yashsingh1/xdaforums huggingface dataset:
[Atrix 4G Android Development] cellzealot:
The real issue with xda and this phone is that it is a Motorola device and this has always been a HTC centric forum. Motorolas will always be red headed stepchildren here. It's unfortunate but true.

Very few people understand how to work with these new Motorola smartphones and its not at all like the old days where there was an active community of very talented and committed people working on them.

Get used to it...
[Atrix 4G Android Development] t0dbld:
Ya i know that i been here sense the original windows mobile days, hell i used the MDA for 3 years thanks to here !!

How ever there has been expansion, i have always been an HTC guy my self but i thought this was just way to cool of an idea and hardware not to pick up and i guess i just though more people would have as well
[Atrix 4G Android Development] phro321:
DAMN GINGER PHONE! lol:p
[Atrix 4G Android Development] dkirchik:
I had a similar thought last night. Went to Fry's earlier and bought a bunch of 4 and 8 gig sdhc cards.

The early usb enumeration is... give me a few min I saw it while digging around last night.
[Atrix 4G Android Development] theknub:
while i dont have to be running linux, it does make things easier. i have experience with kernels, certs, etc but this will be my first foray into a phone. im getting a linux box up and going in the next few days and hopefully i can lend a hand.
[Atrix 4G Android Development] Clienterror:
I agree, but on the flip side when the few that are working on it figure something out they will get donations out the ass. I know I've got $100 sitting aside getting ready to get sent out for donations.
[Atrix 4G Android Development] dkirchik:
This'll take me a while to put together and see if the idea will work. The usb in the phone is of 18f design. So a file for early usb in boot doesn't exist until the phone goes through the "starting early....". Then the file is there. After the min or so the phone deletes the file. Boots normal. So we'd have to do an sd card that has the early usb command on it and to get it to start before the phones usb early etc, starts. Which might require hardware hacking of the phone?

***edit***

The sd card would have to stop the phone starting usb enumeration. Then, the sd card would have to start our own usb enumeration to block/freeze/or rewrite the boot partition.
[Atrix 4G Android Development] frankiedizzle87:
this is so depressing i really want blurr off my phone and have a dual core phone that doesnt lag in comparison to every other phone on the market. G1 didnt even lag this bad :-(
[Atrix 4G Android Development] Clienterror:
If your phone is lagging I recommend you exchange it, mine has almost no lag.

Sent from my Nook Color on Honeycomb 1.1 OC
[Atrix 4G Android Development] dkirchik:
Have you rooted, deodex, and froze apps with TiBu? That helped my lag. Complete 180.
[Atrix 4G Android Development] dkirchik:
/bin/fuser. /bin/kbmode. Both those appear to be linked with the usb.
[Atrix 4G Android Development] darkamikaze:
or try rebooting.. :T
[Atrix 4G Android Development] t0dbld:
Hmm thanks i woll look at that in morning i need to get to bed before 7:00am tonight lol

Sent from my GT-P1000
[Atrix 4G Android Development] dkirchik:
Browsing around, the encrypted boot loader ties to bash files. Also found out ealier today that its developed by motorola, packaged by Unysis. I'ts 1024 encryption process. There's also "suposedly" an update to come out specifically for regestered developers that allows the bootloader to be bypassed, allowing changes to the boot for developing.

SIDE NOTE: Unysis. A Serious number of DoD Contracts all in National Security. I used to stare at their codes all day, and work with their programs. After I get the file system for the phone fully understood and ingrained in my mind. It'll be bypasable (not hackable). Which leads to the phone will have to boot from ext_sdcard then to /boot then /system.
[Atrix 4G Android Development] t0dbld:
ya ill believe it when i see it , hah btw they put a hold on my dev application because my website is currently under construction and closed to the public, i applied before i received the attrix i thought that was ridiculous
[Atrix 4G Android Development] t0dbld:
hmm your talking about a very idea that me and zam have been tossing around , circumventing the bootloader and fuse all together my guess if they do release an update it will to do exactly my idea
[Atrix 4G Android Development] dkirchik:
Im working on my idea. EDIT** mainly your idea, sorry. Already killed one sdcard. They accepted my dev request and I dont have a website yet. been too lazy to make one. Though my "company name" is EDIOS for Experimental Development of Intuitive Operating Systems. Now I'm lost, why wasn't I put on hold?
[Atrix 4G Android Development] dkirchik:
I missed this post earlier, just now saw it. Maybe we all should talk? Seems as if we all have the same idea. Could possibly work. Three heads are better than one :)
[Atrix 4G Android Development] ikenley:
Sorry to interrupt you guys, I've been following this closely but in complete silence as I can't contribute much, but if the supposed update is for developers, would that allow for you to repackage and distribute to not developer registered phones?

If it's not possible, how do I sign up?
[Atrix 4G Android Development] dkirchik:
Developer.motorola.com

To answer your first question, yes. Tho, I'd put money on it moto will create a splash screen or similar to show on boot up that the boot encryption is bypassed or unlocked for warrenty purposes.
[Atrix 4G Android Development] dkirchik:
I located the script for the encryption in tomoyo. In startup it checks the date, first, before checking boot and system security files.

This is the script I saw for checking the 'ppid' when moto sent me a restore file of my atrix. It also looks as if its set to expire dec 31 2069. There's 10 or so files with similar scripts with that same date.

use_trunucate sgr\+d/*\xrw*\31 Dec 2069/*\cvt-/boot/$cvht/local_bin

Allow execute /boot/usr/bootsecurity/dev/int.d/klogbus/un-dev

Allow execute /boot/usr/bootsecurity/dev/sys/storedboot/unm-boot

Allow execute /boot/bootsecurity/dev/sys/uid=09918e16aMB86*****/\var

Allow execute /bootsecurity/$uid/ppid=09818e16aMB86*****

Allow execute /boot/bootsecurity/securitylog/chksum/uid/ppid value = true,true,true

Allow execute /boot/kernal/*\$ system/msplash /mnt /sd/mmcblk2p0/value=1

Allow read /sdcard/mmcblk0p18

Its like into every file system and path. You'd have to rewrite every path's exception value. There's over 2,000 lines in 10+ files.

I "*" out the last 5 digits of my atrix's id# I believe every attic has its own personal number which becomes tied to your blur account.

***EDIT ADDITIONAL BEWARE***

In my process if accessing the files most are hiden, it crashed my computer, multiple times. I have an intel i7 970 16gig 1333mhz ram 500 gig patriot inferno SSD, and opening the file locked up my computer twice. Attempting to open it on my atrix soft bricked it.

***2nd EDIT***

Just saw this. Don't know if its been answered yet. The certificate for the boot is md5. Want the cert. value info? Here it is: 93daf09cb4d42663e2afa4da519f8480
[Atrix 4G Android Development] Jade Eyed Wolf:
I don't know if this would help or not, but here goes:

Apparently for Cisco MD5 password recoveries, this tool can be used. Maybe this method can be used in cracking the MD5 PW for the Atrix as well.

http://www.oxid.it/cain.html
[Atrix 4G Android Development] naturefreak85:
Can't be a 5 digit PID since the model number is MB860. If anything it would be a 4 digit PID. My curiosity is when you were on the phone with them what information did they ask of you that would lead you to think that the files need a custom PID? Plus if you think of the logistics of a custom PID imagine the storage/backend needed to push out/store the updates for each individual device with the proper PID. That PID could be locked to carriers, so a different PID for each carrier, but for each device? I don't see that. (then again I'm not a dev just an IT guy who would have trouble fathoming Motorola having the backend in place to deal with that)
[Atrix 4G Android Development] dkirchik:
The way the ppid seems to work is that when you create your blur account it sends the id of the phone to motorola then they store it on their server somewhere. I know the bloatware, any change you make to the homescreen widgets app locations. When you restore or get a new atrix and login to blur the phone mimics those changes.

Its like the phone's id is an access point so storing that file for maybe 400,000 phones is not a lot of space since the whole file is only 14.0kb in size. Its an alpha tag. Or it could work where moto pushes update. Phone sees update. Phone sends uid/ppid. Moto sees uid/ppid. Moto checks uid/ppid with moto uid/ppid regestry. Moto verifies. Moto pushes up date. Phone recieves installs update. Phone deletes uid/ppid cert.

The info moto asked me for was my blur email, password, secret question, location of store where i purchased the phone, last downloaded app. Birth certifivate, mothers maiden name just joking on that but I wouldn't put it past them.
[Atrix 4G Android Development] naturefreak85:
Ok the way I understood it was that the ID tag was embedded in the update.zip/restore file aka a 30+ meg file over 400,000 devices does add up in terms of distribution. That comes out to 12 Terabytes of storage (if my math is correct) and to push all those individual files to their respective devices seems a bit overkill for the work needed.

Honestly a quicker way I would think is to just figure out the naming scheme for Motorola's updates and try to track it down that way. (could be wrong I know that's how iOS updates are downloaded before official release)
[Atrix 4G Android Development] frankiedizzle87:
i dont understand a lot of the lingo so i will ask just this... Is the bypass quest going well? Or is there hardly progress or a decent amount of progress?
[Atrix 4G Android Development] texasice:
this is very informative. thanks for the example. and your sleepless nights working on this.
[Atrix 4G Android Development] youareme7:
Quick aside: Are you talking about the App Accelerator program or just registration on the developer.motorola.com website?
[Atrix 4G Android Development] t0dbld:
How could we answer this before they even announce it let alone give it to us? Be patient please

Sent from my GT-P1000
[Atrix 4G Android Development] youareme7:
I assume you were responding to my previous post. I just wondered which program dkirchik was talking about (and tangentially which one you were put on hold in). I'm on developer.motorola.com but I haven't joined the app accelerator program, haven't seen the need really. I haven't been convinced that their tools are much more useful than what google gives us and Eclipse.

(hence why I said "aside:", of course you don't know if/when they're going to give us anything :-)
[Atrix 4G Android Development] t0dbld:
Ya i just ment how woukd we be able to tell you if it can be repackaged and distributed if we know nothing about it

Sent from my GT-P1000
[Atrix 4G Android Development] dkirchik:
There's a crypto file. Here's what's in it.

name : cbc(twofish)

driver : cbc(twofish-generic)

module : kernel

priority : 100

refcnt : 3

selftest : passed

type : givcipher

async : no

blocksize : 16

min keysize : 16

max keysize : 32

ivsize : 16

geniv : eseqiv

name : cbc(twofish)

driver : cbc(twofish-generic)

module : kernel

priority : 100

refcnt : 3

selftest : passed

type : blkcipher

blocksize : 16

min keysize : 16

max keysize : 32

ivsize : 16

geniv : <default>

name : ecb(arc4)

driver : ecb(arc4-generic)

module : kernel

priority : 0

refcnt : 1

selftest : passed

type : blkcipher

blocksize : 1

min keysize : 1

max keysize : 256

ivsize : 0

geniv : <default>

name : stdrng

driver : krng

module : kernel

priority : 200

refcnt : 2

selftest : passed

type : rng

seedsize : 0

name : arc4

driver : arc4-generic

module : kernel

priority : 0

refcnt : 1

selftest : passed

type : cipher

blocksize : 1

min keysize : 1

max keysize : 256

name : twofish

driver : twofish-generic

module : kernel

priority : 100

refcnt : 3

selftest : passed

type : cipher

blocksize : 16

min keysize : 16

max keysize : 32

name : sha1

driver : sha1-generic

module : kernel

priority : 0

refcnt : 1

selftest : passed

type : shash

blocksize : 64

digestsize : 20

Its in /proc. Just scroll all the way down.
[Atrix 4G Android Development] t0dbld:
ya i posted that about 5 pages back :-P

I think we need to have a get together tonight to bounce ideas and work forward in the same direction
[Atrix 4G Android Development] dkirchik:
My bad I didn't see that :-/.

I think so too. We are going in the same direction. Just a thought since it appears the security is a kernal it should carry a true,true,true value. We should be able to change the value to true,false,false and bypass the kernal altogether, maybe?
[Atrix 4G Android Development] t0dbld:
i agree as we talked about earlier i think circumventing things all togther might work, and i am fine with that as long as it eventually leads to what i want, witch is full control, from everything i read i think the fuse that is installed on this device can be turned off, as you see when you enter any other boot mode other than normal or RSD or Nvflash which do not get checked at all, the boot process calls to the fuse for its programing and returns a value of 1, i think we can reprogram that value to 0 or shut off the calls all together witch is what we will need for kernel access all together, there is alot more i would be willing to test or try if i had a method of recovery such an sbf but we dont so thats is why i still think getting usb access pre-boot is the most important thing, unfortunitly i cant seem to figure out where to add this , i tried adding a service call to do so in init.rc and than executing init from a shell to reboot , how ever it didnt work, so i think init is being executed after there bootstrap, so the question is where is this bootstrap of theres ? and can we get to it to make edits. I agree that many of us are going in the same direction witch is good and why we have seen progress but i would jsut like to get together for a plan of attack and to bounce ideas off each other
[Atrix 4G Android Development] dkirchik:
I was wondering due to us about to play with kernals, etc... couldn't we do a restore with odin in early usb enu..?
[Atrix 4G Android Development] tarheelfanpdx:
It looks like there may be an Atrix SBF in the hands of a very talented Dev

http://xdaforums.com/showpost.php?p=11952597&postcount=69
[Atrix 4G Android Development] t0dbld:
this brings several problems to mind, one will odin recognize the device as i know i have not tried, two smasung maps the drives differently in there file system, three Odin is not always the fastest and i think trying to flash odin in the 1 min we have with usb while it is still booting will be dangerous, 4 i have no f-ing idea so try if you want :p
[Atrix 4G Android Development] dkirchik:
EDIT TO MY ABOVE POST

Crazy thought. If we pull the modem.bin and edit the file we could bypass the encryption all together using aRoot to push a longer usb enu time then run odin to push a new modem.bin to bypass security.
[Atrix 4G Android Development] dkirchik:
I can see why DG posted it in xoom forums. The only dif between xoom and atrix is honeycomb and no encrypt so running the file on the xoom you'll be able to see target placement if the file then be able to remove it. Hmm I should buy the xoom for testing. There's a guy in that forum that will send the sbf through pm.
[Atrix 4G Android Development] t0dbld:
i think hell send the xoom xbf through personal message, witch i have
[Atrix 4G Android Development] t0dbld:
one question, as it would be above my head... how do you plan on editing the bin file ?
[Atrix 4G Android Development] dkirchik:
The file extention for the security kernal is X11R6. The xoom is also the same. But encryption is disabled (acording to a guy I know at VZW). In theory we should be able to put the xoom file structure on atrix with no issue then place roms to fit the atrix ontop. Or, use the xoom disabled encryption on the atrix.
[Atrix 4G Android Development] t0dbld:
ya we were close to trying this the other day, however with no way to get back ... hence like i said not having a sbf or any from of restore for the atrix
[Atrix 4G Android Development] dkirchik:
Long story short. 5 years ago worked at AT&T. Blackberry curve came out. Iphone came out. AT&T disabled the wifi on the curve to aid in the sale of the iphone.

You guys ever watch attack of the show? Kevin Pereira his brother is a police officer that would come to the att I worked at.

I rewrote the modem.bin file to all for wifi through usin oracle's text editor.

I was fired for doing that a few weeks later. So id edit the bin file the same way but wont know for sure until I get home.
[Atrix 4G Android Development] t0dbld:
haha ok well i promise not to fire you!! im going to look for that text editor see what i cant dig up i also will work on trying to dd the modem.bin
[Atrix 4G Android Development] dkirchik:
Ill eventually get fully caught up with you guys and stop pitching double idea :-P. But im glad to know im on track.

Moto had me do my full restore through the desktop program. I wonder if we can full restore or backups the same way?
[Atrix 4G Android Development] t0dbld:
what desktop program ?
[Atrix 4G Android Development] dkirchik:
Haha yay. Ill try to see if I can copy the .bin onto my external sd from my phone :-/ might work maybe
[Atrix 4G Android Development] t0dbld:
do you rember where it is im looking now, i know how to get it off ... DD it to another location on the phone ... like mkdir /home/modem than DD to that dir. than mount drive in shell and copy to sd card

than exit and adb pull off sd card... thats how i have been making ram dumps (mem.bin) for skoalcan to go through looking for keys
[Atrix 4G Android Development] mp2ning:
Yes its the xoom SBF not the Atrix, he just answered my PM!
[Atrix 4G Android Development] dkirchik:
I have magicISO on my computer which will extract bin files allowing them to be edited and then repackaged back to .bin.

That's what I was planning on using. I used magicISO when I edited the galaxy tab modem.bin. to test ideas.
[Atrix 4G Android Development] t0dbld:
ahh well i will boot up windows than ... but i was asking what desktop program they had you use to reflash
[Atrix 4G Android Development] dkirchik:
I used dos to send it. The blackberry when connected to usb to computer ran like adb connected the entire system to the computer so I just pasted and replaced the modem.bin. through push command
[Atrix 4G Android Development] t0dbld:
lol were not communicating right ... ill wait till you get home :-)
[Atrix 4G Android Development] dkirchik:
-----BEGIN CERTIFICATE-----

MIIDvjCCAqagAwIBAgICEnswDQYJKoZIhvcNAQEFBQAwdTELMAkGA1UEBhMCVVMx

ETAPBgNVBAgTCElsbGlub2lzMRUwEwYDVQQHEwxMaWJlcnR5dmlsbGUxFTATBgNV

BAoTDE1vdG9yb2xhIEluYzEMMAoGA1UECxMDTURCMRcwFQYDVQQDEw5NQVAzIE9U

QSA0NDgtNTAeFw0xMDA4MDYxNjU2MDJaFw0zNTA4MDYxNjU2MDJaMHQxCzAJBgNV

BAYTAlVTMREwDwYDVQQIEwhJbGxpbm9pczEVMBMGA1UEBxMMTGliZXJ0eXZpbGxl

MREwDwYDVQQKEwhNb3Rvcm9sYTEMMAoGA1UECxMDTURiMRowGAYDVQQDExFNQVAz

IE9UQSA0NDgtNS0xOTCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAKie

e1dPP2M3ArFGzpEU2xssrSZJFeXRBMrDeXBFPisPNk4znvb1+i3dYresiDLUtaCs

r/RabPsCDfwZJtZoA6w2BvgCaazsTH0etd+lcxke4wUQbbbP7n6dPj499pF64pkj

r3Df3nMADX7e6Zh4yR7sadhL8rvOCpu8kGrL6dV8UjGmJ7DaLxk6ahouRV9ZjRbR

Q6OzASg1KDS6naLbfdtmR5dx2xCdJFNxYYwrR1MFlcE+1k14+db9wBNNKwj9Kwej

V3pd2m87KHtDZyBTlgF4PHTTMz+dpTxK/uiQe7SJQQ37fP85XUlIKxk+VjVbNAUJ

y3cUVvzYcsZBrCCo+DECAQOjWzBZMB8GA1UdIwQYMBaAFB2ridMIpZVg4y0jP8wZ

2FvmXuqbMBEGCWCGSAGG+EIBAQQEAwIEEDAOBgNVHQ8BAf8EBAMCBeAwEwYDVR0l

BAwwCgYIKwYBBQUHAwMwDQYJKoZIhvcNAQEFBQADggEBANUmWxkLWM/Tr8S7Nhfh

XpZ6z4AHqofoIbVkxDt/7JedK2qNnZjxTUHKnbeDM1tUGm/Q/gnWOE36csF1Vq1e

U93jWHIvF0+2nhLgsGzP6e0Hf4+qB8St8SI7ir9H2RE17qThGDW4tik0saM7mHrj

+PWrWay92w1glFCl4jHatKbcxV5/VQiDLkQSlYzOrtu1to5JuLAsE/0wvvWEdofe

26M4o2nLEQd3wypkGaCbAMNZFlbRs752B+zSktAZOuw/2LeUmLkSoWLcE5G5kkZ/

9oSxkfwycrLrMfJBZMgs2xZVB7p+HiJXAku/1AYZnHbHyxLLU1S2v8OqRYVOctmi

45c=

-----END CERTIFICATE-----

OTA.x509 cert. Could help in a forgery of the security cert.
[Atrix 4G Android Development] dkirchik:
Okay lol. I'll be home in half and a half.
[Atrix 4G Android Development] dkirchik:
/system/etc/security/cacerts.bks

Can anyone open that? Im curious as to what secrets lie within.
[Atrix 4G Android Development] t0dbld:
Ok here us the arg its all broken binary it wont let me post here for some reason
[Atrix 4G Android Development] cellzealot:
The fact is we have considerable experience with Motorola devices with Qualcomm baseband chipsets, but absolutely none with the Nvidia chipset and NVRAM so I am very curious to see how it differs from what we know. We are examining the CGs from the dev builds we have to determine what will be of greatest use to the community here and will release those files soon.

I have to agree with my partner p3droid about avoiding wasting time on deadends like cracking the bootloader, but given the significant differences in this device I am reticent to say that it's impossible, just very doubtful of any positive outcome.

I am fascinated to see what comes out the dev community here and elsewhere for this device, just like everyone else.

On the other hand, we have become only too familiar with the ever increasing steps Motorola has taken to make their phones as difficult as possible to modify in any significant way and have been told by all of our friends inside to expect more of the same only worse with these new devices.
[Atrix 4G Android Development] t0dbld:
Based on what you know ... if we had lets say the tool or script that moto uses to sign its builds, do you think this would allow us what we want, or would custom kernels still upset it... i only ask because i have been working hard with a few connects to try and "Borrow" said script from them through my imaginary friends imaginary friend
[Atrix 4G Android Development] cellzealot:
I would say we should confine the discussion to what is before us with facts and files as there is more than enough meat here to keep everyone busy, and leave the flights of fancy and espionage to other topics. :)
[Atrix 4G Android Development] opusheks:
The dump file is not downloadable at the moment...
[Atrix 4G Android Development] t0dbld:
lol so one of the motorola guys finally replied to me today ...

http://getsatisfaction.com/motorola...l&utm_source=reply_notification#reply_4826802
[Atrix 4G Android Development] cellzealot:
Exactly as expected and we have been stating.

If you are going to now return your Atrix as a result of this "revelation" then I think you were unwise to get it in the first place.

Motorola makes great devices and there is much to be learned and gained by accepting the challenges imposed by Motorola and the carriers and persevering despite the frustration. They have very sound corporate reasons and strategies for doing things this way and you are not likely to sway them by returning your phone. Those of us concerned about or even aware of the meaning of a locked bootloader are the extreme minority of the user base and of little consequence from their perspective.

Bottom line is that this is the future of all/most digital devices and will present ever greater challenges to geeks like us that love to meddle with them. ;)
[Atrix 4G Android Development] t0dbld:
hay big guy, i have been doing this stuff sense T-Mobile MDA :-) I have only been more active in revelation of what we have found, i agreed not to speak of espionage, it did not mean i was going to stop things that i was already doing ;)

BTW i am an entrepreneur and own a few businesses so lets do some math

days=DaysSpentToOpenForDev

N1=500 Days1 =0 / EuroGT=800 Days2 = ~ AcerLiquid=650 Days3= 7 G1=$250 Days4= 0 ....... got plenty more Atrix=$149 days= ?

I'd say if i look at this by means of full control being the goal and ROI at $149 i can afford to spend a great deal of time with it... only negative is it cost me my first contract in 7+years