[JAM, MDA Compact, S100 Software Upgrading] Keeper:
exactly nadam...that's the issue...no one has figured out what password that is...i would suspect that it is stored on the locked area of the rom which can only be accessed with that password...(or by dissoldering the flash rom and reading it with a programmer... :p ) alternatively we could do it if we could craft a JTAG (EJTAG?) interface..but that's a looonngg story...

anyway, idk alot about mobile phones (my knowledge is more related to cablemodems hehe) so, assuming that both have the same concept or at least a similar one, the physical flash rom of the magician would look something like this:

----------

Bootloader

----------

|

--------

OS ROM

--------

|

--------------

Extended ROM

--------------

|

-----------

RADIO ROM

-----------

|

----------------

Non-volatile area

LOCKED

(IMEI,Serial,etc)

----------------

The Securitypass (System pass like i like to call it), is the only password that will give access to the non-volatile area...probably that's the area that allows you to control all those commands, like "l" (L), etc...

That area ain't dumped when you do a d2s...only the 4 upper parts are dumped.

If any of you has the time or will to disassemble the bootloader, we might see some routines which might lead us to a backdoor and/or flaw, so to access that area...but that's a long and hard work...

Anyway, let me drop you some more infos (once again, im assuming that this kind of devices are similar to cablemodems):

- usually, every part has an header: bootloader has an header; OS.ROM has an header for itself; radio rom has an header for itself.

- Each part is usually compressed (except, maybe, the bootloader aka IPL ?)...

- Idk what kind of compression is used on magician for the OS; Radio; extended ROM... (on motorola cablemodems it was LZH)

- If the bootloader is compressed, we would need to decompress it before loading it into IDA PRO...

- Each header is usually composed of one,two or more checksums: crc32 and/or MD5 and/or SHA1 +- others (at least that's how it is on cablemodems) (oh! it seems that the bootloader rom only has one checksum!) and they also have the starting address + end address + version + begin/ end memory write location + rom version, model + more stuff.

Here's a copy of my bootloader header:

MAGICIAN 0000000000

0000001.02 n..9

...rV~.m..xw.B..0...(.g..r

?.W..%.T..].1.n.&.V.....Q.

A....Ys....p$~>.b0"....Y..

...up0..ty....\..;...q..3.

..).".1.<PuWt.......J.{...

.....i.:.....sG...^/O.0.".

...n..|J}.T/.W..."........

5M.<..9.nG....p..`T*n.;...

.g{f..9..07l.m....X.....T.

&.f..0-...?.7.l.65.q.....v

/JYy.e.M.u.f.3..E.p.{D..d]

.,.....x.UlB.[_..Oy.=.V..$

.I.qX.AQ%...+(>J..gjHTCS80

00000000040000398A186E

...if you modify any code, you will need to recalc the start address, end address + checksum and check if it will not overwrite any other part on the flash rom that might be used for something else (like the os rom...)

- Disassembling a ROM / bootloader / radio, requires what is called symbols (imagine them like a function (stdio, stdout) header) without symbols, it's like looking to a pile of text not knowing exactly where each chapter starts and/or ends...(i would assume/believe that the magician roms do have the symbol table with them...if not, it would take alot more time to understand the code)

- The cablemodems that i've studied used MIPS R3000 code...(they were based on a broadcom CPU) magician has an XSCALE CPU...idk what kind of asm code do they use...

anyway, i hope that this gives you an ideia what work we would (will?) face if we really want to get the SecurityPass...

Keeper