yashsingh1/xdaforums huggingface dataset:
[Defy General] samcripp:
listen, this is very simple to find out if is true or not. Get mister chinese man to give you a copy of whatever bootloader it is he has thats unlockable

then on linux run the following on a linux terminal

strings bootloader.img | grep -i unlock
[Defy General] hemil:
Yaaa plzzz free our bootloader epsy
[Defy General] colderain:
The password of this package is bbs.mfunz.com
[Defy General] balika01:
what is the bootloader?? CG45??
[Defy General] djkail:
CG47 i think...

EDIT:

-CG31 : CDT

-CG35 : BOOT

-CG47 : RECOVERY
[Defy General] kadofl:
OMG!

Unfortunately i don't get everything what you say but unlocked bootloader would be sooo amazing!
[Defy General] Epsylon3:
no, the mbmloader is CG63

it look like it is patched (only 3 bytes different)
[Defy General] balika01:
CG56: bploader

---------- Post added at 07:17 PM ---------- Previous post was at 07:15 PM ----------

please upload a .dif file!
[Defy General] balika01:
i don't know this version of diff

i use this:

example.hex
00002a30: 7C C5
00002a30: CA AC
00002a40: D2 CC

patcher: http://data.hu/get/4560025/dif.exe

---------- Post added at 07:35 PM ---------- Previous post was at 07:23 PM ----------

i shink this is the bootloader version:

-000002c0 00 00 ff ff 06 00 00 00 00 00 00 00 70 64 73 00 |............pds.|
+000002c0 00 00 ff ff 05 00 00 00 00 00 00 00 70 64 73 00 |............pds.|

and

-000008a0 06 00 00 00 00 00 00 00 70 72 65 6b 00 00 00 00 |........prek....|
+000008a0 05 00 00 00 00 00 00 00 70 72 65 6b 00 00 00 00 |........prek....|

and

-000037f0 ff ff ff ff ff ff ff ff ff ff ff ff 06 00 00 00 |................|
+000037f0 ff ff ff ff ff ff ff ff ff ff ff ff 05 00 00 00 |................|

the kernel & recovery version:

-000006a0 00 00 10 81 03 00 01 00 00 00 ff ff 03 00 00 00 |................|
+000006a0 00 00 10 81 03 00 01 00 00 00 ff ff 02 00 00 00 |................|

and the sing:

-00003bd0 e5 e8 8c 22 19 2e 8b 50 69 6c c8 0c 9a 03 72 19 |..."...Pil....r.|
-00003be0 9f ba 90 78 2c 04 a0 93 1a 90 e5 44 ee ee 2b e6 |...x,......D..+.|
-00003bf0 3e 18 95 06 33 ed 67 a1 17 20 3d 6e ab 6d ae 09 |>...3.g.. =n.m..|
-00003c00 67 2a e6 4c a4 57 6c 92 ea 4d e2 0b 2e 5a bc 34 |g*.L.Wl..M...Z.4|
-00003c10 46 c3 30 1e 5f 95 6b b6 bc 39 9b 91 29 b2 1a df |F.0._.k..9..)...|
-00003c20 19 36 1e 8c 7b e1 9a f9 41 4e 4f 2b a7 25 ce 49 |.6..{...ANO+.%.I|
-00003c30 cb 06 fb 3c eb 8d 93 ae fc 0b 46 9e e2 8c d8 4d |...<......F....M|
-00003c40 45 4b bb 93 2e 70 ba f3 16 1d 1f fb 89 32 d0 73 |EK...p.......2.s|
-00003c50 35 9e ab ff ff ff ff ff ff ff ff ff ff ff ff ff |5...............|
+00003bd0 e5 e8 8c 36 d9 d2 47 75 3d 14 41 0e 57 f5 ce d4 |...6..Gu=.A.W...|
+00003be0 53 8c b3 b2 ee 8a fc b8 6b 8c 73 b7 a9 79 e6 b1 |S.......k.s..y..|
+00003bf0 c3 4a 34 21 9b a4 8a 96 85 71 b8 3d 47 64 b3 a6 |.J4!.....q.=Gd..|
+00003c00 64 af 40 24 97 69 b1 6f 0c b5 4e 44 6e 58 db 13 |d.@$.i.o..NDnX..|
+00003c10 a1 6e 9b 2f d5 d7 9b 0d bc 3b 08 ee ec 83 9d 2f |.n./.....;...../|
+00003c20 28 47 28 e7 fb c6 ea b7 19 91 9d 81 c4 c4 ad f2 |(G(.............|
+00003c30 a1 6e 3e 99 38 ed 31 cd 64 f5 a6 f8 79 66 c2 0f |.n>.8.1.d...yf..|
+00003c40 e7 16 54 b0 0a 58 f3 4b d7 89 af f4 04 3d b3 53 |..T..X.K.....=.S|
+00003c50 53 16 18 ff ff ff ff ff ff ff ff ff ff ff ff ff |S...............|

---------- Post added at 07:44 PM ---------- Previous post was at 07:35 PM ----------

cdt.bin diff between Chinese and v5?
[Defy General] Epsylon3:
chinese CDT is the 4.5.3-109 DPP 6-7 http://xdaforums.com/showthread.php?t=1263212

this sbf contains :

-rw-r--r-- 1 root root 18432 Jan 13 19:40 CG31.img
-rw-r--r-- 1 root root 133120 Jan 13 19:40 CG32.img
-rw-r--r-- 1 root root 14419968 Jan 13 19:40 CG33.img
-rw-r--r-- 1 root root 18432 Jan 13 19:40 CG34.img
-rw-r--r-- 1 root root 8388608 Jan 13 19:40 CG35.img
-rw-r--r-- 1 root root 342624256 Jan 13 19:40 CG39.img
-rw-r--r-- 1 root root 274432 Jan 13 19:40 CG42.img
-rw-r--r-- 1 root root 3147776 Jan 13 19:40 CG45.img
-rw-r--r-- 1 root root 8388608 Jan 13 19:40 CG47.img
-rw-r--r-- 1 root root 524288 Jan 13 19:40 CG61.img
-rw-r--r-- 1 root root 18432 Jan 13 19:40 CG64.img
-rw-r--r-- 1 root root 18432 Jan 13 19:40 CG65.img
-rw-r--r-- 1 root root 378298725 Sep 8 18:57 DFPRC_U_4.5.3-109_DPP-6-7_SIGNED_USADEFYPRCB1B50AA00A.0R_JRDNGIBRRTGC_P025_A019_HWp3a_Service1FF.sbf
-rw-r--r-- 1 root root 315392 Jan 13 19:40 RDL03.img
[Defy General] balika01:
u on bootloader v6?
[Defy General] chenshuo888:
well done!good luck
[Defy General] sykoism:
If we can get the TI OMAP tool, maybe we can do more than just unlocking the bootloader:-P
[Defy General] pulser_g2:
Correct :)
[Defy General] ezantera:
Hope you have talking skillz man. If he smells money, it would be a price that will hurt for weeks :)
[Defy General] rockeroll:
I think we need a good translater ......

And we must to find a moto engineer to ask for the 16M flie....

well.....Maybe impossable....

I know some engineer of moto, but they are GSM network engineer.......
[Defy General] djkail:
Money? We already paid our phones!!! They want even more!! In their dreams!

Enviado desde mi MB525 usando Tapatalk
[Defy General] djkail:
You can ask them. It's free!

Enviado desde mi MB525 usando Tapatalk
[Defy General] rockeroll:


ehhhhh ....

Maybe it is a good idea.

I'm going to ask them

I hope they can give me some useful message.

for unlock！

forza unlock！

为了解锁！
[Defy General] jufa2401:
How is it going with the v4 Bootloader test?
[Defy General] arpith.fbi:
:(:(:(:(:(

---------- Post added at 09:22 PM ---------- Previous post was at 09:22 PM ----------

M so sorry guys to inform that, but today it dint workout :( :( .. talk just broke down it between...

Anyways i have told my classmate who works for Nokia Siemens in Bangkok to ask her Motorola guys for such tools.:P

I will also be trying to talk to another classmate who is in Texas Instruments for the OMAP tool..

The treasure hunt has begun...we will do watever u can to get the "KEY" to the treasure...we know tat only unlocking bootloader can unlock the door of unlimited opportunity :)

I know u guys had some hopes on me today..but its not just today..the day will come :) :)

I will be traveling 500km tomorrow to talk to one more guy who can help :)
[Defy General] rockeroll:
What a long travel..

thanks for do that .

tomorrow i will to ask my friend work for moto network to find something about it.

unlock is a hard working so we need workharder..(ennnn....).

加油啊各位！英语不好请见谅！

GOODLUCK! My poor English....
[Defy General] linbi4706:
good luck~~~~~~~~
[Defy General] swapnil360:
One of my friends (Defy+ user) has a contact with a Motorola service guy. He says that that guy knows everything about Motorola software and controls an entire service center.

He's probably with us. Will try contacting him tomorrow.

Psst ==> Let's post this in the forums of all other locked Motorola devices with OMAP 3xxx chips too as the TI OMAP tool will help them too.
[Defy General] adlx.xda:
Honestly I doubt those Motorola people would risk their job leaking this kind of confidential stuffs, or tools. #Mho
[Defy General] mdt24:
Ok maybe it's completly unuseful (I understand nothing on this ;-)) but I found this

http://www.ti.com/general/docs/wtbu...lateId=6123&navigationId=12013&contentId=4578

and also

http://omapzoom.org/?p=platform/bootable/bootloader/legacy.git;a=summary

In case someone can use this...;-)

Edit : telepathy !^^
[Defy General] cardozclive:
Can someone check if these links are of any use (I've got zero percent knowledge abt these stuffs)

http://omappedia.org/wiki/Bootloader_Project

http://code.google.com/p/beagleboard/wiki/BeagleBoardDiagnosticsNext

Edit: ^ telepathy
[Defy General] ABBolle:
I think most of this ti-stuff is for a ti device with the same omap cpu. Dont know, if this will help us with our defy.
[Defy General] glycolysis:
The Beagleboard has an OMAP3530, which is basically the OMAP3430 minus all of the security mechanisms to lock bootloader, sign OS, etc. The 3530 is available for hobbyists precisely because it is missing those security capabilities.

In other words, those tools are not really useful to us.

The same is true of the 3730 vs 3630 (which is in the Defy).

---------- Post added at 11:17 AM ---------- Previous post was at 11:14 AM ----------

Yes, I agree. TI probably distributes those tools under NDA (can't find it on the internet, incredible!), so I imagine Motorola has drilled it into their employees not to go around giving away the software.
[Defy General] mdt24:
Found also that about the security of Motorola

http://www.ti.com/general/docs/wtbu...ontentId=4629&DCMP=WTBU&HQS=Other+EM+m-shield

http://and-developers.com/security
[Defy General] heartreaper:
cant we buy an engineering OMAP 3630 board direct from ti, so we can get the ti config tool? along with it?
[Defy General] hackergnome:
good idea!

but what abt motorolas bin file?
[Defy General] heartreaper:
it

might

be easier for the moto employees to leak the bin file than the config tool. you need an installer for the config tool. they may not have access to the installer. but the bin file is just copy/paste.

remember shadow, the guy who first leaked gb for defy?
[Defy General] nepotu:
I don't thinks it's available for mass market users. And even if it is (the price might have many zeroes) + it might came with NDA "attached".
[Defy General] heartreaper:
yes you are right, the ti 3630 site says that it is only available for oems.

we can try this link: http://www.ti.com/general/docs/distributorinfo.tsp

maybe somewhere we can find some distributor. probly in india??
[Defy General] lord0815:
Time matters... :)

I think this LG Tool is not public too.

http://xdaforums.com/showthread.php?t=1244490

and got released.

Perhaps for defy it is the same way and maybe an compareable

tool like this LG tool?!

I´m still sure we need a special cable too.
[Defy General] psicodelico:
The NDA make people here (that can help) just a watcher hauhauauau
[Defy General] maprix:
LG Optimus 3D is driven by a TI OMAP 4430. Similar processor. But there is also a special cable needed.
[Defy General] pulser_g2:
"special" cables aren't an issue - you can easily solder one up. Usually it's standard cable, or one with a minor tweak or two to the pins, such as shorting two.
[Defy General] johnsmithx:
They would risk their job

only

if each of them got a binary different copy of the software and

only

if they gave away this software willingly. If all of them have identical software or the software is taken from them by force (even staged) then they have nothing to be afraid of and on top of that they can make a good money.

Even if they all really have a traceable copy and no one is willing to cooperate (almost sounding like a mob, right?) then there are other ways. What if a service guy forgets his laptop with this software in a restaurant and when he realizes it and comes back the laptop is gone? Or maybe not gone, just the software copied. What if he is actually robbed and his laptop is taken away? So the guy would end up with a broken nose (what a big deal) and some nice $$$, and he might as well sue his employer for making this situation ever possible to happen by locking the bootloader in the first place. In the USA, being a victim of a crime due to the hatred towards my employer (while the hatred was actually caused by my employer's behavior) I would definitely go for the lawsuit, people there are successfully suing companies for much stupider reasons. And if the guy (attacked employee) got some permanent injuries (which maybe, not until the trial is over and the money in the pocket, would turn out to be not-so-permanent) he may sue out some very interesting figure. Or what if the service center offices got robbed? Surely not all of those centers around all the world have the same level of high tech security. How much would it cost to pay some poor Chinese guy (no offense) to commit such a robbery/heist/assault?

Besides, this or similar software has already leaked. We already know that some Chinese guys who are offering "unofficial repairs" use it for that purpose. How much would they want to give us a copy? Everything is about money. It took less than 24 hours to donate enough money to Epsylon to buy a new Defy. Even knowing that the new phone may as well end up bricked again. How much would be people willing to contribute for a proven working solution?

This is not a software otherwise for normal sale so by stealing it and releasing for free would be caused some substantial damages. Nothing would actually happen. No one really cares about some enthusiasts who want to use their (stupid) phones in the full extent. Motorola just needs to be sure that it did all it was supposed to do to prevent leaking this software (as very probably signed in agreement with TI), beyond that no one has really any reason to care. Actually, TI should sue Motorola right away for being irresponsible and by locking the bootloader making the TI's software a target of a robbery. Just look what we are planning here several last pages - we are planning how to steal TI's software from Motorola. All because of Motorola. If I was TI I would call my lawyers right now :-)

Just a little creativity.
[Defy General] royale1223:
We are already working on this. Check out the bounty thread.
[Defy General] djkail:
Think about it... We are looking for a bootloader solution... We dont want TI software. And we werent looking for it if we already have a bootloader solution... All this became because Motorola dont want to free ALL our bootloaders and we are looking for a solution ourselves... Do you think that we look for it for other reason? False...
[Defy General] sam_24:
On Moto's "Factory Cable" the ID-Pin of the micro-usb plug is connectet to Vcc, every thing else stays as it is.

If the "Factory Cable" is pluged in, the battery isn't required to boot the phone or flash a new sbf, i think we should add this to the "McGyver"-Tread

Actually im working on getting a UART acess via the Headphone plug, but i got some difficulties.

dmesg output after loading sec.ko

<6>[ 231.556793] SecGetSWRV = 0f 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0 0 00 e0 00 00

<6>[ 231.562835] SecGetModelId = 02 00 00 00

<6>[ 231.564300] SecGetProcID = 1a 00 01 03 f2 a8 60 01 00 00 d8 ff 22 00 26 1 2

<6>[ 231.569549] SecProcessorType = 44

<6>[ 231.569854] Inserting sec module
[Defy General] djkail:
Oh my god... YOU ARE McGyver!!! :p
[Defy General] slumpz:
Just an idea: If someone with the unlocked phone could swap his for epsylon3's, it could be great. It will fasten the development progress while we're still trying to acquire the unlock software and stuffs.
[Defy General] royale1223:
Have anyone seen this video before it was deleted for violating TOS?

http://www.forum4phone.com/showthre...MB525-hard-reset-Instructions-by-TheUnlock-ca
[Defy General] fabianowerner:
Gimme a little of what u r on
[Defy General] ofmb:
probably this:

Motorola Defy Hard reset procedures by button combination ( if phone is froozen )

Turn the power off. When Motorola DEFY is frozen, take out the battery and reinsert it.

Hold the Volume Down button

Press and hold the Power button until the device turns on. When you see the little DROID just press the LOWER RIGHT of the touch screen!

From the menu: Fastbook, Recovery, Clear Storage, and Simlock

Select Clear Storage by pressing the Volume Down button

Press and release the Power button

Press Volume Up for YES and Volume Down for NO or press the touch screen to select, then the lower LEFT corner OK to hard reset Defy.
[Defy General] royale1223:
I don't think so. Why would this be deleted for violation of TOS?
[Defy General] Epsylon3:
does that works for you ? (this hard reset menu ?)

here nothing ... but well the phone is dead, was a new hope

else ive begun the mbm_loader disasm to compare to droid one : https://gist.github.com/1624247#L3342

The code is almost clear and a bit different Than droid one... which helped me a lot to do the analysis

PROD shouldn't be fused to allow the Eng... there is a check on another bit 12, the MSb of custom code fuse (0x10). Dunno what it is yet
[Defy General] royale1223:
I haven't seen that menu either. Maybe it's paste from some other phone forum.
[Defy General] johnsmithx:
Not gonna give you anything, not for free :-)

Actually it's a mix of several substances, especially two in particular: "common sense" and "creative thinking".
[Defy General] edition-:
Only in android 2.1 I remember to access the stock recovery by pressing bottom right of the screen... Don't think it is something new...
[Defy General] crazy4tricks:
Tried contacting all Authorized service stations near Mumbai India, all they have is RSD lite they don't even know about OMAP configuration tool.. :(:mad:
[Defy General] hackergnome:
There are reports that it kills the battery...

I was gonna try but m afraid....
[Defy General] rishi2100:
is this of any help: http://processors.wiki.ti.com/index.php/C6EaseOfDevelopmentTools
[Defy General] royale1223:
Well if you think they are that open, try asking for the repair manual. How do they repair a real hard bricked defy? On a sidenote I just saw a disassembly video on youtube for defy. It features a t-mobile defy with "engineering" sticker on the battery. Needless to say that my mouth watered. :D

edit: However I have an Idea as to where the tools are. It's probably distributed through https://compass.motorola.com/ . But only people with Motorola membership can access this.
[Defy General] linbi4706:
：（

if ep3 can give defy to chinese js unlock

Maybe can mail it?
[Defy General] rockeroll:
france to china ？

EMS?

p.s.: js=black heart businessman(cash hole)
[Defy General] sonyc2011:
perhaps some hackers...
[Defy General] mpiekp:
I want an unlocked bootloader as much as the rest of you, but it's out of order discussing such illegal activities so openly on open searchable boards, a development forum isn't the place, use irc or something.
[Defy General] lord0815:
Its not the trick to solder them - you need the shematic with pins and other stuff like resistors....

---------- Post added at 09:45 AM ---------- Previous post was at 09:34 AM ----------

....when using such cables you shouldnt use battery!

Device is powered by such cables.
[Defy General] wyumhk:
Has unlocked Defy been proven ?

Some of the people in http://bbs.mfunz.com/thread-298440-1-1.html said that more than 20 Defys are unlocked, but I think his is just counting the people found "SE" in RSDlite. However, one of them with "SE" said he cannot flash the test sbf.

Therefore, found "SE" in RSDlite may not mean bootloader unlocked.

EDIT :

Moreover, in the same thread, a person said he has a NEW motoXT882, RSD also shows SE...Tegra2....
[Defy General] rockeroll:
。。。。not this..

here

in the first bar:“S Flash xxxxx”

if you phone is unlocked

there will change to “SE Flash xxxxxx”
[Defy General] mpiekp:
Please refrain from large quotes. The two things show the same information. An engineering model will show as se, normal is s and there is s third unsecure mode noted as n
[Defy General] lord0815:
Thanks.

I assume he didnt read the full post.

NS Flash OMAP3630 = 1,0,0x00000004, Non-Secure OMAP3630,16
S Flash OMAP3630 = 1,0,0x00000004, Secure OMAP3630,16
SE Flash OMAP3630 = 1,0,0x00000004, Secure Engineering OMAP3630,16

NS Flash OMAP3630 MI = 2,0,0x00000804, Non-Secure OMAP3630,16
;S Flash OMAP3630 MI = 1,0,0x00000204, Secure OMAP3630,16
S Flash OMAP3630 MI = 2,0,0x00000804, Secure OMAP3630,16
SE Flash OMAP3630 MI = 2,0,0x00000804, Secure Engineering OMAP3630,16

so, here is the important part for defy users.

So what i dont know - what is the main difference between Non-Secure and Secure Eng...

Maybe it is true, that SE can flash *all* signed sbf up and down current version including up and downgrade bootloader?!

And NS is the unlock we searching for?! Perhaps NS can only flash unsigned sbf but no signed sbf?

I think SE is just halfway to our goal...
[Defy General] leodfs:
Not just swap, we better let epsylon3 with a unlocked and temporary locked (:D) one. Maybe he was not too close to unlock, but definitely he had a strong clue to do it without a proprietary tool or cable. And now that we known the steps to unlock is easier to persuade some "moto"boy to do it.
[Defy General] sam_24:
l wrote how to connect the pins a few pages ago

http://xdaforums.com/showpost.php?p=21492705&postcount=412

This does NOT DAMAGE your phone or battery in any way.

The ID-Wire consumes about 2 -5 µA witch is just enough to pull a logic level input up.

The Power-Line consumes between 200 and 520 mA during the boot
[Defy General] bone101:
I found this :

http://www.mod2xtreme.com/showthread.php?p=48970&posted=1#post48970

Dont know exactly if this can help.......
[Defy General] nepotu:
@bone101 it is useless. I didn't downloaded the files because I don't have an account there, but from the files names I'm 100% that the files are simple update.zip files containing boot.img for Eclair (signed by Moto), hence it doesn't help. I can create update.zip files with all boot.img versions known so far for Defy, but this won't unlock the BL.

I know everyone of us is eager to unlock or help unlocking the boot-loader but please stop posting every article that you find "interesting". Let's focus on the information that really matters.
[Defy General] free2live:
Agreed. These are old files.. Let the devs work.

DEFYing gravity on ICS planet
[Defy General] wyumhk:
I just connected my Defy to RSDlite, I saw "S flash.....". However, my pst_flash.ini also contains these 6 lines. These lines cannot prove a Defy is unlocked.
[Defy General] mpiekp:
The lines help rsd recognise what the phone is, nobody suggests it will do anything to the phone settings.

So yes all copies of rsd, it's also in the pst of msu contain these lines, they tell rsd how to communicate with each device, you can also see it sends different signals to the device based on what the device is.

this likely affects what blows an efuse on the phone.

May try flashing an bl6 after editing that to recognise an s as an se, anyone think this is worth a shot.
[Defy General] wyumhk:
As we know, Epsylon's Defy was bricked when he tried to set/reset some bits (eFuse ?). If someone actually has an unlocked Defy, he can help to read out the values of those bits Epsylon interested in, and reduce the risk of bricking the phone again.
[Defy General] mpiekp:
Yeah this different though, this can't possibly lead to a brick just being stuck on bl6
[Defy General] hemil:
I M IN INDIA.....CAN ANY1 tell me how can I unlock my boot loader???
[Defy General] jufa2401:
You could use time reading the thread.....

we don't know yet how to do it without bricking the device so ....

You can try going to your local Motorola service man and beg him to do it :p
[Defy General] stefa_vr6:
You are in India and you must be really tired if you haven`t red at least one post from all these 45 pages.

Please remember to sign the petition if you haven`t done it yet! :)

http://www.change.org/petitions/motorola-mobility-inc-unlock-all-smartphone-bootloaders-2#
[Defy General] jayeshrc:
online petitions dont work. ive signed 2 petitions before yours for the bootloader and guess what? no difference.
[Defy General] rockeroll:
it is good thought

but now we just find the way to unlock difficultly

maybe we find NS without SE is easier.

but ,who know ?
[Defy General] glycolysis:
HS / unsecured (NS) modes are set by a soldered pin on the OMAP CPU. Thus, disassembly is required to switch between them.

Some people have accomplished something like that with Samsung Hummingbird CPUs, allowing SD card boot (including bootloader, so the phone is unbrickable), but basically the process is removing a particular resistor that is less than one square millimeter in size, not something most people can do...
[Defy General] royale1223:
Have we identified this resistor yet?
[Defy General] pravarth:
It's been identified on many hummingbird (galazy s and its variants) and also on the exynos.

For the omap3630 it hasnt been located yet: http://xdaforums.com/showpost.php?p=21359711&postcount=184

This could be another line of approach for having an unlocked bootloader, but since it requires a hardware mod maybe not a feasible one for everyone