yashsingh1/xdaforums huggingface dataset:
[Defy General] scholbert:
Hi!

To be honest i would consider to to look into one of the stock SBF's and compare with the dump of the first post.

I don't know if the bootloader will get updated regularly if a new firmware is flashed.

Should be interesting to compare the very first partitions.

So we got this dump in the first post:

@All:

Is this dump definetely from an unlocked device?

If so, it would be nice to get the very first blocks of the device (not the partitions) dumped too.

E.g.:

dd if=/dev/block/mmcblk1 of=/sdcard/mmcblk1.raw bs=512 count=2048

Honestly i don't think it's somewhere in the drivers... but you may digg.

This sounds not really promising...

Anyway might be still something missing.

Please try to make a raw dump of the first ~1MByte of the device with command given above.

There's obviously no risk if you do it the right way.

We'll then have to compare with the files in the zip file (bootloader files taken form the dump in the first post).

When we are able to locate the position of these files in the raw dump, we might also see some hidden block between them.

In fact we'll then have the real raw content of the internal eMMC of an unlocked device.

Following output would be nice too:

cat /proc/partitions

If there will be a device called mmcblk0, this would be very intersting too.

So you might try as well:

dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0.raw bs=512 count=2048

P.S.: In my older post i assumed that the Defy uses NAND flash.

Seems that eMMC is used as external storage and for booting up as well :p

EDIT:

Could someone please give the following output:

cat /proc/cmdline

Regards,

scholbert
[Defy General] free2live:
@Scholbert: have you seen the sbf used for unlocking Atrix or Photon? I think it might help us but I don't have tools or the knowledge to compare this with DEFY SBF
[Defy General] 57op:
My Defy's not unlocked, anyway here's the output:

console=/dev/null rw mem=498M@0x80C00000 init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mmcparts=mmcblk1:p7(pds),p15(boot),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=normal
[Defy General] multiplash:
When I do

cat /proc/cmdline

I get the same, except for the last wort is reboot:

console=/dev/null rw mem=498M@0x80C00000 init=/init ip=off brdrev=P3A androidboo
t.bootloader=0x0000 mmcparts=mmcblk1:p7(pds),p15(boot),p16(recovery),p17(cdrom)
,p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p
25(userdata) androidboot.mode=reboot

Mine is also locked, and I'm running CM9 on Froyo Kernel
[Defy General] mr.han:
console=/dev/null rw mem=498M@0x80C00000 init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mmcparts=mmcblk1:p7(pds),p15(boot),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=normal

Same here, locked Defy
[Defy General] Otto.BR:
There you go! :D (RAW files in the attached zip)

major minor #blocks name	alias

7 0 11466 loop0
7 7 4096 loop7
179 32 1912832 mmcblk1
179 33 128 mmcblk1p1
179 34 512 mmcblk1p2
179 35 512 mmcblk1p3
179 36 1 mmcblk1p4
179 37 512 mmcblk1p5
179 38 512 mmcblk1p6
179 39 4096 mmcblk1p7	pds
179 40 512 mmcblk1p8
179 41 512 mmcblk1p9
179 42 1024 mmcblk1p10
179 43 2048 mmcblk1p11
179 44 512 mmcblk1p12
179 45 512 mmcblk1p13
179 46 4096 mmcblk1p14
179 47 8192 mmcblk1p15	boot
179 48 8192 mmcblk1p16	recovery
179 49 14336 mmcblk1p17	cdrom
179 50 512 mmcblk1p18	misc
179 51 512 mmcblk1p19	cid
179 52 4096 mmcblk1p20	kpanic
179 53 334848 mmcblk1p21	system
179 54 512 mmcblk1p22	prek
179 55 512 mmcblk1p23	pkbackup
179 56 204800 mmcblk1p24	cache
179 57 1319936 mmcblk1p25	userdata
179 0 31166976 mmcblk0
254 0 11466 dm-0

console=/dev/null rw mem=498M@0x80C00000 init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mmcparts=mmcblk1:p7(pds),p15(boot),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=reboot

Also Free2live asked me by PM about what drivers windows was using when connecting with RSD lite.

In bootloader mode the phone will show as motorola flash interface and use motodrv.sys driver.

In Fastboot mode (see my previous post) it will show as Android Sooner Single ADB Interface (see atached JPG) and use motoandroid.sys and a generic windows driver (wdfcoinstaller01007.dll).

Cheers.
[Defy General] free2live:
Great job

Could you please copy the drivers and upload them? At least the one that shows Android Sooner Single ADB..I wonder if it works with normal DEFY
[Defy General] scholbert:
Hi Otto.BR,

that was fast... :D

Thanks a lot i just hovered through the hex values...

Here's the map of the unlocked device from Otto.BR:

eMMC-layout Motorola Defy MB526 (block device mmcblk1)

sector size 0x200 = 512 Bytes

offset 0x00000000 sector 0 partition table
offset 0x00000200 sector 1 .. 27 free (0xff except last 4Bytes = 0x00000001)
offset 0x00003800 sector 28 .. 31 Motorola certificates or keys (filled up with 0xff)
offset 0x00004000 sector 32 .. 35 free (0xff)
offset 0x00004800 sector 36 .. 255 all zero (0x00)
offset 0x00020000 sector 256 .. 511 mbmloader (mmcblk1p1)
offset 0x00040000 sector 512 .. 1023 all zero (0x00)
offset 0x00080000 sector 1024 .. 2047 mbm (mmcblk1p2)
...

I guess sector 28 is a very interesting one :D

The dump does not yet include mmcblk1p3 (mbmbackup), so we might need the rest as well, just to get sure.

If you don't mind try again with some more sectors:

dd if=/dev/block/mmcblk1 of=/sdcard/mmcblk1.raw bs=512 count=4096

Next we would need the same stuff from a locked device as well.

The best would be a dump from a similar bootloader release.

Otto.Br do you know your bootloder version?

Some information about stock bootloader releases in general would be helpful as well. I don't know nothing about bootloader releases for Defy...

If the dump from locked and unlocked are eqal... we'll have to search on a complete different section.

O.K. got it... so mmcblk0 is your MicroSD i guess. So forget about this dump, it's not of any interest.

Does anyone know something about the loop devices?

What does a simple mount command give?

O.K. thanks again... just wanted to make sure which parameters are used.

Nothing more nothing less. Thanks to all the others as well!

I think we don't need any further boot command lines :rolleyes:

If you got nothing better to do... :p

Nice weekend!

Cheers,

scholbert
[Defy General] free2live:
@Scholbert: I have a dump from locked Defy BL6
[Defy General] Otto.BR:
And, here you go again!(see attached zip):D

Onscreen, it shows 9.10, but I'm guessing you want to know the CG version right? Well... I have no idea! all I can say is that when i got my phone back from moto it had a TIM BRAZIL (froyo) sbf, then i flashed BRAZIL RETAIL (froyo),CEE_DEBLUR (froyo), then T MOBILE Eclair, the CHINESE GB (last two to test if my phone was unlocked, posted a few pages back) and finally back to CEE_DEBLUR(froyo for CM7, wich I'm using now).
[Defy General] t0desicy:
I deactivated the function of erasing fastboot inside RSDLite.

Spent hours on IDA...

Now my phone is bricked.

RSD went to 100% and then it failed.

http://imgur.com/laidj

I guess it should have fastboot now, but I can't boot into it.
[Defy General] sonyc2011:
Sorry, hope you find a way to debrick or to be on waranty...
[Defy General] djkail:
Sorry about it... Did it turn on? Does RDS lite detect the phone? Is it totally dead?
[Defy General] brajesh.sharma87:
hats off to guyz like u, who dares for the happiness of other users. Shame on you Moto. :(
[Defy General] t0desicy:
it's totally dead

if anyone want's to continue where I ended, here is the modified DLL.

it should not erase fastboot after flashing an SBF anymore, you just have to find a way how to not brick your phone after flashing..

it's the same size of the original, cause I left everything inside, I just overwrote the command (so IDA still sees every subroutine.)

I will leave here now, ****ing Moto lost another costumer.
[Defy General] mr.han:
Try this !

1) Remove battery
2) Plug phone to PC
3) launch rsdlite (make sure rsdlite driver's is already working properly)
4) Press power and vol+ , and insert battery.
5) Defy screen might still blank but rsdlite would show status connected.
6) flash back your default sbf
7) boot into stock recovery and do factory reset.
8) reboot.

When you put USB cable to the phone white led will blink or something ?
[Defy General] t0desicy:
mr.han, thanks for your help, but it's ABSOLUTELY dead :(

tried everything, I owned this phone for a long time...
[Defy General] mr.han:
No problem.

But there is something like TEST POINT on old Moto's ... maybe it is something like TP in new ones ?
[Defy General] sonyc2011:
warranty??
[Defy General] t0desicy:
don't think so.

I don't use the defy as dayli driver anyway, I have my i9100

I will try to look for a moto service center and see if they can get their hands on it with a certain tool we all know about ;)
[Defy General] sonyc2011:
maybe you will have a unlock defy after that:D

if i will make some test and i will bick my phone what is the chence that the service find out what i did?
[Defy General] t0desicy:
About 0, we are just flashing official, signed sbfs, its not our fault that rsd failed :D

But its on your risk, but basically I dont belive they find out...

Edit:// When I stick my defy to the PC without battery but with macgyver method, I get a white LED, but no bootloader, this is strange.

1. pulled battery

2. sticked juice with USB voltage directly ti to battery connector

3. got white LED

So I think it's dead, cause still no bootloader even with jokes lite volup+power+plug etc etc
[Defy General] scholbert:
Would you mind posting the dump here?

...and could specify BL6 is there any major, minor numbering scheme?

We need full raw dump like Otto.BR made from his unlocked one...

... like this:

dd if=/dev/block/mmcblk1 of=/sdcard/mmcblk1.raw bs=512 count=4096

Excellent!!!

Thanks again... those who want their Defy's unlocked should by you a beer :p

The exact firmware version does'nt matter... knowing it's 9.10 is O.K. for me at this point.

BTW which hardware version is yours, MB525 or MB526?

Could anyone with certain knowledge give me some details about the differences?

Interesting thing is there are two very similar sections @0x00003800 and @0x00183800 in this dump.

Can't tell from memory, what kind of certificates or keys these are...

Might need the dump from a locked Defy to get a better understanding :rolleyes:

Also will do some research again, if i find the time.

The other interesting thing is, that i was not able to located mbmbackup in this dump. Maybe it's located at a higher offset :confused:

We have to find this section, otherwise the risk of bricking is too high.

I'm sorry that you bricked your device, but sometimes every bit counts.

If it's missing, you got a brick. It's really that hard... :(

Unfortunately i got no clue what might be the exact cause or if it could be revived.

What was your intention?

Do have some details about the fastboot erase stuff?

Regards,

scholbert
[Defy General] zdamzdam:
MB526 defy+

stock 2.3.5 rom, locked bl version 9.10
[Defy General] royale1223:
I'm sorry about the brick but there are couple of things you may try.

1) Id vcc usb mod.

2) X-loader. Your device may actually GP one now. No loss in trying.

3) UART - via usb/audio jack

4) Warranty of course

5) If all above fails you can disassemble and investigate more about UART.
[Defy General] edition-:
MB525 is normal Defy

I've seen a lot of references about 526, can be stock CHINA defy or Defy+

There was a tool to find the bootloader version, don't know where to find it now but the last full SBF that I flashed was FR froyo so it should be the same as otto I guess

Attachment with the raw file :)

Edit: I have MB525 normal Defy with CM7 installed
[Defy General] dlhxr:
another dump from locked defy using miui with foyo kernel and green lense and bl4.

plus mine is mb525 made in Tianjin and selling in France
[Defy General] dlhxr:
another one from mfunz.

it is a unlocked defy with bl=4 and mokee rom
[Defy General] Otto.BR:
mine is a normal DEFY MB525, runnig CM7 on top of CEE froyo, made in Brazil, it came with Eclair (froyo was rolling out over here when i purchased it).
[Defy General] dlhxr:
and another one for mfunz.

unlocked device with bl4 and using official 2.3.6 modified by vid90 on mfunz
[Defy General] linbi4706:
official 2.3.6 modified by vid90 on mfunz is 2.3.6 453-109

bl=4 and mokee rom is Froyo kernel cm7
[Defy General] royale1223:
I don't think dumping and flashing mmcblk will accomplish anything. If so epsy would have done it. As the chinese repair man said "Linux (kernal) cannot access/change the important locations where the data related to eng/prod is stored". It is somewhere else in the board. mbm in fastboot mode might work. That's why we should concentrate on RSDlite. I think I know a way to get defy in fastboot using FBFlash.dll.
[Defy General] Epsylon3:
This "reboot bootloader" to show "fastboot" mode, i cant get it... which rom were you using ? was that with "adb reboot" ?
[Defy General] dlhxr:
do you have an unlocked defy now?

it's all based on an unlocked one and locked one will just reboot or enter the bootmenu

and someone with an unlocked defy on mfunz also entered the fastboot mode with adb reboot-bootloader ( i don't know whether there's a dash between reboot and bootloader)
[Defy General] royale1223:
It doesn't work with locked bl. But we might be able to force fastboot via RSDlite libraries. Obviously RSD lite somehow uses fastboot during flashing. Refer my previous posts.
[Defy General] edition-:
That seams like a good idea but are we able to change the data sent from RSDLite?
[Defy General] royale1223:
We dont have to change RSDlite as a whole. We are just taking FBFlash.dll. Make a simple cli tool that can detect a phone, can pass proper arguments to FBFlash.dll and can call FastBootReboot function of FBFlash.dll . It won't change anything on the phone cuz we are not flashing, hence no bricks. Understanding the arguments is gonna take time. Everything's in assembly.
[Defy General] Kaffeekranz:
It isn't that obvious.

RSD Lite features 2 different flash modes and both are accessible via the normal GUI. AP Sierra Flash Mode and Fast Boot Mode.

At least these options show up. It would be interesting if the fast boot mode could (only) be selected on unlocked phones, when booting after using the reboot bootloader command.

Meaning: Still no way to know whether this could be helpful to locked phones, or not.
[Defy General] royale1223:
We'll have to try to know. Right?
[Defy General] scholbert:
Hi,

thanks a lot for the dumps... will have a look at it as soon as i find some time.

If someone would like to help out in the meantime:

Knowing the offset of mmcblk1p3 (mbmbackup) would be nice.

We would a raw dump of that section as well :rolleyes:

Cheers,

scholbert
[Defy General] edition-:
There you go :)
[Defy General] ofmb:
or... we can use Wireshark to capture usb traffic!

than comparing between Otto.br (aka "The One") flashing process and a locked defy flashing process.

i guess capture file would be huge!! but i guess we can filter out most of it... and compare only important files.

so comparing will take place between Otto.br flashing process of signed SBF, unsigned SBF, locked defy signed+unsigned SBF.

4 compares total..

---------------

side note

in order to capture usb traffic (or.. if you have winXP ) you need to have linux as your host machine and windows as guest machine in virtual box.

this link explains it all:

http://wiki.wireshark.org/CaptureSetup/USB

there's also this tool which i'm unfamiliar with:

http://www.usblyzer.com/download.htm

but it looks very complete:

http://www.usblyzer.com/explore-usb-device-tree-view-usb-device-properties.htm
[Defy General] Rbocid:
wireshark!

it's a grade idea!

Let S Anticipate…
[Defy General] erpato:
One question, in any moment of the flash the motorola is in white totally?.

We can stop in that moment and put another rom with a lower kernel.
[Defy General] scholbert:
... never say never...

Hey royale1223!

I wouldn't say it's useless in general... and i don't know exactely what epsy already tried.

There'd been many dumps in the past, but it seems you concentrated on the partitions itself.

When i compare the partitons 2..3 i see no difference on unlocked and locked ones.

But partition 1 (mbmloader) show a slight difference here.

This could be seen better in the "real" dumps...

In the meantime i got 6 different raw dumps, and if the information is correct, there are three locked ones and three unlocked ones.

It seems that the model doesn't really matter and as i already pointed out it's not important which Android version is running.

I'm pretty sure switch for lock and unlock has to be found in the very first blocks, because the initiation for higher level security starts with mbmloader.

I'd like to refer to the raw block device dumps and would like to point to something quite interesting... :D

Basically the pure code parts are equal.

There are some mystery bytes that vary between the locked and the unlocked ones.

First the locked ones:

0x00022a30: 0000 0000 0000 0000 7CCA 8B4C 0000 0000
0x00022a40: D221 0000 0000 0000 0000 0000 0300 0000

Then the unlocked ones:

0x00022a30: 0000 0000 0000 0000 C5AC 8B4C 0000 0000
0x00022a40: CC21 0000 0000 0000 0000 0000 0300 0000

This may be part of a jump table or offset or whatever, but i'm sure it is related to the locking/unlocking mystery :cool:

Additionally it seems that mbm and especially mbmbackup have different offsets in the raw structure of the eMMC, if you compare locked and unlocked dumps.

So i guess this might be a quite good starting point to do some more research here.

Follow the path of observing what RSDlite is doing during update might also be very useful to get a better understanding about the interaction.

This way we might get an idea if the offset plays a role in this mechanism.

Again it's all about reversing stuff :rolleyes:

Have fun!

scholbert
[Defy General] royale1223:
@scholbert thanks, btw is there anyone who knows mbm? His advice would be priceless.
[Defy General] Html5Clouds:
I think epsy said in a later post that he knows him.
[Defy General] nepotu:
I think all the Chinese partitions are uploaded here (except the big ones like cache, system).
[Defy General] marko1103:
There is also a link in the first post 4 this :)

http://www.mediafire.com/?khnvrrr82azwq89
[Defy General] kadofl:
I don't get it. Are still diggin in the dark? :'D
[Defy General] balika01:
sorry guys it not work:(:mad:

edit: (on bootloader v4 and v5 not tested)
[Defy General] walter79:
I have V4 can test on monday.
[Defy General] balika01:
1. test on this rom http://xdaforums.com/showthread.php?t=1263212 back up your all block (whitout big parts (example: system)) whit adb shell dd if=/dev/b... of=/sd... and flash the unlocked whit adb shell dd if=/sd... of=/dev/b...
[Defy General] thomsch:
Also we can ask quarx to try

Enviado desde mi MB525 usando Tapatalk
[Defy General] linbi4706:
THE UNLOOCK DEFY IN RSD will show" SE FLASH OMAP3630", without unlocking the show S FLASH OMAP3630

IMEI 00000001123456 *

if anyone have SE FLASH OMAP3630,is unlock.

but Because the unlockdefy is Rookie use ，have't to test fastboot

If to help, please leave a message, we will contact to test:D
[Defy General] pmp326:
hi flashed 2.3.6 on my defy red lens have all weekend can test all the time :)

i am familiar with adb just dont understand what im replacing
[Defy General] viper520:
sorry for my poor English :), I'm Chinese. I asked a guy about how the defy unlocked(after repair). He said the JS(the man who can fix the dead phone but always want a HIGH pay) only flashed a file(not sbf) into his phone with some tools(not the rsd), the whole procedure without any hardware replacement. Then the JS flashed a uk 2.2sbf with rsd, but in the model col of rsd, it shows SE TI omap 3630. And now his boot loader is unlocked.

So I think the file flashed by JS is the key to unlock, after the flash, the phone will become an eng-board, and the IMEI will become to 000000123456(or 0000001123456 etc).

************************************************************

OK, I confimed a guy who repaired his defy in Shang Hai moto offical repair service site (not the JS), and his bootloader is unlocked now. But the different with above mentioned is his IMEI not changed (not 000000123456 etc). In rsd is also SE Flash OMAP3630, and the hardware is still not changed.

I don't know how they flashed the file, maybe by the usb cable or the usb-to-serial cable...
[Defy General] kevin_diu:
How can we help developers(or us :D) to unlock bootloader, or we need a full dump of the device?? How can we get this??
[Defy General] Cypok:
Any JTAG can read dump.
[Defy General] hackergnome:
I HaD this!!!

My imei was 000000 when I flashed an sbf!(don't remember which one it was will search the junk) flashed another sbf n it was back....
[Defy General] pravarth:
I had something (imei 000000xxx something)similar just after i flashed cm9(maybe for other roms too, didnt notice). It became normal after changed to the right baseband. So i guess its not a big deal
[Defy General] sixSforever:
SBF mirror: http://www.multiupload.com/TRW5DS0M0P
[Defy General] wushantao:
http://www.filejungle.com/f/9XVdza/...2.3.4-4.5.3-66-62-test-keys-ChinaRetail-CN.7z

sbf file CRC32:883DC856

if you can flash this sbf,,,,,

congratulate! you defy is unlock now! hapee ya?:D
[Defy General] hemil:
So if we flash this sbf our bootloader will be unlocked???
[Defy General] eric8810:
nope, that unsigned sbf was for checking if your bootload is unlocked

---------- Post added at 03:06 PM ---------- Previous post was at 03:06 PM ----------

nope, that unsigned sbf was for checking if your bootload is unlocked
[Defy General] popcorn1122:
There is a hope now for a unlocked Boot Loader :)
[Defy General] free2live:
mbm is not a person mate....
[Defy General] mpiekp:
No and he, she, them or it didn't write sbf_flash either .....
[Defy General] popcorn1122:
i dont know if this can help anyone:

http://community.developer.motorola...ader-discussion-board/td-p/22108?pubid=987654

http://developer.motorola.com/products/software/

http://www.motorola.com/blog/2011/10/24/ice-cream-and-bootloaders-and-motorola-–-oh-my/

http://developer.motorola.com/products/defy/

https://forums.motorola.com/posts/c1d5c7abd8?start=1#comment559828

http://www.mod2xtreme.com/showthread.php?t=10059

http://droid-developers.org/wiki/Booting_chain
[Defy General] walter79:
http://xdaforums.com/showthread.php?t=1467739

Milestone 2 with enabled fastboot. Maybe it helps. Milestone 2 has the same hardware like our defy.
[Defy General] ofmb:
interesting - it's not like Otto.br version

http://xdaforums.com/showthread.php?p=21845562#post21845562

but AFAIK you can't flash MS2 sbf's on defy, right?
[Defy General] balika01:
CG30 is the bootloader in 70.13 bootloader sbf and this sbf is unlocked!

link: http://attachments.xda-developers.com/attachment.php?attachmentid=867383&d=1327233540

IT'S DANGEROUS! DO NOT FLASH TO DEFY!
[Defy General] free2live:
What can happen is we flash this to Defy?
[Defy General] djlooka:
Same dump, as requested by scholbert, from my Milestone 2 (CM7 built from sources by tezet - froyo kernel) .

Slightly different hardware, but sw compatible (my phone could run Defy roms with minor porting tweaks).

I think that comparing my dump with that guy's unlocked Milestone 2 might help somehow :)
[Defy General] balika01:
I not tested... I dont want brick my defy