yashsingh1/xdaforums huggingface dataset:
[Defy General] free2live:
There's is hope

Have you all seen this?

If it will get thru then big G should unlock all M's boot loaders as part AOSP(Android OPEN Source Project) policy
[Defy General] kevin_diu:
yeah it is a great news! :) thx for information.
[Defy General] adi4motion:
not really...they said they wouldn't interfere with motorola mobolity products... they only want the patents
[Defy General] free2live:
you are right but they will own moto and it's against their policy to keep the boot loader locked...:) if the boot loader unlock campaign will aim Google their stock shares might lose some good points and i don't think they really want to lose anything right now
[Defy General] arpith.fbi:
well this might only be applicable to next coming model during the time of decision..or update supported device..but certainly not our defy...
[Defy General] pulser_g2:
I've edited out any posts with the quote. Sorry to anyone whose post was edited, but I think it's clear the reason for this.

Feel free to PM me if you need to discuss anything that was originally in your post.
[Defy General] sam_24:
some more info about the hardware, dont know if this is published already

kxtf9 - Accelerometers and Inclinometers

lis331dlh - MEMS motion sensor

akm8973 - Digital Compass Module

MT9P012 - 5Mp, 1/3.2-inch Micron CMOS Image Sensor

USB-Part and index of OMAP36xx ref manual: http://goo.gl/6WufW

tps65950 datasheet :http://goo.gl/xTXHN

i think the part "7.2.5.2 OTG ID"is realtet it shows the resistors needet for the 5 otg modes

if cant upload the full omap datasheet, its freakin big, and my internet conection sucks, if you need a part let me know it i will upload it or mail it.

Samuel
[Defy General] sonyc2011:
Any news about our bootloader?
[Defy General] free2live:
More promises from Motorola on Google+

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] adi4motion:
link please?:D
[Defy General] Sgt-Hartley:
Wheres the link to google +

What have moto said?

:P
[Defy General] free2live:
Here you go: https://plus.google.com/u/0/113884566566424587799/posts/ZRBuPr4CZv3 .. The post at 23.03 thanks to ABBole for posting the link...

If you have any idea what we should do pm me in Romanian :))

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] Epsylon3:
yea im locked on this damn german sbf
[Defy General] balika01:
i'm too :(

---------- Post added at 08:00 PM ---------- Previous post was at 08:00 PM ----------

we able to patch the mbmloader???
[Defy General] mpiekp:
So you need a v5 volunteer?
[Defy General] Epsylon3:
no... a v6 to be able to "downgrade" to this newer sbf 4.5.3-109
[Defy General] balika01:
HOW??????.
[Defy General] Epsylon3:
well, i "flashed" the chinese mbmloader... that boot, but does that change something i dunno
[Defy General] balika01:
unlocked?? [off]your lens is green?working on gb kernel?[/off]
[Defy General] nepotu:
Can you try to flash a different SBF (something with GC ver <6)? We are all waiting to see if this is a hoax or not. Judging from the past experiences you are the most courageous when it comes to testing stuff. Not to mention that you've managed to revive your Defy when no one thought it is possible without a motherboard replacement.
[Defy General] Epsylon3:
i will try to flash the 4.5.3 sbf (v5) over the 4.5.1-134-132 (v6)...

i flashed the mbmloader (no problems), and the pds (no more phone/IMEI at 00000)

ps: i made that after a backup of pds ;) but mbmloader, was fearing me until ive seen its not really signed (or not checked)

the pds.img made by our CM7 ROM work well, i just had to put my pds.img on data and phone was back.
[Defy General] balika01:
please upload the files and the name in the /dev/block/ THX!
[Defy General] Epsylon3:
its in the url https://docs.google.com/spreadsheet...ZEtleGNZQ1llclE&single=true&gid=0&output=html

you are not really helping me ;p
[Defy General] balika01:
i want make a custom kernel if it works :D

and the download?

i downloading the sbf whit 2-3kb/s :/ F*CK!
[Defy General] Epsylon3:
no mbmloader and pds are not enough... black screen, only the usb boot loader, no led or lcd at all

i tried to flash the 4.5.3-109 DPP 6-7 moto SBF (not the chinese zip)
[Defy General] djkail:
Oh... any more ideas?
[Defy General] adi4motion:
can't that guy make a "full" files dump (like everything that's on his phone) and see what it's needed for unlocking bootloader?! and also provide a SBF that he's using...
[Defy General] balika01:
pkbackup? lbl_backup? devtree_backup?

greenbeardmod work? if it work kernel is unlocked :)

u flashed CG31?
[Defy General] Epsylon3:
no... i already tried a full restore of my backed up nand (made just before the 2.3.6 upgrade)... The only hope was on the modified partition not present in a SBF (mbmloader)

there is still this "sp" partition, i dont know exactly what it is...
[Defy General] balika01:
i you flash whitout CG31?
[Defy General] free2live:
Secret part :p
[Defy General] balika01:
upload mbmloader and pds. i want make same test
[Defy General] free2live:
They said:

Motorola Mobility - Hello everyone. We do INDEED read every post and comment and go back to our teams with this data/feedback. Please stand by for updates in the next few weeks.

Motoblur should be called Motobluff

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] Sgt-Hartley:
Hi i dont mean to be funny but the post at 22.03 means absolutely nothing.
[Defy General] free2live:
As I said just more promises and lies

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] sixSforever:
Moto and G are crowded?
[Defy General] sonyc2011:
Google bought a few months ago Motorola, just the phone division I think.
[Defy General] jufa2401:
is eppy still waiting for his new Defy ???:confused:
[Defy General] hackergnome:
He got it...
[Defy General] sixSforever:
I know this ..

you did not understand the allusion ;))
[Defy General] t0desicy:
So Google will force Motorola to unlock bootloaders? :D
[Defy General] slipknotfn:
Has anyone seen this?http://processors.wiki.ti.com/index.php/Flash_v1.6_User_Guide

I am not sure if it is relevant or not. Was looking around the TI website and saw what looks to be a flashing tool. Not sure if it applies here. Been reading and keeping up with all your work for a few weeks, with ICS and stuff. Maybe the TI Config tool is Moto's name for it. Perhaps it is called something else by TI. Just an idea. Maybe someone with a bigger brain than I can look at it. Past my bed time anyway. Good luck all.

Edit:

Saw this too.http://processors.wiki.ti.com/index.php/WinCE-BSP_ARM-A8_Quick_Start_Guide

Does not appear to be for our 3610 (3630) ARMv7 processors but might get the ball rolling. Lots of info on this page. How to eboot and stuff. But moto still holds all the cards I am sure. The 16mb.bin is the mystery. Is it a proprietary file or a TI file? Be so much easier if they'd just cooperate.
[Defy General] suttaroom:
i have a friend working for TI .. wat exactly is required? do we know that.. or actually what tool do i ask him for?
[Defy General] free2live:
Yes. We need TI Board Configure flash tool and a mysterious 16mb bin file

Which should contain the bootloader

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] slipknotfn:
Only thing mentioned in the first few pages was a TI Board Configuration Tool and a 16mb.bin file of some kind. I was cruising their wiki pages and found a few things that may be of use. Moto might be using a different name in house for the programs from TI. That's all that is known that I've seen.
[Defy General] suttaroom:
seems he isnt involved with the OMAP.. but another of my college buddies is.. pinged him with the specifics given by "free2live" and "slipknotfn"

however these guys are working in India. so no guarantees with whether or not he might get his hands on it.. I love my defy and want to add onto this community in watever way i possibly can..
[Defy General] free2live:
Any help is welcome. Even some more info about how to unlock the bootloader. If he is inside TI for sure it will be easier to get this kind of info..
[Defy General] leodfs:
TI already answered that:

http://e2e.ti.com/support/omap/f/849/t/159265.aspx#578284

"

Hello,

Phones such as these have secure OMAP devices that can only be unlocked by Motorola. None of the tools that TI has can unlock these phones and that is the intention. Motorola would not want this.

If you are interested in developing code for an OMAP3630 based device I would recommend looking at something like the beagle-XM board. See:

http://beagleboard.org/hardware-xM

Cheers

Jon

"
[Defy General] free2live:
Oh haven't seen that post.... Looks like Motorola is the only one that can unlock the boot loaders...

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] heartreaper:
most probably the bin file has the magic spell in it. along with ti board configure tool.
[Defy General] pulser_g2:
Bear in mind that while they may not possess the tools, they can easily make them.

I know, because I say the same kind of thing to customers.

"no, we don't have any way to unlock this if someone asks us to"

It's true, we don't! But it would take seconds to repurpose something else to do the job :p

Just remember that the person who designs something knows it inside out. Maybe it is true, perhaps this board genuinely is locked and needs that motorola boot file... But I'm fairly certain that they know fine well how to do it, since they know what each efuse is, and can easily pop in UART boot etc...
[Defy General] royale1223:
I agree. And that's just one guy Jon. Also our question was ill framed and it was a public forum. They could definitely unlock the board if they try.
[Defy General] leodfs:
@pulser_g2

True, I do believe that :D, but unfortunately we are not clients of TI, Motorola is. And I don't think they will help us to break something like secure OMAP that probably cost Motorola a little extra. But they are kind of nice folks, didn't believe they would answer that question and they did fast. All we have from M guys are lies and broken promises.

By the way, anyone has any idea on how motorola would unlock defy's BL? What strategy I mean, to unlock all of them, if they finally decide to.
[Defy General] royale1223:
Its highly improbable that M would unlock the defy bl. Well if a miracle happens and they decide to unlock, it would first appear in test servers first in the form of a flashable sbf. Atleast that's what samcripp said.
[Defy General] Sgt-Hartley:
Ok so i pmed scholbert the creator of This Thread as he seems to know a hell of alot about the omap3630 boards, just to see if he could throw any information our way about our locked boot loaders, the text above the quotes are my pm's. Some stuff cut out but nothing major its just to save time editing this post lol, then the quotes are scholberts replys, im posting this here incase any of the info is of any help to anyone working on this project.

My 1st Pm:

I was looking into one of your threads regarding unbricking one of your devices which had omap3630 chipset, well it happens that the motorola defy has the same chip with locked boot loader which we are wanting unlocked, just wondered if you could take a look at this thread and see if you could throw any input our way?

ME:

Just wondered if the flash 1.6 tool from ti which you used would be of any help to us.

2nd PM From Me

From what ive read myslelf there is a dump from a unlocked defy, which shows up in RSD as SE Flash OMAP3630 (Secured Engineering) Its also been said by the people who have these se flash omap3630 defys can indeed flash unsigned sbfs via rsd. Where as the locked defys "S Flash OMAP3630" Cannot flash unsigned sbfs.

As advised by scholbert i ran his omaptool to get the values of my locked defy.. Screenshot attatched, now we could do with this to be run on an unlocked defy to see if there is any diffrence any takers or anyone know a person with an unlocked defy?

One last note if any of this information is of any help to anyone please credit scholbert some how.

Thanks
[Defy General] psicodelico:
Running the tool:

omapinfo v.1.0.0

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 2b89102f

EDIT: Locked bootloader.
[Defy General] Sgt-Hartley:
Locked or unlocked defy?
[Defy General] ofmb:
we need a chinese speaking user to post it in mfunz forum...

AFAIK there are no users with allegedly unlocked BL here in xda
[Defy General] psicodelico:
I have one locked. I posted just to confirm the values for locked bootloaders.
[Defy General] multiplash:
I also run the tool:

# ./omapinfo

omapinfo v.1.0.0

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 1b89102f

the CPU ID is different, maybe it's not important, but I don't know.

My phone is locked, too.
[Defy General] m11kkaa:
Maybe you have a Defy+?
[Defy General] multiplash:
No, it's a normal defy ;) with green lense btw.

Edit: Maybe the other ones are defy+?

Or does the color of the lense has something to do with that?
[Defy General] Sgt-Hartley:
Hmm strange, my defy is normal defy with soc module I'm not sure if this will effect bootloader unlock. I cannot be certain though. What sbf you have on your phone? Not sure if this will make a difference either :s l

Input anyone?

EDIT: Just noticed the only difference in cpu-id is mine is 2b and yours is 1b and that's it. Maybe it could be age or generation of CPU :s my defy is also soc module and original defy
[Defy General] multiplash:
Hm, I don't know exactly which sbf I flashed last, but I think it was the 3.4.2-179-2 CEE. But I don't think the sbf change the CPU-ID, or do they? Or are there different CPUs? Normally it should be the same, or?

At the moment I'm running CM9 on Froyo kernel
[Defy General] Sgt-Hartley:
Was just curious to see ur sbf. I'm on the same sbf. Weird, the other posted values are identical to mine gets me why they would be different. But like I said before cpu-id shouldn't be relevant but then again I'm not an expert not even close.

We need someone with an unlocked defy, if the values still match it could be interesting, as scholbert said if the unlock and the locked defy values match, some how flashing the dump from the so called se flash omap3630 defys COULD work. not guarunteed though, also if the theory is correct its finding a way to flash in the first place without turning defys into paper weights.
[Defy General] multiplash:
I'll look later for the sbf, I think I still have it on my computer.

I will report in a few minutes
[Defy General] Sgt-Hartley:
I have the sbf its flashed to my phone it obviously dosnt make a difference :)
[Defy General] multiplash:
Yes, but I don't know exactly what sbf I flashed last, but I think it was 3.4.2-179-6.1 T-mobile german blur. But I also think that it's not very important, because normally an sbf shouldn't change something like CPU-ID?!

But if someone knows exactly, feel free to correct me :)
[Defy General] Sgt-Hartley:
No it wont cpu-id should be hard coded? I presume?
[Defy General] sixSforever:
hmm..the right one is the bayer or soc it's recognized loader of cee or nordic or else... next step it's identify what it's diference of them... then trying bootloader specific codes and drivers... weird huh?
[Defy General] lefedor:
~ 11.2010 Defy MB525 SOC Green Cam 179-002 CEE --> CM7.1-11-11-11

# /data/local/omapinfo
omapinfo v.1.0.0
STATE : 205
PKEY0 : c57aa19e
PKEY1 : 31fe2d32
PKEY2 : 2e48bc96
PKEY3 : 15fcea7b
PKEY4 : 876578f3
CPU-ID: 2b89102f
[Defy General] tava2003:
Sorry if my question is too basic, but I wish to run this command too, but I don't know how !.

I downloaded the Omapinfo.zip file, copied to my Defy /data/local and extracted the folder that contain the omapinfo and omapinfo.c file, but I'm stuck there.

I don't have too much knowledge about it, then stuck trying to "run" the tool ?, or copying the c code in terminal, but I can't make it happen !

Maybe I can help a little ;-)

Defy MB525 Manufactured (Ensambled) in Argentina

Bayer Device

Red Lens

Cyanogenmod-7.1.0-RC1-jordan

ARMv7 Processor rev 2 (v7I)

Gingerbread GRJ22
[Defy General] Sgt-Hartley:
If the 'omapinfo' file is in /data/local/ open terminal emulator on your phone and type the following.

su (accept super user permissions) then when the # appears type

/data/local/omapinfo

Or on PC type

adb shell

su

/data/local/omapinfo

EDIT: this really needs to be run on a defy which is unlocked I would goto mfunz and ask but I cannot speak chinease and I'm not going to trust Google translate etc.
[Defy General] leodfs:
Same as majority here on blocked defy.

But I would recommend caution on this approach. If the keys do match, it may not be anything. If that is some hardware-wise lock it may not be used to compute that keys and the results would be the same. Simply flash the bootloader would lead to a brick.

Edit the bl to accept unsigned kernels and then try to sign the bl according do hardware makes sense. But it could end in a catch-22's sort of situation.
[Defy General] tava2003:
Really Thank you furrabbit.nh, the result seems the same as yours

omapinfo v.1.0.0

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 2b89102f

Defy MB525 Manufactured (Ensambled) in Argentina

Bayer Device

Red Lens

Cyanogenmod-7.1.0-RC1-jordan

ARMv7 Processor rev 2 (v7I)

Gingerbread GRJ22

Locked Defy
[Defy General] Cypok:
Locked

Defy (MB525)

Bayer Device

Green Lens

CM 7.1

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 1b89102f
[Defy General] thomsch:
Its good to know this. I think that you can help to find out how unlock the bl.

What about eppy?

Enviado desde mi MB525 usando Tapatalk
[Defy General] linbi4706:
at now is chinese new year 23-30 People visit each otherpopel

Your request has been post in mfunz.

I will contact the unlock defyer test it.
[Defy General] danimagrin:
racca has one engeneering Defy and said on last July that:

more info on that thread.
[Defy General] rishi2100:
ti omap 36xx public database says something about resetting efuse in section 3.5.xx

i will provide the link in some time...
[Defy General] pika2chu:
Is this the omap config tool?

https://gforge.ti.com/gf/project/flash/frs/
[Defy General] linbi4706:
http://bbs.mfunz.com/thread-306912-3-1.html

omapinfo v.1.0.0

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 2b89102f

unlock defy

red led

2.3.6 4.5.3-109
[Defy General] cloogshizer:
So if this is true, with the exception of the CPU-ID (which is 1b89102f on my Defy+, while the other key values are the same), there are no differences between locked and unlocked Defys according to omapinfo. Sad Good news!? (Edit: It's good news, see below ;))
[Defy General] viper.:
well lets see ...
[Defy General] free2live:
Any idea??

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] marhensa:
anddd....

any idea how to flash unlocked bootloader defy dump to locked bootloader defy?
[Defy General] arpith.fbi:
hey guys just now met one of the Vice-President of Texas Instruments..he somehow convinced me tat we CANNOT unlock bootloader without a file which only motorola has access..so no tool of OMAP will help unlocking any motorola phone..reconfiguring the board will do no good..and its kinda risky.phone might be dead...and tat too there is very high chance of killing the phone..he gave me advice to buy any other phone except Motorola :p

tats wat he said..
[Defy General] royale1223:
The safest way to go about dumping and flashing the bootloader would be via the TI FLASH 1.6 . But first we need UART access. What's the progress on that? sam_24 was working on that.
[Defy General] scholbert:
Hi again!

Sure, it is very dangerous to reflash bootloader without knowing the background.

This is information is about how the efuse power supply is involved in the reset process.

E-fuse bits could not be resetted.

This is general purpose flash tool for GP devices.

AFAIK the HS devices will refuse to interact correctly with this program.

For the HS devices there's a tool called CSST.

http://processors.wiki.ti.com/index.php/CSST

There are manuals on the Ti website as well.

Yupp... i guess he's right. Wouldn't be a Vice President if he talks stupid things :D

At least it might be worth a try, if there's an engineering bootloader SBF leaking and the devices pkeys match.

These ones are signed images as well, that could be booted on HS devices.

The difference is that security checks get disabled for higher level loader and certain partitions.

See my comment above. Ti Flash is designed for general purpose CPU's (e.g. Beagleboard, Archos Gen8/Gen9, etc.)

sam_24 got into contact with me already...

BTW Ti Flash uses low level USB access, as well as UART mode.

It doesn't matter which way you connect, but you'll have to enable external boot mode first.

This could be achieved either by software (change scratch-RAM) or by hardware (locate the boot-mode signals).

Anyway... IMHO a HS device will refuse to connect.

You should check out this website:

http://www.droid-developers.org/wiki/Main_Page

Best regards,

scholbert
[Defy General] diamond_lover:
I think "easy way" will be UART mod.
[Defy General] boorce.com:
And exactly the same for a ... Milestone2 !!

omapinfo v.1.0.0

STATE : 205

PKEY0 : c57aa19e

PKEY1 : 31fe2d32

PKEY2 : 2e48bc96

PKEY3 : 15fcea7b

PKEY4 : 876578f3

CPU-ID: 2b89102f
[Defy General] adi4motion:
kinda offtopic but remember the 3610 vs 3630 battle? Motorola saying (after defy+ release) that defy has 3610 and defy+ 3620. Judging from milestone 2 CPU-ID Defy has TI OMAP 3630 processor (like we all assumed):)
[Defy General] scholbert:
Whoooops that's crazy stuff... thanks for giving the hint ;)

Anyway won't help, because:

1. the Milestone2 has locked bootloader as well

2. the bootloader itself will differ, because of different hardware setup (GPIO mapping, maybe other low-level stuff)

There'd been some attempts on Milestone A853 to flash bootloader of unlocked XT701 or XT702 (not sure which one it was).

Both devices had the same pkey hashes as well and mbmloder backup got also updated during this exciting trip.

The end was a bricked device because the bootcode itself didn't match.

The only way to try unlock Defy would be to flash the original signed engineering bootloader.

We have that dump, but this won't help much for now :rolleyes:

Cheers,

scholbert
[Defy General] viper.:
We knew that already.. because 3610 doesnt have "dedicated 2D/3D graphics hardware accelerator" (POWERVR SGX) and IVA 2+.
[Defy General] dlhxr:
moto gave us some original code for the rom of defy and i heard about some password is the 'password' itself. is it the password moto use to sign the rom? is there any possibility to sign the rom by ourselves?
[Defy General] scholbert:
Hi dlhxr!

What is this orignal code for the rom?

Try to be a little more specific, e.g. what are the filenames?

No a simple password won't do. You need Motorola private keys for Defy.

The keys have special format and you'll need a signing tool (it is based on openssl).

Have a look for the CSST manual form Ti, it's partly explained there :rolleyes:

Though only in english.

Have a nice day!

scholbert
[Defy General] nepotu:
I think he was referring to this topic and the engineering_key included in the source files, but this is just a test key, so it's useless.
[Defy General] sonyc2011:
What about brute force for craking the key, if we put all of the computers at work it will teke that long?? We can make something that we split the work. I have 3 PC (and 2 laptops) in my house i will put all of them at work for this. It is need to have a phone conected to the computer to use brute force?

Is there a way, it is a software ready to do this or we need to adapt it?
[Defy General] vanyas:
Bruteforce 1024bit RSA key? I think it's unreal.