yashsingh1/xdaforums huggingface dataset:
[Defy General] glycolysis:
Hm... so from this

SEC_MODE_T SecProcessorType(void)
{
SEC_MODE_T ret_val = SEC_PRODUCTION;
/* UINT16 : unsigned short int */
u32 *iterator = NULL;
u32 *data = (u32 *) kmalloc(SIZE_OF_SWRV, GFP_KERNEL);

memset(data, 0xFF, SIZE_OF_SWRV);
SEC_ENTRY_pub2sec_dispatcher(API_HAL_MOT_EFUSE_READ, 0,
FLAG_IRQFIQ_MASK |
FLAG_START_HAL_CRITICAL, 1,
(void *) __pa(data));
if (ret_val != 0)
memset(data, 0xFF, SIZE_OF_SWRV);

iterator = data + 4;

/*HAB_ENG : 13, HAB_PROD : 14 */
/*Engineering only if engineering blown and production not */
if (((*iterator) & (0x3 << 13)) == (0x1 << 13))
ret_val = SEC_ENGINEERING;

kfree(data);

return ret_val;

}

specifically this part

iterator = data + 4;
/*HAB_ENG : 13, HAB_PROD : 14 */
/*Engineering only if engineering blown and production not */
if (((*iterator) & (0x3 << 13)) == (0x1 << 13))
ret_val = SEC_ENGINEERING;

the checked bits are the 2nd and 3rd most significant bits of 0xe0 = 11100000b right?

Or is my math wrong somewhere? :confused:
[Defy General] Epsylon3:
no... in fact its 13 and 14th bits of the SWRV first 32bit long int

oh... iterator = data + 4; hmm i was wrong ... it should be tested with current set values

i m not sure if its + 4 bytes or "&data + 4*sizeof(u32)" so data + 16 bytes
[Defy General] royale1223:
So who's gonna try the new code?
[Defy General] karan_shah189:
cmon guys plzz unlock the bootloader plzzzz......epsy cmon mahn!!!!!
[Defy General] Darbness:
Ill try any code you want. just give me the instructions :)
[Defy General] Epsylon3:
oh.... i need to double check, but maybe this ENG bit is already set....

that could be this "00 E0", translated to 0x0000E000 as u32 which give "0b1110.0000 0000.0000"
[Defy General] glycolysis:
There's nothing new to try, that's just a snippet of the Moto's kernel code that's always been there. It was just some wondering about how this all works, and whether it's possible without clearing any bits. It seems like we have to clear the production bit though...

[76525.368713] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00

Actually if I'm right about the bit positions, this SWRV from mfunz might be bad news for most of us. The byte 02 Chinese SWRV is e0 in most Defys, so it seems like some Chinese Defys might be unlockable by just blowing the engineering bit. That's sure a lot easier than erasing the production bit since sec.ko basically tells you how to do it.

I really hope that isn't true and I'm wrong about something, but the possibility TI put real OTP efuses instead of flash or EEPROM isn't completely out of the question then. I suppose the people getting their phones downgraded from 2.3.6 contradict that though... Motorola isn't making this easy... who knows, maybe unicorns exist too.
[Defy General] royale1223:
My defy is made in china and assembled in India. So so is the case with most phones sold in India. So is there any hope for us? And did anybody other than chinese manage to get eng mode?
[Defy General] karan_shah189:
my defy is from india too.....any hope for indians????
[Defy General] edition-:
I guess every single defy is made in china xD

That is not the point... Just let dev's do their work and stop spamming this thread...
[Defy General] glycolysis:
If you have an e0 in your SWRV for the 3rd to last byte, I don't think anyone here knows how to erase the production bit. I probably spoke too quickly though. The CG downgrading done by the Chinese service centers shows that the efuses can be erased, if not by traditional means. So, maybe possible still.

---------- Post added at 08:45 PM ---------- Previous post was at 08:43 PM ----------

From what I know of pointer arithmetic, it should be the 2nd.

It's equivalent to &(data[4]).
[Defy General] Epsylon3:
This module code should be wrong, the Blank efuse in almost not credible with only the ENG bit (0x20) and nothing as Model ID

The weird thing is the report of 0x44 with bits set to 0x20, it should report 0x77 if the module code is correct...

but well.... i flashed SEC_CUST_CODE and i got 0xE1 -- ie. epsy.ath.cx:888/lxr/source/drivers/misc/sec/sec_core.h#0082

Im now almost sure its what bricked my phone... the second try was a kernel panic which has "rebooted" the phone.... but never booted again
[Defy General] royale1223:
Hmm. If that's true we'll have to wait for a leak of ti software. It might never happen too.
[Defy General] Epsylon3:
Yea, there is maybe a way to reset all the fuses.... as we can see it on the chinese fuse dump....
[Defy General] royale1223:
And what if moto have intentionally published wrong source?
[Defy General] glycolysis:
Oh yeah you're right. I actually misread that as 02 instead of 20, so I didn't notice.

The code to determine processor type and get the SWRV is slightly different, it looks like interrupts are disabled in the first and enabled in the 2nd. I can't imagine why there needs to be a difference. Weird...

Speaking of which... while I was reading the source code of your module I saw TryWriteFuseReg() in the initialization and nearly had a heart attack because I turned my phone off 10 minutes ago. Then I realized the source was newer than the module you compiled. :p
[Defy General] Epsylon3:
i just used this module as base because the code is there.... and there is a logic here... 0xf on froyo sbf, 0x3f of defy+ gb sbf... 1f on some other defy+

and now the chinese dump which confirm it... I know the code is not (only) stored in nand, i was able to make and restore a full dd of my previous state nand before the 2.3.6... so except if there is a some data between partitions... which is not in the nand.. i dont remember about the last data partition, but i think i made it with it also, and all md5 checked
[Defy General] glycolysis:
I'll give DVSDK's flashing tools a shot, see what it can do.

I won't actually flash my phone though, this is my only one and I can't buy another. Basically I'll try to see if it actually recognizes the OMAP3630, since it's supposed to only support the OMAP3530 and some of TI's DM3xxx processors.

EDIT: Oh my 1.5GB. This is a pretty big dev kit.

EDIT2: What... US Export license??? Never mind...I'd do it but XDA is international, and I don't want to the government coming after me.
[Defy General] royale1223:
Hmm. Data between partitions? That's beyond me.

[/COLOR]

I hope it works. I'm gonna sleep now. Gotta take an xam tmrw. Good Luck
[Defy General] hailmary:
i think the name was "_shadow_" w/o the quotes...he is the earliest source of the leak SBF's in walter79's compilations of official ROMS -way back in early eclair/froyos..i dont know,but i think he has a very close source from inside moto.

just a memory from way back ;)
[Defy General] royale1223:
@Epsylon3 There is one more thing we overlooked. X-loader. If you can load X-loader from sdcard then we 've got an unlock. I know someone has tried this in the past and failed but since there is a distinct possibility that you have already reset some efuses, it might work for you. Here's the documentation.

http://code.google.com/p/beagleboard/wiki/BeagleBoardDiagnostics
[Defy General] m11kkaa:
I think he means parts of the NAND which aren't used by the defined partitions.

Look at "/proc/cmdline" and you will see if there is unused space.
[Defy General] tava2003:
There is a thread to make donations to Epsylon3 so he can buy a new DEFY and continue with research to unlock the Defy Bootloader, he´s very close to get it !!!.

Please, no matter how small your donation, we will help Epsylon3 and we will help ourselves !

Link: http://xdaforums.com/showthread.php?t=1446106

Give the rabbit a carrot !!! :D
[Defy General] eric8810:
Hey guys,

There is another fresh news.

Someone in China call the moto service center in his area to request an unlock.

And the other side says he need to pay 80 RMB (about 13$ ) to do so.

He seek for chance to make them unlock the phone online, but they refused.

Obviously, moto already take steps in unlocking defy, but it might be for value.

Question is how can we get a copy of that?
[Defy General] arpith.fbi:
OH **** OH ****...today my friend(who is an engineer at motorola) showed me an unlocked Motorola DROID RAZR!!! He said they have different "KEYS" to unlock all the devices...

I asked him to unlock my defy :D ...he said he is scared and never done something like tat.( most probly wont help :( )

BTW tat moto razr had ICS 4.0.3!!
[Defy General] [] AL []:
+1

but he's a special rabbid ;-)
[Defy General] adlx.xda:
I've got one too (razr), but for the moment it seems nothing can be done with it to unlock others :-(
[Defy General] balika01:
WoW!!! Atrix 4?
[Defy General] arpith.fbi:
sad...now i know who is going to my new best friend :P

I will make him unlock my defy's bootloader for sure...

I remember he also said he have unlocked defy bootloader in past for testing purpose..

He also mentioned defy development is dead and soon defy+ will be after one final update release :(
[Defy General] pulser_g2:
Ask him to get a copy of TI OMAP Board Configure Tool, and the 16MB file used to boot the defy :)

It shouldn't be too big :p
[Defy General] pulser_g2:
Do we have UART access points known?
[Defy General] TJKV:
Hahaa was going to say the same thing :D

yup...get him to accidentally transfer that onto your SD card ;)
[Defy General] arpith.fbi:
lol...next meeting with him confirmed :D

hopefully he is not a xda member..or else will get screwed :p
[Defy General] linbi4706:
ep3,Chinese defyer want help you to test

I hope you are given the tools and methods

can to be the unlockdefy data or test the eng mode

:D if brick they will give moto Repair and unlock
[Defy General] lord0815:
Found in an other post..

Really detailed...

http://www.ti.com/pdfs/wtbu/OMAP36xx_ES1.x_PUBLIC_TRM%20_vW.zip

BTW: i think we need an additional, above mentioned cable if we get the OMAP dev software...

In the past i´ve unbricked some nokia 6230i phones with the jaf flasher.

i think our defys need, like these nokia phones, a signal too to go into an special boot mode where some parts are not loaded an can be changed

without getting a crash. There were a special pin nearby the GND and VCC Pin and some special JTAG like cables to connect pins on phone board.

Today i think this all can be done by an special USB Cable / Flasher Cable.

Everything in this Thread is before the NAND Space - correct me if im wrong.

+

I think eppy changed some active an locked fuses and his script hasnt finished this way - so using a kernel module will allways lead us into an bricked phone?!

best regards
[Defy General] pulser_g2:
LOL. :D

You could always pass it on to someone else, who was trusted, and who would pass it on to those who needed it after ensuring there was nothing identifying on it :)
[Defy General] pulser_g2:
There are details to make this kind of cable for a moto (solder together a couple of pins iirc). I am presuming Ep3 has tried this
[Defy General] chenshuo888:
i want to help you ,but i don't know what can i do
[Defy General] johnsmithx:
Well, there indeed is some data between partitions on mmcblk1, but the whole mmcblk1 is in the nand so that's probably not what you meant, right?
[Defy General] arpith.fbi:
Thanks for the tip :)
[Defy General] royale1223:
Simple. Can you please try and enquire about unlocking moto defy in a repair centre (unofficial).
[Defy General] linbi4706:
http://www.blognone.com/news/24311/motorola-ประกาศถอย-quotเลิกล็อก-bootloaderquot

There were reports that Thailand can unlock

http://bbs.mfunz.com/thread-301187-1-1.html
[Defy General] the|gamer:
He says they kill eFuses to unlock, can he get more detailed?

Can some Chinese Guy translate it?
[Defy General] ofmb:
isn't that @nov.six who's an active member here and knows english?
[Defy General] linbi4706:
<7>[ 152.733062] usb_ether_get_stats

<7>[ 152.737060] usb_ether_get_stats

<6>[ 183.730316] cpcap spi2.0: notify_accy: accy=0

<6>[ 183.741119] musb_pullup - Disabling USB Pullups

<6>[ 183.774169] device_mode_change_write Mode change command=charge_adb

<6>[ 183.774383] musb_pullup - Disabling USB Pullups

<6>[ 183.792053] musb_pullup - Enabling USB Pullups

<6>[ 183.792236] device_mode_change_write - Successfully enabled function - charge_adb

<7>[ 183.802001] usb_ether_get_stats

<7>[ 183.802825] usb_ether_get_stats

<6>[ 184.089324] MUSB BUS RESET as b_idle

<6>[ 184.129333] MUSB BUS RESET as b_peripheral

<6>[ 184.177856] android_usb gadget: high speed config #1: android

<6>[ 184.302001] AUDIO_DRIVER:spkr1 = 0x20, spkr2 = 0x0

<7>[ 188.007263] turning off regulator

<6>[ 241.351348] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00

<6>[ 241.353179] SecGetModelId = 00 00 00 00

<6>[ 241.353759] SecGetProcID = 24 d0 00 14 d8 8a 49 01 00 00 dc ff 02 00 3c 41

<6>[ 241.355590] SecProcessorType = 44

<6>[ 241.355773] Inserting sec module

<6>[ 247.721313] request_suspend_state: sleep (0->3) at 241585845928 (2012-01-15 14:11:46.889923011 UTC)

<4>[ 247.721984] drvMain_GetDtimListenInterval: SITE_MGR_DTIM_PERIOD_PARAM = 1!!!!!

<4>[ 247.722259] drvMain_GetBeaconInterval: SITE_MGR_BEACON_INTERVAL_PARAM = 100!!!!!

<7>[ 308.542663] turning off regulator

<7>[ 312.614105] turning off regulator

<7>[ 623.905822] turning off regulator

<7>[ 731.807830] turning off regulator

<7>[ 752.545959] usb_ether_get_stats

<7>[ 752.549591] usb_ether_get_stats

the orther unlock defy use the sec.ko out side data.hope it help you:)

---------- Post added at 03:42 PM ---------- Previous post was at 03:39 PM ----------

Is a Chinese in Thailand to buy a defy, then heard the news, the Thailand moto can provide unlocking service, depending on the webpage of Thailand
[Defy General] kevin_diu:
I don't know if someone posted it.

http://bbs.mfunz.com/thread-299315-1-1.html

It is the output of sec.ko (thanks zoe1210 )
[Defy General] sykoism:
The one with 1f is also a locked one.

---------- Post added at 11:58 PM ---------- Previous post was at 11:55 PM ----------

[76525.368713] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00

[76525.371856] SecGetModelId = 00 00 00 00

[76525.372344] SecGetProcID = 04 40 02 13 cf dd 46 01 00 00 dc ff 02 00 14 5f

[76525.374023] SecProcessorType = 44

The phone has been confirmed to be unlocked by flashing an unsigned sbf.

---------- Post added 16th January 2012 at 12:10 AM ---------- Previous post was 15th January 2012 at 11:58 PM ----------

According to translation in Chinese forum, they said that Moto can unlock the bootloader by loading a module and killing eFuse.

Anyone know Thai? Maybe we need to get an accurate translation.
[Defy General] scripttec:
do you have a link?
[Defy General] chenshuo888:
i think this work should many people in different countries join in ,and need some translators

---------- Post added at 05:52 PM ---------- Previous post was at 05:50 PM ----------

maybe i can ,but i live in a small city,let me look for a repair centre
[Defy General] sykoism:
There is a link posted by linbi4706

http://www.blognone.com/news/24311/m...bootloaderquot
[Defy General] lord0815:
It´s also called 'blowing' an eFuse... an eFuse is like Hardware DRM IMHO...

Here is a good point to read something about efuses and how micro$oft (XBOX360)

and Motorola use them as a protection....

http://www.tested.com/news/how-efuses-work-and-why-theyre-not-as-bad-as-you-think/585/
[Defy General] will5:
While unlocking, an efuse is blown to avoid signed kernels from booting.

At least on atrix works this way. Once you unlock, signed sbf wont work anymore.

So, if Any phone is bricked but unlocked, probably will need a new bootloader/sbf/kernel.
[Defy General] Rhyr:
So we must unlock and flashing an unsigned .sbf at the same time?
[Defy General] TJKV:
But the Chinese guys with unlocked defy's are reporting that they can, in fact, flash sbf's, that too the ones that are of a lower version, which the locked phones cannot do. I'm assuming they are flashing the signed ones available everywhere...
[Defy General] lord0815:
Signed SBF wont work?

So what these chinese people said, they can flash 'any' SBF?!

They flashed the versions up an down, and as i understood in most

cases official signed SBFs.

From where do you know that signed SBF will not work anymore?
[Defy General] TJKV:
He is speculating, based on how it works on his device :)
[Defy General] glycolysis:
Wait... so for the Atrix, if it doesn't accept signed bootloaders and turns into a brick after unlocking, how do you flash the unsigned bootloader?
[Defy General] Epsylon3:
On atrix its a bit different, custom roms use another Filesystem (ext4) and original sbf's kernel doesnt support it, or is set to use ext3... So you have to format all partitions to return to ext3.

Also their kernel modules (at least for the wifi) cant be loaded on custom kernels, which are too much different from stock one.

Today i tried to make a 3mm5 jack uart, but no luck... i should receive a new defy (v1) in 3 or 4 days
[Defy General] YaPeL:
Reiser4, zcache, BFS, several arm optimizations, OMG can't wait for our defy to have custom kernels.
[Defy General] free2live:
@Epsylon3 : cannot load sec.ko on defy red lens. Any idea what could be the problem? Running on 4.5.1_2.3.4_dfp 74

Sent from another planet
[Defy General] Epsylon3:
i think because moto one is already loaded... use "rmmod sec" before and "lsmod" to know
[Defy General] mr.han:
Maybe try to force load module like in Linux on PC's ;)

insmod -f
[Defy General] free2live:
Still not working... Cannot rmmod such file or directory not exist...

Insmod -f not working... Invalid module format

Sent from another planet
[Defy General] glycolysis:
Try modprobe -r sec to remove Moto's, then insmod /sdcard/sec.ko (or whatever path you have it in)

Anyways...

Take a look here on lines 4729-4892 here: https://bitbucket.org/droiddev/reverse_engineering/src/e1fb11439d26/asm/omap3430_mbmloader-01.asm

The mysterious enum is the input to a switch statement!

They are not indexed at by bits or bytes at all. 0x65 is just a random number to trick us!
[Defy General] free2live:
Didn't work. Maybe my sec.ko module is corrupted.. Could you please provide a link for a new one?

Sent from another planet
[Defy General] mr.han:
What happens when you change sec.ko in update.zip at /system/lib/modules and try to instal it via CWM ?

EDIT :

BTW.

free2live we live near each other :) I am from Lubań.
[Defy General] free2live:
Didn't try. I'll try. Dzieki I Pozdro :) ( thanks and greetings)

Sent from another planet
[Defy General] mr.han:
And what is the situation ? :)
[Defy General] free2live:
the situation is ****ed up. Nothing seems to work

Sent from another planet
[Defy General] mr.han:
Damn !!

Any other ideas to make ours bootloader free ?
[Defy General] Dodge93:
[Removed]
[Defy General] chenshuo888:
they defy can flash any version bl official sbf,but we don't have any unofficial sbf to flash ,so we can't test they can or can't flash unofficial sbf.they said any version bl official sbf can work well on their defy.their defy are in the engineer mode now.some imei is 00000000000001234.a chinese people vid190 give them a test sbf,and said ,if they can flash it,it means their defy is unlocked,and they are succeed,so they said their defy is unlocked.
[Defy General] royale1223:
An sbf file is actually made from smg files and smg files are just squashfs. Moto have been using them for a long time. Making a custom sbf might be easier than you think.

Edit : also you can try flashing stuff from stock android recovery.
[Defy General] Eramix3:
never unlocked?
[Defy General] chenshuo888:
maybe,but my defy is locked now ,so i can't do anything.on the chinese forum,some people said they asked some unofficial services,and the service said they have some tools to unlocked bl(make your defy in engineer mode),and many people are talking that ,if they can buy the tools.
[Defy General] royale1223:
That's cool. The tools are probably already in the market (if by tools they mean stuff like jtag/master cable etc.). Just ask them the name of the tools and a guide perhaps.
[Defy General] sykoism:
The sbf vid190 gave them is an unsigned one. If you check the phone info after flashing that sbf, you can see that the signature of bootloader cannot be found.
[Defy General] chenshuo888:
i have a question ,if we have a unofficial kernel for defy ,can we use some tools to sign it,make that kernel like a official signed kernel.if we flash the unofficial signed kernel ,can defy boot?!
[Defy General] vanyas:
We don't have key to sign it.
[Defy General] chenshuo888:
maybe we can get the key from official signed kernel ,i think .........
[Defy General] r3flux:
If we could have done that, the BL lock would have been history :)

Anyway, will boxes like these help in any way because these are what technicians use to repair phones? - http://www.alibaba.com/product-gs/463239158/Infinity_Box_with_80_cables_for.html

http://www.alibaba.com/product-gs/426364027/MSS_Box_II_Mobile_phones_unlocking.html

Maybe Epsylon3 would be better off with one of these than a new Defy? Just a thought...
[Defy General] vanyas:
Please read about "asynchronous encrypting", Moto use RSA.
[Defy General] walter79:
4.5.3-109-DPP-14 - retail china LINK

[B]CG31.smg version is 6[/B]
CG32.smg version is 1
[COLOR="Red"]CG33.smg version is 2[/COLOR]
[COLOR="Red"]CG34.smg version is 2[/COLOR]
[B]CG35.smg version is 3[/B]
[B]CG39.smg version is 6[/B]
CG42.smg: signature not found!
[B]CG47.smg version is 3[/B]
CG45.smg version is 0
[COLOR="Red"]CG61.smg version is 2[/COLOR]
CG64.smg version is 1
CG65.smg version is 1

NO DOWNGRADE !!

AND here ASIA 2.3.6

[B][COLOR="Red"]CG31.smg version is 6[/COLOR][/B]
CG32.smg version is 1
CG33.smg version is 1
CG34.smg version is 1
[B][COLOR="Red"]CG35.smg version is 3[/COLOR][/B]
[B][COLOR="Red"]CG39.smg version is 6[/COLOR][/B]
CG42.smg: signature not found!
CG45.smg version is 0
[COLOR="Red"][B]CG47.smg version is 3[/B][/COLOR]
CG61.smg version is 1
CG64.smg version is 1
CG65.smg version is 1
RAMDLD.smg: signature not found!

Motorola did some new changes.
[Defy General] arpith.fbi:
Ok..i think i might get my hands on tat TI-tool and tat 16mb file....i called moto guy and he said to come by his office...will see how much money he asks for it..

Keeping my finger crossed :D
[Defy General] THBlurism:
Thai bloger news was translated from this link

http://phandroid.com/2011/06/13/mot...r-bootloader-policy-and-image-in-the-process/
[Defy General] pulser_g2:
Haha interesting ;)
[Defy General] djkail:
Nope... Maybe they read we are near to ti omap tools and they don't want to fully unlock our devices. And... Q3 or Q4 of this year... Are you kidding me? Again? Like 2011? No motorola... I dont trust you

Enviado desde mi MB525 usando Tapatalk
[Defy General] ABBolle:
it would be awesome! Good luck!!!!
[Defy General] pulser_g2:
That article is from summer 2011...
[Defy General] bone101:
Maybe Moto will do it for money.....

Have anybondy asked them ?
[Defy General] nepotu:
I hope this is is not a hoax, because it's is too good to be true. :) Epsylon3 take care man! Hope the /pds partition saga wont repeat.
[Defy General] djkail:
Take it easy man... Let epsy take it slow... We need someone who can translate from chinese to english to help him... That would help him...
[Defy General] Epsylon3:
Here is the MD5Sum compare of raw partitions :

https://docs.google.com/spreadsheet...ZEtleGNZQ1llclE&single=true&gid=0&output=html

Yes, it look like the mbmloader is different

Could somebody ask him what was the SBF used for this dump ?
[Defy General] sonyc2011:
What is to translate. If it is the forum i used google translate... From chinese to english it is ok
[Defy General] Epsylon3:
could somebody put this on multiupload : http://115.com/file/clsppejf

oh, its ok i found the good button, but 4 hours ;p
[Defy General] twa_priv:
Not sure if this is of any help but boot/devtree/recovery are the same as 2.3.4 - 4.5.3-109 (http://xdaforums.com/showthread.php?t=1263212).
[Defy General] kevin_diu:
LOL... He said his defy stays at BL6 and he can't get signal at home so he try to flash BL5 and BL4 with success. And he don't remember what he did with his defy before and tried flash all BL with success.
[Defy General] kevin_diu:
OK I download it now (30mins) and upload it later.