yashsingh1/xdaforums huggingface dataset:
[Transformer TF300T Android Development] chenxiaolong:
Tracing the code with random (but expected length values), I'm getting URLs, like:

https://mdm.asus.com/DMServer/Devic...H=RkNGOTRFNTBGNzI1N0M5NTE2RkYyNTgxNjcxMUQyMkI

there are also 2 variables

&ACTION=...

&STATUS=...

that I can't figure out. No matter what I send to the ASUS server, I always get the "104" reply.

---------- Post added at 07:05 PM ---------- Previous post was at 07:05 PM ----------

Thanks! I'll see what I can find in it.

EDIT: The hexdump of the partition is attached (EDIT: removed). I see a whole bunch of \x00 bytes and \xFF bytes and some sort of ASCII table. The interesting stuff seems to be at offset E000. I'm not sure what that is for. I'd need to compare it to an mmcblk0p3 partition from a TF300T that's not unlocked.

EDIT2: Would you also mind posting your mmcblk0p4 partition too?
[Transformer TF300T Android Development] prototype7:
Here. Not unlocked yet, but rooted.

mmcblk0p3: http://d-h.st/SjC

mmcblk0p4: http://d-h.st/nIf
[Transformer TF300T Android Development] chenxiaolong:
Thanks a lot! Unfortunately, both of them are empty :( :

┌─(chenxiaolong@cxl-4270cto.lan.cxl.epac.to)─(Mon, 04 Jun 2012 15:48:13 -0400)─┐
├───(/stuff/chenxiaolong/Applications/Android/ASUS/TF300T/PARTITIONS/LOCKED)───┘
└─⇒ $ file *
mmcblk0p3: empty
mmcblk0p4: empty
[Transformer TF300T Android Development] prototype7:
Sorry, I'm an idiot. Tried uploading them directly from the tablet... :p

Here's the mmcblk0p3, still waiting on 4, 816mb lol, I'll update when it's done.

mmcblk0p3: http://d-h.st/mX0
[Transformer TF300T Android Development] chenxiaolong:
No problem :) You can just zip the 4th partition. Most of it is empty, so the resulting zip is around 1MB.
[Transformer TF300T Android Development] untermensch:
file compare shows the only difference is the 16 bytes (which I think is a GUID)

@ 0x0468 and @ 0xE030
[Transformer TF300T Android Development] chenxiaolong:
The 16 bytes at the two offsets seem to be identical too.
[Transformer TF300T Android Development] prototype7:
Here's the mmcblk0p4

http://d-h.st/tGD
[Transformer TF300T Android Development] chenxiaolong:
Thanks for the partition dump! I found 8 areas where the 16 bytes differed between the locked and unlocked systems. The 16 bytes were the same at each offset. However, the 16 bytes in mmcblk0p4 are different from the mmcblk0p3.
[Transformer TF300T Android Development] cozmosland:
Forgive me but what is the point if figuring this all out?

Am i correct to suspect your looking for a way to unlock bootloaders without asus being apart or at least getting with of the bootloader unlock line at startup.

If im on the wrong track correct me, im just curious.
[Transformer TF300T Android Development] chenxiaolong:
Well, there's two reasons (at least for me) that I'm doing this:

1. Don't want to lose the warranty :)

2. A lot of people are having trouble getting the ASUS unlock tool to work. For some poeple have ran the tool and the tool sent the device information to the ASUS servers, but didn't unlock the tablet.
[Transformer TF300T Android Development] FineWolf:
The goal is to be able to unlock your bootloader without sending your serial number to ASUS (and therefore not voiding your warranty).
[Transformer TF300T Android Development] BierLiebHaber:
and in continuation of that (maybe if we really find out how it works) be able to relock the bootloader
[Transformer TF300T Android Development] jujjk:
They're basically looking for a way to successfully reverse-engineer the unlock app. Easier said than done, besides... it could all just be obfuscated code anyway.
[Transformer TF300T Android Development] prototype7:
Let me know if you need any other files, I might unlock over the weekend.
[Transformer TF300T Android Development] untermensch:
I think this is what will be needed, a dump of the mmcblk0p3 and mmcblk0p4

1. locked tablet before the app is run

2. after you run the app BEFORE you reboot.

3. after the tablet is unlocked.

ROOT is needed to get the partition dumps.

I say this because after you run the app and reboot you get a message

like "unlocking tablet please wait" then it reboots again. Any data written

to the mmcblck0p3 and 4 partition is probably erased after the tablet

is unlocked.
[Transformer TF300T Android Development] chenxiaolong:
Thanks! It would be great if you could provide what untermensch said :D
[Transformer TF300T Android Development] prototype7:
Sure, if I decide to unlock I'll do that.
[Transformer TF300T Android Development] prototype7:
Really I just don't want to void the warranty, but I'm getting impatient with this. I know it'll probably take time, but I wanna flash ROMs already! :P
[Transformer TF300T Android Development] chenxiaolong:
No problem :) I understand that not everyone wants to void their warranty (and that includes me too :D).
[Transformer TF300T Android Development] peterperfect:
Any news? I wish i could help but in fact i still cant unlock mine tf300. Im another one with borked SN.
[Transformer TF300T Android Development] prototype7:
I'd love to help to, but I'm no dev, was looking at the unlock app and understood maybe 3 out of every 100 lines. :p
[Transformer TF300T Android Development] chenxiaolong:
I wish we could do something, but I understand almost none of the decompiled code. Right now, we're trying to find what changed in the system after unlocking, but we need someone who hasn't unlocked yet and is willing to provide dumps before and after unlocking.
[Transformer TF300T Android Development] peterperfect:
I can provide the "before" part, but i can't unlock cuz asus is freaking derping with my S/N. The unlocker simply dont work.
[Transformer TF300T Android Development] chenxiaolong:
That would be great! I need dumps of the mmcblk0p3 and mmcblk0p4 partitions. I'll compare it to prototype7's before-unlock dumps. Hopefully, ASUS made this easy and made every device's partitions the same (nothing unique) :D
[Transformer TF300T Android Development] prototype7:
Make sure you zip the mmcblk0p4 or you'll be uploading for an hour. :p
[Transformer TF300T Android Development] prototype7:
What happened to the post unlock mmcblk0p3 dump? Wanted to compare them and was looking back in the thread but couldn't find it.
[Transformer TF300T Android Development] EndlessDissent:
It was here: http://xdaforums.com/showpost.php?p=26943232&postcount=19

Dude removed it for some reason.
[Transformer TF300T Android Development] cavsoldier19d:
Maybe he got death threats from ASUS lol.
[Transformer TF300T Android Development] prototype7:
Wait, I posted my partitions too... :eek:
[Transformer TF300T Android Development] chenxiaolong:
It wasn't a death thread from ASUS :) He was just a little worried that the partition might contain personally identifiable information.
[Transformer TF300T Android Development] prototype7:
Ah. Does it really? Because that would make it different for everyone and harder to find changes.
[Transformer TF300T Android Development] cozmosland:
Thank you for answering my question, keep up the good work.

I'm really looking forward to seeing if this works out :)
[Transformer TF300T Android Development] chenxiaolong:
I certainly hope it doesn't :)
[Transformer TF300T Android Development] DuneBug:
Do you need another dump? I have a locked rooted TF300.

Btw, anyway to get a dump without hooking up to Adb on a PC? On the move at the moment..
[Transformer TF300T Android Development] prototype7:
Yeah, I didn't use a PC at all, just copy /dev/block/mmcblk0p3 and /dev/block/mmcblk0p4 to your sdcard, zip 0p4 and upload them wherever, I used dev-host.
[Transformer TF300T Android Development] DuneBug:
Okay, here you go.. good luck on the quest!

http://db.tt/Tp9Szw2z
[Transformer TF300T Android Development] chenxiaolong:
Thank you very much for the dumps!

Unfortunately, it seems that the partitions on each device is indeed unique, so we can't directly compare two people's partitions. I think we can only compare the dumps before and after unlocking on the same device :(

For those interested, here's a screenshot of the binary diffs of the dumps we have now: http://i.imgur.com/C1ECR.png
[Transformer TF300T Android Development] zaner123:
I was planning on unlocking soon. I can provide the info while I am doing it. Can someone restate what to copy and at what points?
[Transformer TF300T Android Development] chenxiaolong:
Sure thing :) Currently, we know that the unlock tool sends the CPU serial to the ASUS servers and then does something with the device to have it unlocked. Since the tool doesn't require root to run normally, we assume that it doesn't talk directly to the hardware by communicating through /dev/*. What's left would be writing to some part of the internal memory that the bootloader reads to know that it's unlocked.

From the decompiled code of the unlock tool, we can see that the tool specifically mentions the mmcblk0p3 and mmcblk0p4 partitions. So, we would need dumps of those two partitions before and after unlocking :)

EDIT: If you don't mind, could you check the sizes of the dumps before unlocking? Thanks!

mmcblk0p3 should be 2097152 bytes (~2.0 MB)

mmcblk0p4 should be 855638016 bytes (~816 MB)
[Transformer TF300T Android Development] deathskater:
Ha Asus such pricks lol. So those people who haveunlocked by their tool and somehow a toolto lock it comes out they would still know he unlocked and loosehis waranty ( theoretically speaking)

Im definitely going to wait for an unlock that doesnt do this.
[Transformer TF300T Android Development] prototype7:
From that, it looks like the same differences with locked vs unlocked and locked vs locked, so unter was probably right when he guessed that anything written gets erased on rebooting.
[Transformer TF300T Android Development] tewan:
Has one considered emulating the Asus unlock check service to trick the tablet into thinking it is allowed to unlock but sends the serial to a null address? I am not sure of if the tablet phones home every now and then and tells Asus "Hey, I unlocked."
[Transformer TF300T Android Development] prototype7:
I think when you send the serial to Asus, it replies with the unlock code, so that wouldn't work.

Edit: I wonder though, would one serial work multiple times? It is possible to change the serial number, so if someone who already unlocked gave theirs, could we all use it and unlock without them knowing a thing?
[Transformer TF300T Android Development] chenxiaolong:
I don't think a serial would work multiple times. People have unlocked and have gotten the motherboards replaced (probably in countries where ASUS cannot deny the hardware warranty) and they were unable to unlock again.

---------- Post added at 12:31 PM ---------- Previous post was at 12:06 PM ----------

That's a good idea too. It would require a specific network setup though. Since the unlock tool communicates via HTTPS, some special sniffing tools, such as sslstrip and wireshark would be needed. This would allow us to find the exact URL that is allowing the unlock. Something like:

https://mdm.asus.com/DMServer/DeviceState?id=350077523237513&AUTH=RkNGOTRFNTBGNzI1N0M5NTE2RkYyNTgxNjcxMUQyMkI&ACTION=BLAHBLAH&STATUS=BLAHBLAH

It also give us the unlock code that the ASUS server is sending back.

Then we could set up a public webserver to serve that URL and return a proper unlock code.

Assuming that this works, unlocking would be as simple as:

1. Adding the following to /etc/hosts

# IP of webserver
1.2.3.4 mdm.asus.com

2. Running the unlock tool

EDIT: As for phoning home, I think that would just cause unnecessary load on ASUS's servers.

EDIT2: After looking at the decompiled code again, it seems that the warranty is NOT voided after running the tool. The CPU serial goes through a series of hashes and the final hash (SHA1, I think) is sent to ASUS. If this is true, it means that ASUS will have to put the CPU serial through the same one-way hashes and compare the final hash.

My theory: unless the CPU serial is written directly on to the motherboard, ASUS can't know that the warranty is voided when they're servicing a completely bricked tablet.
[Transformer TF300T Android Development] cavsoldier19d:
Thanks for all the hard work so far. So based on your current theory, whats the next step forward on this?
[Transformer TF300T Android Development] prototype7:
Either find out exactly what the unlock program is doing and replicate it, or find out the unlock code ASUS sends after receiving the hash of your serial.
[Transformer TF300T Android Development] deathskater:
How about capturing all packets sent and received during the communication between the unlocker and asus maybe that would help.

I dont know a thing honestly im just guessing by logic
[Transformer TF300T Android Development] chenxiaolong:
That would be the way to do it :) A specific setup is needed to do this though:

1. A router capable of allowing ARP spoofing attacks as well as a firewall with IP redirection and IP blocking support

2. sslstrip for intercepting HTTPS connections

3. Wireshark for capturing all the packets

4. A Linux machine for performing the sniffing

5. A webserver to simulate ASUS's servers

The funny thing is that I have my network set up in a way that can do this, but I don't have a tablet yet :P So, right now we'll try the other method first (comparing dumps before and after unlock).
[Transformer TF300T Android Development] prototype7:
I decided to unlock, I can do what you need but I'm not completely sure how, I obviously only have one shot at it since it'll be unlocked after so I want to make sure I do it right.
[Transformer TF300T Android Development] untermensch:
could the cpu serial/hash be what is written to the partitions?
[Transformer TF300T Android Development] prototype7:
How would that do anything to unlock it?
[Transformer TF300T Android Development] chenxiaolong:
Thanks a lot for helping! I would need a dump of the /dev/block/mmcblk0p3 partition and the /dev/block/mmcblk0p4 partition. I'm not exactly sure how to do the dump under Android though. On desktop Linux, you would run:

dd if=/dev/block/mmcblk0p3 of=/output/file

Maybe someone with more Android experience can chime in here.

Essentially, I need a dump those two partitions before unlocking and after unlocking. Please check that the sizes of the dumps match the following:

mmcblk0p3 -> 2097152 bytes (~2.0 MB)

mmcblk0p4 -> 855638016 bytes (~816 MB)

If the sizes match, then the dumps should be okay :)

Again, thanks for helping :D

---------- Post added at 02:45 AM ---------- Previous post was at 02:31 AM ----------

That's a good point, but I don't think that the CPU serial would change after unlocking.

I can't help but think that only something small is changed. The CPU serial is accessed through the unlock tool using /sys/devices/platform/cardhu_misc/cardhu_chipid, which is provided by the cardhu_misc driver. I don't think that ASUS would write that driver for the bootloader just to know whether the device is unlocked. It's even more unlikely that they would calculate any hashes in the bootloader, since all the code for the algorithms (MD5, SHA1, etc) would need to be part of it.
[Transformer TF300T Android Development] prototype7:
So what exactly is in these partitions anyways? Other than hex codes, is there any way to see the actual files?
[Transformer TF300T Android Development] peterperfect:
Its exactly the same line to dump it on Android.
[Transformer TF300T Android Development] chenxiaolong:
I don't think that the mmcblk0p3 partition is an actual partition. It doesn't have a partition header and is largely filled with zeroes. The mmcblk0p4 partition seems like an ext3 partition, but there are no files in it (weird...).

EDIT: I just found something that I didn't notice earlier. If you look at the top right diff in my previous screenshot: http://i.imgur.com/C1ECR.png, the red hex matches the UUID of the ext3 mmcblk0p3 partition: http://i.imgur.com/kgN0w.png. This means that those 16 bytes in mmcblk0p4 should be different for everyone's dumps. If the unlock tool makes any change, it should NOT be in those 16 bytes :)
[Transformer TF300T Android Development] tewan:
I've got the network that can do this as well as the tablet, but not the know-how. >_> I've failed you guys.
[Transformer TF300T Android Development] rayman:
Hi, a bit of info from our (AndroidRoot.mobi) investigations into TF201 unlock - most likely identical on TF300.

Unlocker sends data from tablet (cpuid amongst other things) to server

Unlocker receives the cpud back, signed with ASUS's private key

App writes boot-unlock to MISC (mmcblk0p3) to tell bootloader to try and unlock

App writes unlock token (signed cpuid) blob to mmcblk0p4 (staging partition)

In short, this has the following implications: Unlock requires ASUS's private key. It's impossible to fake, because it's an RSA 2048 bit key.

I'm not trying to be negative, just sharing our discoveries. Even the slightest change to the unlock token would invalidate it and hence make bootloader reject it.
[Transformer TF300T Android Development] Thing O Doom:
Would there be a way to intercept this key via wifi-sniffing or a similar procedure?

If it's sent standalone I wouldn't doubt it..
[Transformer TF300T Android Development] Northern-Loop:
Doubt it

http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048
[Transformer TF300T Android Development] chenxiaolong:
Well, that's pretty unfortunate. Thanks for the information though! Saved me a lot of time :)

I do have a question: When I looked through the smali code it seems that all the information is hashed before being sent. Assuming that's true, ASUS wouldn't know the cpuid, they must be signing something else then (possibly the final hash)? Wouldn't the bootloader need to verify the key on the blob in mmcblk0p4 and then do the same hashing as the unlock tool?

---------- Post added at 03:06 AM ---------- Previous post was at 03:04 AM ----------

The key would never leave ASUS's servers. They'd sign it and send back the signed information.

The only way we'd get the key is if someone really didn't like his/her job at ASUS and is willing to take a risk...just kidding :)
[Transformer TF300T Android Development] dbdrop:
I just got wireshark setup and was getting ready to take on for the team. Is this a lost cause? I question how far asus would go to lock this thing down, after all there isn't a pot of gold on the other side of the bootloader.
[Transformer TF300T Android Development] chenxiaolong:
If what rayman84 said is true, and the bootloader actually checks an RSA signature, then there's really nothing we can do :( I don't know why Asus does so much just to lock the tablet down either. If they are worried about people returning bricked devices, then they could just unlock the bootloader and release nvflash, so that the forum members can help unbricking the devices.
[Transformer TF300T Android Development] prototype7:
But where does it get the RSA? If that's what the bootloader checks, then what does ASUS send? Sorry if that makes no sense, just throwing out my random thoughts and have no idea what I'm talking about... :cool:
[Transformer TF300T Android Development] chenxiaolong:
You can kind of compare it to something like a bank check. ASUS's server sends the check and signs it (RSA signing). No one knows forge a signature that looks exactly the same (breaking RSA). The tablet knows exactly what the signature should look like on the check and accepts it (RSA verification).

Hope this helps :)
[Transformer TF300T Android Development] prototype7:
So why wouldn't catching and replicating the data from ASUS' servers work? If we can send the exact same info they do, how could it tell the difference?
[Transformer TF300T Android Development] chenxiaolong:
If the data sent back is not unique, then the tablet can't tell the difference if we send the exact same info. The thing is, we don't know if the data is unique to different tablets though.
[Transformer TF300T Android Development] Reilly1812:
IMO - you are trying to unencrypt the transaction between the tablet and ASUS. If it was that easy, no VPN or SSL session would be secure. Each unlock session for each individual tablet is unique and is not duplicated. Easiest way to do that is to incorporate the cpuid into the process. Not trying to burst your bubble but if it was as simple as capturing a datastream then the folks with the Primes would have broken the code long ago.
[Transformer TF300T Android Development] rayman:
It is unique. Quite literally, the actual unlock token is the cpuid (tegra serial essentially), signed with ASUS's key.

We have compared multiple devices unlocks and it most definitely is unique.

Regarding previous questions on why we can't duplicate:

RSA is a public-private assymetric encryption/signature.

You sign data using the private key and is then able to verify using the public key.

So, the bootloader checks two things to allow unlock:

That signature is valid

That cpuid matches device cpuid

So in short: You can use another devices unlock token and step 1 will verify, but step 2 will fail.

I hate to be bearer of bad news but in short: It's not possible.
[Transformer TF300T Android Development] deathskater:
I may be talking bull**** but here is what I have on my head.. lol

Considering it is a unique key based on the cpuid since it is an automated process wouldnt it be some sort of equation that would give you that exact key needed and I'm pretty sure there should be a way to replicate the asus signature right?
[Transformer TF300T Android Development] peterperfect:
Based on your findings, are you able to answer why some owners (like me) are not being able to unlock? The unlock tools keeps returning a "unable to unlock, probably there was a problem on the network connection" or something like that. Failure on sign in on Asus servers?

thanks
[Transformer TF300T Android Development] prototype7:
I'm thinking the same thing, if we compared the cpuid and RSA from 2 different devices, could we find how it was changed and replicate it?
[Transformer TF300T Android Development] prototype7:
Or, could we take the cpuid and the signature of someone who already unlocked and use that? If the two match up, would that work?
[Transformer TF300T Android Development] das7771:
I believe two devs working with the verizon xperia play did something similar. I remember they had either made or figured out the algorithm for the unlock codes from the unlock site provided by sony. Once they had figured it out, they would generate a key for you based off you esn or meid. That's how i was able to unlock I my xperia play.
[Transformer TF300T Android Development] afazel:
So here's a question, and this may have been tried before but I'm going to ask anyway:

We don't have access to /recovery because it is encrypted. Ok, fine, I sort of understand that (although I'm not sure at what point it is encrypted, because I know what an encrypted HDD you _can_ just format and write over it even though you'll lose the data on the HDD).

But we have basically full access to /system once we root. Not sure about /boot. If we can't use traditional recovery to flash changes because we can't flash a custom recovery, what keeps us from using a utility that does something like a dd to /system to flash changes to the ROM from within Android?

Make changes, reboot, changes are applied.
[Transformer TF300T Android Development] chenxiaolong:
I've always wondered about this too. Why not just copy the files from the ROMs over to a running instance of Android? The Linux kernel allows overwriting of files when they are open.
[Transformer TF300T Android Development] unfnknblvbl:
It's a catch-22: in order to do that, you'd need to be root anyway. The bootloader itself is what stops you from ever doing things like that; if you tried to dd to the recovery or boot partitions, it would just fail with some error about insufficient privileges.
[Transformer TF300T Android Development] afazel:
I am root. My question is less about dding recovery and more about dding /system and /boot. I can mount my /system as read/write and make changes there currently.