yashsingh1/xdaforums huggingface dataset:
[Droid RAZR M General] GnatGoSplat:
Wow, thanks for the offer!

I dumped my ROM and compared it to the images in the FXZ for my ROM (9.8.1Q-94). One concern I have is with the sbl1 and sbl2 partitions. What I dumped compared to what's in the FXZ aren't identical. On both those partitions, there's 128-bytes of extra data at the end. On sbl2, it looks like partial strings, I'm almost certain they're not significant. On sbl1, I can't really tell if that extra 128-bytes is significant or not. It could be both are just remnants from when the partitions were resized (older ROM versions may have had different partition sizes). I don't know how to reverse engineer the actual TrustZone code so I don't know if they do a hash or checksum of the entire partition. I kind of doubt it, but I'd feel a lot more comfortable if we could get dumps of sbl1 and sbl2 from a device still on 9.8.1Q-66.

If anyone with such a device is willing to help out, the commands to do it will be:

adb shell

su

dd if=/dev/block/mmcblk0p2 of=/storage/sdcard1/mmcblk0p2

dd if=/dev/block/mmcblk0p3 of=/storage/sdcard1/mmcblk0p3

exit

exit

adb pull /storage/sdcard1/mmcblk0p2 c:\mmcblk0p2

adb pull /storage/sdcard1/mmcblk0p3 c:\mmcblk0p3

This will put 2 files on the root of your c: drive, mmcblk0p2 and mmcblk0p3. If no physical SD card, change sdcard1 to sdcard0. If someone with 9.8.1Q-66 would be willing to dump those, zip them up and upload them, that would be really helpful.
[Droid RAZR M General] doubljdog:
I am on 9.8.1Q_27-2. What is the easiest way to get it to 66?

EDIT: I found the -66 update. Would you prefer the phones bootloader to be locked or unlocked when I pull the files.I've never unlocked it but it's old enough that I can. Also, I attached a zip with the files from my _27 system in case they would be of any help. Let me know how to proceed.

Nevermind
[Droid RAZR M General] GnatGoSplat:
Best way is with RSDLite and the fxz file, which might wipe your phone.

Here is RSDLite:

http://www.4shared.com/rar/q61LmCBp/rsd_lite_615__mtk_patch.html

The fxz file for 66:

http://sbf.droid-developers.org/download.php?device=8&file=73

I did a little more research and found a couple potential show stoppers.

1. Some devices don't allow using DD to brute force flash partitions directly. I've read Galaxy S4s for example don't allow it. From my unfortunately experience, it's possible for the XT907 to brute force flash the TZ partition, but I don't know about the others.

2. Even if it's possible to get all the old bootloader files on a device (via brute force flash, JTAG, physically changing chips, etc), sometimes newer bootloaders blow QFuses in the SoC that prevent the older version from working (again, referencing the Galaxy S4). QFuses, when blown, are permanent and irreversible because it physically blows a "fuse" in the chip. Whether or not the XT907 does this, only someone who knows how to read disassembled ARM code would know (or we'd have to try and find out).
[Droid RAZR M General] doubljdog:
As requested, here is mmcblk0p2 and mmcblk0p3 from a stock 9.8.1Q-66 system. Let me know what else is next. As i've said before, if this bricks my phone it is of no concern to me. The only thing I have it for at this point is a spare screen which I imagine would still work fine even if the phone is bricked.
[Droid RAZR M General] GnatGoSplat:
Thanks, those dumps look good. Before you do anything, maybe also take dumps of mmcblk0p11 thru mmcblk0p14. These are bootloader backup partitions which should contain the same data, but the backup partitions are different sizes. I think they're the same, but padded at the end with FFs so I don't think we will need them; I'll verify this to make sure since we only get one shot.

After that, next step now would be to upgrade to 98.30.1 9.8.1Q-94. This will make you permanently unable to unlock the BL with motochopper.

http://sbf.droid-developers.org/download.php?device=8&file=77

Then root using Saferoot.

http://xdaforums.com/showthread.php?t=2605578
[Droid RAZR M General] gtmaster303:
This thread is starting to get interesting...

Sent from my Droid RAZR M
[Droid RAZR M General] doubljdog:
A question on the update procedure. Do I just OTA the update or is there a download for it? Also, see attached.

EDIT: Funny that I would quote your post that contains the answer for the question I am asking huh? Getting ahead of myself here. Just got off the grave shift.
[Droid RAZR M General] GnatGoSplat:
Actually, FXZ or OTA update would work, so it's up to you, whichever is easier. :good:
[Droid RAZR M General] doubljdog:
Updating now, will root when finished.

EDIT: Updated and rooted. Let's make or break this phone.
[Droid RAZR M General] aviwdoowks:
I missed the instructions the test phone will be clobbered with.

Please before I get my popcorn....
[Droid RAZR M General] gtmaster303:
Not that I'm doubting you (I don't even know what's going on) but can we get an expert that's interested and has a little time to look through these last few posts? No point in bricking this phone if an expert says it will not work.

Sent from my Droid RAZR M
[Droid RAZR M General] GnatGoSplat:
I completely agree, I've been wishing an expert had something to say on this topic from the moment I posted it.
[Droid RAZR M General] aviwdoowks:
Suggestion:

[MENTION=245992]xxxx[/MENTION] for moto savy devs that we think may be qualified?

We can kick around a list & @ them as an edit to the best post?

Edit

Haha maybe xxxx is qualified! Lol. There is no xxxx.
[Droid RAZR M General] gtmaster303:
Only moto dev I can think of is hash code lol...

Not too familiar with the devs for this device considering I just got it. My best suggestion would be to find a dev that shared the original bootloader unlock.

Simple search and I found this thread:

http://xdaforums.com/showthread.php?t=2587520

Try messaging the op of that thread. Looks like he went down the same road as you

Sent from my Droid RAZR M
[Droid RAZR M General] GnatGoSplat:
The guy that wrote Motochopper (Dan Rosenberg) probably has all the answers, but I don't know how to get in touch with him and I don't know if he'd be interested in helping us.
[Droid RAZR M General] aviwdoowks:
http://xdaforums.com/showpost.php?p=50576965&postcount=543
[Droid RAZR M General] GnatGoSplat:
Thanks, I've emailed him.
[Droid RAZR M General] KBA3AP-Mikpo:
why only today? :D
[Droid RAZR M General] Cyb3rw0lfest1:
Would like to hear further about this. It's progressive at some point.
[Droid RAZR M General] DroidRazrNy:
Motorola maniacs

Board Of Directors

http://newsroom.motorolasolutions.com/content/default.aspx?NewsAreaId=140

Executive Committee

http://newsroom.motorolasolutions.com/content/default.aspx?NewsAreaId=1

Senior Vice Presdients

http://newsroom.motorolasolutions.com/content/default.aspx?NewsAreaId=141

May be able to get email addresses or corpotate numbers from linkdIn. Ive seen it done before.
[Droid RAZR M General] doubljdog:
Sadly we are bricked. Phone is now just a spare parts vehicle for my daily driver. At least it's one idea to scratch off the list.
[Droid RAZR M General] GnatGoSplat:
Damn, that sucks! Sorry for your loss!

So everything seemed to work okay, just black screen after reboot?

If everything worked up until the reboot, they must have blown QFuses like Samsung does.

Thanks so much for your sacrifice. At least now we know, there is literally no way to downgrade this phone.

It can be unbricked for $50, but interesting thing I learned is these phones are worth more as parts, if parted out. I bought a cracked screen phone for $26, used the screen from my bricked one, and dismantled my bricked one. Sold a bunch of parts off it for $50 total ($40 after eBay fees) and still have a bunch of parts left over including the bricked motherboard. Ended up profiting from bricking my phone. Who woulda thought? Probably could make over $100 parting out a phone with a good screen which is more than a working used one would go for.

Also, as someone pointed out earlier, it's probably Verizon execs we'd need to write to.
[Droid RAZR M General] Jonnes:
Why need to flash to the 66 builds? I think we can flash it to the 201m or xt905, these can be unlocked.

I am not an expert, just an idea.
[Droid RAZR M General] GnatGoSplat:
All ideas are appreciated. :good:

Whether flashing to another device's FW could work depends on whether the device can be unlocked officially, or through an exploit.

If it can't be unlocked through an exploit, it couldn't work. Official unlocks have you run a fastboot command to get a code which you send to Motorola's site, and then Motorola generates an unlock code that you use to do the unlock. The problem with the 78-up XT907 FW isn't that it doesn't have the capability to unlock via code, it's that Motorola won't send us the code. If a BL for a different device doesn't have an exploit, we still have the same problem that Motorola won't give us an unlock code. The only way we can BL unlock is through an exploit so we need an exploitable BL.
[Droid RAZR M General] Jonnes:
You can read this:

http://xdaforums.com/showthread.php?t=2541739

The 201m can be unlocked through the exploit, and it seems still available until now. Does anyone try it? I can't try it because the VZW M is my only phone, I am just a student, if it is bricked I can't afford a new one.
[Droid RAZR M General] lem22:
Yes, the 201M can still be unlocked, becuase there hasn't been an update to fix it. But there was an update for the XT907, so this exploit can't be used anymore.
[Droid RAZR M General] GnatGoSplat:
I think in order to be flashable to the XT907, and WORK, it has to have a newer signature.

Otherwise, we're stuck with the same problem as with the 66 FW, and doubljdog has already confirmed the appropriate QFuses are blown that an older FW won't boot.

So we'd need both a newer FW than what's on the XT907, and it needs to be exploitable.

I'm going to guess the same exploit was probably fixed in all newer firmware across all Motorola phones.

I'm really only seeing 2 possible options right now, since downgrading is ruled out:

1. Find a new exploit.

2. Get enough group pressure on Verizon to change the rules and allow Moto to BL unlock our phones. All Verizon Moto, Samsung, HTC, and other handset brand owners could be included in this group. The hard part is probably rallying/organizing everyone together.
[Droid RAZR M General] Jonnes:
Newer FW with an exploit? It seems impossible. But if it's just a signature problem, why don't have a try to make other devices' to this phone. Motorola released too many msm8960 phones at the same time. Maybe we can find a very similar model's TrustZone and do some change to the VZW M. I see the MB886 builds seems have the same signature as the VZW M new builds or newer, and the MB886 still can be unlocked through this exploit. And the U.S. Cellular M and the Australia M does.
[Droid RAZR M General] aviwdoowks:
Work for us too?

http://xdaforums.com/showpost.php?p=50979271&postcount=437

Ebay & Chinese 40.00 ul code?
[Droid RAZR M General] GnatGoSplat:
It very well could. Just over $40 for the code and $2.00 to an eBay middleman with access to Taobao.

It's priced high enough to where I'd have to think about it. If it were just $20, I'd jump, but ~$43 is almost half what the phone is worth.
[Droid RAZR M General] gtmaster303:
More like 1/3 of the phone value depending on condition. If you can find Droid RAZR Ms for ~$80 in newish condition, let me know where. I'll buy them all

Sent from my Droid RAZR M
[Droid RAZR M General] GnatGoSplat:
Yeah, true. There are many for $80 or so buy it now, but probably not in mint condition.

I'm still kicking myself for not remembering to bid on a RAZR M that appeared to be in mint condition (seller said no scratches and pics looked great) that had either CM10 or CM11 installed on it. It sold for under $100 if I recall correctly. Had I bought that and sold mine, probably could have come close to breaking even. I thought it was going to go for a lot, but I guess maybe people avoid modded phones like they avoid buying modded cars.
[Droid RAZR M General] Playb3yond:
Instead of trying to downgrade the bootloader, why not create a program that will generate unlock codes to use brute force to unlock it. There could also be some correlation between the unlock data and the unlock code. Maybe there's an underlying algorithm used to make the unlock code. I found someone's Moto X unlock data and code on the internet. Maybe someone could use it to find if this idea of mine is actually real.
[Droid RAZR M General] GnatGoSplat:
I probably still have my Electrify M unlock data and code as well, but according to some of the response on this thread:

http://xdaforums.com/showthread.php?t=890621

It sounds like brute-force would be pointless since it would take so long, we'll all be long gone by the time it completes.

All VZW phone owners are in the same boat, and there are many individual efforts, some with bounties on finding a way to unlock the bootloaders. I feel like what we need is to organize all these individual efforts together into one large effort targeting Verizon executives. If they're concerned about having to support users who have unlocked bootloaders, the solution is simple: just deny technical support to those with unlocked bootloaders.
[Droid RAZR M General] Playb3yond:
How would one go about dumping the kernel and bootloader?
[Droid RAZR M General] GnatGoSplat:
See post #32.

http://xdaforums.com/showpost.php?p=50591558&postcount=32

Change mmcblk0p2 to whichever partition you want to dump from this list:

http://batakang.com/XT907.php

The bootloader is mmcblk0p31.
[Droid RAZR M General] Playb3yond:
One more noob questioin, how to I open this file the correct way? I've tried IDA Pro but it didn't open it properly
[Droid RAZR M General] GnatGoSplat:
I wouldn't exactly call disassembling code with IDA Pro a noob question. ;)

Sorry, I can't help with that, because disassembling code is beyond my level of understanding.

Hopefully someone else can help with that.
[Droid RAZR M General] Playb3yond:
Couldn't you just replace the bootloader with a previous verison found in an earlier version of it and reboot? I don't think it should be very hard
[Droid RAZR M General] TheForceUnleashed:
We all wish it was that easy.
[Droid RAZR M General] GnatGoSplat:
You can downgrade the boot partition easily enough with the older version and it will still boot, but no exploit that way. The boot partition is only part of the bootloader. The other components of the bootloader are more protected by a chain of trust and found in partitions sbl1, sbl2, sbl3, tz, rpm, and aboot. Those can't be downgraded in fastboot, and brute-force downgrading using DD is what we've been discussing for the first few pages of the thread, which doubljdog attempted and ended up with a brick.
[Droid RAZR M General] Playb3yond:
another question I have is how would one get these partitions? are they found in the boot.img and if so, how do I extract them(which tool to use)?
[Droid RAZR M General] GnatGoSplat:
Answered in post #68.

http://xdaforums.com/showpost.php?p=51052579&postcount=68

Boot chain consists of the following:

sbl1

sbl2

sbl3

rpm

tz

aboot

Look those up in the chart and you will know which partitions to dump.

You can also get them from the fxz if you have it.
[Droid RAZR M General] Playb3yond:
where are they located in the fxz? I've downloaded them and extracted them but can't seem to find the /dev/block part in either the system or boot images
[Droid RAZR M General] GnatGoSplat:
In the fxz, they're just files. Fastboot flashes them into /dev/block/mmcblk0pX partitions (where X is some partition #). The chart linked to in post #68 shows which partition they go into.

In the fxz:

sbl1.mbn = sbl1

sbl2.mbn = sbl2

sbl3.mbn = sbl3

rpm.mbn = rpm

emmc_appsboot.mbn = aboot

tz-mbn = tz

boot.img = boot
[Droid RAZR M General] Playb3yond:
that's the information I was looking for, thanks. I'm going to attempt flashing all this at once to see if I get the desired results
[Droid RAZR M General] GnatGoSplat:
I'm not sure what your ideas are, but if you're attempting a downgrade, fastboot will stop you. Bypassing fastboot by writing directly to the appropriate eMMC partitions was what we were trying to do earlier, but that hard-bricked the phone presumably because newer versions blow a qFuse required for older versions to boot.
[Droid RAZR M General] Playb3yond:
I was able to flash an earlier version of the bootloader but the tz partition won't downgrade, no matter what I try. I'm assuming tz is the trust zone partition
[Droid RAZR M General] GnatGoSplat:
Yes, tz is the trust zone partition, and sbl1, sbl2, sbl3, aboot, and rpm are also part of the "chain of trust". I don't believe any of those can be downgraded in Fastboot since it does a version and signature check. Bypassing Fastboot and doing a brute-force downgrade of these partitions was the reason for the post - I did a brute-force downgraded of TZ by itself which hard-bricked my phone. Thinking maybe brute-force downgrading ALL partitions involved in the chain of trust would prevent an unbroken chain and allow downgrading was what doublejdog tried for us, and turned out he got a hard-brick as well.

So it looks like we can't downgrade at all. There are apparently qFuses blown which prevent an older bootloader chain from booting. This isn't terribly surprising, as the Samsung Galaxy G4 hackers had discovered the same with their device. Even using JTAG to write an older firmware directly to the eMMC resulted in a hard-brick for them. The guy that can do a JTAG hard-brick repair on an XT907 also confirmed he can't do a downgrade because it won't boot. Unless you can find an exploit or weakness in the existing 94 firmware somehow (like Dan Rosenberg found for 66 and below), I think we're stuck, short of a strongly-worded email campaign to Verizon execs.
[Droid RAZR M General] minniee:
Hello :)

i have locked xt907 so i looked for some time to find method to unlock and found this thread. unfortunately i'm not an android or mobile developer so please take it easy on me if i say some nonsense but i'm curious if anyone tried to:

1. brute flash entire chain of trust copied from post 98.18 update with unlocked bootloader - assuming qfuse blown it's not entirely downgrade so maybe...

2. brute flash entire chain of trust as above from dev ed?

3. modify downgrade images, so it appears as upgrade (change version maybe?)

4. exploit native upgrade system: use it to downgrade?

and one final thought: assuming that retail and dev phones are same physically and that dev can take upgrades - a wide field to exploit.

what do you think guys?
[Droid RAZR M General] GnatGoSplat:
1. With qFuse blown, downgrading chain of trust can't work. It'll hard-brick.

2. Same as #1.

3. Images can't be modified because they are signed and it would take longer than our lifetimes to crack the signature.

4. Even if we could find a way to exploit Fastboot and downgrade through it, we still have qFuse problem and probably end up with a hard brick.

Retail and dev phones are 100% the same, same FW and hardware. Only difference is Motorola will give you the unlock key for a dev phone, but they will not give it to you for a retail phone. If we had the unlock key, we could unlock it the same as a dev phone.
[Droid RAZR M General] minniee:
ok, so #3 method is not applicable. but what with #1? say i have 98.18.78 (which i actually have) and try to flash it with all chain of trust taken from other 98.18.78 with unlocked bootloader. no downgrade so no qfuse problem. or maybe even from higher version of update. same for #2.

as for #3 i understand, that generic updates from motorola are done with fastboot? not some automagic internal app?
[Droid RAZR M General] GnatGoSplat:
That won't work because firmware is identical between phones with locked and unlocked bootloaders. The difference between a phone with locked BL and one that is unlocked is the "BL locked" qFuse is blown. Entering the unlock code is what blows that qFuse.
[Droid RAZR M General] thewraith420:
Just a thought... Only somewhat related... Could we force flash a real recovery on a locked bootloader phone via dd?
[Droid RAZR M General] minniee:
This doesn't make sense :( What about dev edition which is unlockable - it has to have some changes that makes unlock possible either by blowing qFuse or other way. If I understand right previous exploits used some kind of code to blow proper qFuse, right? After the update this code is modified (gone?) or the new qFuse is blown to prevent unlock permanently?
[Droid RAZR M General] ilichva:
You can read HERE
[Droid RAZR M General] GnatGoSplat:
Yep, read the link provided to ilichva and you might understand.

Basically, the only differences between dev and retail are within Motorola policies which are influenced or demanded by Verizon. How unlocking works with a dev device is you run a fastboot command that returns a unique hash value. You go to Motorola website and submit that value, it generates an unlock code for you which you enter into your phone using a fastboot command. Then voila! Unlocked! Proper QFuse is blown to tell bootloader phone is unlocked. With a retail device, you can generate the unique hash value, and when you submit it to the Motorola website, it says, "Sorry, you have a retail device, no unlock code for you!" That is the only difference. An unlock code does exist for all retail devices, it's just that the website won't send it to you. There's that Chinese seller who has a contact that works in Motorola and is able to sneak out unlock codes for retail devices, which has been confirmed to work.

Yes, previous exploits were able to blow the proper QFuse, but now newer BLs have been patched to protect this QFuse where the exploit doesn't work.
[Droid RAZR M General] GnatGoSplat:
I did try that and it doesn't brick the phone, but it doesn't work either. If I recall correctly, trying to boot into the force-flashed recovery resulted in the phone booting normally and restoring the stock recovery. These phones apparently have this capability which on a BL unlocked device, can be disabled from within recovery. I think even if we could disable that capability, the force-flashed recovery still won't boot due to signature checking.
[Droid RAZR M General] thewraith420:
After some reading around I think we could stop it from reflashing the stock recovery on boot by deleting recovery-from-boot.p
[Droid RAZR M General] gtmaster303:
You sure that won't corrupt the boot sequence? I didn't think it would be that easy... Anyhow, it should be easy to test considering if something does go wrong, you can just rsd back to stock.

Sent from my Droid RAZR M
[Droid RAZR M General] thewraith420:
Well like you said... It shouldn't be a hard brick regardless. Rsd should fix any issues resulting from deleting the file or possibly if safestrap recovery is installed that could even restore system
[Droid RAZR M General] aviwdoowks:
What to make of this?

http://xdaforums.com/showthread.php?t=2697153
[Droid RAZR M General] thewraith420:
Well I just deleted the file on mine and confirmed that it doesn't break the boot sequence. Soo... If we could get one to flash and boot we could stop it from getting flashed over

edit: bummer.. just tried to force flash the recovery... it worked but it wont boot the newly flashed recovery. fastboot comes up and says recovery failed hab check or something like that. so i've already flashed the stock recovery back because at least it boots... even if it is about useless
[Droid RAZR M General] Playb3yond:
I tried deleting the tz partition, but the phone would still boot.It would actually still have the file in the filesystem after booting. Is there a way to remove the tz partition completely, then re-flash a lower version? Maybe that could be the solution. I can successfully downgrade the bootloader to an earlier version without any problems and the phone will boot.
[Droid RAZR M General] GnatGoSplat:
You could use DD to fill tz with zeroes or FFs, but I'm 99% sure that will get you a hard brick.

Also, tz is in the chain of trust. You can't replace it by itself. I already tried that. Got hard brick.