yashsingh1/xdaforums huggingface dataset:
[Moto G Q&A, Help & Troubleshooting] edukn:
Bootloader Keygen

Hello friend, I hope you can develop keygen,'m a programmer and I know the difficulties in deciphering algorithm, searched the Motorola site via inspect element, the most information I got was this extract javascript and a cookie file that stores the device or is not qualified, in my case he is not qualified, I'm 2 weeks and always trying to say that, from what I know of the database, they probably have a database with records of the devices and their unlock code already stored, when user inserts the code in the website, the system checks this database whether the device is registered or not, if the cookie is stored with the value "Phone Qualifies", check out this link:

I hope you can. Good Luck!

motorola-global-portal-pt.custhelp.com/cc/productRegistration/verifyPhone/phoneSN(IMEI)/phonePUID/phoneHASH(The code should be generated from here (phoneHASH))
[Moto G Q&A, Help & Troubleshooting] vientodearena:
For the moment the program only analyzes and prepare the datas obtained via "$ fastboot oem get_unlock_data".

A few years ago I studied the cipher cards, but almost nothing. I think we will have to collaborate all of us.

This is an entertainment that not everyone has time to devote, but if you like you spend one minute.

Imei used, hash and UID bootloader. Model and serial number in hex ​​line 2 does not use it.

All data is used except line 2 (Serialnumber and Model) in the page of motorola unlock device.

I have written some incorrect data and tells me "Your device does not qualify for bootloader unlocking",

but if I return to write well, tell me if I can unlock. So as you can see in the code of the page

type:"POST",url:"/cc/productRegistration/verifyPhone/"+phoneSN+"/"+phonePUID+'/'+phoneHash+'/'...

Uses these 3 values full. My program, for the moment only prepare and presents the data to send.

Note: in

https://motorola-global-portal-pt.custhelp.com/cc/productRegistration/verifyPhone/phoneSN(IMEI)/phonePUID/phoneHASH

i received "Not qualified", but in

https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-b

are ok for unlocking.
[Moto G Q&A, Help & Troubleshooting] danilocps87:
Any news?
[Moto G Q&A, Help & Troubleshooting] denzel09:
No .....
[Moto G Q&A, Help & Troubleshooting] eg0097:
So what exactly does the generator do, as of now?
[Moto G Q&A, Help & Troubleshooting] adrsay64:
basically my moto: g is a brick without unlocking bl :(:(:(
[Moto G Q&A, Help & Troubleshooting] eg0097:
Technically..... we could use a string generator to create a 20 character alpha numerical code and have it generate...idk all the number of combinations. Lol right now i made a test with 10000 combinations going at a steady 3/4 combos per second. But who has a week of spare time.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
I tried to be creative. I used the codes on the google doc, then feed them into the moto unlock page. I found out that it checks each piece of the information. I tried changing just the bootloader uid or that third string but kept all the others the same, and it didn't pass.

Then I put in the right info, but changed it after it gave me the option to request the key. But that didn't work. It kept giving me the old key.

You know, I wouldn't even care if aio/att just didn't remove tethering from the phone. That's all I want. That and maybe CM's way of doing tiles. But this just pisses me off that they lock it and Boost doesn't.

I'd go with US Celluar or Boost if their coverage didn't suck and speeds didn't suck either where I live.
[Moto G Q&A, Help & Troubleshooting] eg0097:
Lets just try to think of how things relate to one another. i found out that in the line 3 "5441383831304146473700585431303238" the last 7 digits are the model number just separated by 3's.:p
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Read this!

Hey guys, found this thread:

http://xdaforums.com/moto-x/general/verizon-moto-maker-bootloader-unlock-t2680651

In it, a guy in china can unlock Moto X and has done Moto G phones!

Edit: He only needs the IMEI but I guess that doesn't mean the code is generated via that.

Costs around $42 or so.
[Moto G Q&A, Help & Troubleshooting] denzel09:
What is the sense to pay 50 dollars, 1/3 phone price, to have a code can be send directly from motorola when motorola can ALWAYS to know that bootloader has been unlocked at least one time?

There is a qfuse!
[Moto G Q&A, Help & Troubleshooting] sprockkets:
It's for non retail phones. Try getting att or verizon to unlock yours. Not going to happen.
[Moto G Q&A, Help & Troubleshooting] eg0097:
With the imei you know all of the device's information... so its like an id for the phone all the other lines are part of the information stored behind that imei. all he really needs is the imei and then he has all the information.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Looks like that person who was giving moto x users unlock codes was fired.

So, back to work.

The unlock code is all ascii, right? Somehow that line 3 40 hex string gets converted, but, it has to be able to be all ascii in the process, and judging by the current codes given here, there are no lower case letters or symbols. Otherwise, straight converting it gives ??? or symbols.

So, we have a range of hex 30-39 and 41-5A.

I'm no expert, and reading up on how sha-1 works, it is just like that Dan Rosenberg said, it is a variant of it.

Read up on wikipedia to see what I mean about what characters are allowed.

http://en.wikipedia.org/wiki/SHA-1#The_SHA-1_hash_function

Thus we have no clear way to make our own keys, perhaps because the hash value stored on the device is only known on the CID partition and motorola, and has no real relation to line 3 at all.

Or, if you can figure out how that line is hashed, it may work. Otherwise, the token from moto is hashed with a key, then the hash is checked to see if it matches what is on the phone, and if it is, unlocks.

Again, that's just speculation. Maybe that key is the bootloader id or something.
[Moto G Q&A, Help & Troubleshooting] fgl27:
sharing my story to see if it helps, I know that some things may have already been reported but I believe that something in it will help.

.....

I'm one that cant unlock the phone, i have a retail version, but always receive the same from Moto unlock site ''Your device does not qualify for bootloader unlocking ''...

I contact Moto care, and after explain what i wanted, the only thing they ask me was the IMEI + my full name, e-mail and documents numbers.

They told me I would get the unlock code via e-mail.

But more than one month have pass and nothing, i tried the second time and they told me that i have to wait, I ask why???

They tell me, because the bootloader is a app of a third-party company, and Moto dont have access to the unlock codes. And this process takes a long time, how long they dont know.

So, or they lost the data from my phone or they dont wanna give me, im not dumb to believe it takes that long.

.....

I dont have any ideia how these numbers work but i think that if they only ask me the IMEI, they must have a spreadsheet with data, and that spreadsheet have the unlock code or part of it, that they combine with the IMEI and generate the number.

So like others already reported, maybe impossible for us to make a keygen.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Another theory. At the factory, each phone has a unlock token generated for it, and is hashed with something on that phone which could be unique or not. The result is stored as well, and could be line 3. But the token is hashed and needs to somehow reach an output on the phone.

Judging by the tokens however, they always have a majority of uppercase letters and a few numbers. That should possibly reduce significantly the amount of codes they generated.

In any case, I find it funny that those boot loaders that cannot be unlocked via moto, still allow you to try, because according to that page about the bootloader on Dan Rosenberg, they could have set it never to be unlockable.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Deleted, calculator error oops!
[Moto G Q&A, Help & Troubleshooting] notzippy:
I had a different ebay unlock code seller tell me that Verizon changes the factory unlock codes on there phones, that is why Motorola cannot unlock it. Of course that could all be BS, but who knows. If it is true then what was changed in theory should be able to be changed back..

Nz
[Moto G Q&A, Help & Troubleshooting] sprockkets:
If you check the link i posted on the previous page, a person in china gave unlock codes for verizon moto x's. They are there, moto just can't give them out per verizon's request.
[Moto G Q&A, Help & Troubleshooting] notzippy:
I am sure there will be a checksum byte in the unlock data and in the unlock code.

Sounds like an interesting challenge. Would be nice if more people added there information though...
[Moto G Q&A, Help & Troubleshooting] eg0097:
What information? :confused:
[Moto G Q&A, Help & Troubleshooting] notzippy:
The results of fastboot oem get_unlock_data and the unlocking string that was sent from Motorola. There are a few, but more would help...

Nz
[Moto G Q&A, Help & Troubleshooting] eg0097:
can send my stuff from an unlocked moto g..?
[Moto G Q&A, Help & Troubleshooting] sprockkets:
At this point I'm hoping for a 4.4.2 exploit since I can't downgrade. If they can do it for the moto x you'd think they could do it for the g.
[Moto G Q&A, Help & Troubleshooting] lightningdude:
There's a root exploit ready, but jcase is sitting on it til August. I think the reason for waiting is work-related or to prevent Google from patching before the next android version.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Well then I'll keep plugging along with mine. In any case I need to have 4 months of aio service to at least sim unlock it, though so far I like them better than tmobile for coverage.
[Moto G Q&A, Help & Troubleshooting] TotesMyGoats:
August? ._. Why? 4.5 isn't gonna be that different from 4.4.2. Google has said its mostly a business focused.

Sent from my Moto G XT1028

---------- Post added at 07:59 PM ---------- Previous post was at 07:57 PM ----------

Plus, 4.5 is supposed to break ALL root. So the exploit probably won't even work for 4.5 [emoji21]

Sent from my Moto G XT1028
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Eh, I won't accept any ota so there :)
[Moto G Q&A, Help & Troubleshooting] TotesMyGoats:
I'm just saying that he should go ahead and release it. But if he chooses to wait, that's his decision >.<

Sent from my Moto G XT1028
[Moto G Q&A, Help & Troubleshooting] denzel09:
Til august? But til august we ll have a new phone! :D
[Moto G Q&A, Help & Troubleshooting] migueldbr:
What?There is already an exploit?Why isnt it released?It makes no sense waiting for the next android version, especially if there is no garantee that it will work on the next android version=/. Of course i have no say in this, but it really makes no sense to me(if that is the reason why)
[Moto G Q&A, Help & Troubleshooting] TotesMyGoats:
Agreed

Sent from my Moto G XT1028
[Moto G Q&A, Help & Troubleshooting] TotesMyGoats:
Is it a moto g specific exploit? Or a general 4.4.2 exploit?

Sent from my Moto G XT1028
[Moto G Q&A, Help & Troubleshooting] notzippy:
If i had a guess it is a android exploit, achieving root access so the bootloader image could be dumped to look for exploits would be a start. Verizons bootloader will be different then moto-g
[Moto G Q&A, Help & Troubleshooting] zLoveXDA:
How do u even know he has an exploit?
[Moto G Q&A, Help & Troubleshooting] sprockkets:
AFAIK the bootloader is untouchable - unless you can crack ARM's trusted zone. The bootloader runs higher than kernel/root due to this. Although maybe moto just makes better bootloaders than htc since those seem to be easily broke.

Think about it this way, if TZ is just like Apple's A5X and up, we are screwed. I know Dan got to trick it once, but it's been 2.5 years since the iphone4s, and (AFAIK) nobody can manage to bypass running any OS they want on it without the key apple sends to sign with it.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
New theory - I'm willing to bet that the phone takes the unlock token, combined with the time listed on the bootloader since most websites do this when you login, then SHA-1 the sum and that has to match what is in the phone to unlock. That might be what line 3 is, but not sure.

For all those that posted your unlock information, post the date and time listed on your bootloader as well.

edit: tried an example that was in the video for a moto x, didn't work. Perhaps the only way to get it is to see if one could rewrite a bootloader to access the various hashes stored in the privileged locations once it is unlocked.

That is my 2 cents for today.
[Moto G Q&A, Help & Troubleshooting] eg0097:
Conspiracys broken?

http://i.gyazo.com/d205b0242b58c1690c9c86b19c9dd455.png <- This image is from a question in the support, it somewhat proves that a keygen can be made just from the code received from the "fastboot oem get_unlock_data" command.:good:
[Moto G Q&A, Help & Troubleshooting] Izaak99:
Cracking the key

I'm wondering if its anything like the SIM unlocker, where it takes 14 numbers off the IMEI (salt) mixed with some other part of that code that you have to supply (google "cracking SL3"). The only doubt I have about that, is that person in China who was supplying the unlock codes... I *think* he only needed the IMEI which makes me wonder if Motorola is using the other part only to verify a non-VZW / ATT phone.

Running those unlock codes through a hash identification program comes back with a lot of craziness (Haval160 MySQL5 RipeMD160 SHA1). Hoping its just SHA1, might be fairly easy to decode.
[Moto G Q&A, Help & Troubleshooting] jam0688:
here's mine. hope it can be cracked soon

A000002CD5A9FA00#5441383831304

514A3700585431303238000000#04BA

4E9DBEBCCCD1BA3ACD78ACAC10668EB

BA30C#1EBB52020F000000000000000

0000000
[Moto G Q&A, Help & Troubleshooting] eg0097:
Mine A000002CD591F800#5441383831304146473700585431303238000000#7382D664EF6BEB5D0E74F7037E345D284C7B5F75#02BCC6020F0000000000000000000000
[Moto G Q&A, Help & Troubleshooting] danilocps87:
Using Brute Force

Why we don't stop try to search the right combination to each phone, and create a script using brute force (all possible combinations) to run into cmd/adb/fastboot?

Well, the code consist in a 20 digits sequence, including letters and numbers. We have 37 possibilities for each position (27 letters and 10 numbers).

OK, OK, we will have some millions of billions of possible combinations... But, the script can run fast into adb, doing hundreds of combinations per second.

So, maybe this easier than find the exact code for each phone? Or not?

I don't know how to create this script, and how do it run into adb. Someone here know how to do it?
[Moto G Q&A, Help & Troubleshooting] sprockkets:
The codes appear to be mostly uppercase letters and a few numbers. The real amount of codes is fairly small, ie, you won't have a zzzzzzzzzzzzzzzzzzzz1 code or something like that.

Problem is, realistically, you can only do 3 tries a second, as the only way to do it is to feed it to the phone.

Moto has the codes for every phone, but they won't give them out if you have an att/aio, verizon moto g. Earlier in this thread I posted how someone in china was selling unlock codes for $40 or so for verizon moto x phones and one did it for his verizon moto g.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
That guy was fired for doing it.
[Moto G Q&A, Help & Troubleshooting] eg0097:
Apparently he worked or had access to Motorolas database :/. and maybe someone can create a generator which generates a 20 digit code then automatically runs the adb command :confused: I tried but instead of a generator i just set the codes to input and it took about 3 hours of random codes then i got bored and unplugged.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
He would take your imei, go to work, come back in a few days with your unlock code.

There is no real "guessing" it. The unlock code gets sha1 hashed with a key and another number, and if the result matches what is on the phone's secure location, unlocks.

Sidenote, if that xda dev didn't bother releasing his unlocker for last years verizon phones, we'd still have the ability to crack it, because I doubt they would have fixed the flaw on their own.
[Moto G Q&A, Help & Troubleshooting] eg0097:
Well i mean we shouldn't be greedy, he helped those people. We need help too and it seems like no one can provide it. :/
[Moto G Q&A, Help & Troubleshooting] Minervamc:
It's a good idea and I love it.
[Moto G Q&A, Help & Troubleshooting] danilocps87:
Guys,

Did you try another commands over fastboot?

I can retrieve a lot of bootloader codes using these commands:

-	fastboot oem config

-	fastboot oem cid_prov_req

-	fastboot getvar all

So, Can be some of these codes the key to generate the right unlock code?

Using “fastboot oem config”, it shows a URL for “FSG IDs”. It’s http://goo.gl/gPmhU. It’s a Google Drive protected document. Can be the bootloaders keys??? Someone here knows how to hack a Google Drive protected document???
[Moto G Q&A, Help & Troubleshooting] sprockkets:
Well maybe he shouldn't have blogged so extensively about how he did it.

Or maybe it doesn't matter. I liked his blog entry.

---------- Post added at 04:50 PM ---------- Previous post was at 04:19 PM ----------

Probably not if this is correct for moto phones.

http://xdaforums.com/showthread.php?t=1959445

Seems to be a backup partition for the modem stuff. But you never know.
[Moto G Q&A, Help & Troubleshooting] eg0097:
FSG IDs Fastboot..signed?...generated IDs?:confused::confused:
[Moto G Q&A, Help & Troubleshooting] fk2106:
I came across this post a couple days ago. After playing around a little, I figured out how the boot loader key is generated.

Obviously, the split is at every '#' sign.

A000002xxxxxxxxx#5441383831303957565A00585431303238000000#B5029136D1CFE74A1C1FDDB92711440EE3BF9EEE#878C51020F0000000000000000000000

The first piece: A000002Cxxxxxxxxx is the MEID/Serial Number

The second piece: 5441383831303957565A00585xxxx03238000000 is unknown for now... may be unused

The third piece: B5029136D1CFE74A1C1FXXXX2711440EE3BF9EEE is the hash code

The last piece: 878XXX020F0000000000000000000000 is the phone UID or PUID

for some people whose MEID is of the form xAxxxxxxxxxxxxxx

The actual esn are the characters in the (0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14)th

for some people whose MEID starts with 99 or 98, omit the last 2 digits.

(Don't ask me how I know this ;) )

Lastly, it's almost or nearly impossible to figure out how to get the reversed code from these numbers
[Moto G Q&A, Help & Troubleshooting] eg0097:
Cool, but what we need to know is how the unlock code is generated.:good:
[Moto G Q&A, Help & Troubleshooting] fk2106:
What I am saying is that unless you are a cryptography expert, it's almost impossible to find the unlock code, because they use Hashing.
[Moto G Q&A, Help & Troubleshooting] danilocps87:
So, the only way to generate a valid key will be using brute force. But… using 37 possibilities (27 letters and 10 numbers) to each of 20 positions, we will have about 38,696,203,475,348,900,000,000,000,000 codes… ADB can runs just 3 codes per second, or 259,000 codes per day. We will need more than 840 hours (35 days) with phone connected to ADB, to find the right code…

Or, if we find a good dev interested in unlock the Moto G bootloader, this may take just about a week… But, the good devs prefer to unlock bootloader from others better phones, like S5, Nexus 5, and others…

So, the question is, how will we to convince a good dev to help us and unlock moto g bootloader? We can offer a premium, doing contributions over paypal and giving to amount (US$300 ?) to this dev… What do you think about?
[Moto G Q&A, Help & Troubleshooting] lightningdude:
It's looking more and more like a bootstrap exploit would do much better. Work around, rather than trying to break through, ya know? Many other phones have had this successfully done, like on S-on htcs and older Motorola phones. Not to mention the Verizon Moto X.
[Moto G Q&A, Help & Troubleshooting] sprockkets:
If you read the first post you would know that we already know that, and more. The second line is the model and serial number in hex and rearranged a bit.
[Moto G Q&A, Help & Troubleshooting] danilocps87:
I notice another interesting thing:

I use MobileGo software to manage my phone through Windows XP. When I connect the phone over USB, it show a message: “Motorola XT1033 connected”.

Ok, until here all is normal, my phone is a XT1033. But, when I reboot into fastboot mode, and select “BP tools”, after the phone boot and I connect it, MobileGO sometimes show: “Motorola XT907 connected”, and other times it shows: “Motorola XT1032 connected”.

XT 907 is the Razr M, that already have root and bootloader unlock unofficials process.

So, can Moto G and Razr M share something, like bootloader, that can give us a unofficial unlock process?

Or, maybe this is just a bug in Mobile Go software…
[Moto G Q&A, Help & Troubleshooting] fk2106:
So

Line 1: phone esn -> PhoneSN

Line 2: phone serial number + model number (XT1028, XT1031, etc...)

Line 3: Hash code -> phoneHash

Line 4: Phone UID ->phonePUID

when checking motorola code, they have a verify function that takes in the phoneSN, phonePUID and phoneHash.

verifyPhone/" + phoneSN + "/" + phonePUID + '/' + phoneHash + '/'

and an unlock function that takes the same arguments

/unlockPhone/" + phoneSN + "/" + phonePUID + '/' + phoneHash + '/'

So they don't seem to be using Line 2 at all. Also by mixing the phoneSN and phonePUID from a valid phone with the phoneHash from an invalid phone, it still doesn't work, so there is also a relation
[Moto G Q&A, Help & Troubleshooting] denzel09:
But someone can explain me the utility about this?

If motorola CAN ALWAYS to know the previous unlock, always, why lost time on this?

If the purpose is the unlock code, ask a code to motorola because the thread purpose is a bit pointless in this sense.

If the purpose is crack bootloader, so ok..

My 2 cents..
[Moto G Q&A, Help & Troubleshooting] adm1jtg:
I believe the purpose... at least for me... is to be able to unlock the bootloader WITHOUT losing warranty. If you do it through motorola they will give you a code but your warranty is voided

If this process works motorolla would never know, your warranty would be intact and yuo could relock the bootloader if the phone ever needs warranty service
[Moto G Q&A, Help & Troubleshooting] sprockkets:
a quick check on the bootloader will tell them if you unlocked it, there is no getting around that fact, ever.
[Moto G Q&A, Help & Troubleshooting] adm1jtg:
just relock it before sending it in
[Moto G Q&A, Help & Troubleshooting] sprockkets:
It will say "relocked" instead of "locked"

That's how the qfuses work. Once you unlock, it is permanently changed in memory that you unlocked it and cannot be undone.
[Moto G Q&A, Help & Troubleshooting] adm1jtg:
This i DIDNT know thank you for explaining it
[Moto G Q&A, Help & Troubleshooting] robin0800:
Yes boot loader locked (virgin) status code is 0

boot loader unlocked status code is 3

boot loader relocked status code is 2

no idea if there is a status code1 or what it might mean
[Moto G Q&A, Help & Troubleshooting] danilocps87:
So, we are just wasting time here. There are nothing to do about this... Even if we have sucess with a keygen, our warranty will be void...
[Moto G Q&A, Help & Troubleshooting] adm1jtg:
For warranty and for USA and GLOBAL gsm units your probably right but you have to remember there are versions of the moto g that are not allowed to be unlocked by moto like the verizon and the AIO versions and I am sure a working unlock would be very helpful to owners of those units that have no unlock options