[Moto X Q&A] samwathegreat:
OK guys, this may be a rather long post...but its time this idea gets some consideration.

First, before I get FLAMED for even considering this idea, realize that I have contributed much to the android community, have a very high reputation, and I'm very well versed in the previous bootloader-exploits for the Razr M. So unless you know something I don't, which is doubtful considering that this whole "china-middleman bootloader unlock" thing is completely shrouded in MYSTERY, I'd appreciate it if you would refrain from blasting/flaming me for suggesting this.

Also, I'm not suggesting that I'm right about this, or even COULD be right about this -- I'm merely suggesting a POSSIBILITY. It is entirely possible (probable, even) that I'm completely wrong / off-track about this. I wouldn't be surprised in the least. In fact, I'm actually EXPECTING it.

OK. So what got me thinking about this were a couple things.

First, I've observed that at least one individual in this thread was sent *the same code* as another individual. According to the info, IIRC, it was sent to one member after the first code sent by the middleman did NOT work, and this second code DID work. The second individual advised that this code did NOT work for him. (This could just be a fluke - the middleman could have sent the wrong code to first individual by mistake...could have just been an accident......but maybe NOT?)

Second, nobody seems to be interested in sharing their "unlock codes". In fact, most of the time someone posts a screen shot of the terminal when they are attempting to fastboot oem unlock their device, they often "BLANK OUT" their unlock code.....I'm not sure why??? There really isn't any personally identifiable data that can be derived based off your unlock code, so I don't understand the hesitance or fear of sharing/posting these.

Because of this, we don't even know if any other individuals have been given the SAME unlock code from the middleman, and if so, whether or not the same code

worked

to unlock more than one device.

Now, we know that the

logic

of TOKEN validation (TOKEN = UNLOCK CODE) is the same (or at least SIMILAR) to that of the RAZR M. Granted, the bootloader-unlock exploit used to unlock the Razr M does NOT work on the Moto X, but this is because the vulnerability was in TrustZone and not the bootloader itself.

According to Dan Rosenburg (author of the famous "Razr M Bootloader Exploit") the "logic" of TOKEN Validation is as follows:

1) The CID partition is read from the device.

2) A digital signature on the CID partition is verified using a certificate stored in the CID partition.

3) The authenticity of the certificate is verified by validating a trust chain rooted in cryptographic values stored in blown QFuses.

4) The user-provided token is hashed together with a key blown into the QFuses using a variant of SHA-1.

5) This hash is compared against a hash in the CID partition, and if it matches, success is returned.

As such, "there is no way for a user to generate his or her own valid unlock token without either breaking RSA to violate the integrity of the CID partition, or by performing a pre-image attack against SHA-1, both of which are computationally infeasible in a reasonable amount of time." (Quote from Dan Rosenburg)

OK, sure, we understand that. Now examine the logic. Nowhere does Dan Rosenburg suggest that the TOKEN is unique to a particular IMEI, OR in any way validated or hashed against the IMEI. Only that it is based on certificates / keys / hashes STORED in the CID partition, and blown Q-fuses.

Following this logic, there is at least a POSSIBILITY that a particular TOKEN could unlock either a range of IMEIs (sequential), or a group of non-sequential IMEIs based on the particular certificate / key / hash / q-fuses for said devices.

Once again, the following is COMPLETE SPECULATION, but I think it deserves consideration nonetheless.

It is possible that we will find that more users have received an identical TOKEN, and that perhaps a single token *worked* for more than one person. If so, we could build upon this idea, creating a "database" of unlock codes. If there proved to be any merit to this idea, users could try each TOKEN, and might eventually find that one of them worked to unlock them.

Just think about how much money the middleman has actually made off this enterprise. $45 a pop! Anyone have any idea HOW MANY people have used his service? I'd say he's doing quite well financially.

I'm beyond certain that everyone would prefer to be able to unlock for FREE, rather than paying.

Now, once more (I can't stress this enough), this might be COMPLETELY off-base, BUT we won't know unless we gather additional data. Again, this whole middleman thing is a complete mystery to EVERYONE, --except-- the middleman, his associates and, of course, Motorola.

So here's the deal. Anyone that is comfortable enough to SHARE their unlock code, I'd like to start some kind of database for comparison. Perhaps another user could create a public spreadsheet in Google Docs or something similar, and we can start adding to the database. ONLY THEN will we actually KNOW if any of us have received identical TOKENS from the middleman. (I'd like help from another user to make available a Public spreadsheet for us to start the documentation - I don't use Google Docs personally. Preferably, it would be WRITE-ONLY, so users could ADD their unlock code, but no "Bad Apples" could come along and erase data.)

I'll start. I've received TWO unlock tokens from the middleman. Both were for Republic Wireless Moto X's. Here are the TOKENS I received:

KXVYDH5SYWYQJ2EB4643 (Republic Wireless XT1049)

AXZ3JJ3QE2GBZEWEG2IU (Republic Wireless XT1049)

Has anyone else received unlock TOKENS identical to these?

And finally, I'll end this post by saying that curiosity is very important to achieve any new breakthroughs. Making "educated guesses" based on analysis of available data is the only way to make innovations and new discoveries. It's OK to be wrong, as long you use what you have learned to build upon your knowledge and use this information to improve future analytics.

This is a hypothesis based on the [small amount of] data currently available. Nothing more.

PLEASE DON'T POST YOUR CODE TO THIS THREAD. IT WILL CLUTTER IT UP! Instead, please add your info to the database created for this purpose HERE < Courtesy of [MENTION=4895568]dier325[/MENTION] (Thanks!)