yashsingh1/xdaforums huggingface dataset:
[Defy General] scholbert:
Hi!

How could i provide it?

All we got are raw dumps.

As far as the defy uses eMMC flash inside the handling is little different compared to raw NAND. In fact this makes things bit easier.

No need to worry about writing ECC and stuff.

There may be two simple ways to flash raw images to the device.

1. using dd within adb session (http://ss64.com/bash/dd.html)

2. using sbf_flash (http://blog.opticaldelusion.org/2011/02/sbfflash-updates.html)

I may easily provide the commands here, but as far as we know nothing about thess signer_info bytes, it might be dangerous to simply re-write this section.

We know nothing about any side-effect.

Maybe someone should ask Epsylon3 again, if he know anything about this part of the key section.

Also i read about some incompatibility of the sbf_flash tool with Defy.

There'd been some contact with developer already. Why not ask him?

To be honest, changing this signature sounds little bit to simple to be true,

but it is a fact that these parts are different between locked and unlocked ones :p

AFAIK, there's no need to flash back to any stock ROM or similar.

Normaly the boot section is not covered by firmware updates and resides at the first sectors, no matter which firmware you flash.

Yeah, good thought :D

JTAG is far beyond (who knows the testpoints?) and as you stated it's blocked.

As far as your device is functional you won't need it :rolleyes:

Good idea!

BTW, i got no such document. I only wrote that the public manual is a subset of the OEM one.

To get it you'll need to be in the big business and sign a NDA with Ti.

Cheers,

scholbert
[Defy General] Kaffeekranz:
My thought process was rather dedicated to the reports from the chinese guys.

I don't know if you've read his story about going to the repair centre and seeing his phone boot up with the CM9 logo after their "reset".

I'd like to avoid having to explain that (if there'd even be something to rescue left after changing the boot section).
[Defy General] sakitobaki:
What kind of incompatibility?!

I'm using sbf_flash without any problems for flashing full froyo and 4.5.3-109-fixed on red lense defy.

CM7.2 Nightly 02012012
[Defy General] free2live:
have you managed to fix your defy??? if you need any help PM me with details(you can write in romanian )
[Defy General] linbi4706:
yes i flash the mbm mbmloader to my lock defy it work but it can't unlock:mad:

and i find the "js" can unlock bl near my city .40 Dollar.:p

need Change the new chip and flash the ?.bin:eek:

it can't re flash Original chip unlock.:cool:

i just have one defy,i can't Brick it.:(

i need a used defy/bad chip defy to give "js" unlock and who can make tools to dump.

who can give me the bad defy to test:D
[Defy General] free2live:
Can "js" sell you the .bin? How much would he ask for that?
[Defy General] linbi4706:
I don't think it possible，it is a living tool.Lose those may let his career

but if can do a deal,i will try to persuade him

Maybe you do not know this kind of odd things

but in china， No complete the transaction is very difficult and merchants continued to talk.

Of course, the best way is our dump it.

sorry my cheap english
[Defy General] Kaffeekranz:
Sorry, but would you mind also posting in your mother language and letting someone else translate? Right now it's quite hard to understand what you're saying.
[Defy General] linbi4706:
Okok~~~

在离我居住不远的城市有“js”可以解锁bootloader

但解锁的方法跟官方不一样

需要拆开defy然后更换芯片，再用专用仪器写入参数。

价钱大概40美金。

也就是说，除了官方，其他"js"的解锁是需要拆机换空芯片，而不是可以在原来的芯片上直接重写数据。

我只有一台defy，我不想用它去测试甚至被刷成砖。

我需要一个二手defy或者坏芯片defy去测试是否真实解锁。

另外有人问是否能购买到那个?.bin文件。我认为希望不大，因为那是"js"工作的家伙，他不可能让自己失业。

不过如果有defy给我去跟他做成这个生意我会尝试跟他交易这个bin。或许你们外国不明白，但在中国，不先跟别人做成交易而去不断发问是很不礼貌的。

所以最好的方法，就是我们自己做出工具去dump这个bin。

解锁的钱我可以自己出，但第二部defy我买不起了，谁可以提供一台坏芯片defy我测试就好了:D
[Defy General] sferrariba:
I agree
[Defy General] free2live:
Try and we'll see..
[Defy General] djkail:
We need someone with an unlocked defy to try this...

http://xdaforums.com/showthread.php?t=1477664

I think it may help a lot... And maybe @scholbert will be interested too :p
[Defy General] dayu80:
Here is my quick translation. Good luck with finding a cheap bricked defy.;)

There is a "js" (private phone vendor) who has the capability to unlock the BL not too far away from my home but he has a different method than the official one. He needs to remove the chip from the phone and program the chip on a special instrument. It costs about $40 for him to provide this service. It seems that only moto CS have the software to rewrite the chips. Other js’ have to dissemble the phone to unlock the BL. I have only one defy and I hate to take the risk of bricking it. I will need another used defy or a bricked defy to test the js' method. Someone asked about if it is possible to buy the bin file from the js. I don't think I can because he needs it to make money. However, if I can give him some business of unlocking BL first, probably he will agree to sell me the file. I think the best shot for us is to have the js unlock a defy and try to dump the bin file ourselves. I can pay for the unlock service by the js but again, I need to get a used defy for cheap first....
[Defy General] dlhxr:
it means we need one new blank chip to write the bin file in for the exchange of the old chip? no software only solution?
[Defy General] m11kkaa:
Could we built a internal usb-logger into the Defy?

Then we could let a repair-store unlock it and we will know how unlocking works.

Sounds very difficult...
[Defy General] mearoth:
That would not work. Since I believe that Moto CS can restore the devices through peripheral boot (->the bootloader is loaded from USB and not from NAND) nothing we could put into the defy would be executed. (altering the CPU on chip boot rom is out of question any way)

The procedure that Moto CS does (which is the one we should go after, since we want a easy way to provide unlocking to every one) is the following (as I guess by all descriptions we have):

They use a "tool" to unlock by USB and a small bin file. The cable it selve I guess is modified.

So what I believe is that the cable puts the CPU in peripheral boot mode- The phone then loads the bin file and executes it - which does some magic to the phone (and that is the big mystery to me - since that could do everything to the phone i guess). afterwards the phone boots up as SE..

It would really help if we could get our hands on that bin file, but since we can't, we have to investigate by our selves.

BTW:has anyone checked and compared the efuse banks of the locked and unlocked phones? I think it would be important if there where changes too.

cheers,
[Defy General] m11kkaa:
What I mean is that we connect some type of oscilloscope directly to the usb-port which saves the raw-data to a integrated chip.

But I think the it's impossible to built that type of analysing-hardware into small devices like the defy.
[Defy General] mearoth:
Ahh, sorry I got you wrong. That would be a nice idea, but as you said, I think there is not that much room left in the defy to do a hardware attack like this. But nevertheless the idea has a certain appeal. We could use a µC like this http://arduino.cc/en/Main/ArduinoBoardProMini but it has nearly no memmory to store the data. so that we would have to add. and then of course we would need to put it into the defy so that service would not see it.

aahh i think it will not be possible.
[Defy General] scholbert:
Hey,

so if i got it right linbi4706 successfully reflashed mbmloader part and nothing changed.

Would have been to simple, as stated...:p

Now let's see what js will do with his phone.

Hopefully it's still a phone afterwards ;)

Yeah interesting, i got PM'ed by pisquared.

Yes, i agree 100%.

There's a tweaked kernel module built by Epsylon3 called sec.ko.

Otto.Br should load it to his platform.

There'd been some chinese reports from unlocked phones with dmesg output as well.

Though it would be better to got some more background about the effects of the efuses involved.

You're talking of sniffing hardware...

Even if it were possible, who should build this piece of hardware?

Please guys keep being serious and try to be realistic.

Regards,

scholbert
[Defy General] linbi4706:
果然是一个神奇的地方，我这里的二手defy居然比新的还贵:mad:

我不够资金去购买
[Defy General] t0desicy:
I don't get it...

http://i.imgur.com/elTMQ.jpg

----

btw, I got a Milestone2 now, so I will continue reading this thread, these devices are really similar (didn't find any DEFY nearby here...), so I am still not gone :p

anyway. don't use my DLL I uploaded, it will definitely brick your device, there is nothing you can do anymore to it...
[Defy General] linbi4706:
in my city the new defy is sell about $330 but the used defy sell $350-360:(

if you don't mind，give your brick defy to me give js unlock

i not have Enough money to buy it

ok you upload it.if brick i give my defy to "js" rewrite and unlock bl.:pJoke

and about the eng-Milestone2,i konw some thing,but my english so cheap,i use the chinese to say it.

在中国论坛里曾经有一部工程里程碑2

据拥有者说，工程里程碑2，进入fastboot的无锁模式和bootloader的有锁模式，是利用不同的组合键，而并非如defy一样必须用reboot bootloader才可以进入fastboot
[Defy General] Tim_Pan:
poor translation:

A new defy is sold $330 while a secondhand one must pay more$20-30 in the city that linbi4706 is living.If you don't mind giving me your defy,i will send it to "Js" to rewrite the board and unlock the BL.Just joking.

There are something about eng-MS2.The owner in the Chinses forum had ever said"the ms2 use the different combo-button to enter the unlocked Fastboot and locked BL instead of using adb reboot into fastboot mode bootloader.
[Defy General] linbi4706:
多谢帮翻译，不过如果他能寄defy过来，我带去解锁这个并不是玩笑

我所说的玩笑是指用他的dll刷砖我的机器然后我拿给js重写和解锁。
[Defy General] Eramix3:
This work? http://android-dls.com/wiki/index.php?title=Engineering_Bootloader
[Defy General] free2live:
That's for G1 not for Defy
[Defy General] hackergnome:
omappedia.org/wiki/Bootloader_Project

Read the SD card boot thingy...
[Defy General] mearoth:
Now, i recently looked this up and the statement on the wiki is not 100% accurate. Our defys boot config id = 0x05 meaning the sys_boot pin config. -> boot = mmc2 (2nd = USB).

There is no mmc1 (SD card) in the boot sequence. For that you would have to disassamble your defy and modify the sys_boot pins. ( more info is in the omap hardware reference)
[Defy General] popcorn1122:
http://unlockbootloader.sonyericsson.com/instructions

Above link from Sony Ericsson . Officially gives instruction to unlock bootloader.

Also tells a user you will lose warranty.

When will motorola learn?
[Defy General] mpiekp:
Yip, hence after my third broken defy, I have a new signature.

On the flip side mind, certain networks are still locking them, even when the manufacturer supplies a tool, it will not override the networks block.
[Defy General] linbi4706:
3 defy?

can you give me the broken one?

:( i need the used one/broken one give "js" unlock
[Defy General] free2live:
That's nice .... Motorola will do it in like 5 years...

Anybody knows how to access service menu on defy ?????
[Defy General] XtremBongChilla:
I have another idea. What about unlocking the bootloader of an defy with enginering board (in fastboot mode with adb, fastboot oem unlock) and making a dump of this unlocked bootloader. Could we do anything with this?
[Defy General] Tim_Pan:
Maybe someone has tried this command but it's useless on defy...

http://bbs.mfunz.com/forum.php?mod=viewthread&tid=308715&extra=&highlight=&page=1
[Defy General] free2live:
It's useless because defy doesn't have fastboot. At least not the normal defy.
[Defy General] XtremBongChilla:
That was what I wanted to know... if we could flash this dump to a locked defy... But if it's not possible then it's useless like you said...
[Defy General] sUpErwHoO:
hey guys, sorry but i haven't been following this thread to know if someones asked this, is there no way to ask someone from ti to help you superbrains with unlocking the bl?? dont you think they'd know what to do?? just a question.

anyway sorry to those who think this is not meant to be in a dev thread.
[Defy General] Kaffeekranz:
We've actually been redirected to their forums by a guy from the TI service line.

But they didn't seem to be willing to help.
[Defy General] sUpErwHoO:
hmmm that should be expected since they'd also be bound by some contractual agreement with moto, is there no other way to appeal to google's nicer side (if there is one) other then the operation mosh??

any way best of luck guys! keep up the super work \M/
[Defy General] devilthehellraiser:
Well I think project is abondend....
[Defy General] free2live:
Not yet. Don't give up hope
[Defy General] Passa91:
Not necessarily...

http://xdaforums.com/showpost.php?p=22323700&postcount=84

I don't want to get everyone's hopes up... but I have my hopes up. :)
[Defy General] dh.harald:
khm... wrong topic
[Defy General] royale1223:
LOL if you just want to bump the thread just say that (no edit!!!).

:D:D:D:D:D:D
[Defy General] RockR172:
So, i dont own a defy, neither do i know anything about motorola phones, but, a locked bootloader means that you cant flash anything in the boot partition, i.e, the boot.img's...

Please correct me if i am wrong... :)

If thats the case, then you guys seem to have something called sbf's which contains moto's new bootloader with new kernel...

So, what i wanna say is that you can actually flash new kernels using the sbf's...

I own a ****ty p500, and we have a tool, some LGMDP or LGDMP stuff and through it, we select what partition we wanna flash... not that we have locked bootloaders but yea, we change our baseband using it... (just the baseband)

So similarly, u might be able to create a program that might select just the boot partition to flash your boot.img's with custom kernels...

Well, as i said, i dont own a defy so sorry if i said non-sense... :)
[Defy General] dlhxr:
it is not that simple...most people here know what you said~:)

---------- Post added at 05:52 AM ---------- Previous post was at 05:49 AM ----------

since the new bl6 china unicom sbf won't allow us to flash a custom kernel, here's another way for unlocking.

a cdt(CG31) without checking kernel signature or allowing all the keys would help.

but we don't know how to sign it.

it at least proves that moto has the ability to "unlock" the bootloader!
[Defy General] mearoth:
Of course, moto has the ability to do such things, they hold all the keys (and this is not symbolically spoken :rolleyes: ). Even if the bootloader itselve would not be that easy to unlock (since the CPU is in HS mode and so on) it would be easy for moto to provide a signed bootloader that does not perform any further checks and break the security chain there.

But since I don't think Moto will ever do this, we can only hope for our super brains here to come up with some magic.
[Defy General] Com4nd3r:
unlock the bootloader!!!!

Sent from my MB525
[Defy General] ramy911us:
lol this was the most demotivational post ever!:D
[Defy General] evolution1g:
Hahaha dont believe/trust you
[Defy General] Cocolopes:
I think he try to say "please devs unlock the bootloader" not that he unlock the bootloader on his phone...;)

On my defy...from ICS...yes!!! in your face Motorola!!!
[Defy General] evolution1g:
Oh yeah you're correct ... I read it as "unlocked the bootloader" instead of unlock :/
[Defy General] dlhxr:
someone on mfunz said that his unlocked defy entered the fastboot mode when press the volumn+, volumn- and power button. He doesn't need to use adb.

can anyone who has a unlocked defy prove that?
[Defy General] ofmb:
Looks very promising, yet not sure what's the current status of it.

http://xdaforums.com/showthread.php?t=1466402
[Defy General] sonyc2011:
Interesting... Is for omap 4 devices but maybe it can be adapted for Defy
[Defy General] Passa91:
My understanding with kexec was that you could never get the radio working. I remember back from the Milestone days, they had kexec working on it, but no radio.
[Defy General] Eramix3:
Really nice work with Cyanogenmod 7.1.

No lag, no frame skip, no force closes.
[Defy General] ofmb:
yeah, i'm aware of the problems they had in the past.

the difference now is that a new team (of one, probably :D ) is working on it.

he doesn't post much, but he's products are top quality.

p.s

my own belief is that if he shares his work (even Async) it'll speed up development tremendously
[Defy General] wizwin:
http://www.gsmarena.com/googles_motorola_acquisition_finally_approved-news-3826.php

Will this help us obtain the keys/unlock?

I wish Google will just post all the keys online... :D
[Defy General] Kaffeekranz:
Has anyone tried fumbling around with RSDconnected instead of RSD Lite?

I grabbed a copy off their server, including the in rsdlite's manual referenced to ID allocation tool.

At the moment I'm not motivated to go through the installation since it requires some setting up and I don't even know if it could be of any help to newer phones.

Given that I couldn't find the version I got anywhere on the mighty internet seemed interesting though.

Have a look here: https://rsddownload.motorola.com/download/RSDConnected_PROD_1.14.75_Release.exe

/e

The page I got this from is this here: https://rsd.motorola.com/cs/servlets/PCClientServlet?action=pcClientDownload&isLogged=false

I got it from googling through rsd.motorola.com and similar urls, and I basically was just looking for access to the place they store their software.

The page itself is of no use, since we don't have a valid OneLogin account (which could be created, I already did so, but the account would need to be linked to a project, or service page by an administrator for the interesting stuff), but at least the links seem to partially work.

I haven't found anything useful under other motorola urls though, Google even told me my search behaviour was getting suspicious and asked me to confirm I'm human.

Well.. whatever.. I'm pretty sure it's of no use, but just consider this a gentle push, as this thread seems to be slowly dying.
[Defy General] popcorn1122:
is the above useful?
[Defy General] sam_24:
RDS Connect

I tried to install it, but it requires the "DeviceIdAllocationTool" from moto.

I was able to get my hands on it and finally installed RSDconnected

You need a Motorola OneIT name and password to access the RSD Server at http://rsd.motorola.com.

You need a valid and correct formatted MASC ID.

You need a well phrased "Matrix" File

The Software capable of nothing without the login-data

If you want to try it too and get any problems, feel free to ask me.

RDS-Connect manual: http://goo.gl/iiwG1

Samuel
[Defy General] vij8:
I was reading manual of RSD lite 5.6 and came across this section of MANUAL page no.19-20

/*

Fastboot XML Format

Tags Definition

Header – Contains information about the target phone and software version to flash

Phone Model – Phone model name the image file/s is for

Software Version – Software version to flash

Steps – Sequence of operation to be performed on the device

Operation – Type of operation such as flash, erase, reboot etc.

Partition – Partition name to flash or erase

Filename – Filename to flash

Examples

Ex . Information contained in XML file such as SW version and phone model are shown in header below.

<header>

<phone_model model=”MXXYYZZ” />

<software_version version=”00.55.00” />

</header>

Steps on flash sequence with parameter values and filename are shown below.

Ex 2. Example of flashing a file image in a partition, then erasing another partition, the rebooting the device

<steps interface="AP">

<step operation="flash" partition="cdt.bin" filename="cdt.bin" MD5="2782D02ECE144A1675F9" />

<step operation="reboot-bootloader" />

<step operation="flash" partition="lbl" filename="lbl" MD5="72E87425EDBD5D3387ADC0" />

<step operation="erase" partition="partitionname" />

</steps>

*/

So can we create a xml file and enable fastboot mode from RSD lite... Which by the way is disabled initially ...
[Defy General] henno88:
lol

where you get the needed files ?

filename="cdt.bin" MD5="2782D02ECE144A1675F9"

filename="lbl" MD5="72E87425EDBD5D3387ADC0"

its just a script for rsd how to flash
[Defy General] vij8:
@henno88

As i can understand it is example okkay

flash

reboot-bootloader

erase

are different operation of fastboot only .... MAybe i am not sure we can execute the other operation of fastboot ..... Since the manual only gives example how an xml file should look like if it was accessing the file like .bin or lbl and other operation like reboot-bootloader without parameters......

just an idea ..... i am not developer for embedded system but it may do the trick
[Defy General] royale1223:
All this have been discussed earlier.Defy don't support flashboot flash.It's for newer devices.
[Defy General] mpiekp:
Wrong wrong wrong, it has fastboot.it's just disabled. There are several pics of it on different threads.
[Defy General] henno88:
That just meens there are difrent people with Photoshop ore something like that.

Defy will never be fully unlocked also its an old Device.

Buy a new Phone Samsung or HTC if you want open bootloader
[Defy General] hackergnome:
nope there are some test versions out there with fastboot...

m gonna try to get some goodness when my xams are over...
[Defy General] royale1223:
I didn't say Defy don't have fast boot mode. It just don't support fastboot flash mode in rsdlite. Only AP Sierra flash is supported by Defy. At least that's what mbm said. Sorry to break your bubble.
[Defy General] mpiekp:
sorry to break your bubble but I didn't mention rsdlite.
[Defy General] hrk:
I'm so liking this "my fastboot is bigger than yours" going on, but could you please refrain to useful comments only, since this is a DEV topic? TIA.
[Defy General] henno88:
and all dev´s know this is a useless topic

thatswhy no dev is here
[Defy General] royale1223:
There is no use trying to talk here lol.
[Defy General] abhishek009:
i guess people might have seen this already but there is a leaked moto defy bootloader

w w w. mod2xtreme. com/showthread.php?t=10059&page=5

if someone could reverse engineer it or something .. sorry if i have re posted this , just wanted to help
[Defy General] nepotu:
I will say this again: those bootloaders aren't useful. The bootloaders from that forum are simple boot.img's extracted from nandroid backups or SBF's (leaked or official). We already have the source code from Moto on sourceforge, therefore there is nothing to "reverse engineer".

In the whole process of flashing custom kernels we are missing only one single piece of data: a valid key from Motorola to actually sign the kernels so the bootloader will allow us to boot such kernels. Another scenario on flashing custom kernels is to turn the Defy in an ES (Engineer Sample/Developer phone ... call it whatever suits you), thus the signature of the kernel won't be checked.
[Defy General] zyxwvut:
yeah..... That is over a year old! 1/13/2011
[Defy General] GodSlayer:
The one thing everyone seems to ignore

What about kexec? We must assemble a team of devs and try it.
[Defy General] nepotu:
If it was that easy we were using it (kexec) already. There were some attempts on Milestone and they've managed to reload the kernel, but they weren't able to initiate RIL.
[Defy General] ofmb:
also there's an attempt of [mbm] for bionic,

and (not verified) attempt of kholk from yesterday

http://pastebin.com/vuVfaQ7U

once it'll be known that it CAN be done it'll worth a shot.

the attempt for razr has more potential in my opinion since it's got an unlocked bootloader (version of..).
[Defy General] GodSlayer:
I've been speaking to kholk for a few days now, he said he managed to bypass the BL 100% of times.
[Defy General] Quarx:
Do not confuse the kexec and 2nboot :)
[Defy General] brajesh.sharma87:
nice to see ur post in this thread Quarx. :)

Just one question from you.

Do you think this topic is practical. I mean, collectively, can we do anything or is it a waste, coz a dev like you, hasn't posted much here. That simply means that unlocking bootloader is not possible by us regardless whatever we do.