yashsingh1/xdaforums huggingface dataset:
[Atrix 4G Android Development] zambezy:
"H-Boot" (Hard SPL, SPL) what ever you want to call it... Basically the BIOS of the phone needs to be replaced with engineering one that does not require signature verification. That information was previously encrypted and protected with the efuse... so it could not be substituted. That part of the phone is what verifies the signature on any .img that is loaded.

WE NEED THAT FILE TO FLASH unsigned boot, recovery...

As far as I know the Tegra2 does NOT contain the infamous efuse. That means that this SPL could be replaced with the engineering one!!!
[Atrix 4G Android Development] infrared411:
Has anyone tried pushing the original BL to the phone? I was trying this earlier today and it kept rejecting it. I am trying to capture some data from a custom kernel module that may help although I might be heading down a dead end.
[Atrix 4G Android Development] infrared411:
Has anyone tried pushing the original BL to the phone? I was trying this earlier today and it kept rejecting it. I am trying to capture some data from a custom kernel module that may help although I might be heading down a dead end.

BTW @darkamikaze @sdlopez83 Thanks I have been a dev on xda since early 2007 (had a membership under infrared prior to that but somehow over the years I had to change it cuz of whatever reason or deleted for inactivity? and the forums have had many changes since then)
[Atrix 4G Android Development] cellzealot:
Ok, I think you folks should take a look at this file.

It will unpack as a 22KB SMG file that can be opened in a hex editor or other tool.

It is CG2 from the GRH55 engineering build and contains what looks like a map of the boot sequence. It has many components we are not familiar with in the boot chain and may help give you an idea of how this chipset and board works.

Have fun! :confused:
[Atrix 4G Android Development] t0dbld:
I am sick and need to goto bed at this hour .... and i am away from any machine capable of running windows :-P but if anyone wants to get cracking i have attached a program that works great for splitting and unlocking moto sbf files
[Atrix 4G Android Development] t0dbld:
on a side note i havent seen one around but we could use a sbf from retail phones if anyone can find that will help and i ll start on this tomorrow when i have time
[Atrix 4G Android Development] cellzealot:
Here's a hint: You don't just "find" SBF files anywhere...you are given them by someone who is risking their job to let you have them...period.

Let's all try to bear that in mind, it's important.
[Atrix 4G Android Development] t0dbld:
very much realized and i do not oppose like a 12 hour uploaded posting policy if that is where you are headed, the people involved are more than likely subscribed to thread and 12 ours is ample time to get than get rid of
[Atrix 4G Android Development] infrared411:
guess the .sbf url

I have guessed sbf URI's from motorola and many people do this to uncover them for many different phones. RSD (remote service diagnostics? i think) connects to the internet and pulls down the correct sbf or tool from the server. RSD lite does not use the internet but instead installs from the local file system. Give a shout out to Skrilax_CZ... He usually finds them quickly and post back.

Please do NOT link to RSD or RSD lite in the forums. These are copyrighted programs by moto and are considered to be warez if they're hosted on other websites.
[Atrix 4G Android Development] cellzealot:
That trick used to work in the old days and we pulled all of the files directly from the RSD servers. To my knowledge, this no longer works and I have not seen any SBF files for any recent devices obtained via this method.

Just an FYI: TBH has released every SBF file that is available on the web for every Motorola Droid device except for 2-3 files that were released by other parties.

I am not saying we have exclusive access to them, just that they have almost never appeared publicly unless we released them. This is over a period of 16 months now so the pattern is well established.

I wish it were not the case, but it seems that distribution of these files has become ever more tightly controlled and monitored.

Good luck! I hope you are successful "finding" them anywhere.
[Atrix 4G Android Development] skoalcan:
Is there a program I can feed the atrix's dump files into, that will allow me to emulate the phone on my computer. I've got an idea about this signed bootloader, but need to emulate the entire system to verify. If noone knows of such program, would there be a dev that would be interested in listening to what I have to say???
[Atrix 4G Android Development] Smith7018:
As an uneducated but still educated response, I would say that the SDK emulator wouldn't work because those are android binaries compiled for x86 instead of ARM. Don't take my word on that, but that's how the iPhone's works and how it would theoretically work unless Google uses some voodoo magic haha.

Also, of course! This is the dev section, let's hear it!
[Atrix 4G Android Development] skoalcan:
Thanks Smith, and if you're interested, here goes. Any cert that has a signature must also have a valid startdate and endate. Now that we have root, we can verify the enddate of the cert. Now we can build our own cert leaving both the public key and private keys open, so that any key used will work. Now simply change system time no more than 24 hrs past original cert enddate. Moto's system should recognize that original cert has expired and will allow new cert to be loaded. Once new cert is loaded, and a reboot verify's that cert is working. We are now ready to tear this beast down and build it the way it should have been. Rather than trying to crack cert, we'll let the system think that the original cert has expired, offering us a way to replace it with our own. If there are flaws to this idea, please point them out, so i can research some more for holes or flaws. Thanks for listening
[Atrix 4G Android Development] infrared411:
The mb300 sbf was found via the rsd server I think. Still skrilax can more then likely obtain it.
[Atrix 4G Android Development] rlewis312010:
Any news on this?
[Atrix 4G Android Development] Pzyduck:
Thanks you so much :D
[Atrix 4G Android Development] ram130:
Flaws? hmm..what if Moto's system has another verification system? like a id number or something? ..I guess we will never know until someone actually tries this though..

thats all I can think of :D ..sounds full proof otherwise..
[Atrix 4G Android Development] Smith7018:
I'm not a security expert here, but I'm pretty sure signed binaries can't just have a new signature on it. One could theoretically hex edit the signature out and put the new one in, but I don't think signatures just "work." Think of a signature like a hash mixed with credentials; it's all based on who you are and what you're signing. Technically, for one to be valid, I think you would have to sign an unsigned version of the kernel to create a signature that would work for it, and we don't have that.

Now, I'm not an expert at all, but that's just my two cents. Anyone here know certs?
[Atrix 4G Android Development] skoalcan:
No No, we don't create a new signature. There is no need to, the way i understand is that moto used an X.509 cert. When writing the cert once the keys are needed to be input, we input "*" or all. which allows the new cert to use moto's signature's that are already in place. Does anyone know if motodev studio will allow for full emulation, if so i will test and verify. Otherwise I'll need a developer to work with that has access to the phone. Anyone else with any comments or questions about this procedure, please reply. I am not a cert expert and could use all feedback
[Atrix 4G Android Development] afroduck:
So...

I happened to get my hands on a developer Atrix handset in one of my stores.

I know you have the dev bootloader, but would the actual handset be of any use to anyone to help solve this here problem?
[Atrix 4G Android Development] jimmydafish:
From our experience, the dev handsets will not enable you to do any work on the other consumer phones. In the droid phones, and yes I know they are different, the only way to unlock the bootloader without motorola is to remove the chip and board and put one in that is unlocked. I am not sure if the Tegra series is based on this same model or not.
[Atrix 4G Android Development] skoalcan:
No luck with motodev studio, was not able to emulate entire system. Could just be me, since I've never used studio before. Would like to make a request for a developer to verify the -enddate of the boot.img certificate on device. Simply verifying the enddate will not brick phone, so hopefully someone will help with request. Thanks beforehand
[Atrix 4G Android Development] slhawkins:
What's the end date on the cert? As for inserting the new cert... Can I just go to AT&T and change the date on one of their phones?
[Atrix 4G Android Development] BravoMotorola:
This sounds like a great idea, but don't you think this was all thought out while building the signature? it seems like a strait forward idea and it's not too complicated. However, nobody will know until somebody tries, and I'm hoping it works.

Good luck to the first to attempt.
[Atrix 4G Android Development] alphadog00:
Certs don't work like this - or at least only some of what you say is valid. A private key related to a motorola cert signed the bootloader. The public key (related to this same cert) is stored on the phone - it probably expires in 20 years. But, even if it expired tomorrow, we don't know that they are checking the expiration date - they probably are not since they know who issued the cert and who signed the bootloader, so they can bypass.

But let's say for arguments sake, that the cert is expired so when the phone starts, it throws an "Invalid signature error" (or invalid cert) - the issue becomes that the bootloader is still valid - if a new public cert could be installed that had a good date (this can't really happen as they key pairs would be different when you made the new cert) it would validate the signature on the bootloader. If you just try to replace the cert (the public side) you still need to install a signed boot loader that matches the cert.

None of this has any bearing on the expiration date. No key stores on any systems throw up a message that says "cert expired" please install a new one. The public key is probably embedded in a chip at manufacturing and is read only. The solution is to break the chain of trust somwhere so the signature check comes back "OK" regardless of anything else.

BTW, the cert could have an expiration date of anything, so the best test of any of this is to change the date on the phone to 12/31/9999
[Atrix 4G Android Development] xxtsfxx:
So has this been tried yet?
[Atrix 4G Android Development] xenorabbit:
There are some very interesting entries on the android github project page regarding the tegra2 and kfuse.

http://android.git.kernel.org/?p=kernel/tegra.git;a=log
[Atrix 4G Android Development] youareme7:
I don't believe that is related to the infamous "efuse"

From kfuse.c:

I actually don't think that there is a separate TPM on this chipset but Tegra is ARM TrustZone capable which serves a similar function that Mshield did on OMAP in combonation with efuse. I could definitely be wrong though. TrustZone was rushed to market pretty quickly so there is yet hope that flaws in its implementation can be found. I'm still hoping there is another way around though, but I haven't found anything yet.

I do appreciate that people are still looking around and seeing what we can find out though, every little bit helps. :-)
[Atrix 4G Android Development] fakeer:
Information about the process

Hi, all

Maybe someone can help me understand something regarding the bootloader

signature.

as far as i can understand from reading about the bootloader lock is that Motorola is using digital signature in order to lock the phone.

and i got few questions regarding the digital signature.

1) Dose anyone know where the private key is stored (is it stored in more then one location) ?

2) Who is preforming the verification process ?

3) When the verification process is performed?

4) Do we know what is being checked (what value was Hashed )?

4.1) the partition size ?

4.2) the full partition Hash value ?

4.3) only specific files?

5) Is there any way to write a new Public Key to the phone ?

6) is there anyway to change the /recovery (partition) name ?

If we can rewrite ALL the location that the private key is stored we can then use our own Key pair and that will probably solve all our problems. (even if there is some kind of HSM chip in side the phone there's got to be a way to reset the "HSM" and push a new Public key into the "HSM")

If we can change the /recovery (or any other partition) name or creating a symbolic link to a temp partition in order to make sure the verification process will succeed, this can also help us, (we will need double the space (old partition - for verification process and new partition that the Phone will use))

p.s

usually when using digital signature an Hashing Algorithm is used. Can we change the implementation of this function ?(if so we can return the hash that we need)
[Atrix 4G Android Development] xenorabbit:
Ah, worth a shot anyway. I noticed the tegra branch was updated a couple of days ago which led me through reading the log. Interesting stuff for sure but not helpful here. :)
[Atrix 4G Android Development] DarkSi08:
Any more info on this yet? I think we'd have solved this by now, if it was that easy.
[Atrix 4G Android Development] infrared411:
The hash is useless without the private key pair. Although using a different partition for recovery and launching from there sounds interesting. How would one go and change the bl to point to new recovery without also changing the checksum
[Atrix 4G Android Development] DarkSi08:
For this scenario, wouldn't we be able to do something through adb? Like a fastboot boot <recovery file>? That certainly wouldn't affect the phone negatively, since you're not making any changes on the phone.
[Atrix 4G Android Development] infrared411:
Isn't fastboot secure enabled?
[Atrix 4G Android Development] mindphaze:
What is the procedure to dump the boot.img and recovery.img? I'm getting a 404 on the dump.7z link in the OP. I've seen other methods that involve doing a #cat /proc/mtd but this is not returning anything for me.

Thanks
[Atrix 4G Android Development] fakeer:
I completely disagree with you and i will try to explain why :

will divide digital signing of a file into 2 phases :

(for exmaple using a self-signed certificate in order to sign and the verify

the file integrity using an asymmetric algorithm aka Public-key cryptography)

I presume that buth sides (The Signer and the Verifier) got the Public Key.

Phase one (signing the file):

usally we will run some kind of Hash algorithm / function (MD5, SHA-1) on the

file content then we will recive the Hash Result.

We will then take the Hash Result and using our Private Key we will "encrypt" the

Hash value.

Then we will add this Hash value to the file (or as an attach file).

phase two (verification):

We will run the same Hash algorithm / function on the file and save this value.

then we will use our (the shared private key) Public Key in order to "decrypt" the Hash

that was send with the file.

*we will then compare our hash with the decrypted Hash. if we get the same

value then the file was sign by the Private Key corresponding with out Public Key, else

we will exit :-)

my question was What Hashig algorithm is being use (this will probably not

going to help us)

and where is the Hashing Funcation is located (what file,) and if we can

chagne it ?

if we can change the Hash function we can them return the Hash Value that we

need (*)
[Atrix 4G Android Development] pokey9000:
If the Tegra2 does a trusted boot like the OMAP Mshield, then you couldn't change the bootloader as it would be signed as well.

Besides, if you can change the function that verifies the hash, then you just make it always return as valid. At some point there's a conditional that says "if hash is good, then boot else hork"
[Atrix 4G Android Development] wingmanjd:
Please excuse the limited knowledge that is to ensue:

Is it possible to then flip that if...then statement to "If hash is bad, then boot else hork" (Hork being the technical term, of course).
[Atrix 4G Android Development] pokey9000:
How you change the check to allow it to boot is irrelevant. The problem is that modifying that check in flash will stop your bootloader from working since the Tegra won't boot a bootloader that fails the signature check.
[Atrix 4G Android Development] jimmydafish:
Ding, Ding, Ding... There are many links in the chain. It begins in the NVRam and goes all the way down to the booting process. Simply changing the bootloader will just have your phone use the backup bootloader, if you change both your phone will become a soft bricked device.

Examining the files and being able to view the boot chain, or what we believe to the the boot chain would suggest that the road ahead is going to resemble the Droid and Milestone phones.

I know that this being a new device that Motorola may have made a mistake, but some documents point to the fact that in order to remove the security on the phone the entire chip(processor) must be replaced.

I am hoping that you find a way to defeat all of this, and succeed where others have failed. Be careful yet courageous.
[Atrix 4G Android Development] andrew53517:
Jimmy, you seem to know a lot about this stuff. Like what you can and can't do.. why dont you purchase an Atrix and help crack it? That'd be fantastic if you could. We need all the help we can get man.

Atrix4G Rooted!
[Atrix 4G Android Development] sdlopez83:
+1 Jimbo, take the dive, help us out!
[Atrix 4G Android Development] andrew53517:
If we have to we'll start a donation fund to get you one lol. Jimmy, please help the community! You know motorola devices so well!!

Atrix4G Rooted!
[Atrix 4G Android Development] ikenley:
Second. Will donate for support.
[Atrix 4G Android Development] b14ck0ut:
I asked earlier in the thread and no one ever got back to me, so here goes to you devs and others with access/knowledge of the filesystem: can someone find and post the public key and public exponent to the atrix's bootloader on here please?

Thanks very much

bl4ck0ut
[Atrix 4G Android Development] jsuresh:
+1 , lets go devs.
[Atrix 4G Android Development] shawnbuck:
I'll commit some money to this as well.
[Atrix 4G Android Development] loztboy:
You got a donation from me too!
[Atrix 4G Android Development] ZeroSvt:
+3 will donate time and money!!
[Atrix 4G Android Development] mthguy:
I think anyone on here with an Atrix is willing to pledge to a research fund, or bounty of some kind. no need to clutter the Thread with +1's and the ilk.
[Atrix 4G Android Development] andrew53517:
True. We don't need that. We need a response from jimmy though. I really would like him to work on the Atrix since he was the first to bring custom ROMs to the droid x. Come on jimmy. Help us all out. We'll give try our best to provide you some funds for an Atrix!

Atrix4G Rooted!
[Atrix 4G Android Development] zen kun:
+4

10 chars
[Atrix 4G Android Development] cellzealot:
Interesting turn of events after the reception p3droid(jimmydafish) has been given on this board by many here.

I don't think he is particularly eager to get involved at this point.

Obviously, having a phone to work with would make it a more attractive prospect.
[Atrix 4G Android Development] andrew53517:
Why? What happened here? If you want you can PM me. (Shows how much I read lol)

Atrix4G Rooted!
[Atrix 4G Android Development] sdlopez83:
Yeah design gears over reacted to his comment. We need jimmy hope jimmy doesn't Hold grudges like in seinfeld
[Atrix 4G Android Development] infrared411:
Maybe moto will pull a sony and tweet the private key. Has anyone tried fastboot oem unlock? Jk. This needs a better orginizational effort though.
[Atrix 4G Android Development] Blind_Guardian:
True, he did over react... it seems to happen a lot in this thread. I saw a lot of people posting things they should not have. Things can only move forward if both sides work together and those with animosity that wish to hinder the dev process are kept at arms length.
[Atrix 4G Android Development] jimmypopulous:
Guys, if you understood the signing chain, you'd realize this phone will likely only be opened if Moto offers an option to do so.
[Atrix 4G Android Development] andrew53517:
So there is really no hope :-(

Atrix4G Rooted!
[Atrix 4G Android Development] xxtsfxx:
Then, I will stop hawking on this thread, keep my TP2 and NEVER invest in Moto. Thankz :D
[Atrix 4G Android Development] skoalcan:
Has any of the developers been able to get a memory dump off of startup?? I understand that if we can gain access to this dump, or trigger it. We can hex the dump and then use xxd to output to standard. There is a chance that once the cert validates signature on bootloader, that the PEM can be pulled from the memory. As I don't have the phone and have yet to use nvflash or fastboot. I'm not sure what the chances are of grabbing a ram dump is. Please any feedback is appreciated. I'm not giving up on this bootloader, but need input from those that have seen the problem firsthand.
[Atrix 4G Android Development] mthguy:
Why are the first two keys the same for *11 and *10, even located in the same place.
[Atrix 4G Android Development] Techcruncher:
holy crap. that would be awesome if you actually found the 128bit key!!!

time for stock :p
[Atrix 4G Android Development] mindphaze:
I believe those are the boot and recovery img, so they should mirror each other.
[Atrix 4G Android Development] YellowGTO:
Nevermind.
[Atrix 4G Android Development] protocol113:
Could you make an empty update.zip signed with the recovery key and flash it to test it without worry about it overwriting anything? In order to test without worry of bricking?
[Atrix 4G Android Development] DarkSi08:
What tool did you use to scrape for that? I think an important next step would be to see if two phones use the same key, before anyone goes trying to make a blank update.zip, etc.
[Atrix 4G Android Development] protocol113:
The purpose of the update.zip is to test key...if its wrong it'll throw a signature verification error. But I see your point. Post your process for pulling the keys so we can check a few phones...

and I think we may want to start a thread for this idea...it could get full fast if a lot of people go posting their keys
[Atrix 4G Android Development] DarkSi08:
Oh, I understand, and I completely agree. We just don't want to try it on a different phone, get a negative result, then be sad pandas because we think that's not the key. ;)

Either way - if someone signed an update.zip package with that key, and it worked, that would be our indicator.
[Atrix 4G Android Development] protocol113:
Correct. And to my understanding signing should be as easy as opening a hex editor going to the correct address and inserting our key correct? If so I can generate an update zip signed and upload it tonight
[Atrix 4G Android Development] dew.man:
No offense, but you guys need to get a better understanding of code signing.

One place to start is http://en.wikipedia.org/wiki/Code_signing

From there, after you get a basic understanding, you should click on the "cryptographic hash" link at the top of the first paragraph. This should explain to you why you can't just add a bunch of hex to an empty update.zip
[Atrix 4G Android Development] protocol113:
That's why I posted it as a question and not a statement. :D thanks for the link btw. do you have any further knowledge on signing by chance? and would you be able to generate a signed blank update.zip?
[Atrix 4G Android Development] protocol113:
and one more thing....would this be of any use to us?

http://xdaforums.com/showthread.php?t=471634

It's an auto-sign application would we be able to use it to sign our update.zip with our key?