yashsingh1/xdaforums huggingface dataset:
[Motorola Photon 4G] adelyser:
I took a look at what they are doing in that thread, and I don't think that approach will work. The reason I believe this, I took a stroll through the kernel code, and the memory they are trying to read to get the SBK appears to be the same info if you were to cat /sys/firmware/fuse/SecureBootKey. The kernel isn't allowed to read this info, so I don't think you can get it from just browsing memory or via a kernel module either. It's worth a shot, as I'm sure there exists a hole somewhere, but it's tough to identify where.

From what I understand, the SecureBootKey can ONLY be ready by the AES engine. It has been suggested the only way to retrieve it is black-bag cryptanalysis.

I do wonder though, if the OdmProduction flag wasn't set, can we then get to the key? Curious.....

adelyser
[Motorola Photon 4G] Lightsword1942:
I'm curious what mechanism prevents the kernel from reading this info and if it is something we can code around by recompiling the kernel? I assume that is what they were trying to do in that thread.
[Motorola Photon 4G] adelyser:
From what I have read and understood, it's stored only in ROM within the chip itself, and only the AES engine has access to that area of ROM. It's not an addressable area of memory, in which any process could then gain access to it.

I'll continue reading through the documentation and see what I can find, I do have some knowledge in this area, but my experience with other devics, and chips from other manufacturers.
[Motorola Photon 4G] Lightsword1942:
Yeah, that's whats been said officially but I wonder why they would even include "/sys/firmware/fuse/SecureBootKey" in the kernel at all if it could never be read from within the OS. I think there is more to this than what they(nvidia) are revealing. Also there is an atrix with jtag hookups, do you think it would be possible to read the AES key using jtag while nvflash is active?
[Motorola Photon 4G] cupliz:
I m not dev

Im stupid and i just want to share a little here.

I have htc evo 3d cdma, and my hboot is unlocked, by soft bricking the phone and i can flash the older hboot. You can read on e3d forum here on xda maybe the method will inspire you :)

Sent from my PG86100
[Motorola Photon 4G] Lightsword1942:
There is essentially nothing in common between the photon and the evo 3d, evo is qualcomm photon is tegra and the bootloader security implementations are radically different.
[Motorola Photon 4G] cupliz:
Uhmm... Like ive said am not a dev so i cant read the coding, but its that true that you cant flash an older hboot even your phone(mopho) it is half death (soft brick)?

And about this way also bullsh*t?

http://xdaforums.com/showthread.php?p=35802277

Sent from my PG86100
[Motorola Photon 4G] Lightsword1942:
We can't downgrade the bootloader at all from the new version and this is why. That post you have is just using the bootstrap recovery with 2.3.5, that is nothing new but does allow some minimal modifications. BTW hboot is a HTC thing not a motorola thing. HTC's security is significantly worse than Motorola's, there has never been a Motorola phone that came with a locked bootloader that has been fully bootloader unlocked without a leak. On the other hand we see s-off hack's for HTC phones all the time.
[Motorola Photon 4G] cupliz:
LOL, we have 2 status here, s-off/s-on and unlocked/locked... Till now I have no idea what is that... For some personal experience i will never buy motorola and sony android phone and maybe not for another htc, bootloader make my head hurts...

Okay, thx for the OoT here. :D

Sent from my PG86100
[Motorola Photon 4G] MarcquisDale:
Hows the development coming along if you need a tester im your guy
[Motorola Photon 4G] Lightsword1942:
If anyone can compile this against our kernel I may be able to try a few things.
[Motorola Photon 4G] adelyser:
I'll give it a try, but it won't be until at least tomorrow. It's a busy week for me.........
[Motorola Photon 4G] MarcquisDale:
Maybe it'll be one step closer. Do you have anything you to be tested?
[Motorola Photon 4G] adelyser:
Not yet, I have been successful in compiling other kernel modules for testing and exploring so far, I just need to find the time to compile this and see what Lightsword1942 is wanting to test. Thanks for your offer though!

adelyser
[Motorola Photon 4G] Lightsword1942:
I want that module so I can get some RAM dumps that may lead to possible unlocks. I would normally compile myself but my internet connection would make setting up a build environment take a while.
[Motorola Photon 4G] phatninja55:
if you did it, itd getvdone faster. since its a request thebdevs are not going to make it a proirity. thus twking days instead of hours to build it yourself.
[Motorola Photon 4G] MarcquisDale:
has anyone been able to get the engineering sbfs to work

http://forums.acsyndicate.net/showthread.php?3362-Photon-FIles
[Motorola Photon 4G] Lightsword1942:
Yeah, they work, they have a bunch of testing utilities, but they haven't really been that useful, you have to manually install them though, can't use RSD,
[Motorola Photon 4G] MarcquisDale:
Thats why they never worked when i tried em, how do i install them
[Motorola Photon 4G] Lightsword1942:
You can extract the SBF then manually flash the boot and system images using dd from recovery.
[Motorola Photon 4G] phatninja55:
In the engineering sbfs boot img, does it have a fuse?
[Motorola Photon 4G] Lightsword1942:
The fuse is in the phone not the SBF...
[Motorola Photon 4G] phatninja55:
i mean reservedodm.
[Motorola Photon 4G] Lightsword1942:
I don't really know what you are asking. Reservedodm is just what you call to read the fuse. You have to use the unlocked bootloader in order to run the extracted eng SBF.
[Motorola Photon 4G] phatninja55:
oh well no one said that, i just figured that it would flash in fastboot, for soke reason i had the impression that the boot. img was signed by moto.
[Motorola Photon 4G] adelyser:
Done, check your PM's.
[Motorola Photon 4G] Cooldevil1989:
Any update?????
[Motorola Photon 4G] masckkara:
Still ongoing ???

Is it done? anyone else still working on this?:confused:
[Motorola Photon 4G] phatninja55:
it moved to a new thread.
[Motorola Photon 4G] tdhite:
Still workingon it. If you're a kernel hack, ATAGS is the current pain.
[Motorola Photon 4G] TheGrimEvo:
wheres the new thread, im am trying to unlock one of these myself
[Motorola Photon 4G] MarcquisDale:
Its under development
[Motorola Photon 4G] phatninja55:
http://xdaforums.com/showthread.php?t=2114984
[Motorola Photon 4G] klingongac:
Helpful article?

blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html?

A friend sent this to me and I think it would be better understood by ya'll.-a.
[Motorola Photon 4G] phatninja55:
I don't think our phones are Qualcomm based... They are tegra based.
[Motorola Photon 4G] Indirect:
Which is closed source

Sent from my hidden jewel
[Motorola Photon 4G] twaffle:
There may be correlations, however. They caused the bootloader itself to bypass its checks. A general assumption could be that they boot loaders are based on a common code base, and may be susceptible to the same sort of bypass.

Our fuses sure do look interesting, but I don't believe anyone with technical knowhow to inspect the bootloader has ever looked to divine meaning to the fuses.
[Motorola Photon 4G] nickman529:
Awesome will look later
[Motorola Photon 4G] mof9336:
smg files are located in sbf files not in the phone and are signed therefore cannot be altered in a hex editor. Trust me I bricked 2 phones this way and I mean real brick not soft brick.

we can unpack and repack usable sbf files already the problem is the fuse from ver 1 to 2. there is no bootloader on a system version 2 that can be unlocked.
[Motorola Photon 4G] Productzer01:
This may be a stupid question but why can't we change the fuse back to version 1 and use the pudding unlock. We can erase everything else on the phone why aren't we able to change the fuse back to the original fuse?
[Motorola Photon 4G] nickman529:
If we changed enough base system stuff we might be able to have SOME progress. Anyone have sv1 to help?
[Motorola Photon 4G] Cooldevil1989:
I am having two CG42.smg file ...one is locked and another is unlocked...

But problem is both are signed by signature ...

And locked one is SV 2 ...

Unlocked one is SV 1....

We are unable to sign it....

And it is impossible to downgrade ....as 2.3.5 is having locked one...
[Motorola Photon 4G] mof9336:
Once the fuse is changed from 1 to 2 it cannot be changed back. This is why photons on 2.3.5. (which is SV2) can be unbricked with a modified version of the electrify sbf (also SV2).
[Motorola Photon 4G] AndroidLover813:
Mopho 4G, Need it unlock

So I got myself a Mopho 4G again because my wife lost the first one:(. I gave her after of course I unlocked:silly: it using the methods posted here on XDA. She was so distraught that we went ahead a purchased a 2nd:good: one in the street. That was my first mistake and the other one was I broke the screen:crying: on one of my many sleepless nights trying to unlock this awesome phone!! I went ahead and decided to purchase an unlock code from one of these websites but can't seem to find the correct method to input the unlock code I was givin:confused:! I dont know whats wrong and I need help asap:confused: !! I love XDA and all the help you guys offer 4 us members:o, I apologize if I posted this in the wrong section but I'm still interested in getting 2.3.5 unlocked so we can go on continuing to use this awesome phone! :cool:

Thanks to all the members on XDA who offer help and develope these great roms, keep up the great work.!!
[Motorola Photon 4G] R2DeeTard:
You should post a new thread in the q and a section.
[Motorola Photon 4G] nickman529:
Agreed. Post in q and a but if you'd like to help please test what we release
[Motorola Photon 4G] nickman529:
The only way is to modify enough stuff(and probably bricking) in the phone to accept a sv1 sbf that would be hard but nay impossible

Edit: What if we unlocked the electrify version (which after work can be unlocked) and flashed a custom sprint rom?(or found a workaround for the fence that blocks our downgrade. Every fence can be hopped)
[Motorola Photon 4G] nickman529:
Can you provide me the cg42 file?
[Motorola Photon 4G] nickman529:
What if we used the digital signature from sv2 and mask the file change as a hidden file and set up a bootstrap to install it right? That would fix the signing problem. But not the unlock. Not yet anyway.

Also sorry I haven't responded til now im im trying to stay in top of this thread. I want this done!
[Motorola Photon 4G] Cooldevil1989:
I am at workplace right now....I will send you both the files....in evening.....
[Motorola Photon 4G] nickman529:
Thanks its 11 pm here so ill look at them in the morning in my time.

Appreciate all the help from everyone! Can't believe all the responses!!
[Motorola Photon 4G] Cooldevil1989:
find attached...........
[Motorola Photon 4G] nickman529:
Thanks. Ill look into it
[Motorola Photon 4G] nickman529:
Is this the unlocked one?
[Motorola Photon 4G] anthony062991:
I just downloaded it and once you extract it you will see the unlocked and locked version in it..
[Motorola Photon 4G] nickman529:
Thanks man
[Motorola Photon 4G] mof9336:
The problem is that fuse. The sbf for the electrify cannot be unlocked only a electrify shipped with 2.3.5. Which is SV1.
[Motorola Photon 4G] nickman529:
So we need some super hack. This is gonna be hard...
[Motorola Photon 4G] nickman529:
Latest update!!

Building different electrify sbfs for out photons. If we can unlock the electrify sbf we can flash a sprint rom and or any radios needed(possibly an unlockable photon GB version for full radio support minus 4G)
[Motorola Photon 4G] nickman529:
I have a few ideas and ill update a new OP with any files to flash to. (Will test first)

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] dakshinasd:
Guys!!! Please don't stop the work you're doing... It's amazing to see something like this is happening!!! I'm nor dev or android hacker. But I'm willing to help you guys since I'm also stuck with this locked phone...

AND ALSO, please try to keep this thread live!!!

Thanks for all the efforts! You guys are rocking!!!:good:
[Motorola Photon 4G] nickman529:
Don't worry I'm not stopping till its done!

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] JohnH4:
Perhaps a method could be crafted to bypass the reservedODM fuse check?
[Motorola Photon 4G] nickman529:
I hadn't thought of that. What's the reserved odm number for sv1

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] WiredAnim:
What method did you use to unlock the USC SBF? Was it this method or something new?
[Motorola Photon 4G] anthony062991:
Isn't it posible to create a U Boot for our device to bypass the bootloader?

http://elinux.org/Panda_How_to_MLO_&_u-boot
[Motorola Photon 4G] nickman529:
Maybe. Ill need help with that

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
It was something new. Not a FULL unlock persay

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
I wish I could help you on the U Boot, but I don't know that much when it comes to compiliing..
[Motorola Photon 4G] Indirect:
I would help but I don't have a photon to get the information I need for this. Anyone rooted already wanna hit me up, I'll take a crack at it. I wouldn't mind breaking open a new device. ^^
[Motorola Photon 4G] nickman529:
we need an ics rom and kernel.. for uboot

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] FernBch:
May be a dumb comment, but isn't the ICS kernel one item that is missing (besides the drivers). The ICS and JB ROMs use a GB kernel correct?
[Motorola Photon 4G] nickman529:
Not certain. Could someone verify this? I know they use a custom kernel

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] JohnH4:
The known reserved odm values can be found on the first post on this thread

http://xdaforums.com/showthread.php?t=1650520
[Motorola Photon 4G] nickman529:
Will take a look at this for a bypass

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] tdhite:
Not a bad read, just for backdrop info ... https://forums.motorola.com/posts/e598071946
[Motorola Photon 4G] Planters76:
I don't know if this will help out or not but some interesting reading

http://www.atmel.com/Images/doc8390.pdf

If you need a guinea pig, I have a Motorola Electrify that is lock due to the OTA

---------- Post added at 09:03 PM ---------- Previous post was at 08:56 PM ----------

Also I wonder if Neal Buckendahl will talk?

http://www.linkedin.com/pub/neal-buckendahl/4/942/36a
[Motorola Photon 4G] nickman529:
I hate moto...

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Thanks.

Idk he might talk...

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] FernBch:
It is a custom kernel, I believe, but still GB based. There are a couple threads in the dev section about ICS kernels by Jokersax about compiling kernels for ICS roms. But I always thought it was a modified GB kernel. That is what was being used in his and th3bill's work.
[Motorola Photon 4G] nickman529:
Thanks. I thought it was but I wasn't sure

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Okay if we are able to either downgrade or bypass our bootloaders we could just use someone else's rom like jokersax or something

My point is. I don't wanna focus on the rom and kernel side of the issue. I wanna get out of this bootloader cage.

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
We can reach and change the odm but I wanna match a locked 2.3.4 build

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Is there a 2.3.4 sv1 sbf for the photon

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Lol found this.

https://sites.google.com/site/motosbf/photon-sbf-files

We might be able tto flash that sbf if we change our reserved odm

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Who wants to be the guinnea pig??

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] Planters76:
Pick me pretty please. I will be home after 5pm Central time

Sent from my Motorola Electrify using Xparent ICS Tapatalk 2
[Motorola Photon 4G] LightingZ:
Im at home NOW i can test it right now! PM me
[Motorola Photon 4G] matt51:
I'm game, at the moment I'm only using my Photon as a VoIP phone, I can test international GSM, but not CDMA.
[Motorola Photon 4G] nickman529:
To anyone WILLING. I am not responsible if anything goes wrong. (Nothing should)

Change the reserved odm to a standard locked photon then use adb to reboot normally but hold volume up while booting to get to fastboot.

Then. Try to flash one of the sbf files in the link earlier. Let me know the results

(I also just learned. Our device has 2nd init. May look into building a 2nd unit rom for cm7 or 9? Gonna need a biiig hand with that one.)

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Here is how to do 2nd init.

http://xdaforums.com/showthread.php?t=1200937

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] LightingZ:
Tried that it's failed saving the edited reservedodm.
[Motorola Photon 4G] nickman529:
May have to save it elsewhere and copy it in.

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Reservedodm in in system/firmware/fuse

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Try copying it and editing it somewhere else then paste the new one into the folder with the original and replace it. (Or back it up)

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] LightingZ:
Can't copy :eek: it's failed ,
[Motorola Photon 4G] nickman529:
Are you using es with root enabled

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] LightingZ:
Yep
[Motorola Photon 4G] nickman529:
I just tried. We might need to use a computer to copy over

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] LightingZ:
Yep. but how? (adb?)
[Motorola Photon 4G] nickman529:
That's the only way. Windows explorer can't see the root system. (Linux maybe)

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] LightingZ:
:crying: I guess the file is protected...
[Motorola Photon 4G] anthony062991:
ReservedOdm is within the kernel? There is no way to edit the file. If you edit the file then save it and push it back in the values will go rite back to where it was. I've already tried that.. You have to use ES File Explorer then navigate to /dev/firmware/fuse/ReservedOdm hold click on ReservedOdm change Properties and make you check Read check mark all and Write jsut check User and Execute check all. That's the only way to write to the ReservedOdm. But once you save and exit it the values will go rite back to where they were. You can't just edit it..

---------- Post added at 12:42 PM ---------- Previous post was at 12:40 PM ----------

Has anyone tried this?
[Motorola Photon 4G] nickman529:
I want to but I need a partner

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] anthony062991:
I would try it out.. His DL link is dead.. :(

Does anyone have a working DL Link for:

http://xdaforums.com/showthread.php?t=1200937

Even if this does work we are still not able to run a custom kernel with it unless we find some modules to make the kernels work with this method?
[Motorola Photon 4G] tdhite:
Also, though probably not new news, you need to remount /system as rw. Assuming busybox:

cd /

/system/xbin/mount -o remount,rw /system

Before you edit anything on that file system.
[Motorola Photon 4G] atsuisofu:
I want to help, I want to get the kernel ball rolling so we can see about getting webtop on non stock roms.
[Motorola Photon 4G] anthony062991:
Thanks for the reminder.. The problem is that the DL link is not working in his thread http://xdaforums.com/showthread.php?t=1200937

I found the thread over in the Atrix forums, but the link is not working over there either.. I was able to find remountpds and 2nd-init files, so I'm not sure what else I am missing from the zip?
[Motorola Photon 4G] Indirect:
Guys. If we can have kexec working, we can load up a new kernel. Then we can focus on the boot loader
[Motorola Photon 4G] anthony062991:
How do we know if kexec is working or not?

Edit:

How can we get kexec to work?
[Motorola Photon 4G] Indirect:
seeing as how I don't have a device, I can't check to see if kexec is enabled.
[Motorola Photon 4G] JohnH4:
Wait a second...do you mean to flash the reserved odm values to a lower number? Because as far as I know its only possible to flash it higher. I could be wrong about that.

I still think that the best course would be to find a way to bypass the reservedODM check with the 2.34 bl. Otherwise, if the check could be modded to accept and install 2.34's bl on the phone's reservedODM we got from 2.35 that might work as well. Not that it would be easy....
[Motorola Photon 4G] anthony062991:
That's were we come in..

You can tell us the steps or point us in the rite direction? My device is rooted so I can throw commands at it..

Edit:

I tried /proc/atags but there is nothing there..
[Motorola Photon 4G] nickman529:
I have my /system writable. Still can't write to or from the /sys partition. As for kernels you wouldn't need a custom. 2nd init hijacks the init process to boot cm modules for a 2nd init rom

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Okay let's hop on kexec then!!!

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Latest update!!:

Based on ideas from other people on this thread kexec sounds like our best bet right now. I need people that can help me port (or if it is already) get it working.

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
That's what I mean is to make that number null on the checker. I have no clue how to though

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] tdhite:
Webtop works fine with most locked ROMs. See my posts in General regarding Debian Linux under webtop, which I use all the time with Mof's Slim ROM.
[Motorola Photon 4G] anthony062991:
We have to compile kexec with the ramdisk/kernel I beleive? We have to also have to edit CWM to make a boot between stock and a custom rom..

Here is a video of kexec working on a Motorola Droid 3:

http://www.youtube.com/watch?v=i588pDVqAMc
[Motorola Photon 4G] tdhite:
Well, /sys is not a partition, rather a kernel level pseudo-file system, which may preclude writing new values, depends on the kernel.

---------- Post added at 03:04 PM ---------- Previous post was at 02:56 PM ----------

I can build just about any kernel mod we need. I'm not sure how we trigger the load, though, given we can't touch the boot loader. What's the thought there?
[Motorola Photon 4G] nickman529:
Kexec and 2nd init nay help. If we can get kexec working that would be helpful.

If you can help us with the kernel and kexec that would be awesome.

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
Can you help with this?

Sent from my ICSish MoPho

using xda-developers app
[Motorola Photon 4G] nickman529:
By the way. I don't use webtop at all but I want to fully support it in anything we release. It seems to be a popular thing.

Sent from my ICSish MoPho

using xda-developers app