[Defy General] scholbert:
Some thoughts....

Hi folks,

let me first point out, that i do not personaly own a Defy and that i'm not fully aware of all the bootloaders floating around.

I had been PM'ed by furrabbit.nh to give some comments on the attempt to unlock the Defy.

Let me further point out that i am willing to consider the report from the chinese guy as trustworthy.

So i'd like to refer to this translation over here:

http://xdaforums.com/showpost.php?p=21395694&postcount=145

Mmmmh so how to start...

The security on OMAP processors is a real engineering masterpiece, once the CPU has been set to HS mode.

By blowing the HS fuse bit the device gets nearly uncrackable.

There are only to exceptions:

1. You got Motorolas private key and are able to sign your code

2. You got a engineering bootloader (signed as well) that does match the hash keys hard-coded into the device

It seems that there is such a code, if we trust the chinese report :rolleyes:

So what does omapinfo give us?

You might refer to the public datasheet of the OMAP3630, which in fact kind of a subset from the OEM variant which includes also all the security stuff.

Tell me if you need the link or something...

STATE : 205

Simply tells us that the device marked as high security device (not in GP mode).

By setting the HS bit the internal ROM is aware about the use case of the platform.

In other words the internal ROM code "knows" it is executed on a securtity enabled smartphone.

The internal ROM's bootcode then treats external devices with certain security aspects and prohibits low level debugging as well (e.g. JTAG access).

See my thread over here covering the Milestone hardware:

http://xdaforums.com/showthread.php?t=849632

PKEY0 : c57aa19e
PKEY1 : 31fe2d32
PKEY2 : 2e48bc96
PKEY3 : 15fcea7b
PKEY4 : 876578f3

These device specific hash keys are stored in particular area called efuse bank.

The dedicated registers simply represent the setting of a particular area of fuse bits.

Often these bits are unique to a certain platform or device model, in this case all Defy's of a certain series will have the same keys.

Thoughts about efuses:

http://xdaforums.com/showthread.php?t=911611

Maybe it's not up to date concerning all information, but gives an idea.

The internal ROM loader inside OMAP uses these keys to check the consistancy of the very first loader

stored in external memory (mbmloader).

Usually this is NAND flash or an eMMC storage device.

The ROM knowing it is run in HS mode, then expects a certain format for this very first block as well.

E.g. there are certain keys to grant the rights for the bootcode to access special memory areas.

These keys are even higher level security... i really have to skip some points here,

because i would be too much to explain it all and it's already late.

CPU-ID: 2b89102f

This is obvious, if you have a look into the public OMAP3630 manual.

It also hard coded value and represents the silicon verison the processor itself relies on.

There's no specific effect on the security lock.

CPU-ID: 1b89102f -> OMAP36xx ES1.1

CPU-ID: 2b89102f -> OMAP36xx ES1.2

So you may find 1. generation and 2. genration devices here... no big deal.

See page 204 in OMAP36xx manual.

If the story of the chinese guy is true and the service really handed out the same piece of hardware,

there might be hope to convert a usual phone to an engineering one.

The engineering bootloader which is used by Motorola simply has to match the pkeys of the customer phones.

Another story is to flash this loader succesfully to your device if you have not the right tools. So maybe that's why the service needs this mysterious OMAP board configuration tool.

A good thing would be to have the original SBF file of that bootcode.

At least this technique sounds similar to other manufacturers who decided to open up their bootloader.

I guess my comment is not quite complete, but i'll have to sleep now.

Anyway i'll have a look here recently and try to answer questions if i'll find some time.

I also apologize for this technical overdose, but i was asked to put my thoughts down here ;)

Happy hacking and good luck!

scholbert