yashsingh1/xdaforums huggingface dataset:
[XPERIA X10 Android Development] mmxsaro:
Hi gang, if we're going to bruteforce the private keys, we might as well factor the RSA 1024 number (that 309 decimal number). If we had a quantum computer, it would be very easy (but we'd be past that already).

Forget about playing around with the phone's voltages to make a key spew out. There's a reason why capacitors exist. We need the proper voltages applied to phone's PCB components to prevent damage (over-volting AND under-volting).

The possible logical steps here are (from hardest to simplest):

Write your own bootloader, overriding the X10's.

Find a flaw in the bootloader.

Buy a new phone.

I don't want to be a "Debbie Downer", but coupling together a few quad core processors and high-end GPUs will not even come close to factorizing the RSA number. Sure, you can accelerate the cracking with the help of Amazon Web Services (a GPU farm) but the costs involved would be more than buying a new phone for everyone on XDA. Let's be realistic for a moment.

The MilestoneRSA project is a nice attempt, and it shows dedication, but the guys who put it together have no idea what's going on here. Cracking the RSA 1024 key is pretty serious. We're talking about computer science here. You'll win the Nobel Prize, Google will hire you and Albert Einstein will congratulate you personally. You think a bunch of college kids are going to crack open an encryption in the span of six months with the gathering of i7-980xs and GTX 580s?

As much as I want Android 2.3 to be running on the X10 natively, we have to accept the fact that Sony Ericsson engineers are a bunch of assholes for locking **** down tight.
[XPERIA X10 Android Development] DaveShaw:
You can't do #1 without #2 first (or some exploit or other).

I don't know much about android or SE, but in the ol' HTC Win Mo days it was a patched SPL that could be loaded into memory from within the OS and then "Jumped" to. (JumpSPL). The patches allowed the flashing of new Bootloaders and/or OS's.

Also there was the USPL Exploit to perform a stack overflow to inject executable code into the running bootloader - in this case another patched bootloader ;)

EDIT: Hey, this old mod's knowledge isn't completely useless now Win Mo is Dead :D

Dave
[XPERIA X10 Android Development] Lord Takyon:
I've spent the last few days getting a better grip with cryptography, my knowledge was seriously out of date, and brute force is not the answer.

It is going to take someone with some serious talent in this area to beat this conundrum. Brute force will not cut it, this is going to require a very technical approach.

Although, discussion like this is often fruitful.
[XPERIA X10 Android Development] MrHassell:
Mate you are right and it has been said before but you made a very good post and did it without being a douché! - A flaw will be the way that this happens, as much as I would love to screw out the pass phrase by draining the phone of power, it's a hell of a lot cheaper to buy a Nexus S, Desire HD, iPhone 4 and HTC Mozart outright than build the supercomputer that more than likely will never amount to anything other than a great games machine... I'm going with option 2 :cool:
[XPERIA X10 Android Development] kordiak:
What kind of wrench that one? It is a RSA 1024 bit? It might be a solution www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf

I hope that helps.

Sorry for my English. use google translator because I do not know English well.
[XPERIA X10 Android Development] pedrocel85:
Hello,

I want to try this project.

I run a university informatic lab with 28 computers.

28 core 2 quad 2.8ghz.

I will configure it all to work for it in nightime.

ChillRalaxed? Lets move on?
[XPERIA X10 Android Development] FilexUnderground:
That should be great! :D
[XPERIA X10 Android Development] Chillaxed:
Well its up to you guys. I'm not the one building the program to do it. Raw numbers isn't the answer. Before checking with the bootloader make sure its a prime number and a certain length obviously so we don't waste as much time. Then as time goes on implement faster and new ways of filtering out useless numbers.
[XPERIA X10 Android Development] pedrocel85:
Chill,

Lets make this happen

Is there anything concrete avaliable for we to basis this work?

The milestone program(tweeked) can work in our devices?

I have no knowledge to be the hesd of this project, you have chil?? you know someone who have it?
[XPERIA X10 Android Development] ttf:
Hi,

As others said, brute force the RSA 1024bits is just a no go (today).

Just for fun have you already tried the kirk keys already? (i know devs can be lazy sometime) worth a try:

D76AA478E8C7B756242070DBC1BDCEEE (HMAC Key)

428A2F9871374491B5C0FBCFE9B5DBA5 (AES Key)

004080C01B5B9BDB004080C01B5B9BDB (AES Key)

9802C4E6EC9E9E2FFC634CE42FBB4668 (AES Key)
[XPERIA X10 Android Development] idtyu:
impossible

for wat i had learnt, RSA with 1024 bits of key seems impossible, unless you have 1000+ CPUs to work on it, and tat is still going to take at least a week ... but i guess u can build a program to let everyone do it for u , like PS3 ...
[XPERIA X10 Android Development] pngface:
Processing power is not an issue here.. there are enough people who will volunteer cpu power. The problem is the time its going to take if we just use a brute-force method. There should be some vulnerability to the key that we can exploit, and hence drastically reduce the run time
[XPERIA X10 Android Development] Hawkysoft:
so instead of talkin about it for weeks now... did anyone start to make such a program that we can scan it? idc if ppl say it takes years w/e.... we need to start else it will never happen!

oh for the reply's dont gimme that stuff about its not possible... it takes to long.. to much cpu... etc.etc.

i got tons of pc's i can use... all i need is the program.
[XPERIA X10 Android Development] skyleth:
create a boinc project like the one in the motorola droid/milestone forum. They're trying to do the same as us
[XPERIA X10 Android Development] FRAPSROOTET:
Migth got a friend for the Job, to create this so everybody can start helping us.

Ill inform you with a PM if he will assist XDA. Hes the bruteforce (God) we all need.
[XPERIA X10 Android Development] pedrocel85:
yeah!!!

We only need this programer, the computer prower we already have.

fingers cross
[XPERIA X10 Android Development] Minoza:
OpenCL

I just wanted to say that OpenCL might be a good starting point, we could use our GPUs to do all the job, maybe I'm wrong but aren't GPUs alot faster than CPUs when it comes to things like this?
[XPERIA X10 Android Development] ffortissimo:
SETI@HOME (Sony Ericsson To Infinity ;))
[XPERIA X10 Android Development] nekkidtruth:
Not to be a Debbie Downer, but hasn't it already been established in the Bootloader Cracking thread that this is useless? Not because of how long it would take to actually brute force the key, but because the key doesn't actually work like we think it does.

I'm not entirely sure, but someone might want to take a look at what's going on in that thread before proceeding. No point in wasting not only our own time, but others time as well.
[XPERIA X10 Android Development] Adolf1994:
If anyone decide to do something, here are some info about rainbow tables and an (nVidia CUDA) GPU accelerated hash cracker that uses rainbow tables

http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracking.html

http://www.cryptohaze.com/
[XPERIA X10 Android Development] :
rainbow tables totally useless for task of factoring of rsa keys.

anyway, if nothing groundbreaking will happen ( i think not ) pc power ( mainly, hdd and memory amounts ) to factorize rsa 1024 key will grow enough after 5-6 years from today.

maybe even more.
[XPERIA X10 Android Development] DooMLoRD:
if anyone can get a cuda optimized program ready... i have a few fermi [GTX 480] (480 cores each), GTX280 (240 cores each) cards with me... i am willing to help out...
[XPERIA X10 Android Development] Hawkysoft:
the_laser give me the right program to crack the bootloader and im sure i can give u the key within a month end of discussion about time rate
[XPERIA X10 Android Development] pngface:
I think it has been well established that most people own a decent computer(s) So the 'only thing' we need is the program :p
[XPERIA X10 Android Development] Meikrekel:
Would that be if we only let this task be done with one pc (the 5 or 6 year) or with many pc's?
[XPERIA X10 Android Development] Chillaxed:
When its ready let us know
[XPERIA X10 Android Development] Blagus:
He meant "wait for 5-6 years, then computers will become enough powerful to crack 1024-bit RSA key easily"... ;)
[XPERIA X10 Android Development] Blagus:
I've given the key somewhere in this thread (S1_loader_root public key)... so go and crack it... it's not hard to Google some apps to crack these keys :p
[XPERIA X10 Android Development] Hawkysoft:
If its not whats stoppin u?
[XPERIA X10 Android Development] Blagus:
OK, I was a bit wrong about ease of finding cracking tools on net :p but, couldn't we kindly ask AndrOINC developers directly for help?
[XPERIA X10 Android Development] DooMLoRD:
guys i just wanted to say that i have access to gpu cluster which can help us cut down the time required for this cracking process... its better to have a few thousand dedicated gpu core doing the work for u rather than using a few cpus... ;)
[XPERIA X10 Android Development] :
768-bit rsa key was factorized in about 3 years using hundreds of top quality cluster systems.

about 10 terabytes of hdd space was needed, about 180 gigabytes of ram was used during processing.

concluding remarks from authors:

what to say more ;) well , that - gpu is NOT (yet?) usable in most time consuming part of rsa factorizing task.
[XPERIA X10 Android Development] Hawkysoft:
@blagus, lol i knew you would swallow those words ghehe, but atleast ur honest +1 for that.

About andro group, can u get in touch with them or u need someone for that?
[XPERIA X10 Android Development] Blagus:
I don't think there's some big problem in sending a PM to OP of AndrOINC thread here :p
[XPERIA X10 Android Development] Hawkysoft:
Gawd i love sarcasm in the morning, but good job bro lemme know what he says
[XPERIA X10 Android Development] MrHassell:
SSL strip

Before BIOS executes on a computer, CMOS ensures power is available and BIOS is safe to load. Modifying the hardware initialization sequence or using a jam table approach is difficult because of the encryption being in EPROM -first signaled event and challenged on initialization of the file system load.

Consider the N-Tier approach to certificate cryptography, the one everyone encounters daily is SSL, when checking email or surfing the web it is the basis of client server cryptography.

check it out and google for the videos if your interested. Being not a client server scenario and the communication is on a circuit board, no obvious method is exposed for intercepting the encrypted communication channel, as is with remote web servers and a web browser.

This method is employed by the phone, each X10 being a Marlin client, talking to Octopus via web services over HTTP. This is used for certificate issue and revocation, although worth intercepting all we see is what we can already access by certificates in plain sight cached on every phone's firmware.

EROM AID: 0001

SOFTWARE AID: 0001

LOADER AID: 0001

FLASH ID: "000C/00Z1"

LOADER VERSION: "RXX00Z"

The flash process works and today we switch out firmwares based on this process, SIN files (BIN) are pushed via recovery mode. This works with the exception of SIMLOCK.TA - the primary reason for encryption on the Boot loader, according to Sony and their partner "agreements".

I question the validity of SE's vendor agreement and level of enforceability, based on the legal stand point the owner of the phone, has the right to modify all aspects of a mobile phones firmware, of which the boot loader is an integral aspect!

PROCESSING: simlock.ta

UNLOCK IMPOSSIBLE IN "SIGNED" MODE

This signed mode is the RED or RETAIL signature, on all retail devices. The BLUE_BROWN or ENGINEERING signature is available and we can compile Android and sign with this but.. the EPROM is signed with RED as has been pointed out far too many times now.

Dev's have no-way of intercepting or interpreting what the RED key looks like or obtain it, so no choice but to find an exploit within the X.509 chain, RSA method, DRM validation, base initializer or use hardware related faults to generate an error sequence accurate enough to replicate and make the phone spill it's secret.

I'm messing around with this, tapping the circuit with a club hammer and it isn't working very well. Like my grandfather said, you never take a football to the ballet.
[XPERIA X10 Android Development] Blagus:
Can you explain a little bit detailed this quoted part - which recovery and how? "True" recovery on phone or what?

And where does that "UNLOCK IMPOSSIBLE IN "SIGNED" MODE" message pops up???

I'm sure that all we need is enter bootrom mode somehow - on X8, next to headset plug there are strange three pins, maybe leading to RX, TX and GND? :D
[XPERIA X10 Android Development] pato66:
sinlock.ta

// [SIMLOCK S1]

02

000007DA 0134 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 02 00 05 0A 02 00 00 00 0A 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 40 4F 50

5F 49 44 3D 22 38 32 36 33 22 3B 4F 50 5F 4E 41

4D 45 3D 22 47 65 6E 65 72 69 63 22 3B 43 44 41

5F 4E 52 3D 22 31 32 33 32 2D 39 38 39 37 22 3B

43 44 41 5F 52 45 56 3D 22 52 39 41 22 3B 00 00

00 09 00 07 30 30 31 30 31 2D 2A 00 00 00 00 00

00 00 00 00 00 00 00 02 00 00 00 0A 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 0A

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 02 00 00 00 0A 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00

Is this anything?, sorry and delete if its useless

cheers
[XPERIA X10 Android Development] pathogen:
So from my understanding of reading this gibberish is that the goal is to crack the public key to get the private key? if there are multiple public keys couldn't we find some kind of similarity between the primes to make it easier to crack the private key? could this not be done with the red and brown keys?
[XPERIA X10 Android Development] abrarabbu:
RSA can be cracked (100 hrs)

The scientists found they could foil the security system by varying the voltage supply to the holder of the “private key,” which would be the consumer’s device in the case of copy protection and the retailer or bank in the case of Internet communication. It is highly unlikely that a hacker could use this approach on a large institution, the researchers say. These findings would be more likely to concern media companies and mobile device manufacturers, as well as those who use them.-said umich.edu.

We cannot broke an RSS algorithm’s private key.We can find it out by guess only.To broke a private key of a 1000 digit RSA algorithm, it takes a time longer than the age of the Universe.But using their voltage tweaking scheme the U-M researchers were able to extract the private key in about 100 hours.

They carefully manipulated the voltage with an inexpensive device built for this purpose. Varying the electric current essentially stresses out the computer and causes it to make small mistakes in its communications with other clients. These faults reveal small pieces of the private key. Once the researchers caused enough faults, they were able to reconstruct the key offline.

This type of attack doesn’t damage the device, so no tamper evidence is left.

The solution for this attack is not found yet.But it is very interesting to read that a computer program hacked through an electrical effect.So, what you think of it.Please share your feelings here.

You can get the more information on this hack at the umich.edu
[XPERIA X10 Android Development] maxrfon:
So do you really offer us to stress the SE servers with voltage?

I would love to do it :D
[XPERIA X10 Android Development] abrarabbu:
Is it something related to SE servers?

I didn't know that.

Actually I took a book and tried to solve RSA algorithm using simple numbers, almost 50 papers are full of ink and i was not able to even get idea of solving it for large numbers.

Its really a headache.

I also heard that 768 bits RSA was solved by hackers... we could follow their steps, might be helpful.

I am ready with my pen again.... can work for hours together though. Any guidelines?
[XPERIA X10 Android Development] nightspirit:
I understand your enthusiasm but you are wasting your time.

fact is:

- 1024 bit RSA private can't be calculated on current hardware

- voltage hack method is completely useless, maybe it worked once while testing it in some lab, but thats all. And first of all you would need direct access to signing server...

maybe.. if you find some SE developer and torture him to get access to private keys.. :)
[XPERIA X10 Android Development] yournameshouldbehere:
Yeah the only way I see this working is by hacking Sony Ericsson or something and taking the key from them
[XPERIA X10 Android Development] aZuZu:
Answer is 42 :D :D :D No need for more math! :D :D :D
[XPERIA X10 Android Development] aR_ChRiS:
So you are telling me that this simple 2-digit number is the code for our bootloaders?
[XPERIA X10 Android Development] kxhawkins:
As well as life, the universe, and everything.
[XPERIA X10 Android Development] Mayazcherquoi:
Yes. That number was calculated by Deep Thought, the universe's second most powerful supercomputer. :)
[XPERIA X10 Android Development] riginal:
I thought that was 3.14159265358979323846264338327950288
[XPERIA X10 Android Development] gregbradley:
What we need now is the universes most powerful supercomputer to work out the question
[XPERIA X10 Android Development] abrarabbu:
Its not possible to crack RSA using mathematics...

someone have to come up with a different technique.

OR best thing is to bribe SE personnal and get key.

Hope you people understand.Bruteforcing RSA needs a Supercomputer and it would take years long to manipulate it..
[XPERIA X10 Android Development] Ryukenden:
Well, people thought that Armadillo's ECDSA-113 is not possible to reverse engineer, and now every kid knows how to make keys for that scheme...

I'm sure people will come up with something for this too...
[XPERIA X10 Android Development] ishunz:
This might be a way, anyone want to try FOLDING?
[XPERIA X10 Android Development] gregbradley:
lol...have you ever read hitchikers guide to the galaxy,...

I am a maths teacher and deliver masterclasses on ciphers, so I know that a mathematical attempt to crack rsa is possible, but useless as by the time we can crack it humans will have evolved to use telepathy!
[XPERIA X10 Android Development] maxrfon:
LOL, guys, didn't you read this?:

http://xdaforums.com/showthread.php?p=15539795#post15539795

What ghost are you fighing? What RSA are you cracking? Does any of you know how to re-sing the bootloader? Do you have the keys to crack? Do you know the keys structure?

No - ok, i have the answer :D There is _the_lazer here, he has discovered it here:

http://xdaforums.com/showpost.php?p=15404471&postcount=62

LOOOOOOOOOOL

All blogs are posting this shame :D

Why don't we add one zero and maybe it will get cracked as 1.2.3 ? :D

Ok to talk serious - if you wanna crack something you got to have a prog to run on users PCs. There are like half a billion PCs around, if you make something like OpenOffice or Ubuntu, you can get the PCs power at once (just mention this in the UA- user agreement) and voila, you are owners of a huge cracking net! MD5 - 2 secs, etc...

So if you really wanna do something big - do something cool and free... like 7zip

That's the best effort i think..
[XPERIA X10 Android Development] diimaan:
guys!

it's actually 72! it has been found from the pyramid!
[XPERIA X10 Android Development] DooMLoRD:
guys lets not convert Dev threads to General discussion threads....

PLEASE LETS STOP SPAMMING!
[XPERIA X10 Android Development] maxrfon:
My lord.. have you seen any spam in my post?

I said a quite good idea, mixed it with a bit of humor..

Don't you think so?
[XPERIA X10 Android Development] Adolf1994:
so that's why that message wasn't towards you
[XPERIA X10 Android Development] DooMLoRD:
not u dude :D

it was directed at others...

(damn now i am spamming :P)
[XPERIA X10 Android Development] abrarabbu:
Spam Spam Spam till maxrfon gives us bootloader cracking method...

Hu ha ha ha ha. As there is nothing left to do instead of waiting.
[XPERIA X10 Android Development] aZuZu:
should i try hex numbers too?

anyone wanna give shoot?

here all signatures and pkcs crack app

usage: pkcs_crack signature_file

XPERIA_Signatures & PKCS_Crack

p.s.

i'm working on loader_signature
[XPERIA X10 Android Development] Haano:
Would this actually work?

Im trying it with the loader key....

its doing around 900000 per 10 secs. up to 40000000

(?)
[XPERIA X10 Android Development] aZuZu:
http://en.wikipedia.org/wiki/PKCS12 << this is what our sin signature is...

will it work? no idea... if password is not to complex yes...
[XPERIA X10 Android Development] Haano:
Thanks for the info. but with my pc specs, i5 2400, its going to take 712 years if i dont find a way to speed it up.

Guess im out. Good try though.
[XPERIA X10 Android Development] mayank.1love:
If we really want the signing PKCS12 key then firstly we need a proper software to bruteforce the certificate.

The bruteforcing method must be based on serverless distributed computing. This way we can use the PC power from around the world for the bruteforcing.

But the starting point is still building a tool for distributed bruteforcing.

I think we must all donate some money and with that money we hire someone from TopCoder or sites like FreeLancer or Fiverr to code our bruteforcing software.

Once we have our initial and most crucial step done i.e. coding of bruteforce software we can all then concentrate on the real bruteforcing task and getting people around the world to join it through Twitter, Facebook, Google+ etc, etc.

The guidelines for the software is it must be serverless with P2P style framework, but if we can get more money then we can surely have distributed computing with a server but that will cost us more. The software can be coded in any language but preferably in Java for maximum OS compatibility.

This will require a very little amount of money because afaik coders gonna code the software as their hobby and they will also get some money from this.

@aZuZu

Could you please pm me the algo u used for bruteforcing the files. If you can explain a bit that would be more helpful. I'll try to know how much would it cost to build a distributed bruteforcing software based on your algo.
[XPERIA X10 Android Development] DooMLoRD:
since we are talking abt bruteforcing why not tap into CUDA power? CUDA-multiforcer...
[XPERIA X10 Android Development] OmegaRED^:
True.

Almost every Nvidia graphics chip above the 7 series has cuda cores.

You could use a card like the 480 or 580 to Brute that x10.

My one friend used the Gpu power from one of those cards for data processing on a server.

Well worth it.
[XPERIA X10 Android Development] mayank.1love:
CUDA processing is great but implementing that on a software may be hard. I have posted about the project on freelancer(http://www.freelancer.com/projects/PHP-ASP/Decentralized-Distributed-Bruteforcing.html), hope I get some coders to get started the program development. I'll try to understand how to implement the CUDA processing into the software till further development.

Also can anyone here tell me about the exact length of SE key and if it is hexa or numeric.

I'll need a lot of info about the type of key and other facts.

Please everyone here whatever info you have please share with me on pm. If its feasible we can surely make it.

Also if anyone here know about PKCS decryption or any algo about it pm me.

Thanks