yashsingh1/xdaforums huggingface dataset:
[Droid X General] lilott8:
It requires custom rims on another host. Realistically all you need is for the princeton program to read the ram from a different partition. Im sure it can be modified to mount the phone and read the ram from there.
[Droid X General] SysAdmin-X:
Kinda as an acknowledgement/off-shoot of what zaphod has said...

What if a second init process could be kicked off to hijack the boot process kinda like what koush did..

If the ram could be dumped quick enough... Would this work? I'm not a dev, but do a lot of sys admin work and understand many of the concepts for kernels, and boot processes...

Just trying to help throw out ideas and get the creative juices florin for those who can develop.

Ps, zaphod, thnx for all ur contributions on this forum, many of ur posts have helped me.a TON
[Droid X General] dreamersipaq:
Just Chiming In

That's kind of what unrevoked did:

I know we have completely different phones, but this is basically how they cracked HTC:

They found out that in the booting of the phone, during the init, adb would start, but then immediately get killed off by HTC's init. what they did then was found out that if they inserted an SD card into the phone at the precisely exact time (between when ADB started and got killed off by MOTO) so that it would be read right before ADB was killed by MOTO, it would hang MOTO's init, so they had full adb access during the init process, which allowed them to run the phones STOCK recovery alongside ADB. Firstly it allowed them to get root, then once they got root what they basicall did was kick off a LEGIT system update through the phones recovery and then SWAP it for a payload right in between when the phone finished the key checks and started writing the new system....

I know that we have two different things going on here.... but if they did this, I'm sure we could pull something like swapping kernels during load.....

MAN I wish Unrevoked got and tried to crack the X, but they focus on HTC phones.
[Droid X General] SysAdmin-X:
Any way to send this idea the devs' way without looking pushy? I think from a technical stand-point this is a worthwhile idea to look into...or at least give some thought to it...
[Droid X General] lilott8:
thinking about it further

After thinking about this more I think the answer has to lay in this exploit. We are right in stating that the key is actually burnt into a chip somewhere. However, we must remember that there is some key generation going on during the bootloader phase. Thus: at some point the correct key is stored in memory as the phone correctly boots. If the phone boots, the key is laying someplace in memory. It's just a matter of finding it.

I haven't had time to play with this yet, hopefully I will have some time this week or weekend. I am very confident that this will work, it's just a matter of figuring out how to get the program that reads the memory to look at my phone, not my computer.
[Droid X General] SysAdmin-X:
Liliott,

I'm really glad you are looking into this. I've read about this hack for pc's and think there may actually be something to this. I feel like if we could have something that hijacked the boot process real similar to Koush's recovery then if someone could write a program that would dump NVRAM (I think this is the equivalent to the phone RAM) this would work. With this said, I believe that the devs originally working on cracking the bootloader were able to get NVRAM into "engineering mode" (don't remember the exact terminology off the top of my head)....but I still am thinking this idea should definitely be given more credit and looked into.

I would love to help, but I don't have any dev experience, so I'm somewhat at a loss there....Thanks for pursuing this!
[Droid X General] jfwfreo:
The key you need (presumably an RSA key) wont be stored anywhere on the phone at all.

What happens is that Motorola produce new software for the phone and sign it with their private key (that only Motorola have). This is then sent to the phone. (OTA or whatever they do) The phone verifies the signature using a public key burned into the ROM of the phone (i.e. you cant change it without physically modifying the hardware somehow)

The best hope to break the bootloader on this phone is to reverse engineer it and look for an explot, as has been done on Moto phones in the past (various Motorola MOTOMAGX linux phones have been cracked open this way)
[Droid X General] dreamersipaq:
Question:

Ok, I know that this will pretty much fall flat, but I have to ask. The Milestone, and OG Droid are pretty much the same phone. Do they have the same boot loader, just unlocked? If so is it the same as the X? The reason I'm asking is it might be easier to crack the Droid since it's already unlocked?

It might be like looking at the lock from inside out trying to figure out how it opens, vs trying to open the lock by looking at it from the outside.

Also, does the MOTO use "goldkeys" like HTC did at one point in time, or have they moved on from that?

On another point, MOTO changed their keys from 2.1 to 2.2, and the phone accepted them. That tells me that it's possible. How much time that will take, I don't know.

Finally, is there any way to "intercept" the process like unrevoked did? I mean if we could get adb working while recovery is working, we could start the recovery process using a legit OTA, and overwrite the zip through adb AFTER verification and before the actual copying. That shouldn't set off the fuse, right?

ideas?
[Droid X General] TheSonicEmerald:
The Milestone has a locked bootloader, and hasn't been cracked for a year.

Sent from Eris with Froyo
[Droid X General] dreamersipaq:
I really am not trying to sound (too) rude when I say this, but

Did you even READ my whole post?

Yes, the Milestone is locked, but the Droid (the Milestone's US twin) is not.
[Droid X General] JinxtPhoto:
*Golf clap*

Gotta love it when people reply to a post without even reading a few sentances of the post they are directly replying to. It is understood that the Milestone's bootloader is locked, he was questioning how close the hardware and programming were between the OD (Original Droid) and Milestone aside from the lock being activated in the Milestone. It is the general consensus that the same lock and efuse functions exist in the OD but they are not activated. If this is true then it might be beneficial to see if any of the developers out there with a spare OD test to see if they can figure out how to activate the lock on an OD and then potentially have a better understanding of what might be involved with de-activating it.
[Droid X General] dreamersipaq:
Thanks!!!

rant

*Bow*

I'm glad that there are still people out there that have a reading comprehension above that of a wet mop. I won't insult them and say they have a low IQ though :p

I hate it when you take the time to put something that you though about up and someone comes along, reads the first sentence, and (without making any effort to finish the paragraph or REALLY think about what the person is trying to say) spew up crap equivalent to that of the "First" post on blog comment boards.....

/rant

Any haxzors? is this liable, possible, waste of time?

*please don't reply with "waste of time". give us some reasoning, otherwise your post does not help us at all*
[Droid X General] lilott8:
The reason it might now

The reason why it actually might not fail is this:

When the system boots, it runs it magic RSA/PGP/AES encryption. It then takes that and compares that to its bootloader routine that it loads. Where does it store the bootloader encryption result to compare to the system boot key? If you guessed memory you would be correct. Now if it stays in memory we will have the golden ticket. If Motorola is smart, and wipe that part of the memory upon OS boot, then it's a matter of timing. If we can get that key, we can, potentially, intercept the bootloader, present the key that we stole and boot our own bootloader/cooked rom.

I think there is quite a bit of potential here.
[Droid X General] SysAdmin-X:
*Clapping continued...*

I'm glad to see more people finally chiming in on this topic. Call me naive...but when it comes to the dev communities, it seems like "where there's a will...there's a way"

They had made decent progress on cracking this (kinda...) maybe this idea is one that should be looked into (probably said this like 5x in this thread now...oh well)

Thank you to dreamerispaq and Jinxt, appreciate you guys throwing some comments in here
[Droid X General] giventofly17:
did the release of the 2.2 SBF help at all? If there was a kernel change from 2.1 to 2.2, wouldn't a method be inside of the SBF? Is there any way to hijack the SBF to allow installation of a custom Kernel and ROM?

Shouldn't there basically be an entire phone image inside of the SBF file? If so, would it be possible to alter pieces of that to create some kind of exploit, or use RSD Lite itself and altered SBF's to load up custom kernels and ROMS?

I'm just chucking stones blindly here, I know this is way above my skill level, but I can't help thinking that a full SBF should help similar to the way you can pull the system image from an HTC RUU.
[Droid X General] dreamersipaq:
Unfortunately, I don't think so. The issue is that both sets of keys are probably hashed and encrypted.... so even if we pulled out the private key out of the SBF that motorolla used, we'd have to brute force it to decrypt it. If, let's say they were smart and used something like RSA as stated above, it'd take a super computer a couple of decades to crack it. :(

A brute force attack is not going to be helpful here I'm afraid. I'ts going to be more of a lets look at the code, and see if we can find a flaw somewhere in moto's coding that we can use to our advantage.

That's why I recommended looking at the OD. If it shares the same bootloaded, it's already uncloked. Maybe we could take it, reverse engineer it, and look at the calls it makes, where it looks for files, what order it loads things in, etc.... THIS would be more beneficial IMHO.
[Droid X General] SysAdmin-X:
Agreed. I think that looking at the OD may be one of the best choices we have right now...
[Droid X General] jfwfreo:
There is no private key for the bootloader stored ANYWHERE on the phone OR in any SBF files in ANY form. (encrypted, hashed or otherwise)

There is a public key stored somewhere (likely burned into the CPU like on other Motos I have worked with). This key is used on bootup to validate an RSA signature attached to each of the signed firmware pieces in the phones system.

There are 3 ways to defeat the protection on the locked-bootloader motos:

1.Extract the public RSA key from the lowest-level bootloader and brute force it (not an option given the vast computing resources and time required to do such a thing)

2.Reverse engineer the bootloader and find an exploit in it (as was done for the Motorola Z6, Motorola V8, Motorola Z6w and other phones)

or 3.Break into Motorola and steal the private key :P
[Droid X General] dreamersipaq:
So, I guess me and you are in agreement with reverse engineering the bootloader. Could someone in the know PLEASE chime in and let me know if

1) The OD bootloader is the same as the Milestone or X bootloader

2) If looking at an unlocked bootloader is any more beneficial then looking at a locked one

I'm stumped as to why no one has answered this after me posting questions about it three times. Is it really true that no one on this forum knows?

I'm still convinced that the CRACK would be to find out how the bootloader works, then let it authenticate a legit hash and AFTERWARDS, somehow redirect it to where we want it it to go.... IF EVEN just for the kernel. We don't need to unlock the damn thing. We already have recovery and roms.... we just need the kernel...
[Droid X General] giventofly17:
Who's up for option 3!! :D
[Droid X General] kennydied23:
In case you guys are interested in the bootloader progress (by nenolod), here it is:

http://nenolod.net/~nenolod/sholes/README

This project is pretty much abandoned though because the devs gave up, or are working on other stuff now.
[Droid X General] joshbates15:
mbm no luck

This is what nenolod said about this thread:

"no, the bootrom does not contain a key, only a sha1sum of mbmloader - mbm does not keep the key unencrypted in ram"
[Droid X General] eulerphi8:
A lot of these ideas have been tried on the Milestone, which is basically the locked version of the Droid...

can't post link but it's over at and-developers.com/start

They used the kexec exploit to load a second kernel but couldn't get the radio to initialize on the second boot.
[Droid X General] amathophobia:
Is there any information on how cvpcs is getting the AOSP kernel to boot. Are they using the kexec exploit to boot it?
[Droid X General] OldManJames:
cvpcs isnt using a custom kernel he is using the stock one. He is using chroot to get around the motorola init though.
[Droid X General] kennydied23:
A linux kernel dev has a plan to have a custom init to use kexec to bootstrap a custom kernel over at DF, so there may be ways to have custom kernels run soon...hopefully his plan isn't impossible.

http://www.droidforums.net/forum/droid-x-hacks/93955-getting-custom-kernels-running-droid-x.html
[Droid X General] Ubermicro13:
The following post is with a good nature intention.

Has anyone tried nicely asking Motorola for the info?
[Droid X General] SophT:
Yup. The mods edited the request and basically said 'no' and that asking is forbidden on the moto forums.

https://supportforums.motorola.com/thread/32922
[Droid X General] kdkinc:
Way over my head here !!!:eek:

Its nice to look Back to see what Moto Did on past phones similar to the DX.

Maybe a look at phones that Moto has since developed would shed some light on the BootLoader Issue.???

You can only use a old trick so many time until smart folks ,like yourselves , catch on...

:cool::cool:
[Droid X General] jasonm4046:
bribe

Why can't we just bribe someone at moto....... I mean the leaked froyo updates have to be coming from someone at moto....... you know a little slide of palm some money in some pocket and we have bootloader keys...... and for the people who look in the mirror way to many times through out the day don't take this serious and have fun with yourself... ( in a publicly safe way)
[Droid X General] aholeinthewor1d:
Yea I agree..I don't see how so muchcan be leaked..all the froyo versions and updates and both full sbf's..same for the d2...I was new to android when I got the x but from what I've read moto stuff has always been leaked
[Droid X General] eris_evil:
Im ready to see something happen we ***** and moan about how we want something and when we finally get its like yesterdays news so lets chill and it will come.
[Droid X General] c0uRtJe$t3r:
Huh?
[Droid X General] poisonberry17:
I could be wrong, but IIRC, Moto changed the encryption keys in the bootloader with the FroYo Update, didn't they? Wasn't that why the 2.1 SBF would get you stuck in the bootloader if you used it after accepting the OTA?

Which means, it's *not* hard coded... and wouldn't that mean that the new encryption key was actually coded somewhere into the OTA?
[Droid X General] poisonberry17:
Because as I understand it, only a handful of people (supposedly) know/possess the keys. Although, someone has to design and code them, so maybe that's not the case...
[Droid X General] wardo5757:
What news are u refering to?
[Droid X General] mr2man07:
I have no software engineering knowledge to give out, but if all else fails, there is the Class Action path.... Just saying ;)
[Droid X General] Ezun:
Hey guys, any update here? I know the OP seemed to have some significant kernel knowledge, curious if that knowledge along with the cold boot thoughts has been tried/tested or if it's still in the works.
[Droid X General] jasonm4046:
openiboot

Ok I just watched a short video of the apple Ipad being loaded with a bootloader that will be able to allow the Ipad to dual boot ios and android 2.2 in the near future.. granted it is still a work in progress. On that note would it be possible to piggy back bootloaders.... and if you don't know openiboot is the name of that bootloader (hense the title)
[Droid X General] Ezun:
Just tweeted: Any Linux hackers out there wanting to get kexec working on froyo please contact me

Tweeted by Aliasxerog
[Epic 4G General] andrewt328:
will epic charge while in clockworkrecovery?

thanks
[Epic 4G General] BThomas22x:
Lol... is the phone plugged in? Just because there's not an icon to show you doesn't mean its not.
[Epic 4G General] MysteryEmotionz:
Why would you wanna charge your phone in CWM anyways

Sent from my Emotionless Beast of an Epic using the XDA App
[Epic 4G General] jirafabo:
Haha I had this same question today. The reason I would want it charging when in Clockwork is because at the exact nanomillisecond before I clear my battery stats, I want to make sure it is still at the 100% it claimed to be at when I rebooted into Clockwork. Rebooting seems to take more effort than just being on, so I definitely want it charging while in clockwork. Plus, you can't tell by a blue full charge light bc I think the light is always orange in recovery, but I may be mistaken there.
[Epic 4G General] gophergun:
I don't believe so, but I'm nowhere near positive. I know the Droid X doesn't charge in its recovery mode, but I believe my old G1 did.
[Epic 4G General] BThomas22x:
Nah it charges... when you do the battery stat clearing, you charge it fully, unplug to boot to recovery, then plug it back in to maintain charge so its still at 100%, then wipe the stats... plus I charged in recovery just to test... worked for me lol.
[Vibrant Q&A, Help & Troubleshooting] kush815:
am kinda of a rookie on diz... my vibrant stays stuck on the " samsung vibrant screen...it goes in to download made and recovery as well... and have the correct drivers and odin and the files that i need.... the only problem is my stupid ass computer wont recognize my phone... can some one help plz :(
[Vibrant Q&A, Help & Troubleshooting] disturkis4u:
Odin wont recognize it even in download mode? Once you put it in download mode have you tried unplugging it and plugging it back in while Odin is on? It should say com6 in yellow in the box on the top left

Also, what were you doing when it bricked? What mods have you done?
[Vibrant Q&A, Help & Troubleshooting] chichu_9:
Install Kies Mini on your PC that should install the correct drivers, then use the latest version of ODIN.
[Vibrant Q&A, Help & Troubleshooting] larrisa12002:
Try this first: Google: "Froyo that does not brick"
[Vibrant Q&A, Help & Troubleshooting] NikolaiT:
EDIT: Issue Resolved.
[Android Apps and Games] mbrando45:
MAYDAY! I need the H7C Clock Skin for Weather Widget!! I accidentally deleted it, and now it has been yanked from the market. Of course...haha Can anyone please send it to me if you have it?

I would be very grateful!

Mark
[Android Apps and Games] mbrando45:
Got it. Thanks!!
[Android Apps and Games] pandacat17:
do you mind telling me where you found it?
[Android Apps and Games] mbrando45:
Just do a google search for h7c-clock. I found quite a few places.
[Android Apps and Games] mrpiggae:
I wasn't aware that it had gotten pulled. Thanks for the heads up, I just pulled the .apk's for the H7C clock and weather skins with Root Explorer and saved them.
[Android Apps and Games] mbrando45:
No prob.

Would you mind sending me the weather skin? The one I have is acting weird. The icon is not extending past the bottom of the clock. It's just a cut off flat edge.
[Android Apps and Games] loen:
can you please send the h7c clock file to me too?

Had it, reset my phone and now can't find it...

Thanks
[Android Apps and Games] mbrando45:
You can find it below. If you have any trouble, let me know and I will email it.

http://code.google.com/p/prettyweather/downloads/detail?name=h7c-clock.zip

Mark
[Android Apps and Games] loen:
Got it!!

Thanks!
[Android Apps and Games] tlfarnum:
One of you guys with he APK wouldn't mind sending it to me would ya? I just loaded up a new rom last night and realized they took the H&C skins of the market.
[Android Apps and Games] msoccer2:
Whoever has it can you send it to me too. I reset my device and when i searched for it in the market i couldn't find it and thought it was a market error, but apparently it has been removed. Thanks in advance :D
[Android Apps and Games] martigan3g:
If anybody can send me the archive h7c-clock.zip

In the link given it shows this message

In response to a complaint we received under the U.S. Digital Millennium Copyright Act, we have removed project "prettyweather".

If you wish, you may read the DMCA complaint that caused the removal at ChillingEffects.org.

Thanks
[Android Apps and Games] mbrando45:
Mods, is it ok to post these files to share in this thread? I am getting a lot of requests, but I don't want to break any rules.

Thanks.

Mark
[Android Apps and Games] Dodgylegs:
does anyone know where i can get the apk for Weather Widget or Pretty Weather?

I have a new phone and it isn't on the market anymore :-(
[Android Apps and Games] go3asy:
Could someone post the APK of H7C clock ive lost it and its down everywhere! thanks
[Android Apps and Games] Master K:
Me too!

I hate doing this but if someone has it and could PM it to me I would appreciate it!

Thanks.
[Android Apps and Games] mbrando45:
Moderators, could you please tell me if it is ok to post the skins on this thread? I am getting tons of requests. I don't mind sharing at all, but it would be a lot easier to just post them here if it would not be breaking the rules.

Mark
[Android Apps and Games] n0yd:
Ya bro if you wouldn't mind sending me the links to the clock and weather skins, that would be great. I would greatly appreciate it, thanks ahead of time.
[Android Apps and Games] epicguy:
if anybody who has it could also pm it to me it would be greatly appreciated
[Android Apps and Games] 3vilhomer:
i juz update my x10 to 2.1 n i cant find H7C clock in the market anymore...y is it removed??
[HD2 General] Illusive Man:
I'm using an HD2 with the stock ROM. I'm running CHT 2.0 (with much love). Everything works find with one exception: When miss a call the notification icon shows that call, but I don't know how to clear the indicator without restarting sense. Am I doing something wrong???

-
[7 Mozart General] Qazza:
I've got a number of Microsoft Office documents that I've created on my PC, but want to be able to use them on my Mozart...so the question is, how on earth do I get the documents on to my device?!?!?!
[7 Mozart General] pikacz:
download zune and sync your phone with your pc
[7 Mozart General] Qazza:
Zune only syncs Music and Videos, not documents...

I think I've found something, just need to get home and try it out.
[7 Mozart General] Maxwell Smart:
I've just been e-mailing them to myself... but I think you can use their cloud service to store them. I know not as handy as having folder access.... :mad:
[7 Mozart General] LordLugard:
Upload them to your Skydrive/Windows Live account. Simple as that.

Obviously a drag and drop PC solution would be optimal but it is what it is at the moment.

Forgive My Brevity. To Be Or Not To Be...