yashsingh1/xdaforums huggingface dataset:
[LG Optimus 4X HD] trapacska:
ok so.. basically /data/local/ have no permission to write (adb push needs rw folder, or su)

so you can use adb shell su -c and do stuff, but what i did:

adb push dumpSBK /data/local/tmp/ <because /data/local/tmp is rw by default

adb shell

su

chmod 777 /data/local

mv /data/local/tmp/dumpSBK /data/local/ <not needed regarding to .c file, but why not ok

chmod 777 /data/local/dumpSBK <you can try chmod 4777 /data/local/dumpSBK as well

/data/local/dumpSBK

here you go, what i've got is:

/data/local/dumpSBK
Generic Nvidia Tegra Secure Boot Key Dumper, v0.1
Usage: /data/local/dumpSBK [mem_size]
for P880, mem_size=1024
Before kernel patching:
secure_boot_key is NULL
odm_production_mode=0x00000001

then phone freeze to kernel panic and shutdown(security as well)

then i turned back and again:

/data/local/dumpSBK 1024
Generic Nvidia Tegra Secure Boot Key Dumper, v0.1
Usage: /data/local/dumpSBK [mem_size]
for P880, mem_size=1024
Before kernel patching:
secure_boot_key is NULL
odm_production_mode=0x00000001

Searching physical memory size=1024MB
Searching..... 000MB

and kernel panic shutdown again. hope it helps
[LG Optimus 4X HD] marsgod:
I am not sure what cause this problem.

So , please open another adb shell, type:

su

cat /proc/kmsg

and in another adb shell, re-run dumpSBK,

I want to check what the kernel provide kmsg when trying to access /dev/mem

It seems that the kernel enable the /dev/mem security protection.
[LG Optimus 4X HD] marsgod:
2013/01/01:

modify the program, and let you select which memory range to patch.

usage: dumpSBK [start_memory_addr] [end_memory_addr]

for example: dumpSBK 1 1024

which will search 1MB ~ 1024MB memory and try to patch the kernel.

It seems that the linux protect the firrst 1MB physical memory from being read/write.

So you can select which memory range search for the patching point.

But as I remember, the patching point is in the first 1MB memory.... :(

Maybe we have to search other technology to patching the kernel or bypass the protection.
[LG Optimus 4X HD] Tim_Pan:
127|shell@android:/ # /data/local/dumpSBK 1 1024
/data/local/dumpSBK 1 1024
Generic Nvidia Tegra Secure Boot Key Dumper, v0.2
Usage: /data/local/dumpSBK [star_mem_addr] [end_mem_addr]
for P880, end_mem_addr=1024
Before kernel patching:
secure_boot_key is NULL
odm_production_mode=0x00000001

Searching physical memory [1MB~1024MB]
Searching..... 1023MB
Kernel patching failed! Abort....
[LG Optimus 4X HD] marsgod:
So, I need a boot.img for P880.

someone can dump this for me?

just in adb shell

dd if=/dev/block/mmcblk00? of=/data/local/boot.img

adb pull /data/local/boot.img

I don't know which mmcblk is for boot.img, so need some skilled guy do it.
[LG Optimus 4X HD] reas0n:
boot.img ==> http://xdaforums.com/showpost.php?p=30947607&postcount=11 (thanks to Dexter!)

and about mmcblk, is this it? https://skydrive.live.com/#cid=089FD6B2972F0181&id=89FD6B2972F0181!157
[LG Optimus 4X HD] marsgod:
Thanks for info.

By extract config from the zImage, I found that the # CONFIG_STRICT_DEVMEM is not set

This mean that we should have full read/write access for the whole physical memory.

So the "dumpSBK 0 1" should work.(this will check the first 1MB memory)
[LG Optimus 4X HD] razerblade17:
thanks..i think u much more hardworking than kholk..we donate to kholk last year, but still dont has any news from him..he should respect the donator :laugh:
[LG Optimus 4X HD] marsgod:
2013/01/01:

v0.3 add more error detection in the file.

it should print out some message before linux crash..... :)
[LG Optimus 4X HD] The Troll:
no offense to kholk, but i see more progress done here
[LG Optimus 4X HD] trapacska:
i already tried kmsg, but here is the log, nothing... just sudden death(can be k-panic)

i think we are in ****. :)

we need jtag. i am not gonna disassembly my phone, but i am sure we need jtag :)
[LG Optimus 4X HD] nickslg:
As I see it without jtag support what is happening here is completely useless
[LG Optimus 4X HD] marsgod:
This method is try to bypass the kernel read SBK protection.

kernel protection:

if ((param == SBK) && fuse_odm_prod_mode()) {
pr_err("device locked. sbk read not allowed\n");
return 0;
}

as you can see, the kernel try to block read operation when in production mode.

So, if we has some method patching the kernel when it running, like this:

if ((param == 100) && fuse_odm_prod_mode()) {
pr_err("device locked. sbk read not allowed\n");
return 0;
}

Then we can read out the SBK.

Currently, it seems that the P880 kernel has a full /dev/mem read/write access, so it should be possible patching the kernel when it running.

And the most bad thing is , when you read out SBK, and it said the SBK is all zero...... It means that the SBK is blocked by hardware, not just kernel patching can read it out. (But I think SBK is burned on fuse, so it can be read out.)

PS: This method seems has nothing to do with JTAG.
[LG Optimus 4X HD] marsgod:
And I have no P880 at hand, so I tested the program on my SU660(which has a tegra2 processor and no SBK burned). The program can patching the kernel when it running.

So I think it should be the P880 has some difference thing when patching the running kernel, it will cause the kernel panic.

root@android:/data/local # ./dumpSBK
./dumpSBK
Generic Nvidia Tegra Secure Boot Key Dumper, v0.3
Usage: ./dumpSBK [star_mem_addr] [end_mem_addr]
for P880, end_mem_addr=1024
Before kernel patching:
secure_boot_key=0x00000000000000000000000000000000
odm_production_mode=0x00000000

Searching physical memory [0MB~10MB]
Searching..... 000MB
Found patching point at physical address=00061E4A [0X05 -> 0X07]
Trying to write the memory now, wait 5 seconds.....
Write the memory done.....
Searching..... 009MB
After kernel patching:
secure_boot_key=0x00000000000000000000000000000000
1|root@android:/data/local #
[LG Optimus 4X HD] RuedasLocas:
Sorry guys cause about programing and stuff like that, I don't understand nothing...

I don't know from where but, I found the file "init.rc" in /data/local/temp... can someone explain what is that file about?

I save it as a .txt file:

View attachment 1609748

Thank you and sorry once more :o
[LG Optimus 4X HD] Tim_Pan:
"init.rc" is included in boot,but I don't know why the file exists there.

I know little about programming as well...:D

BTW,

4XHD can communicates with pc through uart.

I have a USB to TTL Board,however,i can't see any logs on the term and I can't find a way to make it works correctly.
[LG Optimus 4X HD] nickslg:
Devs i found a post that that might be relevent to the cause .........A new report on the new Generic SBK Dumper: (I can't directly access the thread since my post count isn't high enough)

Unfortunately, it didn't work either. However, I made some research and found out that mmap_min_addr is set to 4096. Since marsgod is trying to map the NULL (0) address, wouldn't this be the reason of these kernel panic ?

(I am not able to confirm this though: using sysctl -w vm.mmap_min_addr = "0" didn't change anything but I'm not sure it actually made a real change into the kernel parameters)

Maybe it would be worth reporting in the good thread. This just may be a wrong explanation but it seems this parameter has been set to 0 in many older systems, and since he doesn't own a P880 he may not know about it.
[LG Optimus 4X HD] RuedasLocas:
That was my doubt...
[LG Optimus 4X HD] reas0n:
@marsgod, where are You from? Maybe kholk could lend You the P880 (when LG sends it to him back) and You could make dat sh*t working :D
[LG Optimus 4X HD] trapacska:
Yes,i know. I just think, that to be able to go thru' bootloader to get nvflash or fastboot workings, and then we need to request a token key from fastboot, and then generate somehow sbk, or at least looking for offsets from token generated. token generated regarding to device id, imei etc.etc. AND partly from bootloadr unlock code.

and basically i think we can flash custom kernel or anything over OTA service. need to be hardly smali-ed the ota app, and well done.

correct me if i am wrong. we have su, we can smali apk/framework, OTA can upgrade any part of device. need to remove download-->temp place --> update file and make simply load from --> our place --> our filename. if it is an encrypted format(i guess, why not) will be easyer to mod that file instead of kernel patching.

do anybody know what file downloading over OTA?

---------- Post added at 02:34 PM ---------- Previous post was at 02:23 PM ----------

Please, somebody who update over OTA, and not formatted /data yet provide me this file: or folder content:

/data/data/com.lge.lgfotaclient/files/dlpkgfile
[LG Optimus 4X HD] reas0n:
well, You can just flash for example v10a firmware via kdz and do it by yourself :D

i unfortunately can't help, still waiting for the phone
[LG Optimus 4X HD] friartuckme:
il give it a try and flash v10a on to my phone and then update it when im back at home in an hour if no-ones done it by then
[LG Optimus 4X HD] trapacska:
I need OTA zip. When you are on an older kdz flashed, and go to settings - > software update and thats dwnloads it(that update zip which may contains .b files, as a patcher)
[LG Optimus 4X HD] Dexter_nlb:
there is no ota zip. the dlpkgfile is encrypted and not possible to unpack (at least not without encryption key)
[LG Optimus 4X HD] friartuckme:
flashed to v10a and when try to update OTA it keeps saying i have the latest already, ive checked in the phone info and its saying its on v10a so not sure what is happening
[LG Optimus 4X HD] RuedasLocas:
factory reset? :confused:
[LG Optimus 4X HD] friartuckme:
ive tried factory resetting afterwards to see if it helps and still the same.it says you are using the latest software version in current os version
[LG Optimus 4X HD] RuedasLocas:
weird... when I downgrade to v10a I don't even connect to the internet, is just the time to factory reset and upgrade again, but if the v10a is the right one for the phone (not a euro_open in a canadian or brazilian phone for example...) it should give the update notification :eek:
[LG Optimus 4X HD] friartuckme:
i tried the euro open version as im certain it was the euro open when i got it,but il find and try the uk open just to rule that out,thanks mate
[LG Optimus 4X HD] RuedasLocas:
After tried everything on "NVflash" and "ADB" my phone started to freeze and turn off... yesterday I re-installed everything again.

So soon my will to test whatever it is without any tiny hope that it works is zero... :eek:
[LG Optimus 4X HD] alekthefirst:
Kernel panics when trying to search the first mb of memory
[LG Optimus 4X HD] alekthefirst:
Any news?
[LG Optimus 4X HD] marsgod:
2013/01/06:

v0.4 wil search the first 1MB physical memory, you can specify the start_address , for example dumpSBK 32

and this dumpSBK version has a updated search pattern , it will fit for more compiler options.

for P880, if you run "dumpSBK" crash you device, I think you can try different start_mem_address, for example:

dumpSBK 200

dumpSBK 300

dumpSBK 400

....

PS: now the dumpSBK will ONLY search the first 1MB physical memory.... so it should be very fast....
[LG Optimus 4X HD] alekthefirst:
Will try... :eek:

---------- Post added at 12:40 PM ---------- Previous post was at 11:54 AM ----------

My phone crashes even at the highest possible value...

(i did try lots of other random numbers)

C:\Users\Expert>cd C:\o4xr

C:\o4xr>adb shell

shell@android:/ $ su

su

shell@android:/ # /data/local/dumpSBK 1008

/data/local/dumpSBK 1008

Generic Nvidia Tegra Secure Boot Key Dumper, v0.4

Usage: /data/local/dumpSBK [star_mem_addr (KB)]

It will search the first 1MB of physical memory...

System page size=4096B

Before kernel patching:

secure_boot_key is NULL

odm_production_mode=0x00000001

Searching physical memory [1008KB~1MB]

(Phone crashed here)

C:\o4xr>

C:\o4xr>

C:\o4xr>adb shell

shell@android:/ $ su

su

254|shell@android:/ # /data/local/dumpSBK 1020

/data/local/dumpSBK 1020

(Phone crashed here)

:crying:
[LG Optimus 4X HD] roesti91:
some tests

Hi, I also tried this on V10h:

shell@android:/ $ su

su

shell@android:/ # dumpSBK

dumpSBK

Generic Nvidia Tegra Secure Boot Key Dumper, v0.4

Usage: dumpSBK [star_mem_addr (KB)]

It will search the first 1MB of physical memory...

System page size=4096B

Before kernel patching:

secure_boot_key is NULL

<CRASH>

kmsg output:

<3>[ 185.430172] device locked. sbk read not allowed

What more can be tested here??

On the first try I also got:

odm_production_mode=0x00000001

and the usual crash.

Can we have a progress bar and more debug output? Why would does it output "sbk read not allowed" if the kernel is supposed to patched to allow the sbk reads, BEFORE any sbk read is attempted by the dumper?

BTW. I really love your work!! I hope we can somehow get it working :good:
[LG Optimus 4X HD] marsgod:
The program try to cat /sys/firmware/fuse/secure_boot_key before kernel searching and patching.....

so you got the device lock message.

Then it will search the 1MB memory, it seems that the first 1MB memory of P880 can't be read/write....

this may because:

1. the 1MB memory is protected ..... but I don't think so...

2. the 1MB memory is mapped to some other memory , such as I/O or somewhere else, but not kernel memory....
[LG Optimus 4X HD] marsgod:
A modify version dumpSBK, it use the new search pattern and search the 1MB~1024MB memory.

just run "dumpSBK" and wait...
[LG Optimus 4X HD] alekthefirst:
Will try when i get home, this post will be edited then...
[LG Optimus 4X HD] roesti91:
Thanks, I tried it:

shell@android:/ # dumpSBK

dumpSBK

Generic Nvidia Tegra Secure Boot Key Dumper, v0.4

It will search the 1MB~1024MB physical memory...

System page size=4096B

Before kernel patching:

secure_boot_key is NULL

<FREEZE>

I guess a freeze is a crash, there is no kmsg output, also freezes. (Well I guess it should not freeze while searching?)

Is there a simpler test if any part of the memory can be read at all, or if memory cannot be read on the P880, without patching something first?

( How about making sense of the OTA_UPDATE inside the dlpkgfile, looks like the syntax at the end of the file is not encrypted, but I cant make sense of the file structure: http://www.mediafire.com/?14513uiv3xmkjbn )

Here the LG url to this ota_udpate example: http://63.123.43.41:80/dlserver/mo?firmwareid=FW00004196&packageid=P1&workcode=100&uid=11111111111
[LG Optimus 4X HD] roesti91:
How about compiling Lime for the kernel and use its dump to search for the bootkey. If anyone can compile it, I will create the memory dump:

http://www.xda-developers.com/android/lime-forensics-kernel-module-for-raw-memory-snapshots/
[LG Optimus 4X HD] Tim_Pan:
"The most important thing, for you memory hackers out there, is that viewmem relies on the /dev/mem and /dev/kmem devices. Since the /dev/mem and /dev/kmem devices allow direct access to device memory, they are a vulnerability. These Linux devices are being phased out, as they have been the targets of multiple exploits as of late. "

can we?
[LG Optimus 4X HD] alekthefirst:
There is no /dev/mem
[LG Optimus 4X HD] The Troll:
i'd suggest peeps to use 10a for this..

i dunno.. lg did say something about fixing exploits on later firmwares *as i seem to recall*

also, sourse for no /dev/mem?

might be present but not accessible/hidden due to locked bootloader *i hope*
[LG Optimus 4X HD] roesti91:
There is a /dev/mem and even kProbes are enabled in the Kernel:

http://www.libcrack.so/2012/09/02/bypassing-devmem_is_allowed-with-kprobes/

So even if it were software locked somehow, it should work, but I cannot get anything from /dev/mem, yet it exists:

shell@android:/ $ su

su

shell@android:/ # dd if=/dev/mem of=/dev/null

dd if=/dev/mem of=/dev/null

/dev/mem: read error: Bad address

0+0 records in

0+0 records out

0 bytes transferred in 0.001 secs (0 bytes/sec)

shell@android:/ # cat /dev/mem | wc

cat /dev/mem | wc

/dev/mem: invalid length

0 0 0

But will the fuse not contain only the decrypt keys? Which are efuse readonly? So LG does supply encrypted OTA or KDZ images?

Only a SBK leak/compute or break in the nvflash / bootloader software will bypass this security ....
[LG Optimus 4X HD] alekthefirst:
You think that adding my own text of sbk format to the file from sys/firmware/fuse will do any harm?
[LG Optimus 4X HD] dfreake:
you guys talking about the memory(ram) i have 978 mb ram so you guys should check your maybe this causing the crashes because of diffrent memory(ram) but i think mine stupid so yeah

just an idea
[LG Optimus 4X HD] marsgod:
2013/01/07:

Secure_Boot_Key Dumper for tegra2/tegra3 v0.1

1. adb push ss.ko /sdcard/

2. adb shell

su

cd /sdcard/

insmod ss.ko

dmesg

3. at the end of dmesg, you should see the secure_boot_key.....

This use a readl/writel the fuse register directly. it will not use /dev/mem anymore.

And this is a module, you should insmod it , and check dmesg for the message.
[LG Optimus 4X HD] Dexter_nlb:
<4>[ 601.883056] Activating secure_boot_key_dumper

<4>[ 601.888020] readl:addr=FE30F800 data=C0040000

<4>[ 601.892565] readl:addr=FE30F800 data=C0040000

<4>[ 601.897228] writel:addr=FE30F800 data=C0040003

<4>[ 601.902028] readl:addr=FE30F800 data=C0040000

<4>[ 601.906575] readl:addr=FE30F800 data=C0040000

<4>[ 601.911155] writel:addr=FE30F804 data=00000000

<4>[ 601.915954] readl:addr=FE30F800 data=C0040000

<4>[ 601.920769] writel:addr=FE30F800 data=C0040001

<4>[ 601.925688] readl:addr=FE30F800 data=C0040000

<4>[ 601.930301] readl:addr=FE30F808 data=02B00009

<4>[ 601.934863] odm_prod_mode=0x00000001

<4>[ 601.934870]

<4>[ 601.940503] readl:addr=FE30F800 data=C0040000

<4>[ 601.945048] readl:addr=FE30F800 data=C0040000

<4>[ 601.949780] writel:addr=FE30F800 data=C0040003

<4>[ 601.954413] readl:addr=FE30F800 data=C0040000

<4>[ 601.958983] readl:addr=FE30F800 data=C0040000

<4>[ 601.963695] writel:addr=FE30F804 data=0000000E

<4>[ 601.968502] readl:addr=FE30F800 data=C0040000

<4>[ 601.982246] writel:addr=FE30F800 data=C0040001

<4>[ 601.986852] readl:addr=FE30F800 data=C0040000

<4>[ 601.991366] readl:addr=FE30F808 data=FFC718B5

<4>[ 601.995986] readl:addr=FE30F800 data=C0040000

<4>[ 602.001132] writel:addr=FE30F804 data=00000010

<4>[ 602.005751] readl:addr=FE30F800 data=C0040000

<4>[ 602.010362] writel:addr=FE30F800 data=C0040001

<4>[ 602.014912] readl:addr=FE30F800 data=C0040000

<4>[ 602.019674] readl:addr=FE30F808 data=FFFFFFFF

<4>[ 602.024127] readl:addr=FE30F800 data=C0040000

<4>[ 602.028590] writel:addr=FE30F804 data=00000012

<4>[ 602.033215] readl:addr=FE30F800 data=C0040000

<4>[ 602.037747] writel:addr=FE30F800 data=C0040001

<4>[ 602.042557] readl:addr=FE30F800 data=C0040000

<4>[ 602.046993] readl:addr=FE30F808 data=FFFFFFFF

<4>[ 602.051444] readl:addr=FE30F800 data=C0040000

<4>[ 602.055955] writel:addr=FE30F804 data=00000014

<4>[ 602.060556] readl:addr=FE30F800 data=C0040000

<4>[ 602.065170] writel:addr=FE30F800 data=C0040001

<4>[ 602.069775] readl:addr=FE30F800 data=C0040000

<4>[ 602.074206] readl:addr=FE30F808 data=FFFFFFFF

<4>[ 602.078790] readl:addr=FE30F800 data=C0040000

<4>[ 602.083410] writel:addr=FE30F804 data=00000016

<4>[ 602.087934] readl:addr=FE30F800 data=C0040000

<4>[ 602.092424] writel:addr=FE30F800 data=C0040001

<4>[ 602.096936] readl:addr=FE30F800 data=C0040000

<4>[ 602.101492] readl:addr=FE30F808 data=FFFFFFFF

<4>[ 602.106097] secure_boot_key=0xffffffffffffffffffffffffffffff00

not sure this is the key you want?
[LG Optimus 4X HD] phynix5800:
This key doesn't look very secure to me :eek:.
[LG Optimus 4X HD] The Troll:
looks pretty keyish to me

dexter, whats the format for a sbk?

does any of what you extracted look familiar?
[LG Optimus 4X HD] reas0n:
a example (it's a key from Transformer :D)
[LG Optimus 4X HD] The_0ne:
Hex: ffffffffffffffffffffffffffffff00

Binary: 000100000000000000000000000000000000000000000000000000000000000000000000

Decimal: 295147905179352830000

Too simple.:confused:
[LG Optimus 4X HD] emre81tr:
Where we gonna use that secure key?
[LG Optimus 4X HD] reas0n:
if we'll get it, to unlock bootloader and to flash custom roms (we'll get official cm for sure i think if it will happen)
[LG Optimus 4X HD] phynix5800:
I don't know much about cryptology, but what I do know is, if this key is real, I would fire the guy responsible @LG.

Nice try though, keep it up! :)

Gesendet von meinem LG-P880 mit Tapatalk 2
[LG Optimus 4X HD] The_0ne:
Maybe that's LG's plan, making the people believe the SBK isn't correct, because it appears too simple. :p
[LG Optimus 4X HD] phynix5800:
'Security through confusion' xD. Brand new security paradigm pioneered by L f*ing G.

Gesendet von meinem LG-P880 mit Tapatalk 2
[LG Optimus 4X HD] reas0n:
whatever. how to check whether it's right SBK or not?
[LG Optimus 4X HD] Dexter_nlb:
the nvflash binaries i got do not even recognize our device as being APX capable, even with newest drivers. so if the device is not recognized, we cannot even test our sbk if its right, so maybe that should be more interesting to find binaries that work.

remember to test APX mode, hold VOL+ and VOL- when you power on the mobile, and it shows black screen and attaching USB you get a APX device connected.
[LG Optimus 4X HD] Tim_Pan:
I download a nvflash format rom of 2x.

I doubt whether my phone was found or not.

Flickr 上 Poon Chi Tim 的 4x
[LG Optimus 4X HD] Dexter_nlb:
same error i got, which normally works fine, when i used it on acer or other tegra devices i got. it should normally start sending bootloader and show hardware details initially as well. if its just because the sbk is wrong, well then we know the many f's are wrong.
[LG Optimus 4X HD] The Troll:
does any tegra include one x?
[LG Optimus 4X HD] Dexter_nlb:
i do not believe OneX got APX at all, since HTC made their own bootloader edition like on other models.

Asus prime and other got it i believe but require those hacked methods done to use it. (prime is tegra3 device)

anyways asus do things pretty standard, which probably is also the easiest way to get more profit out of a release, with no work on the software they focus on hardware alone.
[LG Optimus 4X HD] marsgod:
I think all tegra2/tegra3 devices should have a APX mode, it is a nvdia low level interface,

To enter this mode,

1. power off you device; for some device , you have to remove its battery;

2. hold down vol+ and vol-

3. plug the usb cable into your PC.

And you should find the "NVIDIA USB Boot-recovery driver for Mobile devices" in device manager.
[LG Optimus 4X HD] marsgod:
Does this work?

nvflash -w --sbk 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFF00

nvflash -w --sbk 0xFFFFFF00 FFFFFFFF FFFFFFFF FFFFFFFF
[LG Optimus 4X HD] roesti91:
Thanks for the module!! I extracted the same SBK using your kernel module. I also get "Unknown device found" when I try and use nvflash.
[LG Optimus 4X HD] Tim_Pan:
Nvflash started
UnKnown device found
[LG Optimus 4X HD] marsgod:
2013/01/08:

v0.2 dump all known fuses.....

this should be the same value as you cat /sys/firmware/fuse/....
[LG Optimus 4X HD] marsgod:
Anyone know that the nvflash working with tegra3 devices?

I think maybe nvflash only work with tegra2 devices.....
[LG Optimus 4X HD] Tim_Pan:
<4>[ 538.627116] Activating tegra_fuse_dumper v0.2
<4>[ 538.631900] device_key=0xffffffff
<4>[ 538.631907]
<4>[ 538.637305] jtag_disable=0x00000000
<4>[ 538.637312]
<4>[ 538.642833] odm_production_mode=0x00000001
<4>[ 538.642841]
<4>[ 538.649014] sec_boot_dev_cfg=0x00000011
<4>[ 538.649021]
<4>[ 538.654780] sec_boot_dev_sel=0x00000000
<4>[ 538.654788]
<4>[ 538.660752] secure_boot_key=0xffffffffffffffffffffffffffffff00
<4>[ 538.660761]
<4>[ 538.668529] sw_reserved=0x00000000
<4>[ 538.668536]
<4>[ 538.674034] ignore_dev_sel_straps=0x00000001
<4>[ 538.674042]
<4>[ 538.680298] odm_reserved=0x00000000000000000000000000000000000000000000000
00000000000000000
<4>[ 538.680309]
<4>[ 538.691038] sbk_devkey_status=0x00000001
<4>[ 538.691046]
[LG Optimus 4X HD] Zhus06:
Dexter said it worked fine for him on other tegra devices..
[LG Optimus 4X HD] reas0n:
something with nvflash is in default recovery so it should work
[LG Optimus 4X HD] The Troll:
how about using software update mode?

*i know a noob reply*

but there should be a way in through there too..