[Defy General] eiyee:
You are speaking in official capacitiy there as devilthehellraiser, so I suppose the Ministry of What Is Dead must have misfiled a notice. :)

(Way to motivate!!)

Joking aside, let me share some research on the Defy bootloader.

So, it is possible to get the Defy into a peripheral boot mode in which the ROM reads the initial bootloader from a different device (MMC/SD, UART, USB). The USB boot is probably most interesting given the reports of unlocking in Motorola stores using just a USB cable and "TI Tool" (see below).

Triggering peripheral boot works by writing a boot structure to a part of memory that is non-volatile ie. remains unchanged after reset, and then doing a software reset. The ROM finds the structure and gives it preference over the normal boot order. It is described in How_to_load_mbmloader_from_SD_card.

The register offsets are valid for our OMAP3630 (I checked TRM) and I tried it, it works just as described. The Defy instantly resets and shorty after reappears as a different device

#[895580.116891] usb 1-1.5.4.7: New USB device found, idVendor=0451, idProduct=d00e

#[895580.116923] usb 1-1.5.4.7: New USB device strings: Mfr=33, Product=37, SerialNumber=0

#[895580.116929] usb 1-1.5.4.7: Product: OMAP3630

#[895580.116933] usb 1-1.5.4.7: Manufacturer: Texas Instruments

This is the ROM in USB boot mode before any bootloader starts.

The command syntax of the USB interface are publically described in OMAP docs. It basically allows to read the ASIC ID (see droid-developers.org wiki), to change the boot order and to upload a memory image to boot from.

I wrote some python code to access the ROM based on published information in the OMAP3630 reference manual (3530 pages!! what a pain. :)) about the USB interface . The code is linked on the wiki page. It can read the ID and upload an image, but so far no luck getting it to actually boot with the data I tried. It just hangs OR resets back into USB peripheral boot.) This is probably because I don't understand the image format yet. The examples for "HS/EMU" in the TI CSST might give it away. There is a TOC header, KEYS section, then signed loader image. Hmm. Perhaps a mbmloader dump from the internal mmcblk could work?

Now in this USB peripheral boot mode, the phone should be recognized by the TI Flash Tool ("v1.6") on Windows (I think linked somewhere in this thread), I think it contains the right USB IDs but I cannot verify because the ROM resets ever 3s and this messes with my Windows kvm guest on Linux :rolleyes: Anyone who could try on Windows what the TI Flash Tool can do? You need to load a module to trigger the peripheral boot, I can upload one later and will attach here (or link here).

[Edit: Uploaded trigger module here http://www.droid-developers.org/wiki/File:Pboot-defy-2.6.32.ko.gz. Load into the kernel with insmod.]

Note, peripheral boot will not by itself help us unlock the bootloaders. It is a way for more low-level access but still the image to be executed must have a valid signature by the root key listed in the KEYS section which in turn must match the hardcoded hash in the fuses. So still relies on the root key which we don't have.

But I think this matches the reports of unlock in the stores - if it was some TI tool, not RSDlite, then chances are good that it was this TI Flash Tool talking to ROM in peripheral boot. The mysterious loader image is what we are missing still. Or rather, to know exactly what it does to the phone. :)