yashsingh1/xdaforums huggingface dataset:
[Motorola Photon 4G] Dragonmoon07:
i am ready and willing to test for a 2.3.5 OTA bootloader unlock. Ive been waiting for something like this!

(I cant code though but hey a tester is better then nothing ,right?)

(However if there is a risk of permabricking the phone i cant because its my only one.)
[Motorola Photon 4G] Cicar:
If we are going to exploit kenel into loading some module in the memory, why are we trying to boot into uboot we can replace default kernel with our custom kernel in runtime as haret does in winpho. there is a tool to do this in linux kexec i suppose... If we can get custom linux kernel to be loaded then we can make it to load custom rom stored in memory card.
[Motorola Photon 4G] mquezada21:
Unfortunately I can't code but I do have 3 photons 2 with shiped 2.3.5 and one unlocked 2.3.4 one of the 2.3.5 insured so Im willing to take all risks. I got up to speed on the thread and understand 90% of whats going on. I want to be useful to this project
[Motorola Photon 4G] tdhite:
Alas, the photon kernel has kexec explicitly turned off. Kexec == No workee!
[Motorola Photon 4G] xopher.hunter:
Bummer...

Oh well new phone time. Screw you moto
[Motorola Photon 4G] kdog350:
I think uboot is still possible. but changing the kernel is not
[Motorola Photon 4G] nickman529:
Uboot doesn't need kexec people
[Motorola Photon 4G] bullfrog527:
Well I couldn't stand moto blur anymore, and the wimax at work sucks. I'm back to unlocked but still willing to help ya'll out where I can.

I feel for you guys that got screwed over by moto

sent from my Liquid Smooth Jellybean MoPho
[Motorola Photon 4G] tdhite:
LOL -- too funny.

I'm now building down the kernel and a module for testing exploits. Also building the 'latest (purportedy greatest?)' u-boot. For git savvy folks, you can get it here: git://git.denx.de/u-boot.git

The key to the module is getting it to load, given the stock kernel set the module versions flag, yet explicitly disabled the 'force' flag for loading/unloading modules.
[Motorola Photon 4G] anthony062991:
Would you be able to modify the init.rc to run the module? Idk if it would boot up though modify the init.rc though?

EDIT:

Do you think a script like this would work if we add a modules folder to our system?

http://xdaforums.com/showpost.php?p=17668439&postcount=7
[Motorola Photon 4G] tdhite:
Probably not -- it's part of the (kernel) blob and I have a sneaky suspicion the blob was signed, not just the kernel. But consider that so long as we can load a module, at any point, we should be able to create an exploit to jump the kernel to our own code, I hope to effectively re-create a kexec-like mod with the module. It'll be tough, dunno, just messing with this at the moment.

alas: "[1] Illegal instruction (core dumped)" is where I am with jumping to u-boot right now.

As for the module loading via init (which is what the link shows), sure -- that'll work once we jump to our own code -- we can load 'whatever' init we want, and if we choose s sysv type model (similar to the post), then that'd work.

But, first, I gotta get past the illegal instruction (surely compiler back-end error dumping arm code) and get the module loaded.
[Motorola Photon 4G] tdhite:
Looks like a broken compiler: http://www.mail-archive.com/u-boot@lists.denx.de/msg85088.html

---------- Post added at 09:32 AM ---------- Previous post was at 08:36 AM ----------

Sorry, man -- just noticed this while digging back into the thread for something I wrote. You will get that error if you attempt to run a 32-bit statically linked executable on a 64-bit system. So, just build a 32-bit Ubuntu VM (use qemu or virtualbox or vmware or whatever you like). Compile on that and you should be fine:

sudo apt-get install build-essential

sudu apt-get install make (just to be sure)

set as described for the toolchain in other posts -- presto magico, build.
[Motorola Photon 4G] tdhite:
BTW -- for those wondering what module to exploit, I'm using the methods described here: http://www.phrack.com/issues.html?issue=68&id=11#article. The module I intend to replace with the injected init code /system/lib/dhd.ko. Scary? Well, yeah, but it's loaded by the boot process (probably waiting for events to settle during udev startup).

Here's why:

First: it's loaded by the boot process.

Sedond: it's "license: GPL v2" by simple modinfo inspection.

Therefore, code is available by definition and we therefore don't run into any sort of 'reverse engineering' rules regarding copyright, ownership, etc. We also get it loaded at boot without worry. Presuming it's loaded early, we can setup the init.rc as we see fit (one way or another). After that, we'll see what we do, but right now, that's where we are.
[Motorola Photon 4G] tdhite:
A little more on the matter -- I grew tired of trying to coerce a cross-compiling chain to actually generate valid code for us. It's always possible, it's just frustrating.

Instead, I've moved on to building on the phone with the same model as in guides-cm9-kernels. If anyone wants to know how to setup the Ubuntu (Lucid) image on your phone so you run the thing chrooted, let me know. I plan to modify it for use under WebTop as well (similar to my post here on Debian).

Anyway, if anyone gets a valid cross-compiling chain, lemme know. Obviously things are faster on a monster machine for compiling, but I need modules that don't fail simply because of broken cross-compilations. With that said, I have loaded modules (though they do nothing interesting yet), so in fact, folks, we can do that with our current kernel, no mods necessary.
[Motorola Photon 4G] phatninja55:
I hope you guys get this working, i'm stuck on 2.3.5 ota on the electrify, and miss being able to use custom roms.

Loading kernels should work since other have made a module to overclock the stock kernel. Good luck with this!
[Motorola Photon 4G] tdhite:
I'm not sure who else may be trying to inject an exploit in modules, but I made it very easy for you:

Look on my xda DropBox folder for the two scripts: overlay_motorola.sh and build_kernel.

If you get the android sources setup correctly for building (see the readme on the photon sources Motorola put SourceForge), you can then download all the tgz files and use overlay_motorols.sh to do just that (overlay the motorola sources properly over the vanilla android code).

The kernel gets laid down in <android_top_dir>/kernel/tegra, the modules all go into 'vendor/...'. Just put the android 'repo' (see the repo comand) in ${HOME}/android, and the motorola .tgz overlays in ${HOME}/photon and it'll just work for you.

To build the kernel use the build_kernel script -- it'll set things up correctly and build the kernel (sunfire -- yes, our kernel). The modules can also be built with that script as well just by calling the functions therein.

Anyway -- just making it easier for folks trying to play. I have all this working, finally, on Ubiuntu Lucid (11.10), so no need to kill the phone any more for builds. Note also that the repo from Google/Motorola has the toolchain they used to build the photon builds. So no more hunting down toolchains that might be broken.
[Motorola Photon 4G] krrishvaid:
well ........i didn't understand much in the post as i am not a developer...................but it seems like the things have gotten easier...........so....is there a hope getting the bootloader unlocked on photon 4g ........
[Motorola Photon 4G] Doballa:
Bootloader unlocked - no

However uboot will allow you to use custom roms without an unlocked bootloader (once everything is working)
[Motorola Photon 4G] krrishvaid:
a reason to be happy?

So does that mean that we will soon be able to install custom roms on our photon 4g..........and btw what does that uboot mean.......if you could kindly explain briefly
[Motorola Photon 4G] Doballa:
Yes for custom roms. Again provided the devs can get everything working. May or may not have working 4g. And finally u boot is a universal bootloader that can sometimes can be side loaded onto a device to bypass the original system. A good example of this is u boot for nook which allowed it to run cm7
[Motorola Photon 4G] AndroidLover813:
I made this comment in another post but needed to post here but got confused by title anyways I have my Photon running on Android 2.3.5 and my bootloader is still locked but I'm able to now use on any gsm network which was the whole purpose of seeking to unlock bootloader. I used Peetr Rom because they say it's the most stable to use with KDDI radio. I was able to flash both files after I rooted and now my Photon is no longer a paper weight awaiting bootloader unlock. I'm making this comment cause the Photon is a great phone and I hope the XDA community doesn't give up on it. Anyways thanks for the knowledge.
[Motorola Photon 4G] phatninja55:
I'd assume that if the rom for unlocked bootloaders doesn't have 4g, then the ril settings needed for 4g wouldn't be in a uboot ported rom either.

The electrify doesn't have 4g, but when i had sprint I was very dissatisfied with the service of 3g, and calling. So if it was me, I wouldn't worry about 4g.
[Motorola Photon 4G] tdhite:
Ok, need a tester for a modified vpnclient.ko module. I hijacked its load and unload calls. I originally planned dhd.ko. but it appears vpnclient loads earlier.

Anyway, if someone is willing to replace the module on a test phone PM me and I will explain how. It should work the same, but will send a few key messages to the kernel log so we can see the hook loading. If it works, the next step is usurping init at the point it loads.

It could mess up too, so only a test phone should be used.
[Motorola Photon 4G] Lightsword1942:
Anyone else see this? Wonder if it is applicable to us.
[Motorola Photon 4G] hoslayer13:
I've tried and get this: cannot open sys/firmware/fuse/secure_boot_key

Do you think its a matter of getting the write command? Like for example, instead of secure_boot_key, just SecureBootKey?
[Motorola Photon 4G] tdhite:
Interesting -- I was looking for that byte (the one he modifies). I'll jump in over there, compile the module down for our phone and see whazzup with it.
[Motorola Photon 4G] Lightsword1942:
Maybe, I however can't compile right now, but I can test if needed. I think we need someone with a factory cable to test if the SBK is valid though.
[Motorola Photon 4G] hoslayer13:
This would be very helpful. I dont have anything setup for compiling and don't have a factory cable either. Only thing I tried is hex editing and replacing the file names specifically for the photon and ended up getting a segmentation fault error.
[Motorola Photon 4G] tdhite:
no workee (yet). Looking into it. See my post over there: http://xdaforums.com/showthread.php?p=36807448#post36807448
[Motorola Photon 4G] tdhite:
All good:

<6>[ 1214.770675] VPNClient hook loaded.

<6>[ 1214.770698] VPNClient built on Jan 17 2013 00:47:46

boots ok, runs ok, gets hijacked ok.

So next step: need to kill init and restart it with a different config file (of our choice). That's the next step, so it'll take a bit.
[Motorola Photon 4G] twaffle:
Why not just kexec at that point?

http://xdaforums.com/showthread.php?t=1110048&page=2 for reference.
[Motorola Photon 4G] tdhite:
The stock kernel has the kexec flag expressly set to 'no' -- meaning no such support.
[Motorola Photon 4G] ghfjdksl:
tdhite - Just a thought here (and I don't know the kernel configuration parameters all that well). Does 'no' for kexec actively disable kexec - as in countermeasures to prevent that behavior - or does it just omit support? If the latter, couldn't you add in the code for kexec support into your module to re-enable it?
[Motorola Photon 4G] tdhite:
Folks often think kexec is just 'one thing.' It is two (in a brief sense). First, you must have kernel support, and second user-space tools (kexec-tools). When the kernel does not support the functionality, the latter cannot work. The Photon kernel has CONFIG_KEXEC set to off on the build, and thus there is absolutely no kernel support for the feature. Therefore, not even a module can add it back in.

In short, there is (absent certain exploits I'm trying) no way to boot another kernel. The exploits attempt to get the existing kernel to 'jump' outside. That jump, hopefully one day, will end up a call to u-boot (which effectively reboots the phone, but under its own control).

There's a myriad of issues in this mess, all of which kexec would solve. We just don't get that luxury.
[Motorola Photon 4G] twaffle:
You are missing the point.

http://xdaforums.com/showpost.php?p=14433243&postcount=7&nocache=1&nocache=1

It *IS* kexec, but as a module. As such, if you're at a point where you can inject using an existing module load, then you can get this module to load, which will allow for kexec, even if support is not built in to the kernel I believe.
[Motorola Photon 4G] tdhite:
I *did* miss the point (didn't even look at the sources). Interestingly, I found this:

https://github.com/D2-DX-Customboot

I like your thoughts. What I can do, in fact, is since I built a working 'hijacked' vpnclient.ko module, I can make it depend on a kexec-mod module (presuming I can get that to work at all). Since the kernel will load the dependencies in order (kexec-mod /before/ vpnclient.ko if the latter depends on the former), then on vpnclient's init, I think we can make some motion.

I have zero clue if the kexec-mod works (no place I found suggests it does -- everyone appears to have given up before success) but worth a shot. Lemme build the thing this evening and see where we land.
[Motorola Photon 4G] MaddogF16:
Following progress and have a locked 2.3.5 Electrify I'm willing to blow up if needed, when you have a method in place to try this exploit process. Absolutely awesome work.
[Motorola Photon 4G] tdhite:
Well, after fixing it up (it was broken for the Photon -- first few loads just hung the phone), it loads, anyway:

# lsmod

Module Size Used by

kexec_load 21583 0 [permanent]

bcmwimax 244037 4

bcmsdio 7864 1 bcmwimax

dhd 234647 0

vpnclient 66748 1

Note the permanent marker -- can't unload it ever (it modifies the sys_call_table). Anyway, now have to get kexec-tools running (that should be fun ... not really).

I attached the git diff of the sources in the event others want to build down the module.
[Motorola Photon 4G] mquezada21:
I dont quite understand the code since Im not a programer or have the resources to help code but I can definately use my photon as a test phone. All I need is the files and basic instructions. Im about to cancel Sprint so if it breaks I'll have insurance to replace it however this will only be for another week or so. No rush.
[Motorola Photon 4G] twaffle:
There are modified kexec tools to use that module, not sure how stable they are tho.
[Motorola Photon 4G] twaffle:
It may also be interesting to have the kexec module interface with VFS functions, possible eliminating the need for kexec tools to be needed to initiate the load&switch.

It could hook up to know what a new mount has happened, and check fore the existence of a "kexecNewKernel" sort of file, and if present, kick off the kexec directly.

Even better, hypothetically you could actually convert a raw kernel into a struct inside the module, and not need to load anything, but have the module be a fully self contained kernel in and of itself.

Altough, as cool as it sounds, it might be a bad idea, you could end up in an infinite loop and never be able to boot again.
[Motorola Photon 4G] twaffle:
Nevermind this post. Just move along. :)
[Motorola Photon 4G] tdhite:
Let's take a walk through the code ...:

From the init program source:

keywords.h:

...

KEYWORD(start, COMMAND, 1, do_start)

...

then, following do_start to service_start in builtins.c:

...

NOTICE("starting '%s'\n", svc->name);

pid = fork();

...

So start, in the context of init, is a true implementation in the guts of init itself. Therefore, all those 'start' don't call /system/bin/start, rather it implements start internally (standard fork/exec work).

the program at /system/bin/start (really, just toolbox), just does a property_set on ctl.start with the service name to start -- essentially signaling init to do the work.

At least that's all my read of the photon sources.

See my other note on kexec, though -- it's looking promising ...

---------- Post added at 08:59 PM ---------- Previous post was at 08:54 PM ----------

I have the modified kexec tools -- they don't compile yet -- lots of work.

However, on testing the kexec_load.ko module, I can reboot at will into the existing kernel. What that means is the module is working. What I *can't* do yet is actually power the device off (the module has a pretty bad bug, but we can fix that later -- it's doable, just don't want to worry about that right now).

For the rest: as usual -- if you use what I give (in this case, kexec_mod.ko), you might brick your phone, and that's the risk you assume, knowing of that risk.

If you're wondering how I test kexec_mod via reboot, you can play with it yourself if desired -- I uploaded it here (just insmod it). The module rewrites the reboot vector to 'kexec' into the existing kernel. When you reboot your phone, you will see the phone goes dark, then after a bit restarts. You will find, upon checking, that kexec_mod.ko is still loaded (meaning, you did *not* reboot via bootloader).

To unload the module, it's a battery pull, shutdown of power still fails.

Kexec-tools, if they work, should do the trick here. We are getting closer, for sure.
[Motorola Photon 4G] dakshinasd:
Awesome mate!!! Keep up the good work!

Counting fingers to run ICS on my monster...

Feel bad about not being able to help you guys!

Anyway goodluck:good:
[Motorola Photon 4G] tony442:
Has anyone looked into doing a locked ics rom with the gingerbread kernel? And I also have to say that it's sad when a community has basically abandoned this phone in the dev section and then a moderator closes a thread due to lack of development... I have lost faith in this site and will now only continue to come here to support the community... Not the site. Each individual should be able to express themselves and reach out to everyone for help... Rather than being limited to just the public eye. Sorry for the rant just pisses me off seeing the man pick on the little ones.
[Motorola Photon 4G] tdhite:
Not to worry. I'll open a thread in the developer forum once were have a viable and defensible plan of attack. The moderator was right, imho.
[Motorola Photon 4G] Lightsword1942:
Not sure if this has been posted before, but I have attached the kexec module from the Olympus(Atrix 4G). I don't think it was ever fully completed due to the unlocked bootloader coming out but it might be helpful. The one attached with olympus-kexec in the name was apparently working, the other one was not.
[Motorola Photon 4G] tdhite:
I also found the projects on gitosis and am using those to merge with the droidx2 sources that I started with. Takes a bit, but should be worth the effort.
[Motorola Photon 4G] phatninja55:
tdhite: Tested on my Moto Electrify 2.3.5 locked, and I get this:

insmod: error inserting '/data/local/tmp/kexec_load.ko': -1 Invalid module format

Edit:

I assume this is because I don't have the modded vpnclient.ko...

Edit:

I tried to load the vpnclient.ko but got the same error.
[Motorola Photon 4G] tdhite:
ok -- let's see what's up, please verify that your phone matches what the module expects (a Photon 4G tegra kernel) -- the info below is the output from my phone:

# md5sum /data/local/tmp/kexec_load.ko

d269fe8fdfcdbe918dfb644786f19908 /data/local/tmp/kexec_load.ko

# uname -a

Linux localhost 2.6.32.9 #2 SMP PREEMPT Mon Jun 11 21:27:05 EDT 2012 armv7l GNU/Linux

# insmod /data/local/tmp/kexec_load.ko

# lsmod

Module Size Used by

kexec_load 21792 0 [permanent]

bcmwimax 244037 4

bcmsdio 7864 1 bcmwimax

dhd 234647 0

vpnclient 66748 1

#

(the vpnclient.ko module is uninteresting for this -- you don't need it).
[Motorola Photon 4G] phatninja55:
Well theres the problem I think:

Linux localhost 2.6.32.9-00012-gadd9752 #3 SMP PREEMPT Tue Oct 25 16:05:27 CDT 2

011 armv7l GNU/Linux
[Motorola Photon 4G] tdhite:
We can probably make it work for you -- can you post the output of this:

modinfo /system/lib/vpnclient.ko

that'll at least give me the 'version magic' so maybe a chance to muck it. The problem, ultimately, though, will be that your kernel *very likely* does not have the same address for the sys_call_table vector as does the stock kernel. I use the exact address from the System.map file generated from the kernel build -- there's really no other way. But if you give me that value I can make it optional and you could set it.
[Motorola Photon 4G] phatninja55:
# modinfo /system/lib/vpnclient.ko

modinfo /system/lib/vpnclient.ko

filename: /system/lib/vpnclient.ko

license: GPL

description: VPNClient

depends:

vermagic: 2.6.32.9-00012-gadd9752 SMP preempt mod_unload modversions ARMv7

parm: ssh_debug_level:Debug level (uint)

parm: in_priority:Netfilter hook priority at IPv4 PREROUTING (int)

parm: out_priority:Netfilter hook priority at IPv4 POSTROUTING (int)
[Motorola Photon 4G] Cicar:
Insmod kexec_load.ko ----- OK

Checking kexec_load.ko not loaded after reboot or battery pull ------ OK

Tdhite, I confirm that your module works perfectly. :thumbup:
[Motorola Photon 4G] Slender Troll:
phatninja55, quick question. Why does your post date say 1970?
[Motorola Photon 4G] Lightsword1942:
Looks fine to me but probably related to Unix epoch time.
[Motorola Photon 4G] phatninja55:
I think its a tapatalk bug. My friend had that happen on a couple of posts.
[Motorola Photon 4G] Slender Troll:
Ok. Just making sure you aren't time traveling or anything lol.

Anyways, I would love to help, though I have no computer to do anything on.
[Motorola Photon 4G] twaffle:
Yea, I deleted the post text after posting it, and then doing exactly what you did, go look in init.c. :)

---------- Post added at 02:34 PM ---------- Previous post was at 02:24 PM ----------

It is most likely the magic information. When you attempt to load it, you will see a line in the dmesg output saying why it didn't like it.
[Motorola Photon 4G] phatninja55:
Any way around this?

like a magic spoof?
[Motorola Photon 4G] twaffle:
# lsmod

lsmod

Module Size Used by

kexec_load 21792 0 [permanent]

dhd 234647 0

vpnclient 66748 1

#

Looks good.

---------- Post added at 03:35 PM ---------- Previous post was at 03:05 PM ----------

Try using insmod -f kexec_load.ko

This will force it to load regardless of the checks. Since your kernel is very close to ours, it should work.
[Motorola Photon 4G] phatninja55:
Still fails to load.
[Motorola Photon 4G] Cicar:
I think it's discussed a couple of times earlier too. force loading of module is disables in our kernel. only thing possible right now is to edit version and subversion in kernel config file according to your kernel version and then recompiling the module. Ask tdhite he can do that easily.
[Motorola Photon 4G] tdhite:
Well, normally yeah. Alas, our kernel has the module force flags explicitly off. Moto absolutely tried to block whatever it could.
[Motorola Photon 4G] phatninja55:
I'd help you out and find the needed stuff, But I can't find the source for the electrify any where.

Found a release of all motorola phone sources:

http://sourceforge.net/motorola/wiki/Projects/

But this doesn't include the electrify.
[Motorola Photon 4G] tdhite:
I can checkin to github, but you'll need the kernel sources for the electrify so you can build and get the sys_call_table address. I will post a github report.

Time to create the development thread. I will start that with the source access attached.
[Motorola Photon 4G] phatninja55:
I emailed Motorola about there not being any publicly available source for the electrify, I shall await a reply.

For some reason I included this:

Motorla must supply you the source, or be in violation of the GNU General Public License.

all released moto source: http://sourceforge.net/motorola/wiki/Projects/

The electrify source is not included in this list, and there is no publicly available source for it.
[Motorola Photon 4G] LightingZ:
same here...
[Motorola Photon 4G] nickman529:
Thank you all very much. I recently was gifted an Evo 3D but I still support this Photon project all the way!!!