stay in this thread (even though it is really enormous already!!)
[Defy General] unrafa:
that was right thanks,

I found something interesting , a chinese user with a bricked phone and all he can get with rsdlite is "blank omap3630" withouy any insmod module

http://bbs.dospy.com/thread-13738650-1-404-9.html

transtation is this:

<<<now with 60% the battery, first plug the USB cable, and then press and hold the volume up key, then press and hold the power button, and then put the battery, hear the <<<computer buzz ring tone usb devices inserted, wait a minute, and RSD there is reaction of the At this point, and RSD Display: Type: Blank, OMAP3630, open brush, Failed <<<flashing process.Failed flashing process. Phone [0000]: the Error sending TI ROM, the data packet request. the Device API Error: 0xE0030097 (0xE0031097): phone <<<disconnected.

The post finish with this:

<<<"The last one, I found that I defy the BL may be unlocked. Because I see with RSD SE FLASH the OMAP 3630"

The "SE" in "SE Flash" means secure engineering. In the past, this type of hardware would allow non-signed builds be flashed. However, I'm not sure this is the case with Android devices.

But the guy still have his phone bricked it seems
[Defy General] YaPeL:
Not that I can help, but, in which wiki? I wanted to take a look at that script but I can't find it anywhere :/
[Defy General] eiyee:
You can find it in the droid-developers.org wiki on page How_to_load_mbmloader_from_SD_card, code is called omapusbboot.

The wiki is highly recommended, btw!! An excellent source of high quality information.

Most information is relevant to our Defy as the mechanism are very similar if not identical across all locked Motorola OMAP3xxx based devices AFAICT. Our root key is identical to that of Milestone2. So we share a common cause with the Milestone/Droid/etc. hackers. :)

I collected some basic Defy info there, too. Nothing new, just putting information in one place. Corrections/additions welcome!
[Defy General] hackergnome:
I once asked about loading bootloader from SD but got an answer that it was disabled on the board by moto(or something similar)
[Defy General] Tim_Pan:
I read it and the fact is the guy bricked his phone then sent it to js but he said he knew little about BL so i think he didnt know the board has been changed...
[Defy General] Kaffeekranz:
Anyone with Flash 1.6 installed tried to use TI's usb drivers instead of Moto's while trying peripheral boot? The inf's got entries for the omap3630, the vendor ids also are correct, but it gives me an error (no x64 drivers, not compatible, blah) when I'm trying to install them on a x64 system.

Could be necessary to use those when using the Flash tool.
[Defy General] free2live:
I'll give it a try on 32 bit system, but what will we do with that without having a bootloader to flash.
[Defy General] Kaffeekranz:
Nothing at all, I guess, just doing some possibly preliminary "work". ;)
[Defy General] Eramix3:
http://www.omappedia.org/wiki/Android_Getting_Started

Help us?
[Defy General] eiyee:
Probably won't help unfortunately - it is about GP mode boot. For HS mode the loader and image formats are different.
[Defy General] Kayant:
http://xdaforums.com/showthread.php?t=1522226

Might this help?
[Defy General] viper.:
Can this help us somehow?

Motorola RAZR -- Bootloader bypassed with KEXEC http://pastebin.com/vuVfaQ7U
[Defy General] djkail:
Impressive!!! :)
[Defy General] Eramix3:
Look at this: http://sourceforge.net/directory/os:windows/freshness:recently-updated/?q=motorola
[Defy General] henno88:
thats old

we dont need the sourecode unless we dont have the key to sing it
[Defy General] GodSlayer:
There is one thing I noticed about Motorola Unlocked phones.

All phones which were unlocked, use fastboot as a flash method, Not only RSD Lite.

Our phone doesn't. Maybe that means something?
[Defy General] free2live:
Yeah. That means the bootloader has to be updated in order to support fastboot....

DEFYing gravity on ICS planet
[Defy General] Kaffeekranz:
As far as I understand the whole thing:

Nope, since they're exploiting a loophole in their uboot, whereas we're blessed with Motorola's mbmloader.

Still, there are some interesting things to be found:

http://www.ti.com/lit/ug/spruhc3/spruhc3.pdf

2.6

All HS devices can be run in NONSECURE mode after initially booting in SECURE

mode using this sequence. (..)

If running in secure mode, with the secure kernel active, you can request a override to

non-secure mode by using the SK_switchNonSec() API call. See the Secure Kernel Users

Guide for more information on the secure kernel APIs

http://omappedia.org/wiki/Bootloader_Project#Building_Xloader_for_EMU

mshield-dk?

But, as I've mentioned a hundred times already, I'm collecting information, but haven't got a clue what it's all about.

And at least the guys on Motorola's bootloader boards seem to be polite:
[Defy General] Tortuga52:
@Kaffeekranz

I'm not a pro, but what you said seems that some kernel hacks/overflows could bring it in unsecure mode?
[Defy General] Kaffeekranz:
Nonono, I'm saying nothing.

I'm just pointing out some promising phrases in TI's docs.

Although these seem just to refer to a DSP.

There's also very interesting information in the TMS320C674x/OMAP-L1x Processor

Security User Guide.

Many of the security parameters seem to be the same like in the aforementioned document, so they might (what do I know) be similar for all the omap devices and products.

The document needs to be requested here: http://www.ti.com/general/docs/lit/getliterature.tsp?literatureNumber=sprabk7&fileType=pdf

But if somehow your request is rejected I could also upload it at xda.

I think a lot of the information in there might be applicable. (or not)
[Defy General] thacmonster:
Got this today on craigslist and wandered across this thread. I was just wondering if this could help the cause. Orange sticker on battery says engineering sample for product development purposes only.

http://img208.imageshack.us/img208/5663/img0037lh.jpg

http://img9.imageshack.us/img9/8199/img0040cw.jpg
[Defy General] sykoism:
EP3, if you need anything, you can tell me.

I know Chinese and I can do the translation and post it to the Chinese Forum Mfunz ;)
[Defy General] royale1223:
Am I getting this right?

1) There are right now two people who managed to unlock the defy bootloader.

2) 1st guy flashed some mysterious sbf and ended up having an engineering defy.

3) 2nd guy bricked his phone, seeked the help of a mysterious man from Shang Hai (a jedi perhaps). This man did his thing with a flasher other than RSD lite and file other than sbf. He too ended up having an engineering defy.

3. This there is a real simple method to make a normal defy engineering defy.

4. Engineering defys can flash any partition without the need of signing. It can flash unsigned sbf too. We don't need fastboot unlock. Or do we?

5. I read some where else that smg files inside sbf are just squshfs. Is that true?

6. Is a there a way we can contack this Shang Hai man? Phone number/ email perhaps?
[Defy General] kevin_diu:
A new guy who owned a unlocked defy

http://bbs.mfunz.com/thread-298435-1-1.html
[Defy General] royale1223:
I'm calling up mobile repair guys out here (unofficial). As you know these guys have contacts inside mobile phone companies who steal repair software and stuff like that for them.
[Defy General] balika01:
translate it please!

http://bbs.mfunz.com/thread-298435-1-1.html

---------- Post added at 09:11 AM ---------- Previous post was at 09:04 AM ----------

password? -- found! bbs.mfunz.com
[Defy General] djkail:
I can't breath right now... Lets keep researching!

Enviado desde mi MB525 usando Tapatalk
[Defy General] eric8810:
That thread mainly talk about another people's defy turns into eng-mode after he send it to who do phone repair unofficially. Seem the repair man has tools to unlock bootloader. I do believe they use it to solve bricked phone that flashed wrong SBF, like directly from 2.3.6 to 2.2.

People on bbs.mfunz.com are now seeking those who may have this tool.
[Defy General] balika01:
im tryed the sbf .... fail :/ image attached
[Defy General] free2live:
So.. You are saying that if someone manages to flash this SBF has an unlocked bootloader? I'll gove it a try in the afternoon.

Sent from another planet
[Defy General] eric8810:
still locked, only unlocked phone can flash that sbf
[Defy General] edition-:
Not really, the SBF doesn't unlock the bootloader it just proves if you already have your defy unlocked...
[Defy General] sykoism:
That guy sent his defy to moto to repair for it, and he discovered that his defy became unlocked, with the ability to flash ANY SBF.

He used this unsigned sbf for testing: http://115.com/file/clsppejf

Here is the info of his phone before testing:

IMEI:

RSDLite:

Phone Info after flashing:
[Defy General] balika01:
what is the RAMDLD.smg????
[Defy General] vanyas:
It is a loader, that loaded to phone RAM by RSD and then this loader flash firmware.
[Defy General] adi4motion:
Man, tell him we will pay to give us that software and tell us what cable we need! we can give donations for this and raise pretty good amount of money!

Edit: you that this means Motorola already have a tool for unlocking bootloader but they choose not to release it!
[Defy General] dalet11:
I have a defy with v4 tell me what to do to test this..
[Defy General] balika01:
they homo!
[Defy General] samsungc6:
Please tell him to post a picture with rsd to see if it says se omap, a picture with full sbf 2.3.6 flashed and a picture with the same phone with full sbf flashed 2.2 or 2.1. :)
[Defy General] VTomi1975:
+1 of course :)
[Defy General] balika01:
tomi te hányas bootloaderen vagy és milyen lecséd van?
[Defy General] hackergnome:
if u have adb working on ur pc then give adb reboot bootloader command and see if u get fastboot...
[Defy General] thacmonster:
just reboots the phone
[Defy General] TorAll:
I've tried, but something wrong:

# insmod /mnt/sdcard/pboot-defy-2.6.32.ko
insmod: init_module '/mnt/sdcard/pboot-defy-2.6.32.ko' failed (File exists)
#
# /system/xbin/busybox insmod /mnt/sdcard/pboot-defy-2.6.32.ko
insmod: can't insert '/mnt/sdcard/pboot-defy-2.6.32.ko': File exists
# lsmod
vpnclient 65648 1 - Live 0xbf02e000
kineto_gan 3338 0 - Live 0xbf028000
sec 3812 0 - Live 0xbf022000
modem_pm_driver 1764 2 - Live 0xbf01c000
netmux_linkdriver 7426 0 [permanent], Live 0xbf015000
netmux 51723 19 netmux_linkdriver, Live 0xbf000000
# cd /system/lib/modules
# ls
act_mirred.ko
sec.ko
modem_pm_driver.ko
sch_ingress.ko
dummy.ko
vpnclient.ko
tiwlan_drv.ko
wl127x_test.ko
pcbc.ko
output.ko
ifb.ko
em_u32.ko
tiap_drv.ko
act_police.ko
cls_u32.ko
sch_htb.ko
act_gact.ko
netmux_linkdriver.ko
kineto_gan.ko
netmux.ko
#

Where is my mistake?
[Defy General] eiyee:
You need to unload the sec module first.
[Defy General] TorAll:
Thanks! It work.

Now I see "Blank OMAP 3630" in RSDLite

And now I ready for ANY crazy and dangerous experiments, so my Defy can't left Groundhog Day
[Defy General] balika01:
for me rsd not see the phone and reconnect to pc in every sec. (not unplug from USB). problem is the driver or MIUI?
[Defy General] Kaffeekranz:
Try to tick the field for "TI Blank Flash" in RSD Lite's settings.
[Defy General] balika01:
thx! this fix the problem!
[Defy General] Otto.BR:
Sorry guys, haven't been around for a while...

and... Yes, that's right... the phone enters Fastboot mode with Power + Vol up + Vol Down.

P.S. you guys can PM me if you need me to test/dump anything, my week days are kind off full, but my weekends are free! :D
[Defy General] dent87:
and ... can i take fastboot mode for my defy + with BL7 ?
[Defy General] pss214:
we need more info pls :(
[Defy General] kadofl:
Oh how I wish I could help and take part ;)
[Defy General] TorAll:
AFAIK, it load Safe mode, not Fastboot
[Defy General] hackergnome:
He has an BL unlocked Defy!(Lucky!!! :P)
[Defy General] tava2003:
I have a Red Lens Defy to test

Hi guys, I have a Defy which I can do all the dangerous tests needed, because if I have a Brick, I'll take it to Technical Service for another problem anyway.

Tell me if I can be of any use to the cause as I like to help so we can have a custom kernel.

I await instructions

Motorola Defy MB525

Bayer Module
[Defy General] adi4motion:
sorry mates...posted in wrong thread (so many tabs opened):(
[Defy General] mihovil13:
I see that there are some unlocked BL's ... any progress for porting it to rest ?

BTW how did you managed to do that? Did tech support unlocked your phone or?
[Defy General] marhensa:
new defy variant.

any news of its bootloader?

http://m.gsmarena.com/motorola_defy_xt535-4622.php

Sent from XDA-Developers Android Application​
[Defy General] mihovil13:
It's a Defy+ with front camera...nothing new i guess...but, XT series are common to be unlocked...let's wait..
[Defy General] joydeep1985:
Its just released in China . We have to wait till Mfunz guys or someone else from china gets their hands on it :(
[Defy General] walter79:
it is a new defy. http://m.gsmarena.com/motorola_introduces_new_defy_in_china-news-3950.php

It has 2 camera.
[Defy General] marhensa:
hope that true mihovil13,

XT series are commonly unlocked.

Sent from XDA-Developers Android Application​
[Defy General] walter79:
qualcom cpu MSM7227A 1000 mhz
[Defy General] marhensa:
different hardware.. :'(

Sent from XDA-Developers Android Application​
[Defy General] jayeshrc:
a friend of mine got a backflip engineering device, a company exec gave it to him (it says its not for sale and is an engineering version on the side of the phone) and he's willing to help.. can his phone help us in any way?
[Defy General] eiyee:
The backflip is based on Qualcomm MSM 7200A (or so says google), so different hardware platform as well, unfortunately.
[Defy General] Eramix3:
@Otto.BR

Cara meu Defy é TIM também, tem como você me add no msn e me explicar como você desbloqueou? Grato!
[Defy General] CallMeVentus:
MSM7227A = ARMv6

Herpderp Defy.
[Defy General] Otto.BR:
I missed Epsylon3 post about the sec.ko module, but Eiyee PMed with a link:

My last SBF was 3.4.2 179-002 DEBLUR CEE (Froyo CEE for CM7).

[34250.065948] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00

[34250.068542] SecGetModelId = 00 00 00 00

[34250.069427] SecGetProcID = 19 70 00 13 8c 40 6b 01 00 00 dc ff 02 00 0a 09

[34250.073425] SecProcessorType = 44

[34250.073577] Inserting sec module

P.S. Please people, stop PMing me with "help unlock my phone!" stuff, If I Knew how to do it, it would be posted here already. here is my post explaining what happened with my phone.
[Defy General] Kaffeekranz:
So you've got a blank model Id and your SWRVs differ from ours.

Epsylon tried to change the fuse data, but he changed his values to something different than yours before he bricked his device.

It might be time for him to chime in as he fumbled around with those before.

Simply changing them to your values might be too easy, right?

Though it's nice to see you've got a "normal" HS device after all.

/e

Forget that, I haven't even noticed someone with an unlocked phone has already run the module.

But knowing that this seems to be common behaviour from Asia to South America is still nice to know, as there really seems to be a common unlock option at Motorola.

Whatever.. Eiyee, get on it!
[Defy General] skeevydude:
Bravo has 9.10 Bootloader

I've seen that the Defy uses the same bootloader as the Bravo (9.10), so could anything from the Bravo be of any help? And hexdumps of smaller partitions are from our 2.2.1 (only) sbf are identical to the Defy JRDNEM_U3_3.4.3-36-1.7.sbf.

I only noticed cause a google search on hexdumping led me to a post by Epsylon3 about cg31.smg being hexdumped for the partition table, so I hexdumped ours and it was the same, so I did a few others and so were they (a month ago so I don't remember exactly which ones).

Also if anyone knows how to find cg levels, I'd be thankful. Tried the Defy tool posted around here, but no luck except 45. Have a thread here if someone who knows cares to chime in.
[Defy General] eiyee:
Thanks Otto! As Kaffekranz noted this matches the value observed on the Chinese eng phones.

Happily! Send me a PM to learn my typical hourly rate :p .. just joking of course.

Actually I don't see where to go with regard to eFuses. There is still no evidence that a normal locked Defy can be turned into a engineering phone only by some software mechanism - for all we know, the Chinese phones and Otto's phone could just have been produced with different initial eFuse values.

Until we can get evidence that it can been done, personally I remain sceptical about the possibility of resetting eFuse values. TI's OMAP security mechanism relies on them being irreversible and it would be a major fail with, I presume, some very big and unhappy TI customers if it turned out the eFuses could not be relied on.

You could try this quick python hack. Not tested much, perhaps it even works. :)

#!/usr/bin/python

import sys
import struct

for path in sys.argv[1:]:
img = open(path).read()

off = 0
while True:
i = img[off:].find("\xb4\x01\x00\xca\x02\x14\xda\x95\x1b\x6d\xdc\x97\x07\xce\x40\xea")
if i < 0:
break
off = off + i
print "%s version %d (@%#x)" % (path, struct.unpack("<I", img[off-4:off])[0], off-4)
off = off + 16

if off == 0:
print "%s sig not found" % path
[Defy General] nameite:
No read here

I brought my gf the XT615, it has the same cpu (MSM7227A) has the new Defy XT535 and Defy mini.

Short bench on Setcpu is around 400ms and long bench is around 450ms

Compared to my Defy@1200ghz, my short bench was 180ms and long bench was 450ms

Anyways I dont think the new Defy will be helpful to us...
[Defy General] skeevydude:
Thanks, but it gave same results as the other tool. I've been hoping since both our phones have same bootloader, and are real, real similar in other aspects, maybe the sbf's were the signed the same in regards to CG level.

I really do hope you guys succeed with unlocking the bootloader. With all the knowledgeable and determined devs here, you'll turn that 1 to a 0 eventually.