yashsingh1/xdaforums huggingface dataset:
[Defy General] qsmyle:
Joke of the day! :D LOL
[Defy General] sonyc2011:
I am sorry guys for the big, let say mistake, I wrote above.

I did some extra research and I found that is near to imposible.

There was a similar project for SE Xperia x10 that was abandoned before start.

Even cloud computing is out of reach...

Maybe if ET will help us...

But my hope is still in our devs.
[Defy General] protozeloz:
ET tried... we must prepare a group and abduct the nearest motorola engenier and make him give us the codes jk still wish moto unlocks our bootloader

But if we have devs and hints we might get something so let's not loose our hopes in them
[Defy General] royale1223:
Its becoming real now. Two guys from michigan cracked it in 3 days with 30 pc or so.
[Defy General] joydeep1985:
the Best way is to hack their server ;) mght b possible that they have hidden the key somewhre as download link only. or else how the moto servic personnels get the key and 16 mb bin file ?

or else option is hire a hacker ;) and bring their server down ;) and claim the key :D :D
[Defy General] royale1223:
We can't even hack a phone that we have physical access to. So c an't you imagine to security of their servers?
[Defy General] Otto.BR:
I don't know if this is still relevant, but i think i also have a unlocked defy... mine went for service a few months back, and now i found in this thread that if SE is shown in RSD lite, it's unlocked - and that's the case, so i attached the OMAPINFO and RSDLite screens.

Hope this helps.

Also, I'm getting the hang of modding/hacking, but I'm still far away from understanding development, but I'm sure whilling to help and test!
[Defy General] heartreaper:
could you try flashing to full sbf gb if you haven't and then flash the full froyo sbf? and check what happens?
[Defy General] ABBolle:
I advise to flash an Eclair sbf... so he still is on a froyo biuld if it don't work.
[Defy General] joydeep1985:
You have mentioned you have motorola defy (older one) . if your manufacturing date is May or before June surely it would have come with Eclair Build . Now the question is if u already have upgraded ur mob to froyo then Flashing Eclair SBF wont work . so in case ur mobile is showing SE mode . just try to check out if you mobile was accidentally unlocked by Motorola Personnel . in case of unlocked defy you would surely can flash an Eclair SBF without any problem :)
[Defy General] Sgt-Hartley:
There is a unsigned sbf lying around somewhere if you can flash that you do indeed have an unlocked defy :)
[Defy General] psicodelico:
That is the better approach.

Where is the unsigned sbf? Anyone knows?
[Defy General] walter79:
search for 4.5.3-109 DPP 66 chinese rom
[Defy General] scholbert:
Hi!

Yeah i agree... this might proove it.

There's one dangerous part, i'm not totally sure of:

From what i know Motorola splitted firmware updates and bootloader updates.

But it might be useful to check if this particular SBF contains a bootloader update file.

There's also an SBF floating around to check for engineering bootloader on Motorola devices.

I remember that Skrilax_CZ mentioned this in the Milestone-modding IRC-channels.

I once grabbed this SBF file, but i don't know anything specific about it.

You might contact Skrilax_CZ to be sure.

EDIT: It was used for Milestone to check for engineering loader or similar. Don't know if it would even be accepted by RSDlite and work for the Defy.

So please make sure first and don't blame me that i said you should brick your phone :D

Please do a google search search for: dev-phone-check.sbf

This is one of the coments he gave at the IRC:

So i think it will be useless for the Defy...

It would be really bad if the SBF you are talking of, reflashes bootcode again :rolleyes:

In fact you'll need some harmless unsigned SBF file suitable for the Defy to check if it works.

Good luck!!!!

scholbert
[Defy General] psicodelico:
I don't have the SE one :), Otto.BR has the SE Defy. We need to think in a test that can't brick (in any possible) his phone. He is not a developer and we can't ask to much for him.
[Defy General] scholbert:
Yepp... totally agree!

EDIT: This might be useful to examine the SBF:

http://and-developers.com/sbf

Should work for the Defy as well...

Uuuuh this is a satanic post (look at the number) ;)

Regards,

scholbert
[Defy General] leodfs:
Posts 8 and 9 from this thread, i think they could be helpful .

@Otto.Br What was your defy problem, where did you take and do you know if it went to anywhere else during repair?:cool:
[Defy General] popcorn1122:
I wish that defy unlock bootloader could be so simple as in this video :

http://www.youtube.com/watch?v=H02N4p9vEg0
[Defy General] Otto.BR:
I was changing the bootlogo again with this instructions.

then i issued a REBOOT comand on terminal emulator and the phone just showed a black screen, then i pulled the battery, and realized the phone was still connected thru USB, after that the phone wouldn't power up anymore. so i took it to the Moto service center in downtown São Paulo (Av. São Luis 153, Galeria Metrópole). they said their lab was unavailable, so they shipped my phone (wich, by the way, is made in Brasil) back to the factory.

I haven't reallized it was unlocked (SE) until i read this thread, I'll try to flash a Ecláir SBF to se what's what.

BTW my last SBF flash was JRDNEM_U3_3.4.2_179-002_CEE_DEBLUR for CM7.

- - - - - - - - - - - - - - - - - - - - - - - - - -

EDIT: Successfully flashed this 2.1 Ecláir ROM

JORDN_U3_6.36.0_SIGNED_USAJRDNTMOB1B4B5DE1028.0R_JORDANTMO_P022_HWp3_Service1FF

EDIT 2: Also successfully flashed the 2.3 Gingerbread Chinese ROM

p3a_jordan_umts_jordan_china-user-2.3.4-4.5.3-66-62-test-keys-ChinaRetail-CN

YEAH!! I really have a unlocked DEFY!!!:D

if you guys need anything from me just ask!

Now, back to froyo CEE => CM7 :D thanks Quarx, Epsylon 3 and Maniac 103 for this awesome ROM! and everyone else here for the support! my thanks meter went CRAZY! :D
[Defy General] Sgt-Hartley:
Atleast we don't have the language barrier to overcome now. :)

No more mfunz translation's
[Defy General] kevin_diu:
Here :D

If you need translator :D PM me and post the link on this thread. :D
[Defy General] Sgt-Hartley:
You misunderstood what i meant. What i was trying to say is that Otto.BR an xda member appears to also have an unlocked defy, so its no longer required to translate to and from mfunz to communicate with some one with an unlocked defy. :D
[Defy General] sixSforever:
Otto.BR you gave evidence that, in fact, not only is unlocked bootloader, SE is more ... probably fasboot + bootloader ... we see how the developers will help ..

PS: Did you know that green lens is capable of 1080p? :o
[Defy General] free2live:
Would it be possible to use something like this on our Defy ???????????
[Defy General] Eramix3:
Just curious, have tried this method? The same as the Atrix?

Sorry my english, google translator.

---------- Post added at 11:48 PM ---------- Previous post was at 11:22 PM ----------

Sorry for duble post, but my defy is unlocked?
[Defy General] mr.han:
Someone got microscope to examine this picture ? :P
[Defy General] Eramix3:
Sorry, image fixed
[Defy General] pulser_g2:
Locked bootloader.

S Flash OMAP3630

You want SE for secure, engineering mode, which is what people call unlocked...
[Defy General] vanyas:
No. It isn't unlocked.
[Defy General] AgentSmith:
Is the fact that some people have unlocked bootloaders going to help the community? If it's impossible to transfer their bootloaders to locked phones how would it aid development of custom roms for the Defy?
[Defy General] royale1223:
Well, since every attempt at unlocking the bootloader have failed so far, we might as well boast of having the most secure board in the Industry. And having a couple of unlocked phones are surely a great asset for the devs because, now we know that it can be done. We were groping in the dark before.
[Defy General] leodfs:
We don't know that yet. But if locked and unlocked phones are the same hardware-wise and we are able to enumerate all the differences between them, we can reach a possible happy ending. I think the key words here are reverse engineering.
[Defy General] free2live:
I'm thinking of flashing a full dump of the unlocked phone via RSD lite. I'll do some more reading of how exactly I can do that. Any idea is welcome...
[Defy General] m11kkaa:
Epsy said that the difference is anywhere between partitions or outside the NAND.
[Defy General] iddqd2:
maybe we must do another donate and buy new defy to owners of unlocked device and he transfer his unlocked phone to epsylon?
[Defy General] Kaffeekranz:
Do we have any idea how RSD Lite recognizes a device as being either a secure, or eng board?
[Defy General] royale1223:
Could we make a list of all possible areas? Have anyone tried that yet?
[Defy General] t0desicy:
you are not contribuiting. SE Flash = Eng, S Flash = locked.

Good idea, but wheres Epsy?

Will not work, cause locked

Y U ASKING IN A DEV THREAD?

---

I am starting to get pissed, please guys, we don't need such comments... make a chat thread in general... "let's talk bout bootloaders" or something like this.
[Defy General] scholbert:
Hi!

Yepp, no bubbles please!!

Agreed... i have not completed reading any single line of this thread... especially about the stuff epsylon3 tried with the sec driver.

I once made some similar attempts on the Milestone.

Have to realize there are many similarities.

So interesting techie stuff :D

No need to flash a full dump i guess...

There's this dump of an unlocked Defy, right?

AFAIK, there are also some stock bootloader update files, right?

Don't know if it's possible for Defy, but there'd been talks about SBF recalculation and stuff.

So if a stock bootloader updater could be extracted, the bootloader raw file might then get replaced by the dumped one.

The SBF will need some recalculation to match the checks of RSDlite.

Then it should be possible to flash it to the phone.

At least the second loader (mbm) might get rewritten this way.

There might one problem left... i wish i could remember correctly right now...

but as far as i got it into my mind, the problem is to replace mbmloader as well.

... but there should be a way... Motorola service is not God... they are technicians (with the keys obviously and this is similar to God) :D.

As far as i can tell from memory, NAND ECC checksums have to be correct in first blocks. I guess i will gather my old informations again :rolleyes:

Edit: I'm a bit clearer now... but must admit time is lacking right now to explain every detail.

You need real raw access to NAND memory to replace the first blocks correctly.

As i said a NAND dump with spare blocks (ECC) would be required as well (dumping mmcblk is not enough).

That's the cruel thing here.

Motorola service seems to have tools and images to tell the OTP ROM on an HS device that anything is fine.

They use something like a raw NAND driver to rewrite first blocks of the phone (replace mbmloader and the mbmloader backup).

On a GP device Ti Flasher could do this, but on HS devices other procedures/tools are needed.

It might be possible to write a tool/driver to access NAND on low level and start this on a rooted device. The mbmloader and stuff must be rewritten with it.

This is a one-shot then... if anything goes wrong the device will be bricked.

We need some more specific information about that... perhaps he refered to the NAND ECC in the first blocks...

Has it been posted already?

Where's Epsy...did he leave this forum?

Have fun!

scholbert
[Defy General] hackergnome:
I think he is busy making cm7 for us...

Oops forgot cm9 too!!!
[Defy General] Kaffeekranz:
That's not what I meant.

How does RSD Lite know whether it's locked, or unlocked? I'm pretty sure the phone doesn't just say "hey, it'sa me, SE FLASHio!" and SE Flash is just the name given after reading out some parameters.
[Defy General] free2live:
You are right. I was looking for this parameters too but I didn't manage to find them .
[Defy General] royale1223:
Many of you probably know this. But still I've gotta post this. There is an alternative for RSDlite. It's called sbf_flash for linux/mac. A very small binary, which would be easier to reverse engineer/decompile.

http://blog.opticaldelusion.org/2011/02/sbfflash-updates.html
[Defy General] thedoginthewok:
I don't think that there is anything we can learn in that sbf_flash program. It was not made by Motorola. Some normal guy did it and I don't think that he knows anything that we don't know, about unlocking the bootloader.
[Defy General] royale1223:
I didn't know that. If so who made it? Is the source available?
[Defy General] ofmb:
imho it's a good idea - to check what sbf_flash can extract out of an unlocked defy.

afaik, it wasn't able to fully extract sbf, but it sure does some sort of lower-than-usual access thru the usb.

Worth Checking!
[Defy General] hackergnome:
Not a NORMAL Guy!!

[mbm] made it!!

Its not that easy!!!!
[Defy General] leodfs:
@ scholbert. From vipers520 post: http://xdaforums.com/showpost.php?p=21394172&postcount=137.

" ... At last, the man told me that DO NOT SIMPLY TRY TO UNLOCK WITH RECOVERY(or similar utils in phone), because the linux can not access to the most important things, because this things are not stored in mtd partitions, the linux won't (can't) mount then. Or you can just hack the bootloader program to bypass the secure check, but it's difficult!

He says except the TI tools, we can research on RSD tool and will find some useful addresses, so that we can write some zero into the address and empty the environment varible. "

Could this be relevant to your idea?:

On a GP device Ti Flasher could do this, but on HS devices other procedures/tools are needed.

It might be possible to write a tool/driver to access NAND on low level and start this on a rooted device. The mbmloader and stuff must be rewritten with it.
[Defy General] royale1223:
Who's got IDA? Maybe we should just decompile the whole RSD lite. That would be huge.
[Defy General] SeiferTV:
While we're at it, we could decompile mac os and windows, right ?

Just kidding, but, I think if we could "just decompile RSD Lite" someone would have done it by this point.

Or am I missing something here?
[Defy General] scholbert:
Yeah, thanks for pointing me at this post...

This all makes sense to me and i guess i know what this "man" was talking about.

Anyway hacking the code of the bootloader (in fact mbmloader) to bypass security checks, doesn't make sense, because this will break the signature of stock loader.

AFAIK the mbmloader part of the engineering bootcode already bypasses this check.

Basically it's partly there...

Unfortunately we got no SBF of this engineering loader with a signed RAMLDR to properly reflash this baby.

It would be helpful to have a raw dump of an engineering/unlocked device.

The real weird part will then still be, that with the dump only we are in trouble to put everything right in place.

It might work though...

Maybe i'll write down some further lines in the evening :rolleyes:

Why would you do that?

Ask mbm for help if you like to know something about the protocol in use.

He reversed it and wrote everthing from scratch (sbf_flash).

So he's the guy :D

Cheers,

scholbert
[Defy General] Otto.BR:
Hey Dudes, about FASTBOOT mode, when entering the bootloader with the button combo, i just get a normal one, but when i issue a REBOOT BOOTLOADER in terminal, i get this baby here!
[Defy General] the|gamer:
So you reboot to Bootloader via ADB/Fastboot?

And get this?
[Defy General] mr.han:
When i type REBOOT BOOTLOADER then phone reboots normally ... It not go to bootloader.
[Defy General] adi4motion:
he already has an unlocked device
[Defy General] the|gamer:
The Defy of Otto.BR has been unlocked...
[Defy General] royale1223:
Its just 4mb right. Guys even crack mac and windows. Its not impossible. Not easy either.
[Defy General] brajesh.sharma87:
I thought epsylon will be more active on this thread after getting the new defy. Sad he's not. Maybe he's working on it underground.
[Defy General] TJKV:
Or he doesn't want to risk his Defy any longer. His is one of the more important phones in this community :D
[Defy General] t0desicy:
DECOM RSD??? THANKS FOR YOUR HALP OMG!!!! Y NOONE THOUGHT ABOUT DECOMPILING RSD TROLOLOLOLOLZ!!!!!!!!!!!11111111111 U R SOFAKING AWESOME!!! BAWKSY SHOULD MAKE A YT VID FOR YOU BRO

have ****ing fun with this bunch of assembly.

http://www.xup.in/dl,60073580/rsdlite_source.zip/
[Defy General] royale1223:
Is decompiling easy? Hell no, it's damn hard. Is decompiling impossible? Every program is decompilable. So the only question is: Is it profitable? Well since we have tried almost all easy methods, lets try difficult ones.
[Defy General] thedoginthewok:
I never said it was easy. Even if that guy is a genius, he would still not be Motorola. That is all I wanted to say by "normal". (I meant, "normal != motorola")
[Defy General] erpato:
flashing the china rom (posted in the page 8 ) i can downgrader to froyo? (I have flashed a 2.3.6 rom of defy+ on my normal defy)

-I want to say this :

Originally Posted by wushantao View Post

http://www.filejungle.com/f/9XVdza/p...naRetail-CN.7z

sbf file CRC32:883DC856

if you can flash this sbf,,,,,

congratulate! you defy is unlock now! hapee ya?

So if we flash this sbf our bootloader will be unlocked???
[Defy General] t0desicy:
. . . . .. . . . . . . . . . . ,.-‘”. . . . . . . . . .``~.,

. . . . . . . .. . . . . .,.-”. . . . . . . . . . . . . . . . . .“-.,

. . . . .. . . . . . ..,/. . . . . . . . . . . . . . . . . . . . . . . ”:,

. . . . . . . .. .,?. . . . . . . . . . . . . . . . . . . . . . . . . . .\,

. . . . . . . . . /. . . . . . . . . . . . . . . . . . . . . . . . . . . . ,}

. . . . . . . . ./. . . . . . . . . . . . . . . . . . . . . . . . . . ,:`^`.}

. . . . . . . ./. . . . . . . . . . . . . . . . . . . . . . . . . ,:”. . . ./

. . . . . . .?. . . __. . . . . . . . . . . . . . . . . . . . :`. . . ./

. . . . . . . /__.(. . .“~-,_. . . . . . . . . . . . . . ,:`. . . .. ./

. . . . . . /(_. . ”~,_. . . ..“~,_. . . . . . . . . .,:`. . . . _/

. . . .. .{.._$;_. . .”=,_. . . .“-,_. . . ,.-~-,}, .~”; /. .. .}

. . .. . .((. . .*~_. . . .”=-._. . .“;,,./`. . /” . . . ./. .. ../

. . . .. . .\`~,. . ..“~.,. . . . . . . . . ..`. . .}. . . . . . ../

. . . . . .(. ..`=-,,. . . .`. . . . . . . . . . . ..(. . . ;_,,-”

. . . . . ../.`~,. . ..`-.. . . . . . . . . . . . . . ..\. . /\

. . . . . . \`~.*-,. . . . . . . . . . . . . . . . . ..|,./.....\,__

,,_. . . . . }.>-._\. . . . . . . . . . . . . . . . . .|. . . . . . ..`=~-,

. .. `=~-,_\_. . . `\,. . . . . . . . . . . . . . . . .\

. . . . . . . . . .`=~-,,.\,. . . . . . . . . . . . . . . .\

. . . . . . . . . . . . . . . . `:,, . . . . . . . . . . . . . `\. . . . . . ..__

. . . . . . . . . . . . . . . . . . .`=-,. . . . . . . . . .,%`>--==``

. . . . . . . . . . . . . . . . . . . . _\. . . . . ._,-%. . . ..`
[Defy General] erpato:
Did you read the post of Otto?
[Defy General] Rhyr:
Only if you have an unlocked bootloader. This .sbf is signed with test keys, so only bootable to an unlocked BL.
[Defy General] ahmedelhoseney:
sorry guides i kept for one month trying to unlock my defy with 2.3.6 build locked boot loader...i wish if i had patience like all of you but deprive of camera and fast phone and other features made me gave up..:(

i went to motorola customer service they tried to unlock it but failed..so they replaced the main board of defy with another unlocked one ..it cost me 500 pounds while i bought for 1900 ponds..:mad: of course the issue is out the warranty because of rooting the device and installing non official build besides it was for defy+ not defy...!!

any way one can`t be taught for free...i spent 500 to learn to read very well before installing any damn locked build..:mad:
[Defy General] Eramix3:
@Otto.BR

Como você desbloqueou cara? tem como ensinar pra gente?

How do you unlock? is to teach us?
[Defy General] mr.han:
He brick his Defy and got board replacement.
[Defy General] Epsylon3:
i confirm, i know him from openwrt stuff and he doesn't want to share sources... i had to rewrite a tool like this to make the tests... but nothing really useful... almost all is locked in the ramloader...

yep i wait the return of my defy to play again with fuses , p ... at least i ve a working one to make roms

for the info my room mate has bought an atrix and ... not unlocked is detected as SE Flash in RSDlite... (before any flash ops)

It could be a difference between Oem (sim free) and operator's versions
[Defy General] Kaffeekranz:
Mine's sim free and it still shows up as S Flash, so.. just saying.
[Defy General] airwolf1544:
I can confirm that..
[Defy General] t0desicy:
Sorry for being kinda pissed, your found seems to be useful, my friend IDA and I will take a look at it the next days...
[Defy General] thedoginthewok:
You da man! :D

I wish I could help you guys! But all I can do is butcher some PHP Code together :D
[Defy General] royale1223:
:D I can't even do that. I'm just a doc. LOL

---------- Post added at 02:12 PM ---------- Previous post was at 02:01 PM ----------

Don't worry about it..
[Defy General] marhensa:
like this

i like how it sounds..

eFuse BLOW!

that damn thing should be destroyed!

hope that information helps the devs :)
[Defy General] vanyas:
From RSD Lite help
[Defy General] ofmb:
if we could reboot to fastboot that would be a very good start and a good indication...

then maybe could simulating the same commands via, lets say, 2nd init, be the next step..?
[Defy General] t0desicy:
To any unlocked defy owner.

I am going to see what I can do, but I need something. I know they are in thread already but I am too lazy to read all the **** comments given on 70+ pages.

only for unlocked defys!!! do not need files from locked ones, cause mine is locked, too!!

1. go to ADB and:

# cat /dev/mtd/mtd1 > /sdcard/mtd1.img
# cat /dev/mtd/mtd2 > /sdcard/mtd2.img

2. Give me these files

3. See happy t0desicy :)

If you have a custom boot.img on your defy, I don't need this, I hope you didn't change. (mdt2.img = boot.img)

Steps I will try this weekend:

99,999% I will fail, cause I have about 1% asm experience in my life, but who knows, in germany we say "selbst ein blindes huhn findet mal nen Korn!", so let's try.
[Defy General] nepotu:
I'm skeptic you'll achieve anything with the boot.img file. BTW it doesn't matter if the bootloader was replaced with another boot.img, while the user may flash any BL code (= can write any boot.img and the Defy will boot). This means the KEY for unlocking won't be found in the boot.img. We should look for it in other place.

Of course you can try and prove us wrong. ;)
[Defy General] t0desicy:
Yeah, you're right, but maybe the SE boot.img from motorola is also signed, so I could be able to flash it onto my locked defy. :)
[Defy General] free2live:
+1 . The upgrade is somewhere in the ramdlr . At least this I understood from taking a look at the sbf used to unlock Photon and Atrix.
[Defy General] Otto.BR:
I don't think this will help, right now i have CEE froyo as base for CM7, so anything that i extrat from my system will be from that SBF, i think the key to enable Engeneering mode is something more low level... i believe it can be done thru RSD, i just don't think that it will be in any SBF we have now.

have you guys considered looking at the moto drivers? maybe there's a clue there... since you already looked at RSD...

And here is a post from Racca in the Project Cheesecake Thread about his eng defy:

http://xdaforums.com/showpost.php?p=15933173&postcount=76

And if you guys need anything, just ask here or send me a PM!