yashsingh1/xdaforums huggingface dataset:
[HTC One X] EddyOS:
It's not branded but it's the Hong Kong region unbranded handset - you have to wait for HTC to push the update out (which I don't think they have yet)
[HTC One X] Product F(RED):
Can't you just change the CID to turn it into any other country's (that also has it) model? I mean, as long as you make sure you don't mix up a One X and One XL CID, and the radio frequency for the one you change to is the same (in case any update has a new radio), you should be fine, right?
[Motorola Droid RAZR] Skrilax_CZ:
On request, I've made a small application that allows you to check secure version checks by the bootloader, by which you can determine whether you can downgrade or not.

What is secure version: when bootloader checks signature (on the signed partitions), it will also verify that their secure version is greater or equal than the requirement stored. The storage works as follows:

CDT Secure Version is written to eFuse as SEC_AP_OS. It is not possible to reflash a cdt with lower secure version, you will get stuck in fastboot.

Other partitions' secure versions are stored in CDT. Therefore it's potentially possible to have multiple CDTs with same secure version, but different secure version requirements on the partitions.

Secure version is checked right when signature is checked. This is for Signature Type:

00 - unsigned

01 - checked at each boot

02 - checked at each boot by BP

05 - checked once, and right after flashing with fastboot

How to check whether you can downgrade? It's quite simple.

1) Find the last cdt.bin (cdt.bin_signed) in OTA or FXZ you flashed. Open it in the tool.

2) Open the FXZ or OTA, you are about to flash. Compare secure versions for all partitions, including CDT. If the new flash file has lower secure versions, you cannot downgrade.

Lastly, note that to flash through fastboot, filesystem partitions with 05 signature type are checked for signature / sec. version, but you cannot find these in OTA.

Download the tool from here: http://skrilax.droid-developers.org/moto/tools/CDTParser_1.00.zip
[Motorola Droid RAZR] whirleyes:
Thanks, I'm just about to release mine.

But yours if perfect!

To someone who prefer to get their hand dirty,

Open the cdt.bin with a binary editor.

Main secure version ID is at 0x37FC (value = 04 since ICS)

Certificate is 2048bit, starting at address 0x3800 ~ 0x3FFF

Customer ID (CID) is at 0x3FFE

- 7 : EU XT910

- 5 : SKT XT910S

- 4 : CN XT910/KDDI IS12M (XT909)

- 3 : LATAM XT910

- 2 : VZW XT912

- DEAD : Phone with a wiped CID.

Extra:

Remember the method to install chinese ICS??

by wiping the CID partition, the bootloader ignores CID number &

that enable you to flash different region rom.

The side effect is, it's only bootable via bp-tools.

Update : Myth is confirmed!! CID is erasable by "allow-mbmloader-flashing-mbm.bin". But make sure to have a backup of it first.

I'm a motorola noobies & my information could possibly wrong.

Proceed at your own risk.

Attached is a simple Java command line tool (usefull for batch job)

usage : java -jar cdt_reader.jar input.bin > output.txt
[Motorola Droid RAZR] Pzyduck:
As always the best my brother. ;)
[Motorola Droid RAZR] dtrail1:
But without root we aren't able to wipe the CID partition?
[Motorola Droid RAZR] whirleyes:
No idea. I think, fastboot doesn't implement function.
[Motorola Droid RAZR] linusmax:
I have erased cdt partition and after i have flash via fastboot. For do it is important flash first the mbloader rewrite module, reboot, after not flash mbloader but erase cdt partition and after write mbloader.

If you look the sbf step in t-mobile package ...execute only first flash and reboot, stop procedure, erase cdt partion and after execute the next two step in sbf.

In this mode you can erase cdt partition. i have do it ...but after i have reflashed the cdt of 4.0.4 ota signed because the system not accept any cdt. You find cdt partition in zip of the OTA 4.0.4 T-MO ..

Bye
[Motorola Droid RAZR] john9:
Thanks for the files!
[Motorola Droid RAZR] pedrotorresfilho:
Hi Skrilax

This is cdt_bin from two versions of GB, first 2.3.5 and 2.3.6 respectively:

2.3.5

2.3.6

My question is about the secutiry version. It's a 03 cdt secure that's not described by you and I want move back.

It's possible, somehow a workaround to flash this?

May I just delete the CDT bin?

system also have diferent secure version, this is a problem to flash system too?

And, Thanks a lot for the tool!
[Motorola Droid RAZR] linusmax:
I have erased cdt partition via RDS Lite but i can reflash only with same secure cdt extracted from the OTA. I try to flash minor secure cdt but it is NO possible.

Where is the control ?
[Motorola Droid RAZR] pedrotorresfilho:
Hi, thanks 4 the reply.

Had you flashed the lower secure mbmloader before?

Status code (Locked 0) :/
[Motorola Droid RAZR] Skrilax_CZ:
@pedrotorresfilho: Secure version is a plain number. What I was describing is signature type (different column).

And no, once you have cdt.bin with sec. ver 03, you can only flash another one with sec. ver 03.
[Motorola Droid RAZR] pedrotorresfilho:
Oh, Man!

Actual official OTA to Vivo is GB 2.3.5, but update to 2.3.6 before ICS rollout is about to happen. Next one will probably be the good one. (All the OTA updates to LatAm razrs came from service providers, carrier: Rogers, Fido, Telcel, Vivo...)

I saw a VIVO update news in motorola website and I'm guessing ICS will come first to vivo phones.

Thanks a lot!
[Motorola Droid RAZR] reachking:
Thanks for sharing!

I have a bricked xt910s which has no sbf files to flash...

My question is if i change the CID in other razr version's fastboot files cdt (to match my xt910s), would i be able to flash it to my damn SKT Razr?

Would it be possible to edit that cdt file?

I greatly appreciated your suggestions!

Thanks.

Sent from my HTC Wildfire
[Motorola Droid RAZR] whirleyes:
The cdt file is sign by a Motorola security certificate. If you edit it, it will failed the verification test. It won't be flash-able.
[Motorola Droid RAZR] nischalnischal:
am stuck on ICS 4.04 leak(non rooted) :( i plan to flash 2.3.6 on this and give motorola my non booting phone to get a motherboard or some sort of replaced phone to get back to the 2.3.6. :(
[Motorola Droid RAZR] dtrail1:
No need to change hardware parts. They are able to flash special signed fastboot files to rewrite partitions.

Gesendet von meinem XT910 mit Tapatalk 2
[Motorola Droid RAZR] nischalnischal:
wow thats news :) good let me try that :)
[Motorola Droid RAZR] lukas77:
Of course it's possible they'll check partition signature to find out you void warranty.
[Motorola Droid RAZR] nischalnischal:
I would say i got an OTA and this is end product :)
[Motorola Droid RAZR] xlightwaverx:
There is a way around these signature checks. But it would require a lot of work and multiple blocks rips from each phone/cdt.bin level that deals with this type of protection.

For example:

Motorola Verizon DROID Razr XT912

2.3.5 / 2.3.6 / 4.0.3 share same cdt.bin version.

6.12.744 ---> 6.14.79

4.0.3 / 4.0.4 share same cdt.bin version.

6.14.84 ---> 6.16.206

There are special signed partitions that only get checked once, and there are special signed partitions that get checked prior to fastbooting and prior to booting.

Once you go up in cdt.bin version, the signatures on all your partitions, (at least ones that require sig,) must match the signatures on that same cdt.bin

If one would want to roll back to GB from ICS, we would have to incorporate the rules of the signature checks.

For one, we would have to find out how the signatures are stored on the partitions. Secondly we would have to have DD backup copies of all the mmcblk's for both GB cdt.bin version and ICS 4.0.4 cdt.bin version.

The new cdt.bin can be knocked out with DD, but I don't believe that alters the eFuse chip configuration.

Once cdt.bin is written, eFuse is changed, and any alterations to system would have to follow those new set of rules.

If we want GB back on an ICS 4.0.4 build where cdt.bin has been upgraded (downgraded version number) we would have to use DD to rip the specific location of signatures (using DD and count option) from each GB and new ICS mmcblks, and then replace those pulled ICS signature bytes from each ICS mmcblk and DD count overwrite them on each GB mmcblks signature location on each specific GB mmcblk. Then DD the newly altered GB mmcblks with new cdt.bin (ics 4.0.4 sigs) back to device, reboot fastboot mode, the phone should have most modern cdt.bin, GB partitions with new ICS signature, and also check required partitions and find the most current signature, hence validation preflash requirements.

Only alteration on GB end would be to exchange old cdt.bin for new cdt.bin in old GB fastboot files. That is as easy as pulling it from the OTA.

Just an idea.

X
[Motorola Droid RAZR] nischalnischal:
Wow thank you so much for the good explanation :) hope to get some ideas and work into it and get this broken :) yay!!! am sure we can, we are one step closer to the solution :) what do you guys think
[Motorola Droid RAZR] dtrail1:
I think this would be a lot of work, many tries and failures and maybe a bricked phone at least until we'll get this to work. But good suggestion. Whirleyes should invite Xlightwaverx to our group.

Gesendet von meinem XT910 mit Tapatalk 2
[Motorola Droid RAZR] whirleyes:
Not as simple as this...

The big M really care to lock the bootloader, how can this simple hack defeat it?

The certificate is calculated unique to the content of the file. Change only one bit can trigger a fail.

So I think, forking a certificate from other version won't work.

It wasn't designed to be like that.(plausible statement)

Disclaimer :

I don't fully understand how the bootloader treat certificate. I never reverse engineer it (never will I).
[Motorola Droid RAZR] xlightwaverx:
Seems like there are a few people from each community all trying to accomplish the same thing. Sidgrafix and I from droidrzr.com have been at our wits end trying to figure this out.

I will help any way I can but as for now I'm just throwing out ideas.

X
[Motorola Droid RAZR] sidgrafix:
On another note, it is an exhausting task and anyone with ideas or trials or added info who would bring them forward "with there thought process behind it" could possibly help to move us forward on this... We are soon to be starting another round of tests, yes probably brick after brick -but inevitably there is a way "there is always a way!"

-we will keep things posted as the trials progress...
[Motorola Droid RAZR] sidgrafix:
You may very well be correct? "BUT" My question would be has anyone actually tried? and what steps were implement? Results if any...

Everybody seams to say no "But who has tried" we have and are! "Bricked more than once already :D " ..and willing to brick again, and again till this is figured out!

So... -anyone!
[Motorola Droid RAZR] FrAsErTaG:
Once we have the official ICS out and providing we can get onto it which im sure we can using the same methods we have now to jump from leak to leak erasing the CID etc

Why would you want to back to GB once the final ICS is out? why risk a brick to go back to what you did not want, hence why you upgraded to a leak before the official was out?
[Motorola Droid RAZR] sidgrafix:
Well there are many reasons! First even being able to jump to the official ota when it comes out is no guarantee.. "yes i agree recent methods should be able to do it!" But at the same time that doesn't solve the problem.. Some developers and many users have put a lot of work into mods for the official released versions.. In my opinion and that's all it is... is my opinion "but having the ability to go back to stock original should be a choice" that being said once figured out could open a whole new playing field even on devices with locked bootloaders...

Further more jumping from a leak to the official ics release "whenever that will happen" is no guarantee you would be able to go backwards at that point either! Thus my efforts along with a handful of others...

As to update on testing and possibilities, it's been slow.. life tends to get in the way... but we have not given up!

Who else out there is working on this i ask? :)
[Motorola Droid RAZR] pedrotorresfilho:
Dont worry about it. There's a team working on this. A new root/upgrade method will be released soon as ics comes out officialy.

Cheers

Enviado de meu XT910 usando o Tapatalk 2
[Motorola Droid RAZR] reachking:
Up for XT910S
[Motorola Droid RAZR] Vatazhka:
I just wanted to confirm that this tool works perfectly under Linux using Mono. :good: Thank you very much for it!
[Motorola Droid RAZR] Osmatic:
Can you add support of RAZR M? XT907/905/902...
[Motorola Droid RAZR] mydoom:
Hi there, i just note my BL number show 0A.74

Can i downgrade to low level BL ?
[Motorola Droid RAZR] Semseddin:
Is there any possibility of cdt.bin downgrade ?
[Motorola Droid RAZR] By.TRabZonLu™:
With these transactions jelly bean 'Can we get back from the ICS?

ban english,sorry.
[Motorola Droid RAZR] mydoom:
POOR ME.....i forgot cdt issue and flash rds fastboot file from cdt 5 to cdt 7 today, madness....
[Galaxy Y GT-S5360 General] amw1:
Hey hii everyone

PLZZ can some one give me stock rom.zip file that can flash with cwm??

Plz help me I need my warranty back coz m giving my cell to my dad

so plz help me

PLZZ help me

Thanks in advance
[Galaxy Y GT-S5360 General] talha936:
Well you can't find CWM backups of stock ROMs here. But you can flash a stock ROM via ODIN. Here is a list of ODIN-Flashable stock ROMS uploaded by Doky73.

Visit this thread for info on how to reset the custom bin counter.
[Galaxy Y GT-S5360 General] manoranjan2050:
yes why not use odin package......... use doky73 odin packages
[Galaxy Y GT-S5360 General] amw1:
..

Ummm I know abt dokys post but the big problem is i can't install odin when i run installer it opens for 2 sec and closed i try it after and befor disabling kies and antivirus till it wont work

By the way can you make backup through cwm and send zip to me????

??

Thanks for replay:rolleyes:
[Galaxy Y GT-S5360 General] hell_lock:
Odin doesnt even have a installer!!
[Galaxy Y GT-S5360 General] Filip98:
ummm ya if you want your warrianty back you will haf to reset the custom bin counter, undo root(do the unroot procedure and uninstall any root theings u have), and be on any stock rom in short everytheing has to be official the kernel too even a random theing like changing model number from gt-s5360 to Galaxy :) could maybe be considerd as voiding -_-

just look in the development section u have everytheing there
[Galaxy Y GT-S5360 General] amw1:
..

I know it wont have any insstaller ......

Can you give me a backuped files through cwm of stock rom ?????:confused::confused::confused::rolleyes::p
[Galaxy Y GT-S5360 General] Saurabh Kamble:
Doky73 does not provide ddlk1....
[Galaxy Y GT-S5360 General] amw1:
Hey someone added ddle1 flasheble via cwm in igoogleplay.co.cc

Just google it
[Galaxy Y GT-S5360 General] sgytweaker:
Here: http://galaxyydroid.wordpress.com/2012/06/16/stock-rom-cwm-flashable-with-14-toggles-status-bar/

i have no friends:'(
[Galaxy Y GT-S5360 General] reynaldoj:
uninstall your ODIN and KIES. Then download and install SAMSUNG USB DRIVER and ODIN.

Odin -> http://www.4shared.com/file/v5eUr999/Odin3_v182.html

Driver -> http://www.mediafire.com/?h59ogjbs78jm0ge
[Galaxy Y GT-S5360 General] luan.pro:
Install driver is quick and easy, affter install y can flash via odin
[LG Optimus 3D] axlina:
Hi. My phone mixes my ringtones. Everytime alarm goes on, or i recieve notification it's different from the one i choose for alarm or notification. I'ts realla annoying. Can someone tell me how to fix this?
[Galaxy Note GT-N7000 General] siuming720:
same as the topic, what rom?
[Galaxy Note GT-N7000 General] joshua:
CM9 to ParanoidAndroid to Ayslum...

Flash them almost everyday depends on mood... :lol:

but mostly stick to CM9...

Noted From My G.NOTE Using XDA Premium
[Galaxy Note GT-N7000 General] nandihno:
LPF stock smoothes stock ics
[Galaxy Note GT-N7000 General] AA1973:
Galaxy Note N7000 - PARANOID ANDROID (CM9)
[Galaxy Note GT-N7000 General] Elmar1801:
Stock LPY with LPF (CF Root) Kernel
[Galaxy Note GT-N7000 General] dbzgts:
Love cm9 based rom but no integrated with spen function.. So stick with kingdroid ics v1.6... It's awesome.. Give it a try ;)

Sent from my GT-N7000
[Galaxy Note GT-N7000 General] debernardis:
Like he said, but with cfroot LPY kernel
[Galaxy Note GT-N7000 General] mstasz:
RON

I was on Rocket ICS v1 but couse of superbrick i move to Paranoid Android :)
[Galaxy Note GT-N7000 General] glienart:
Kingdroid 1.5v really good rom (don't use svoice and launcher so no need to upgrade to 1.6v)
[Galaxy Note GT-N7000 General] Barracuda77777:
Stock lpf, lpf kernel, rooted, with many useless Samsung apps frozen. Running very smooth and battery life exceptional with no deep sleep issues.
[Galaxy Note GT-N7000 General] primitive.A:
i gave official ics german a try, but it was boring compared 2 the rest out there.

felt exactly the same as my old gingerbread. so now i have 2 decide between paranoid android and cm9. wich one has less issues?
[Transformer TF300T Android Development] BierLiebHaber:
Hey,

since im one of the few people that cant get OTAs or unlock bootloader I decided to decompile the unlock apk.

I used dex2jar.

So I now have some Jasmin code (which look to me like assembler) of which I don't understand most. Though looking through the code for things i do understand I found that in "com/asus/unlock/s.j" it says:

L0:
new java/io/FileOutputStream
dup
ldc "/dev/block/mmcblk0p3"
invokespecial java/io/FileOutputStream/<init>(Ljava/lang/String;)V
astore 10
L1:
aload 10
aload 3
invokevirtual java/io/FileOutputStream/write([B)V
new java/io/FileOutputStream
dup
ldc "/dev/block/mmcblk0p4"
invokespecial java/io/FileOutputStream/<init>(Ljava/lang/String;)V
astore 9

which looks to me like its writing raw data from mmcblk0p3 to mmcblk0p4...

So I was wondering 2 things:

1. does anyone know what is on mmcblk0p3?

and 2. is there someone on this forum who understands Jasmin code better than me and could look at the file?

PS: i attached the Jasmin code to this post if thats against the forum rules please take it down.

EDIT:

ok jsut tryed to dd mmcblk0p3 to mmcblk0p4... nothing happens :(
[Transformer TF300T Android Development] XpLoDWilD:
Obviously code shows it writes to blk0p3 and blk0p4 some magic (I guess there's a hash done on serial number, and passed to bootloader).

Once rebooting, the bootloader probably checks this magic, and proceed to unlock if the magic is valid (hence the "Unlock Check Failed" some people got).

Two things to do to make it work:

- Know what is written, how to calculate it

- Know where exactly it is written in p3 and p4
[Transformer TF300T Android Development] john9:
I am here to learn.:)
[Transformer TF300T Android Development] TonyStark R.I.P.:
This post is more suitable for Q&A. This section is for development not for questions of development.

Please have your post moved to the correct location. Thank you
[Transformer TF300T Android Development] BierLiebHaber:
how is this not development?

I'm trying to hack/mod the unlocker apk to unlock all devices... sure its not ready yet but i thought the dev forums are for developers (and wanna be devs - like me) to talk about how to solve problems.
[Transformer TF300T Android Development] peterperfect:
I think its OK on development too. Im asking for xplod/nebkat help to see if we can go further on this.
[Transformer TF300T Android Development] TXKSSnapper:
I don't see a problem with it, but I'm assuming the person who does was referencing the fact that in many device forums (especially ones with large numbers of users) the rule for the android development section is "if you didn't make it, it doesn't belong here." Which isn't a bad idea considering there isn't a dedicated roms or tweaks section.
[Transformer TF300T Android Development] TonyStark R.I.P.:
Yes sir
[Transformer TF300T Android Development] chenxiaolong:
Here are the decompiled java code zip files created with dex2jar and then jad and jd-gui. They're not perfect and not everything could be decompiled, but it should make the program a lot easier to read :)
[Transformer TF300T Android Development] BierLiebHaber:
hmm after looking at the code for ages and trying to recompile it i always get a "wrong sinature" on the transformer (yes i did sign it)... i dont know and cant/wont work on it anymore since i got the ota's today at 3am and was able to unlock the bootloader :)

so i guess its a waiting game for anyone who cant get ota's/unlock
[Transformer TF300T Android Development] XpLoDWilD:
It won't work by compiling it as-is since the obfuscated/undecompilable bytecode resulted as comments in the code (which as it turned out is the part we actually need).

You get "Wrong signature" when installing the app? You probably miscompiled it (or didn't sign it properly). Anyway, as I said above, it won't work as-is.
[Transformer TF300T Android Development] chenxiaolong:
I'm not sure if you're referring to the Java code or the smali code. If you're referring to the latter, I was able to decompile the unlock tool, recompile it, and sign it and it ran in the Android SDK emulator (obviously, with no effect though) :)
[Transformer TF300T Android Development] BierLiebHaber:
i compiled the jasmin code so there were no comments (since it was all byte code)

and i guess i did sign it wrong but i used SignApk (which works for all the cwm zips if created) maybe i have to create/use a special key to sign it?

edit: also i didn't get "wrong signature" when installing i only got it when i tried to install it over the existing install (if i tried to install after factory reset it only said "The app was not installed" :( )
[Transformer TF300T Android Development] untermensch:
this apk need to be signed with the same key as the system, test signing it will not

work.

it also submits the device serial number to ASUS looks like

https://mdm.asus.com/DMServer/DeviceState

the unlock code is probably in the server response.
[Transformer TF300T Android Development] chenxiaolong:
I don't know if running it on a real tablet is any different from the emulator, but why wouldn't a test key work?

I was able to run the (modified) tool in the emulator by doing this:

1. Extract apk with apktool

apktool decode UnLock_Device_App_V7.apk

2. Open res/raw/keystore.bks with Portcecle and delete the certificate.

3. Modify smali code

4. Rebuild apk with apktool

apktool build UnLock_Device_App_V7/ modified.apk
5. Create signing key
[code]keytool -genkey -v -keystore testkey.keystore -alias testalias -keyalg RSA -keysize 2048 -validity 10000

6. Sign apk

jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore testkey.keystore modified.apk testalias

---------- Post added at 04:47 PM ---------- Previous post was at 04:43 PM ----------

Does anyone know how to skip the EULA portion of the tool? The checkbox doesn't show up in the emulator. I don't have an ASUS tablet yet, but I do have have an environment ready to sniff the traffic between the tool and the ASUS server.

I'm thinking of replacing /sys/devices/platform/cardhu_misc/cardhu_chipid in i.smali with different text files and seeing the response from the ASUS server.
[Transformer TF300T Android Development] untermensch:
Android wont allow the requested permissions, unless the apk is signed with the ASUS

key or you sign the rest of the ROM with the test key, unless something has changed

since froyo.
[Transformer TF300T Android Development] chenxiaolong:
Ahh, I see. I didn't know that.
[Transformer TF300T Android Development] untermensch:
you may get around that by odex-ing your changed code and installing

along side the unmodified APK, it has been at least a year since I hacked Android

so I don't quite remember what worked and what didn't work. I seem to

remember that APK's installed in /system/app were trusted regardless of the signing
[Transformer TF300T Android Development] untermensch:
here is my mmcblk0p3 post unlock