yashsingh1/xdaforums huggingface dataset:
[Atrix 4G Android Development] mister_al:
The simplest way to describe this... one file is signed with a particular key. if you have another file that differs even in 1 bit (I'm taking poetic license here), then the 2nd file will have a totally different key.

What needs to be determined is HOW to generate that key so that it looks like it came from the right place. You can't just take one key and plug it in somewhere else.
[Atrix 4G Android Development] protocol113:
so instead of a blank we need a garbage data update.zip that is the same size as a true update.zip?
[Atrix 4G Android Development] FISKER_Q:
No you need an update.zip that is the same as a true update.zip
[Atrix 4G Android Development] perdurabo2:
dew.man gave you the best advice you could get. Unfortunately, you discounted his advice when clearly you need to stop posting & go read about code signing.

Go read the link he gave you and stop asking the same questions over and over.
[Atrix 4G Android Development] mister_al:
What he said.

I'll try this one more time though

123 - three letters

321- three letters, same numbers

These would both generate different hash keys
[Atrix 4G Android Development] protocol113:
I am reading it. I guess I didn't realize I was asking the same question.
[Atrix 4G Android Development] skoalcan:
There are very few ways to crack this bootloader. Either we need to get a leak from moto somehow, We can try to brute force it, which shouldn't take anymore than oh let's say 4 or 5 hundred years depending on processing power. We could somehow by a miracle of God, guess the signature. OR...we simply need to find out approximately where the bootloader along with the certs are entered into the ram. From my understanding and from what I've read, (and I can provide links if need be), ram stores everything in binary form. Which means regardless of what encryption was used, or what algorithm, we can force a memory dump. Pipe this data to a file which can be run through xxd to output text as close to standard text as we can get. No it's not perfect, the signature or PEM may only be in one out of every 4 or 5 dumps. So patience is a key. Since I don't own the device, it's impossible for me to do this. However if a developer would take the time to research this, request links if need be, and try to get a memory dump of the bootloader. Then we may have a chance. If anyone takes initiative here, I've researched the board, as well as the tegra2, and have yet to find where the bootloader will load into ram. Which brings us to starting at address 0x000002 and dumping from there on. We shouldn't have to dump any more than 128m of ram. By this stage the kernel should have already started to load and all information needed should already be in ram. Now I understand that most developers here are not open to suggestion, most seem to be focusing on what ideas they have in mind. But please dont' just wave this idea off. Honestly look into and find for yourself. FYI, this method has been used before to crack an encrypted and signed bootloader on a phone that was thought to be uncrackable.
[Atrix 4G Android Development] YellowGTO:
Depending on the type of encryption. 128bit can be crack in days with systems like Boinc. From what i've been reading. It seems the cert uses 128bit MD5 hashes. But thats where I get sorta lost:confused: But dumping the ram seems like a good idea.

Did find this about X509 though http://www.win.tue.nl/~bdeweger/CollidingCertificates/
[Atrix 4G Android Development] DarkSi08:
Would you mind giving me a hand soon? I'd like to get some better understanding and get a dump going.

So with the info about hashes, which I do understand, I'm left with one thought - why would both the bootloader and recovery images have the same hash? Obviously they wouldn't. Unless, is it possible that the whole thing (all signed images) share a single hash? As in, recovery and bootloader images hashed together, rather than individually?

Thanks!
[Atrix 4G Android Development] t0dbld:
i 100% agree jsut kindly tell me how to hook up the phone to get a ram dump and i will start right now :)
[Atrix 4G Android Development] iamtheloser05:
I don't own this device but, If a single bit makes a difference on the signature, how would the recovery know to accept the update.zip when an update is released. There would be many bits different which means a completely different signing key. There's no way moto could predict the key to allow recovery to accept it. Shouldn't there be a standard key that moto has to sign the updates?
[Atrix 4G Android Development] airbillion:
If someone can make a signed update with this key ask user tl_bull to test an update.zip: http://xdaforums.com/showthread.php?t=979990

He is returning his atrix tomorrow, the sooner someone makes the test zip the better!
[Atrix 4G Android Development] iamtheloser05:
So an algorithm? Sounds fun. . . . . . . .

Or did I misunderstand you about the 2 prime numbers.
[Atrix 4G Android Development] krkeegan:
A few points/ideas/questions:

1. Where did the data that t0dbld posted yesterday come from? I am not sure I understand his post, but I read it as possible public keys for the images.

2. What is the source of the evidence that they are 128 bit keys? 128 bits while not child's play, is exponentially better than the 1024 bit key on the Milestone. The 1024 bit key is for all intents and purposes unbrute-forceable (to invent a horrible word). But a 128 bit key seems more doable, albeit still really hard.
[Atrix 4G Android Development] t0dbld:
Look I did not post this as Hay here are the keys... Where i got this or exaclty how is not the most important thing right now, what is did is essentially what skoalcan is asking for only i used the two img's i had the boot and the recovery aka 10 and 11 i than ran a program used to find keys hidden in ram dumps and this is what i came up with... now i dont know how old those img's were after a boot, how they were obtained or anything else so what i basically did was start a fire .. i want to keep people moving on this because i do not believe that this lock is " " un-beatable, i dont believe in that period for anything, my expertise is not that of cracking encryptions but i will continue to work at it and i want people to do the same, but i do not want this thread to continue to fill up with crap ..

Now what i posted might be crap, or it might not it might be a key to help us find more private keys etc ...

" as a general principle, the choice of RSA key size and the choice of symmetric algorithms are independent, both being driven by the desired security level. A 128-bit AES key may be used with a 1024-bit RSA key if the 80-bit security level is adequate for an application, since both choices meet or exceed that security level. Similarly a 128-bit AES key may be used with a 2048-bit RSA key if the 112-bit security level is adequate. A 128-bit AES key does not require a 3072-bit RSA key."
[Atrix 4G Android Development] youareme7:
Aside: wow, be away a few days and this thread really fills up...

I could be totally off base here but I "think" those 128bit keys are cryptographic hashes of the public key and are stored in OTP memory. Someone please chime in if i'm way off but it does seem to fit based on what I've read about TrustZone since OTP memory takes up a lot of space on a die they wouldn't want to put a 1024bit key on it. If that's true then messing with that small key could lead to trouble real fast since OTP memory is a poly-silicon fuse.
[Atrix 4G Android Development] t0dbld:
@Minister_al

actually, you should read the forum before you come in and throw suggestions around as to who should do what. Now that we have established you as an expert kindly answer my question as to how you plan on getting a ram dump off of the Atrix ?

.....sheesh what a Douche
[Atrix 4G Android Development] BravoMotorola:
Thats exactly what I was thinking. He came in with a good idea and he replyed this? I'll say it like you said it. What a Douche indeed.
[Atrix 4G Android Development] cellzealot:
Some people on this forum seem to have a penchant for driving away anyone with any real idea how these things work...amazing.
[Atrix 4G Android Development] Squadfer:
I agree, I would chime in but im only still learning this stuff in college. A lot of the good ideas that are being mentioned are being shot down by the negativity in this thread...on both sides of the playing field. Could we please try to leave the personal bickering to private messages? The fastest way to crack this is if we all work together for the end goal.
[Atrix 4G Android Development] xxtsfxx:
+1 Maybe some knowledgeable being should name off the different ideas/approaches as well as say what has and hasn't been attempted. (Perhaps do this in the OP?) This might establish definite goals and at the same time keep it neat.
[Atrix 4G Android Development] ram130:
I know right. I'd stop wasting my time.
[Atrix 4G Android Development] t0dbld:
What are you talking about?? are people reading the same forum i am? what did he suggest? what is it that he said that indicated he knew anything? i just looked at all of his post i don't see anything, what i read was some guy coming out of left field obviously not reading my posts but than telling me to go research in general. this is a joke I am working towards the same thing as everyone else, i am not driving anyone away, but i also am not going to be told to go sit at the kids table when i clearly dont belong there
[Atrix 4G Android Development] ram130:
You've missed his point.
[Atrix 4G Android Development] t0dbld:
and this ever elusive point is ?
[Atrix 4G Android Development] slyydrr:
We're arguing pointless semantics. Let's get back on track. Everyone here wants the same end goal so let's stop arguing about bull**** that hinders that goal from being achieved. Please.
[Atrix 4G Android Development] Squadfer:
That throughout this whole thread there has been nothing but bickering from both sides. Hardly any progress is being made with all this bickering. It drives people away because honestly would you want to have someone screaming at you when your trying to work on stuff. From your post a couple minutes back you clearly mentioned that you don't like it.

In order for this to be done smoothly we need to have a mod clean out all the bickering and side comments (this post being included as a side comment). Then we can clearly see what has been mentioned, what has been worked on, what needs to be worked on and also what ideas haven't been brought up.

Lets all be friends here, we are all working for the same goal right? :)
[Atrix 4G Android Development] slapdaddy:
Maybe a mod can pull out all the bickering posts and create the new "[DEVS ONLY] Crack/bypass/trick Boot.img Signature Thread for Personal Bickering Only!"

In all seriousness though, t0dbld had every right to defend himself. The guy basically implied that he was an amateur and if someone told me that about something that I know a lot about, I would take it personally as well and absolutely defend myself....I'd just do it over PM. :)
[Atrix 4G Android Development] Squadfer:
I completely agree, I know I would have defended my case. :)
[Atrix 4G Android Development] milk242:
You can probably get more information here on dumping and extracting the ramdisk for android:

http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

Practice using the existing boot.img dump

I believe the method of attack the poster was going for is this:

http://citp.princeton.edu/memory/
[Atrix 4G Android Development] droidbird:
Frankly, if I didn't already own an Atrix I wouldn't spend much time here either as a possible project, there is way to much **** waving going on. I see a lot of folks with good intentions, but without the knowledge to back it up and with the apparent lack of desire to go learn.

Being a Dev isn't about how smart you think you are or how smart you want others to think you are, it's about hours and hours of learning, discovering and thoughtful questions to those who know more.

The Atrix has lots of possibilities, but in the last week alone this forum has driven away several groups of people who do know more about it than probably anyone here. So we can all sit here and "Be right" and those folks who stopped by can be "Jerks", but the fact remains that those folks are gone and with them an enormous base of knowledge has left the building.

I miss the knowledge already.
[Atrix 4G Android Development] humancyborg:
Even though I am one of the knuckleheads, I actually agree with this post. I was under the impression from a certain Facebook posting that Motorola may be providing a solution to the bootloader.

This no longer seems to be the case and the Atrix is back at the AT&T store where it belongs.
[Atrix 4G Android Development] milk242:
I was doing some reading on other motorola devices and seems like they already tried this method (not a surprise). Someone chimed in and said the key is nowhere on the phone and the public key is most likely burnt into the phone itself and only does hash checking on the boot.img and other things that need to be verified. So I'm not sure if this is even a feasible idea and by even doing this we would must likely just obtain the hash code for the encryption key.

So I have another idea that I would like to toss around. I'm assuming the boot loader on the Xoom is identical and just unlocked (if my assumptions are wrong, sorry). We could reverse engineer the Xoom boot loader and look for exploits and get it to crash. I'm thinking a lot of devs are probably hesitant on pursuing any of these avenues until we can at least get an SBF file and I don't blame them.

Happy hunting
[Atrix 4G Android Development] skoalcan:
OK back on topic, I'm glad to see members interested in mem dumps. And glad to see some people researching. Now in order to perform a mem dump, we have to have some way of addressing the ram. So we need to find a device that can do this. Since I don't have the atrix, and hopefully if I provide the method for cracking you guys can find someway to get me one. We need to look at the filesystem. I need verification of a few things. Does the device have /dev/mem, more than likely no. As I've heard that it was removed for And 2.2 and higher. But just in case let's see. Also, if it is gone, then we need to know what is in the subfiles of /proc and don't just look for mem here. /proc is something like a virtual filesystem. Not every address in this folder will point to an identical physical address. All listed numbers under /proc are good, also look into one of the PID's and see if there is a mem listing under that PID. If so we may be able to gain access through it. Lastly this is a long shot, but see if there is any way of installing /dev/mem on the device if not already there. May or may not work, functionality would need to be built into the kernel for this, or a kernel module would need to be in place. Regardless, we need somewhere to start. If by chance /dev/mem is there, and let's all pray. Try this command in shell

dd if=/dev/mem of=/home/sam/mem.bin bs=64000

Changing the of= to an address of your choosing, example: of=/home/john/mem.bin or of=/home/jim/memdump.bin

Keep in mind that "if" and "of" should never be reversed, this would cause a file to be overwritten by an empty file. Although probably not bricking the phone, causing very bad problems.

Also best to perform this from a fresh restart, while the files loaded into ram for boot may still be there. Please respond with any progress or roadblocks, I'm still researching, and need to know which way to go with this. Also speak with any developers you know about devices that have access to ram during boot, that we may be able to use for dumping.
[Atrix 4G Android Development] cellzealot:
We have a lot of internal docs and files relating to the Qualcomm MDM6600 chipset which is shared by all of the new Motorola devices including the Atrix and Xoom, Bionic and others.

This is very good news...although it may mean little with respect to the locked bootloader.

I am very excited! :D
[Atrix 4G Android Development] milk242:
Sorry I'm new to this. Anyways...

Just by using root explorer I do see /dev/mem and I'm thinking you want a fresh dump so I would think a script would need to be written to dd right when adb is detected. Want to write up a quick script? I have no experience with adb commands.
[Atrix 4G Android Development] milk242:
Could I get copies of those documents. I would just like to read them and try to extract some sort of knowledge from it.

Edit//

Doesn't the iPhone 4 also use the Qualcomm MDM6600?

If so, wouldn't it be beneficial on collaborating with iPhone devs that have worked on unlocking as they probably know some exploits?

nvm, the Verzion iPhone 4 uses the Qualcomm MDM6600, so the iPhone dev community would most likely have no exploits for it.
[Atrix 4G Android Development] t0dbld:
edit** BTW i am in dir /dev when i copied this

# ls mem

mem

# dd if=/dev/mem of=/home/sam/mem.bin bs=6400

/home/sam/mem.bin: cannot open for write: No such file or directory/home/sam/mem.bin: cannot open for write: No such file or directory

# cd /proc

# ls

binder

bluetooth

bt_status

bt_stat

bt_power

mtpctl

mtd

apanic

apanic_annotate

uid_stat

sysrq-trigger

partitions

diskstats

crypto

key-users

yaffs

kpageflags

kpagecount

kmsg

bootarg

softirqs

version

uptime

stat

meminfo

loadavg

interrupts

devices

cpuinfo

cmdline

locks

filesystems

slabinfo

vmallocinfo

zoneinfo

vmstat

pagetypeinfo

buddyinfo

config.gz

kallsyms

modules

timer_list

iomem

ioports

execdomains

schedstat

sched_debug

iovmminfo

bootinfo

nvmap

cpu

scsi

misc

fb

wakelocks

irq

cgroups

sys

bus

tty

driver

fs

sysvipc

net

mounts

self

1

2

3

4

5

9

11

14

17

34

35

36

37

38

39

40

41

42

43

44

45

244

246

248

262

265

313

327

330

335

338

351

359

378

397

398

447

457

561

563

565

567

611

614

626

627

688

697

708

722

727

740

755

765

770

777

829

832

848

855

1158

1271

1275

1276

1279

1288

1289

1353

1357

1358

1359

1360

1361

1363

1364

1365

1369

1370

1371

1372

1373

1374

1375

1376

1377

1378

1379

1380

1418

1422

1445

1458

1460

1461

1463

1464

1466

1493

1873

1874

2066

2187

2272

2429

2577

2580

2581

2584

2586

2589

2591

2592

2595

2607

2610

2638

2654

2707

2708

2722

2738

2741

2760

2776

2794

2809

2826

2833

2843

2852

2860

2902

2919

2921

2926

2954

2972

2973

2995

3015

3026

3027

3077

3094

3113

3127

3135

3207

3208

3217

3218

3277

3289

3294

3313

3314

3322

3337

3346

3353

3357

3374

3403

3431

3445

3448

3454

3465

3474

3483

3495

3502

3536

3548

3562

3576

3586

3597

3603

3611

3618

3625

3645

3663

3854

3898

3909

3921

3939

3969

3978

4034

4141

4175

4192

4194

4195

4202

4204

4205

4210

4365

4367

4369

4370

4371

4373

4388

4390

4391

4393

4395

4397

4399

4401

4402

4403

4420

4423

4435

4449

4474

4517

4759

4877

5636

5637

5660
[Atrix 4G Android Development] ntwrkwizard:
So a question. I would assume that as part of the Google Checkin Service, the application that checks for updates OTA, that there would be a way for the system to check the update.zip that is downloaded for verification.

In reviewing the /data/data/com.google.android.gsf/sharedprefs/CheckinService.xml it makes references to the OTA-rel-keys and the location specifically that I would assume it is checking on the Google servers for the update.

So, couple of questions:

1. Can one assume that the update.zip is validated with the mentioned certs (meaning they are on the device somewhere) prior to the reboot?

2. Can the CheckinService be modified to back rev the version of the OS being reported to the servers to force a download of an update.zip that would include all of the correctly signed img files so we have them for tinkering and reference?

NW
[Atrix 4G Android Development] Coblica427:
-t0dbld

Whenever you run this command you have to write to a directory that has been created, and it seems /home/sam has not been created. If you want that to be the directory then "mkdir /home/sam".

You could probably get around this issue (correct me if I'm wrong) by changing the original command to:

dd if=/dev/mem of =~/memdump.bin bs=64000

This should output the memdump.bin file into your home directory, whatever it is.

EDIT: To navigate to your current home directory after the file has been output type "cd ~ && ls"
[Atrix 4G Android Development] milk242:
was wondering what is a safe directory to write the mem.bin file to? When I wrote it to /home and did a adb pull to get it I got a permission denied.
[Atrix 4G Android Development] Coblica427:
Hmm...since you're getting permission issues I'd make a new directory and change the permissions. Something like:

(As root)

mkdir /dump

chmod -R 777 /dump

dd if=/dev/mem of =/dump/memdump.bin bs=64000

Then if you're still having permission issues pulling it change the permissions on the dump file:

(As root)

chmod 777 /dump/memdump.bin

Then try pulling it again...I'd be really surprised if you still have permission issues
[Atrix 4G Android Development] t0dbld:
haha of course.... sorry i was just trying to help real fast, while i am working on the webtop dock, the most ironic part was that i was DD the mmcblck0p13 at the same time ....

anyhow did a fresh boot and pulled here is the link http://www.trendingtechnology.com/mem.7z
[Atrix 4G Android Development] mp2ning:
It is the /dev/mem file which has the permissions restricted

crw-------

Would it be safe to temporary change them?
[Atrix 4G Android Development] Coblica427:
No. Never change permissions of a root directory. You can change the permissions of the dumped file, but do not change the permissions of the /dev/mem file. If you're having trouble parsing the dump command...run it as root.
[Atrix 4G Android Development] mp2ning:
Yeah figured it out after posting.

Coblica you posted that bs=6400 but initially it was bs=64000!!

I think it was the later...
[Atrix 4G Android Development] Coblica427:
Thanks for catching that! I went back and changed my posts.
[Atrix 4G Android Development] t0dbld:
perhaps we could get link added to op
[Atrix 4G Android Development] t0dbld:
just a question... but would we not possibly get the best results from this if we booted in early usb enumeration and started the dump during the boot process ?
[Atrix 4G Android Development] infrared411:
This is the process we should be working towards. Replacing the recovery.img to accept test keys on an update.zip. that is signed with test key. I don't think we can replace it without the recovery.img failing verification. Correct me if im wrong
[Atrix 4G Android Development] zambezy:
#1 What initiates the bootloader. and looks for the signing keys...

#2 Has anyone verified if there is any evidence of e-fuse...

#3 Can the bootloader be overwritten at all... (considering engineering bootloader that would allow for test keys...)

#4 Does anyone have access to system images of boot, recovery, system.... that we could restore from in case of soft brick...

My impression is that the bootloader image is not encrypted and can in fact be modified but can not be flashed because of lack of signing keys. Please correct me if im wrong. I believe someone mentioned something about engineering bootloader that may allow for test keys.

Has anyone tried to overwrite the bootloader after the system has booted or is it on a partition that we have no access to...

It would be interesting to find out what the full bootchain is from power-up to login....
[Atrix 4G Android Development] zambezy:
I agree this might be a the best way to attack this, but we dont have any of those files ... if we find recovery that is signed and we can flash and would allow updates signed with test keys... At that point we might be even able to get the bootloader replaced.
[Atrix 4G Android Development] strauss0829:
Prayin for a fix
[Atrix 4G Android Development] zambezy:
http://xdaforums.com/showthread.php?t=965021

Has anyone attempted to flash this?