yashsingh1/xdaforums huggingface dataset:
[Atrix 4G Android Development] frankiedizzle87:
I dunno maybe ill get a captivate or something that's extra crackable. That way ill have my upgrade still and get something like a LG 3D jumpoff

Sent from Atrix ;-)
[Atrix 4G Android Development] andrew53517:
Im sure there are some. Da_G hasn't quit yet! Along with others!

Atrix4G Rooted!
[Atrix 4G Android Development] frankiedizzle87:
Azpizza could swallow elephant load for all I care enthusiasm in a phone I invested in and a unlock project I have interest in a comment here or there isn't bad.

Sent from Atrix ;-)
[Atrix 4G Android Development] art3mis-nyc:
Stupid question on my part, but if the xoom is just a big atrix, can we "use" the bootloader from there so that we can at least unlock? (assuming that we can figure a way to flash it to the phone.)
[Atrix 4G Android Development] zambezy:
People dont even have a full partition map..

Its all speculation...

Without some solid guys experienced in cripto this will go nowhere...

This is the current state of the bootloader...

BTW I think we successfully loaded bootloader on the phone but it bricked as it could not get past the "sbk fuse". If that is the case unless the fuse is turned off and bootloader is loaded at the same time I dont see this working..

20:42:28, March 22, 2011

Line: 767

ERROR: Phone[0000]: The "Motorola_Flash" Interface could not be found.

The super-file is not secure and for re-flash;

the phone needs a super-file that is not secure and for reflash.

File: D:\GitProjectsReleases\hdt_windows_flash\flash\code\flashdll\MIFlash.cpp

Device ID: 0

Followed by...

20:50:52, March 22, 2011

Line: 378

ERROR: Error getting subscriber unit information.

File: D:\GitProjectsReleases\hdt_windows_flash\flash\code\flashdll\SUInfoOp.cpp
[Atrix 4G Android Development] ikenley:
Hi All,

I've just registered to be a part of an AT&T testing group for an update for the Motorola Atrix. Is there anything we can gain from getting this update.zip before it installs?

It's a first in best dressed deal so I recommend signing up to get it, to increase the chances of someone who can actually do something with this to get it.

https://supportforums.motorola.com/thread/47575?start=0&tstart=0
[Atrix 4G Android Development] t0dbld:
well that is good cause i signed up over three months ago :-P, once again this is not related to the forum and belongs in general
[Atrix 4G Android Development] naturefreak85:
Won't be difficult to get the update file they give out, I was part of the backflip update program what they do is they give you a link to download it and you can either use Motorola's program on the computer to do such or you can download the file to an SD card.
[Atrix 4G Android Development] frankiedizzle87:
Was the backflip update significant?

Sent from Atrix ;-)
[Atrix 4G Android Development] Immix:
I don't think that method applies here as all device manufacturers have their own ways to lock down the bootloader. Good thing with iPhone is that there are so many people using it, which means there are that many more devs trying to find a solution to the locked bootloader. Motorola Atrix, not so much. There are currently only a handful of people trying to crack it open. I have to say though that devs that are at it here are tremendously gifted. Hopefully we will have a solution soon. Moto itself might open the bootloader as it has hinted in the past.
[Atrix 4G Android Development] ncfballkid:
When was this hinted in the past?
[Atrix 4G Android Development] Immix:
https://supportforums.motorola.com/thread/45249?tstart=0

https://supportforums.motorola.com/message/347543#347543

We really are cluttering up this thread with non dev issues. Please people, lets use relevant sections fro these issues.
[Atrix 4G Android Development] joe ferreira:
hoping to help model boot layout

Has anyone looked at /var/log/boot and /var/log/dmesg?

can we enable bootlogd?

also here is a app to collect logs from logcat

code. google .com /p/android-log-collector
[Atrix 4G Android Development] live4nyy:
Those are the worst hints in the world. The first one Moto pretty much says it's not true and the second one is just really reaching. plus the FB comment linked from the first one was dated before the Atrix was released. More than likely, they will allow certain devs that they can trust to fiddle with the bootloader, not the general public. And they refer to it by saying "bootloader solution" which is just pure speculation.
[Atrix 4G Android Development] unity311mu:
Thanks for the heads-up here...just registered and signed up for that program. The more information/code we can get from Moto, the better!
[Atrix 4G Android Development] naturefreak85:
Well it took it from 1.5 -> 2.1 so yes, but I doubt this will be as significant, chances are this will fix some bugs we all have noticed as well as potentially bringing 1080P recording.
[Atrix 4G Android Development] frankiedizzle87:
That isn't bad although I wouldn't loose my sideloading app access for that

Sent from Atrix ;-)
[Atrix 4G Android Development] kholk:
Hmh... just an idea that is talking alone in my mind...

When I've had a Milestone, we've tried to load a different MBM, MBMBACKUP and Bootloader (original Motorola's engineering version) and we've bricked a lot of phones because of the trusted OMAP bootchain. Keys were stored in the eFuses and checked at boot time (prior to execute anything off the trusted bootchain), bl keys rejected and Milestone bricked (unbrickable. JTAG is disabled on Sholes).

On Tegra2 as I see on the Moto Xoom (unlockable) it appears that:

1. On the Tegra2 platform the eFuses maybe can be reprogrammed

2. Surely the Tegra2 platform isn't as secure as OMAP, because Sholes can't be unlocked because of its HW setting (HS Mode vs GP Mode)

3. If the Xoom is unlockable, the Atrix is....but how does Moto unlock it? Signed bootloader upgrade that writes zeroes as signature in CDT partition....or eFuse reprogramming?

I've seen that if you relock the Xoom you HAVE to flash an original SBF prior to relock it, otherwise it'll be bricked (don't know if permenently or recoverable through bootloader mode and signed SBF flash).

Think on that.

Anyway, if it's an eFuse reprogramming, the CDT data and Bootloader partition should be reflashed as well with an unsigned one. Or is this not happening on Xoom, simply disabling signatures?

Don't think so.

Has these situations been examined?
[Atrix 4G Android Development] t0dbld:
actually, the method i have been working on for quite some time , is to reprogram the fuse, i will not know until its done where this is the end all, personally i think that i will need to first reprogram the fuse than flash an engineering bootloader, i got my parts in today to build the usb i need, or so i hope, but unfortunitly i am sitting on a broken atrix hopefully replacement comes tomorrow and i will be able to report more in next few days. I agree that the atrix is beatable, the biggest problem is the lack of people working on this, as its down to me and da_g and neither one of us is a crypto guy :-P today i also gathered some info from released lg and it to has the tegra 2 with fuse, how ever I have not yet been able to compare setting to know how its is configured

** i believe our biggest difference and biggest challenge is that each of our partitions are signed, so its not just the fuse we have to worry about, i don't think that what i have stated above will fix all of our problems, a dd of all the partitions may also be necessary
[Atrix 4G Android Development] LancerV:
Should get geohot on this :o
[Atrix 4G Android Development] sdlopez83:
Maybe throw a bounty in there to entice more devs.
[Atrix 4G Android Development] guidojusto:
There is already a bounty that i started 3 days ago, today it reached 700 USD for the one who can unlock the bootloader. You can take a look on my posts or just give a look to the thread Bounty Time on Q&A section.
[Atrix 4G Android Development] xxtsfxx:
The eFuse is one time programmable. However, you can Read the data on it i believe. But i know for a fact you cant "reprogram" or write to it.

http://xdaforums.com/showthread.php?p=11897599#post11897599
[Atrix 4G Android Development] t0dbld:
This is not an efuse, i appreciate anyone helping but the info you have is actually the opposite, if we could read the data that means we could get there keys, please attempt what ever you wish, but i will go my route as it is determined through over a months work of studying and testing , you are partialy correct as i will not be able to change the keys assosiated in the fuse , but thats ok i dont want to :-D

Sent from my GT-P1000
[Atrix 4G Android Development] DroidDont:
Still pissing up a rope?
[Atrix 4G Android Development] rozzco:
With the wind in our faces! :rolleyes:
[Atrix 4G Android Development] nomisunrider:
Is Da_G working on this any more? Haven't seen anything from him in over a week.
[Atrix 4G Android Development] kholk:
Do you know that there are some re-programmable Fuses?

When we've studied the OMAP bootchain I've discovered that there's an OMAP chipset that is using the reprogrammable Fuse, called if I remember well "eeFuse" or something like this.

But anyway my definition of "eFuse" in Tegra2 is wrong. Tegra2 hasn't got eFuses.

And... if you look at the Tegra2's nvflash program, it can rewrite the Secure Boot Key (impossible to READ, but only writeable).. so it's definitely beatable.
[Atrix 4G Android Development] Clienterror:
Yes he is.
[Atrix 4G Android Development] sdlopez83:
he is handling Personal issues.
[Atrix 4G Android Development] Ririal:
As said, he's handling some personal issues. I've been poking around with stuff in his absence, and we've definitely learned a lot about how the bootloader is checking sigs and verifying the partitions are legit. It's unlikely that anything practical will come from this type of research, but it's certainly giving us more insight on how the Atrix is doing what it's doing. Stepping back and being objective for a moment, Motorola has done some VERY impressive locking down of the system (please don't reply with comments on how Motorola is evil, it's ignorant and annoying), Sony could learn a thing or do from them ;)

We'll get something eventually, or Motorola will crack and give us the answer, intentionally or accidentally.
[Atrix 4G Android Development] YellowGTO:
EVIL!:cool:
[Atrix 4G Android Development] xxtsfxx:
Perhaps your correct. I didnt know about eefuses As said in my Very first post I'm a noob. lol

And yes Tegra 2 and the fuses are completely separate things.
[Atrix 4G Android Development] kholk:
@xxtsfxx

I've appreciated your post about the eFuses etc, infact I've only said to you that there even exists fuses that aren't OTP :P

Anyway, you're right: why talk of eFuses when Tegra2 hasn't got any of them? :P
[Atrix 4G Android Development] iservealot:
Would the update/ beta update from Moto help to establish bypassing security measures?
[Atrix 4G Android Development] drock212:
I think it might. Im not a dev but the OTA needs to be signed right? So there might be something there. I still haven't installed my Beta update so if someone wants to walk me though how to snag it then also compare what its checking against my phone Id be more than willing to help. Just PM me and Ill give it a go
[Atrix 4G Android Development] zambezy:
Partitions

CG2	22K	Partition table

100%	CG3	mmcblk0p2	ext2	BCT?	sig	512K	Partition Table (points to 0x0000 androidboot.bootloader)

CG5	sig	20,358K	Radio

CG42	sig	3,072K	MOSTLY EMPTY

CG44	sig	3,072K	Bootloader?

CG47	sig	256K	Microboot (Engine and Slot for hashing in microboot priv.c = 0x%x, 0x%x ... Loading BootLoader)

99%	CG53	mmcblk0p8	no	1,014K	unknown (SOL:) mmcblk8:1024k

100%	CG55	mmcblk0p10	ext3	sig	8,192K	Kernel? boot.img?

100%	CG56	mmcblk0p11	ext3	sig	8,192K	Kernel? (revcovery?)

CG57	mmcblk0p12	ext3	sig	327,680K	system

CG58	mmcblk0p13	ext3	OSH.bin	sig	786,432K	osh

100%	CG59	mmcblk0p14	HFS	APPbin? sig	20,480K	Apple_hfs Motorola Helper related.

mmcblk0p15	ext3	CAC.bin	cache

mmcblk0p16	ext3	UDA.bin	data

CG62	mmcblk0p17	ext3	preinstall

mmcblk0p3	PDS.bin

CG50,CG51,CG52,CG54,CG60,GG61 are empty

This is what I have found so far....

If anyone can contribute or find problems with this please let me know...
[Atrix 4G Android Development] benem3000:
There's a post on this forum with the ota beta. I don't want to test it because I have gingerblur. It is already signed and everything. Could you simply put the files you want in the zip? Of course the size thing could cause issues.

(EDIT) Would the CRC32's be of any help?
[Atrix 4G Android Development] zambezy:
Sure you could sub the files. I can imagine that the update.zip is signed so any changes will cause it to fail Signature.

you can try...

YOu could even sign it with test keys but the bootloader might rejected it as the keys would not match...

I doubt that it would be that easy...

Also what are you going to replace. We dont know how the protection mechanism works or where it is, let alone comparing it to the engineering units that should work with test keys...

I think that mapping out the partitions and ota packages, sbf's.. is a start. Then we can focus on what is different in the engineering units.

We are ways away form loading kernels yet as the source code is not released. Understanding how Motorola setup the unit is vital... If anyone on here is experienced in Crypto and reverse engineering please come on freenode #XDA-Atrix...
[Atrix 4G Android Development] t0dbld:
+1 Could not have said it better and more polite my self
[Atrix 4G Android Development] benem3000:
What I thought lol. I'm not very good with keys and sigs. I guess looking at it objectively cant hurt ;)
[Atrix 4G Android Development] xyrovice:
For what it's worth, I really appreciate this optimism. Of course, I'm wondering "EVENTUALLY WHEN?!" just like everybody else, but asking won't make it come any sooner. So until then, you guys just keep up the great work. And thanks buckets for all you've done so far.
[Atrix 4G Android Development] YellowGTO:
https://opensource.motorola.com/sf/go/projects.atrix/frs.olympus
[Atrix 4G Android Development] nomisunrider:
Does this mean they're going to provide an unlocking and/or signing method as well?
[Atrix 4G Android Development] -PiLoT-:
Right Ive Cleaned up the thread

point 1, stop posting irrelavent crap if you not a developer or at least a person who thinks they can help

point 2, Those devs who are *****ing at posters, you're all idiots. preaching rules in posts when you are failing to follow them either

if you see a post that doesnt belong here then ignore and report it, dont rage at the poster or leave a rant, that way we have to delete less posts.

also Shadowscreation you're a senior member, so you dont get a ban hammer, and calling other members douchebags isnt the way to get one nor a correct talk to other members either

to summarize posts that inquire about the workings of the craqcking or people offering their services is allowed here but peope asking if its done yet or progress are'nt

If any of you have issue with what ive said PM me isntead of filling this thread with responses
[Atrix 4G Android Development] corneliusm:
Unlikely. The source they released is simply to comply with the GPL. It should be enough to build the kernel... at least we'll have a good starting point if/when (hopefully the latter) the bootloader is bypassed.

This will certainly help with reverse-engineering the webtop too! B)

I wish I could help right now (I'm a Linux systems dev) but reverse engineering and crypto is outside of my realm.
[Atrix 4G Android Development] :
Is there a place where the known information is compiled? ... like what we know of the partitions and such. For someone just jumping into the discussion 49 pages is a lot of read, plus there is misinformation in there.
[Atrix 4G Android Development] zambezy:
MOTOROLA ATRIX FULL PARTITION TABLE

Partitions
CG2	no	22,528	Partition table
CG5	sig	20845608	Radio
CG42	sig 3145728	MOSTLY EMPTY
CG44	sig 3145728	Bootloader?
CG47	sig	262144	Microboot (Engine and Slot for hashing in microboot priv.c)

rdl.bin ?????????
ptable ?????????
CDT.bin ?????????
BCT.bin ?????????
PT.bin ?????????
EBT.bin ?????????
MBR.bin ?????????
EBB.bin ?????????
NVC.bin ?????????
mmcblk0p1	3670016
CG3 mmcblk0p2 ext2 CDT.???	524288	points 0x0000 androidboot.bootloader
100%	mmcblk0p3 PDS.bin	2097152	Persistent Data Storage
mmcblk0p4	EBR.bin 1024	Extended Boot Record?
100%	mmcblk0p5	SP.bin 1048576	Signature
mmcblk0p6	CID.bin	524288	UNKNOWN?
mmcblk0p7	MSC.bin	524288	Misc?
100%	CG53 mmcblk0p8	LOG.bin no 1048576	Logo (boot)
100%	mmcblk0p9	KPA.bin	2097152	Kernel Panic Data
100%	CG55 mmcblk0p10 ext3 SOS.bin sig 8388608	Recovery
100%	CG56 mmcblk0p11 ext3 LNX.bin sig 8388608	Boot Image - Linux zImage + Ramdisk
100%	CG57 mmcblk0p12 ext3 APP.bin sig 335544320	System
100%	CG58 mmcblk0p13 ext3 OSH.bin sig 805306368	OSH WebTop
100%	CG59 mmcblk0p14 HFS CDR.bin sig 20971520	CDROM (Motorola Helper)
100%	mmcblk0p15 ext3 CAC.bin	671088640	Cache image
100%	mmcblk0p16 ext3 UDA.bin	2147483648	Userdata image
100%	CG62 mmcblk0p17 ext3 PIA.bin	361758720	Preinstalled image
100%	mmcblk0p18 fat SDC.bin	11233792k	Internal SDCARD
EBF.bin	??????
NVF.bin	??????

512k ? CDT/EBR/CID/MSC/MBR
CG50,CG51,CG52,CG54,CG60,GG61 are empty
[Atrix 4G Android Development] t0dbld:
Good now that you finished that ill send you alot more files to decompile, dont want you to get board on me! J/k get some sleep i tty timorrow :-P

Sent from my GT-P1000
[Atrix 4G Android Development] Neo.:
Hey everyone,

Haven't tried to read all the pages. but am still going through the pages. I haven't got my atrix yet,but I was just wondering did you guys tried to use kexec() module to bypass the bootloader?
[Atrix 4G Android Development] BravoMotorola:
I think you guys should forget it. More luck with 2nd init because it has actually gotten custom roms and kernals to phones like the Defy, while as actuall cracking the bootloader has never been done to any Motorola device. I suggest you go here.
[Atrix 4G Android Development] zen kun:
I guess 2n ini let you load custom rom but no custom kernel, perhaps seems its working In defy and milestone 2 would be nice port to atrix

.......................................................

Sent from my loved atrix ;D
[Atrix 4G Android Development] hankpunk:
I believe I have an unsigned Atrix, but I'd like someone to walk me through to verify. Since I'm a noob, I would actually prefer to have the stock signed version so I can get updates through ATT. Right now, updating is a time consuming process of loading unsigned sbfs vs. signed sbfs. I'd appreciate some help to verify that I do have an unsigned Atrix. Thanks
[Atrix 4G Android Development] t0dbld:
id be happy to help just message me
[Atrix 4G Android Development] lyon21:
Ill trade ya my signed atrix in a heartbeat!
[Atrix 4G Android Development] kholk:
Got an unsigned Atrix too.

Connect it through fastboot, send this command:

fastboot getvar secure

If the output is "secure: no" your atrix is an unsigned engineering version.
[Atrix 4G Android Development] tassadar898:
KHOLK any updates on the OC module
[Atrix 4G Android Development] PixoNova:
This topic has nothing to do with Kholk's OC module...
[Atrix 4G Android Development] :
Are you sure, this device was purchased through AmazonWireless in ATT packaging. Unless you think they shipped engineering Atricies?

EDIT: someone in IRC pointed out this bug in the fastboot executable.
[Atrix 4G Android Development] PAulyhoffman:
Mine=yes

but it appears that some users who bought their device from amazon wireless are seeing secure = no
[Atrix 4G Android Development] jysue:
Does rsd pickup your device as NS or SE?
[Atrix 4G Android Development] sifon187:
Mine shows secure: no but I seen it is most likely a bug.
[Atrix 4G Android Development] :
how did you get the secure: no? "getvar secure" or "getvar all"? I think secure is correct and all is buggy, but that's just from my own testing.
[Atrix 4G Android Development] sifon187:
I did getvar all, but getvar secure shows secure: yes
[Atrix 4G Android Development] rafkong:
Do any of the devs here own an Atrix with unsigned bootloader?

Because if they do then those devs should at least try to flash custom recovery and start cooking some full roms for those who do no have a signed bootloader.

I'm sure those people who own such devices will donate heavily.

I mean, I'm just talking out of my ass!

Sent from my heavily crippled by AT&T and Motorola Atrix pseudo 4G using the awesome XDA App
[Atrix 4G Android Development] jysue:
same here

getvar all shows secure=no

getvar secure shows secure=yes

whilst it doesnt exactly help our cause much -

fastboot oem fb_mode_set

forces fastboot mode on reboot

fastboot oem fb_mode_clear

clears the forced fastboot mode

Can be helpful if you are playing around with trying to use fastboot reboot-bootloader / fastboot boot
[Atrix 4G Android Development] t0dbld:
sure thing Burt *eh eh eh eh*
[Atrix 4G Android Development] krkeegan:
I think it is significantly more than 28 bit, as 28 bit would be easily doable with brute force. The Milestone was encrypted with 1024 bit. They attempted to brute force it with a boinc system, but I believe support crumbled pretty fast when people realized that a brute force attempt of every possible combination could take hundreds of millions of years.
[Atrix 4G Android Development] JayRolla:
Phones are now getting 2048bit encryption, I highly doubt the Atrix is 28bit.
[Atrix 4G Android Development] neer2005:
I thought the atrix was only signed and not encrypted?
[Atrix 4G Android Development] blunted09:
man my wallet is overflowing with money. I just wish i had something/someone to donate to right now...

:D
[Atrix 4G Android Development] xXxSamxXx:
New thread with very close solution check that out.

Sent from my Rooted, Chilled, Webtop Modded, and GreyBlured Atrix 4G
[Atrix 4G Android Development] GSLEON3:
The Moto Unlock tool is very similar to HTCDev unlock. You are thinking to "BIG"...

Forget encryption, it is a simple 2-byte change that is made when less than 1kb is injected into the bootloader.

Also, take a look at force dload sql data strings into the spl memory of the bootloader.
[Atrix 4G Android Development] Swiftks:
Really you posted in a thread that's last post was May 14??? WTF

Sent from my CM7 Atrix 4G
[Atrix 4G Android Development] CaelanT:
This ^^^^^^ ! LOL
[Atrix 4G Android Development] sdlopez83:
Wow gsleon is a big-time dev since winmo days. Surprised he did.
[Atrix 4G Android Development] amandaerichardson1984@gma:
Amanda Richardson
[Atrix 4G Android Development] lolvatveo:
quantum computer very helpful
[Atrix 4G Android Development] Festaman:
I got this from an someone inside Motorola. Who I know and don't want to get into trouble. SO i am trying to keep this as generic as I can.

You can bypass the bootloader. However he could not me how. But, he did tell me that you should look at how the LG was bypassed. That might help. Also, later this year Motorola will tell people how to do that safely."

I think he may mean the LG Alley? But i am not sure i am waiting for a return email
[Atrix 4G Android Development] Smith7018:
Woo! Which LG phone? I'm trying to remember some with a locked bootloader, but I can't really think of any :\. I think some were made without FastBoot?
[Atrix 4G Android Development] Festaman:
I think he may mean the LG Ally? But i am not sure i am waiting for a return email
[Atrix 4G Android Development] mthguy:
He is probably refering to the Lg optimus x2 that has the same chip as the Atrix! I don't know much about it, but I am looking into the Dev that has happened over there.
[Atrix 4G Android Development] ram130:
I think he might be right on this one..but can't confirm it yet...keep looking guys..
[Atrix 4G Android Development] Festaman:
Sweet...If confrimed
[Atrix 4G Android Development] sdlopez83:
Yeah your right where are my manners.
[Atrix 4G Android Development] slapdaddy:
Motorola should tell everyone how to do it safely now instead of later this year. Though it might take some of the fun out of bypassing it. :)

I do believe he is referring to the Optimus X2 though as they do both run a Tegra 2 chip.

Sent from my Inspire 4G.