yashsingh1/xdaforums huggingface dataset:
[Defy General] Kaffeekranz:
Though it would be highly unlikely that Otto and the Chinese guys got a BAD phone right after sending them in because of downgrade/bootloader issues.

We can say for sure that those secure bits can't be reverted, right? HS stays HS.

The only thing Otto can do is flash unsigned images which mbmloader allows, whereas mbmloader can't be replaced with something else (which seems to be conclusive with Moto's official unlocks regarding the Razr Dev phones).

Unfortunately I can't find much on the internet describing TI's CPFROM (customer programmable fuses ROM).

Are you sure that those SWRVs actually describe efuse bits?

I really don't understand much about this whole topic, but don't sbf upgrades (v5, v6, recently v7) alter exactly these SWRVs bits?

The only thing we know for sure is that SecProcessorType can't be altered and still stays at 44 even on the "unlocked "phones, right?

_________

Funny story:

Most of the time I'm googling for documents I come across IRC logs with you discussing this topic on the milestone channel.
[Defy General] viper.:
You should move your search here.. www.mail-archive.com/find.php?cx=pa...cof=FORID:9&ie=UTF-8&q=ti+omap+3630&sa=Search

There is a bunch of tehnical data maybe you could find something helpfull.
[Defy General] ofmb:
Anyone has stable kexec-ed kernel for defy to play with?

AFAIK quarx managed to kexec on the defy but failed to keep it alive.

on milestone they reached to a point where they just couldn't reset/re-init the radio.

so, if a pre-alpha kernel would be released we could aim our efforts on finding a way to make the radio work instead of unlocking the bootloader itself.

tell me what you think about that..
[Defy General] abhishek009:
Any updates

Sent from my MB525
[Defy General] vap_66:
Trust me, if that damned bootloader was cracked, you would've read about it on every topic in this Defy forum :p.
[Defy General] coelho_:
You can bring your help if you want:p
[Defy General] Lemark:
I can imagine anything but this :D
[Defy General] Passa91:
This looks promising! Quarx might be going the kexec route? I believe they've had success with this on the RAZR, so much so that the only problem they have left is activating the second core of the CPU.

Fingers crossed folks. :)
[Defy General] tlongren:
Nevermind, i'm an idiot. A mod can delete this.
[Defy General] Football Fan:
There is a second core on our phones? :eek:
[Defy General] joydeep1985:
You little cute stupid :p ( dont take it otherwise ). The second core he spoke was about motorola razr :p
[Defy General] Football Fan:
Ah misread him!
[Defy General] Skrilax_CZ:
I noted earlier, that somebody talked about engineering bootloaders. I'll just make several things clear:

A) bootloader uses the eFuse information whether to check signatures or not, yes

B) production mbmloader (MLO in your case), will blow SEC_ENG upon booting

C) engineering phones have special bootloaders with fastboot support, but those are unsigned, and even if they were signed and flashable to production phones, they would check for signatures on production phones

D) cdt.bin secure version is blown to eFuse. It contains minimum secure version for the other partitions when it's checking for signature, information about whether to check for secure version on filesystems (sig. type 5) is stored in sp partition
[Defy General] Kaffeekranz:
"Special" meaning what exactly? Scholbert only noticed a three byte difference between Otto's mbmloader and ours.

And there's dispute whether his is an engineering phone, or a product of some kind of unlock procedure by Motorola, as he got this one back right after sending it in, because he was stuck at an unsupported Rom (iirc).

But thanks for mentioning all this, it's hard to find easily understandable information on this anywhere.
[Defy General] leodfs:
Dude, true and false are only 1 bit of difference, :cool:

So three bytes means a lot of thing and I dont like to think (2^9) -1 ways to brick a defy
[Defy General] Skrilax_CZ:
I made a mistake in my B) statement, only SEC_ENG is blown by mbmloader here (SEC_PROD and the verification of fuses is on Motorola RAZR (probably new on OMAP4 devices)). The bootloader checks for signatures when SEC_PROD is blown (in bootloader mode, in case of Defy, phone without blown SEC_PROD and SEC_ENG fuses will be seen as "NS Flash OMAP3630", phone with blown SEC_ENG only will be seen as "SE Flash OMAP3630", phone with both fuses blown is seen as "S Flash OMAP3630").

Special bootloader is simply a different bootloader - main difference is fastboot support.
[Defy General] Kaffeekranz:
So, let's say someone with a SE phone would somehow replace his mbmloader with ours, it would blow the sec_prod fuse at boot?
[Defy General] iolinux333:
I have a RAZR too and am very excited by how close we are to unlocking that phone, but an unlocked BL for my Defy would ROCK MY WORLD :-)
[Defy General] Skrilax_CZ:
Only in case of Motorola RAZR (well I'd say all OMAP4 devices, SE devices have there special bootloader). I've only seen that Defy mbmloader (from production phones) blows SEC_ENG, but not SEC_PROD, so such Defy could use regular bootloader.
[Defy General] kevin_diu:
maybe we can tell someone who have an unlocked device to flash our bootloader(or something else) to test weather which bit is the different or we may get some important information from it
[Defy General] miziel:
Any news? :)
[Defy General] cgordonfreeman:
I'm sure the thread would be updated if there was...
[Defy General] abhifx:
razer kexec sources released

sorry for bumping an old thread (and not even reading it fully)

it looks like razer kexec code is released. only only core is working is working but that is fine for us :D

http://xdaforums.com/showthread.php?t=1519448
[Defy General] Eramix3:
http://www.gsm-shorbagy.org/vb/showthread.php?t=10005 Help us? Support for OMAP 3630 CPU in JTAG
[Defy General] tinti93:
I hope our nice developers port this to deffy :p
[Defy General] hackergnome:
its a secure board so won't help...
[Defy General] bone101:
Kholk have bypassed the moto razers bootloader - is this not possible with defy ?
[Defy General] djc151084:
Please read past posts

Djc
[Defy General] devilthehellraiser:
Any updates... anyone ....
[Defy General] toncy12345:
hi all, is there any news?
[Defy General] NI55AN:
If something had happened the thread would be updated
[Defy General] pjgowtham:
But how come there are some 1 or 2 unlocked defys roaming outside...hows that possible? and is there any way we can find whether a phone has an unlocked or locked bootloader?
[Defy General] leodfs:
If you are not a developer with some important update, please let this thread die. There is no use to have a unlocked defy if the developers don't have one, you will only do what you do now.

Sent from MY GT-P6210
[Defy General] toncy12345:
anyway somebody works on it?
[Defy General] vap_66:
Motorola works on not keeping promises.

Trimis de pe Defy CM9
[Defy General] toncy12345:
wehehe, i mean except motorola...
[Defy General] Moises_sto_zn:
Not any more progress?
[Defy General] toncy12345:
Today morning I saw a thread called: "Defy's bootloader unlocked" but when I tried to open it, it was deleted or something. Btw Google showed me that...

So it's done or just was a fake thread? That turned up my mind...
[Defy General] jassi32:
ya i had seen it too

but its was a spam

links leads to youtube .... some music video;s

image attached
[Defy General] marhensa:
yes, it was here..

http://xdaforums.com/showthread.php?t=1681132

just some joke..
[Defy General] pjgowtham:
We should kill such people...and guys don't forget asking moto unlock bls on fb and twitter ...I do it everyday as soon as I get up in the morning.lol.may b we could do an app which automatically posts in fb and tweets with one click!!!..lolz
[Defy General] Tranzior:
I am now going to also write to them every day on facebook
[Defy General] Omya:
i always write abt unloking bl on dere page :D

official page of moto

https://www.facebook.com/motorola
[Defy General] klickig:
How about make a Spam Day on all offical sites of moto. Twitter Facebook everywere...
[Defy General] Step666:
I have now re-titled and moved this thread - whilst the original attempts to unlock the bootloader detailed within have long since been abandoned, the thread itself can still serve a purpose as a focal point for discussion/keep the forum tidy.

And if I see any more petty squabbling, I'll start knocking heads together.
[Defy General] constantin_padure:
One friend will try next week to rewrite the EEPROM directly with one kind of flashing box. Maybe he can make this downgrade ...

For any results, I will come with one answer.
[Defy General] toncy12345:
I dont know about any box that support defy for any jobs, except unlock.
[Defy General] toncy12345:
can we get hope of something? 'till now Epsylon went the far way of bootloader unlock...

btw no trust from motorola comapany. after so many message not even one answer.. .**** moto company.. :(
[Defy General] pranks1989:
Guys do you think there may be any way to compel Moto by law to do this?! Check the thread in Moto forum linked in my signature
[Defy General] hrk:
In the EU (or at the very least in Italy), Motorola could be legally obliged to unlock the bootloaders, as they released a public statement promising the unlock at the end of 2011, when they were still selling the same devices they promised an unlock for.

This is known here as a "binding promise" because I may have bought the device because of the promise.
[Defy General] pranks1989:
So anyone here from italy who could may be lead this movement and take legal steps ahead?!
[Defy General] Epsylon3:
Could you please edit your post, because all our CM builds never touch the bootloader version ;) only the SBFs do that
[Defy General] m11kkaa:
Does anyone have an old broken defy?

I would really like to know what chips are located under these metal-shields:

http://www.flickr.com/photos/81166802@N02/7867311640/in/photostream/

Maybe someone could disassemble them if you have an bricked defy :P
[Defy General] bone101:
I will do this next time........
[Defy General] m11kkaa:
Great :)

I hope, the metal-shields aren't the chips itself...
[Defy General] bone101:
here you are....

http://db.tt/9Hgip3Ch

http://db.tt/rfQln7HC

http://db.tt/GNLAn13S

MB525 xda developers app
[Defy General] m11kkaa:
What happened to the pictures?

404 not found :(
[Defy General] bone101:
Sorry , pikture upload dont work

---------- Post added at 09:53 PM ---------- Previous post was at 09:46 PM ----------

http://www.skyworksinc.com/Product.aspx?ProductID=623

GSm modul
[Defy General] m11kkaa:
thx.

there is an Power-IC(same as milestone):

http://www.wiisingonline.com/TI-510...la-Milestone-XT800-A855-MB525-p-5073-350.html

and 256mb sdram:

http://www.ubmtechinsights.com/repo...device-library/Device-Profile/?SINumber=27643

but where is the omap-chipset or the nand?

maybe completely integrated into PCB?

---------- Post added at 10:16 PM ---------- Previous post was at 09:59 PM ----------

between simcard and sdcard are two more metal-shields.

can you remove them, too?
[Defy General] bone101:
Is this nand ?

http://db.tt/MLmHj2DB
[Defy General] m11kkaa:
yes, 2GB. But there's no omap-chipset.

It really seems it's integrated in the multilayer-pcb.

Or do you see any other chips? Maybe you have access to an xray-scanner? :P

Sometimes you can see a little bit if you hold the pcb before a bright light-source(halogen lamp).
[Defy General] bone101:
No x Ray here :)

But omap is maybe the yellow thing under the elpida thing
[Defy General] m11kkaa:
which yellow thing?

There's a chip between camera and elpido which I couldn't identify.

But I thought it's too small but - who knows :P
[Defy General] bone101:
Some smaller ones seems to be polished......

Have you noticed the online price of the elpida chip ?

$495,- :)
[Defy General] m11kkaa:
oops, that's much for 256MB sdram :P
[Defy General] bone101:
Yellow thing - Maybe only the socket.....

There is a number on that chip you mean 5705A1AM
[Defy General] m11kkaa:
yes but I can't find anything with that number.

except all the very little chips only the polished ship and the chip above the camera(with the white pad) are remaining.
[Defy General] Kaffeekranz:
Afaik, they're usually mounted under the RAM chip.
[Defy General] bone101:
......the yellow thing which looks like a socket
[Defy General] AnTerNoZ:
if u need more pictures from the chips, look at this old post

looks a bit different, but that pics haven't a good quality

Jelly powered.Defy
[Defy General] marcospulido:
the chipset probably is under this. note the transistors that form a square around it.
[Defy General] turffe:
Defy with unlocked bootloader: http://geek.widgetsradar.com/upload...ictures-motorola-defy-news-techradar-uk_6.jpg
[Defy General] Kaffeekranz:
Nice. A battery.
[Defy General] AnTerNoZ:
look over the battery, there stand not for sale. but why does it matter, we had Quarx kernel ;)

Jelly powered.Defy
[Defy General] turffe:
cheesecake update found

Found update on defy+ 2.3.4 4.5.1-134 dfp 82 server - master-dev.blurdev.com.

UPDATE:http://www.sendspace.com/file/8x71ja

Set up cluod option on dfp82 :1.wipe all data, 2.when it says welcome to blur, 3.press menu button. 4. choose ,,set up cloud''.

and i cant recreate motoblur acc after wipe it says: cant login try later, so i reflashing 2.3.4 fixedsbf + nandroid

master-qa3.blurdev.com - no update.

master-qa1.blurdev.com - no update.

master-staging1.blurdev.com - no update.

master-lab.blurdev.com - no update

Need to test this:

master-demo.blurdev.com - no update

master-staging1.blurdev.com - no update

master-sdc1.svcmot.com - no update

master-blur.svcmot.com - no update

master-homer.blurdev.com - no update

master-bart.blurdev.com - no update

master-lisa.blurdev.com - no update

master-maggie.blurdev.com - no update

master-marge.blurdev.com - no update

master-bqa1.blurdev.com - no update

master-bqa2.blurdev.com - no update

testcloud01-sdc1.blurdev.com - your phone is updated

master-devtest.blurdev.com - no update at this time
[Defy General] VTomi1975:
Zöld és Froyoig vissza tudok menni. Most is épp ez van, mert semmi mással nem megy rendesen a wifi és a videofelvétel.

Green lense here, using Froyo (for proper wifi and video recording)
[Defy General] ABBolle:
@sykoism:

I can't see the attached pictures in your post...
[Defy General] free2live:
That's what I was saying

Sent from another planet
[Defy General] linbi4706:
Customer service unlocking process

http://bbs.mfunz.com/thread-298577-1-1.html

Brush lines is the motorized original USB data lines, plugged into a computer to open a tool is TI OMAP Board Configure Tool title, then he ordered a Reset mobile phone, enter BL mode ( at that time (the first time ) did not pay attention to the screen of the mobile phone, the BL is that BL ), TI OMAP3 Series Board system prompt device, and then he on the tool selection of Device&Bootstrip Configuration, open a 16M bin file, the file name is very long, only to see the 16.0M, then click a button, should put the document into the brush, and then point out the Reset, mobile phone into a menu interface, the above shows Factory reset, immediately followed by mobile phone operated a few did not see clearly, mobile phone and a reboot, then he turned to RSD, brushed inside a SBF, boot... See the CM9, I took the machine to take over the roll off, he said to go back to system brush, or else can not use...
[Defy General] sykoism:
Image re-uploaded.
[Defy General] djkail:
Yes... Its unlocked...

we need a copy of mmcblk files of that guy...

Edit: Or the "JS" software to unlock it... even better :D

Edit2: Moto... all this time you had the unlocking ability... You lied! :mad:
[Defy General] balika01:
Thanks! now this please: http://bbs.mfunz.com/thread-298577-1-1.html
[Defy General] royale1223:
what is this guy's name? What is the shop's name?
[Defy General] adi4motion:
do not make this public , that guy may get into trouble
[Defy General] djkail:
You are right...
[Defy General] viper520:
Me again :)

Finally my defy is unlocked by local moto offical service site.

Days ago I flashed Ep3's ICS update, and the BL upgraded to 6. But today I found Q's 0112-nightly 2.2 ICS, and I flashed the zip directly. After that, my defy blocked at M (bootup stage), so I think this is a chance to unlock my defy throuth the moto offical service site (Though I know how to fix it).

After a check by the engineer of local moto offical service site, he asked me whether I flashed the phone before, I said I upgrade the software to 2.3.4 at another offical service site, and then OTA to 2.3.6. OK, he says he will restore the software totally and all data will be lost. I said I want my phone and data both.

Later, I got my phone and the bootloader was unlocked!

For some reasons, I watched the whole "fix" procedure (with standard USB cable).

He opened a tool titled "TI OMAP Board Configure Tool" and click the "Reset" button.

Then my phone reseted and enter the Bootloader Mode(maybe not), the computer found a new hardware named "TI OMAP3 Series Board".

Then he select "Device&Bootstrip Configuration" and opened a bin file with about 16MB size (the file has a very very long filename), after a flash, he click "Reset" again.

Then my phone entered a mode with some menus, the title is "Factory reset".

He performs some operations in the menu but I'm not see it clearly, then the phone reseted again.

Then he opened then RSD (I found my model is "SE Flash OMAP3630") and flashed a sbf (about 40MB size, I think it's a SPECIAL kernel which can boot both 2.2&2.3 system).

After that my phone works, but it blocked at CM9 startup logo.

When i get home, I flashed the north-euro 2.2 sbf(BL=4) and Q's 2.2 0112-nightly ICS update, and it works well.

The result is my IMEI NOT changed, but the bootloader is unlocked :D

So I think the real unlocking procedure was done by flashing the bin file or operations in factory reset mode.

Maybe the bin file is just function to boot into the factory reset mode, and the real thing will done in the menus.

I have a screen snipshot of RSD (SE) but I don't know how to attach now. While then I will edit the post.
[Defy General] sykoism:
The guy has a defy with bootloader version 6.

He then flashes the cm9 ROM from Quarx, and got stuck in the M logo.

He went to moto customer service and said that his defy got stuck in the M logo after charging ;)

Moto's worker trys to repair for his phone, and it is in fact an unlocking process which makes it be able to boot cm9 after that.

A summary for the unlocking process:

1. Plug the phone into computer with a original moto usb cable

2. Open a 'TI OMAP Board Configure Tool' program in computer

3. Click 'Reset', and the phone boots into bootloader. Computer shows a message for new device 'TI OMAP3 Series Board'

4. Click 'Device&Bootstrip Configuration' on the tool, and open a 16M .bin file

5. Click 'Reset' again after the operation of the .bin file

6. The phone enters a menu with some options. The top one is 'Factory Reset'

7. The Moto worker operates something on the phone, and then it reboots again

8. open RSDLite and then flash a sbf, the phone is under normal operation again.

After that, IMEI has no change. The phone has a bootloader version=4 now. It can boot cm9 with kernel from north Europe. (I guess it means 177/179 kernel)

RSDLite shows that his phone is now 'SE Flash OMAP 3630'.
[Defy General] royale1223:
you might be right. But do we have the guy's name? Is anybody contacting him?
[Defy General] sakitobaki:
Why do you need his name so badly?!

Defy-CM7.1.0-11
[Defy General] balika01:
please upload TI OMAP Board Configure Tool
[Defy General] sykoism:
No one can get it, except Moto.
[Defy General] ABBolle:
i think, nobody has got the tool, except the "JS"-man in the Motorola Service Station ...
[Defy General] mpiekp:
You say standard usb cable, but unless you gave him yours to use, you can't be sure.

Moto also have a master cable, that unless you cut open you can see no difference, check the atrix threads for info
[Defy General] djkail:
I think that tool is at moto customer service.. I dont think he has it... Maybe he could talk to them to take a "copy" of it... :)
[Defy General] adi4motion:
We really need TI OMAP Board Configure Tool and that .bin file. Someone that can get in touch with him tell him we'll pay GOOD Money for it!
[Defy General] royale1223:
If somebody had it they would've uploaded it months ago. Lets dig for it. Try googling. Maybe we might find it in some obscure ti site.
[Defy General] balika01:
:/ upload the unlocked mbm backup??
[Defy General] royale1223:
Doesn't anybody know a motorola repair executive? Its as simple as getting two files right?

Edit: it need not be a moto software. What if its made by TI? Did anyone try this link? http://processors.wiki.ti.com/index.php/Flash_v1.0_User_Guide. Looks like a universal flash tool for ti boards.

Edit: It looks like its for ti 37xx and evm. Maybe we could find more like this.
[Defy General] adi4motion:
we can "make" the cable!
[Defy General] VTomi1975:
Wouldn't it be a good idea to contact someone from TI, not Motorola?
[Defy General] adi4motion:
but we still need that .bin file (which is made by motorola <containing the key> i think).
[Defy General] sykoism:
@EP3

They said that they are able to flash any sbf from moto, but they are not sure whether their defy are really unlcoked or not.

So, they would like to ask you how can they test for it, for example, to get a custom kernel from you and test if they can boot it.
[Defy General] VTomi1975:
you're right...

I'm seriously thinking of "bricking" my Defy and bring it to a Moto service... :S
[Defy General] djkail:
He already tested a custom kernel and it worked... Its unlocked... We need to unlock OUR bootloaders... His bootloader is unlocked!
[Defy General] VTomi1975:
It's a logical step from Motorola if they don't publish the unlocker. It might cut the sales of Defy+ I'm curious whether they'll do it a few months later when Def+ will also be an "outdated" model (although - as it's proven - it has more potential than we would think from its pure specifications).
[Defy General] samsungc6:
to test just flash a full official sbf 2.3.6 then see if it's working. Second step is to flash a full sbf 2.2 (froyo) and see if it is working :)
[Defy General] djkail:
It is useless if epsylon3/quarkx cant get his bootloader unlocked to make a CM9 rom... We need some method to unlock "all" bootloaders... or sign the kernels...
[Defy General] adi4motion:
that's what i told my gf about an hour ago and she said that's a bad idea:D . she might be right because i don't know if here (in romania) they use the same tool:-s

... but i just can't wait to unlock it:-s

---------- Post added at 01:16 PM ---------- Previous post was at 01:16 PM ----------

that too

10 char
[Defy General] djkail:
He already proved it

http://xdaforums.com/showpost.php?p=21390929&postcount=92
[Defy General] adi4motion:
http://bbs.mfunz.com/thread-298577-1-1.html

please translate the update! i used google translate but didn't fully understand:D
[Defy General] VTomi1975:
Damn... Now that we know it's possible to unlock the bootloader (in a very easy way) it's even more frustrating that we cannot get our hands on the tools :S