yashsingh1/xdaforums huggingface dataset:
[Atrix 4G Android Development] BlackOtaku:
What about a modified kexec module? That's what they tried (but abandoned apparently) on the Milestone and what is being worked on for the Droid X. http://www.droidforums.net/forum/dr...ss-project-droid-x-more-need-driver-devs.html
[Atrix 4G Android Development] DuoM:
Thanks for this :(

Is it possible to ask him to confirm whether the bootloader is

locked and signed,

locked and encrypted,

or locked, signed and encrypted,

just to make sure that there is no misunderstanding?
[Atrix 4G Android Development] ram130:
I'm not giving up yet. Since I'm not a experienced dev I'm just going to go directly to the source and show them why they should provide a solution. We are trying though and we got another reponse..anyway wish us luck as well.

https://supportforums.motorola.com/message/327923

Anyway on topic : this is a hard nut to crack, the kernel seems linked as well.
[Atrix 4G Android Development] tbae2:
http://pocketnow.com/android/motorola-atrix-bootloader-signed-custom-roms-complicated

DA_G will be picking up this phone in March, also he wrote that article. Has a very good point at the end that someone could probably try to transfer over the technique in that way.
[Atrix 4G Android Development] designgears:
http://xdaforums.com/showthread.php?t=965021

Check that out guys ;)
[Atrix 4G Android Development] t0dbld:
Motorola jsut announced on twitter that Xoom will come with a lockable/unlockable bootloader wtf!!
[Atrix 4G Android Development] zambezy:
I though this might help you guys... Correct me if Im wrong. I currently have only vaguely researched the topic.

Front what I understand the chip does not contain e-fuse... That being sad it is signed so you cant just hack it. It would have to be resigned.

This seems very similar to the MyTouch3G Bootloader. It was signed and it could not be directly modified. Through engineering H-Boot it was possible to remove the signature verification and load modified recovery, boot, system...

The topic of cracking the certification keys came up back then and it was determined at the time was not possible because the keys to sign the certificate differ from the public keys... Im not saying that its impossible.
[Atrix 4G Android Development] loooney2ns:
I posted the following reply on both Motorola threads. I think it says what we all feel in a polite manner. I hope to get some kind of response from Mark at Moto.

Mark, couldn't the engineers provide a developer's key to unlock the bootloader for dev's? They are doing this with the Xoom, so why not do it with the Atrix and Bionic? The general public wouldn't know or care about it, and it would satisfy those who want it. There could also be a restore image like manufacturers put on PC's if anything gets messed up. It would be beneficial to everyone. No more bad-mouthing Motorola by the influential few. Your company already manufactures the best hardware. Why not follow it up with great customer satisfaction? Motorola has come back from the brink-almost out of the cell phone business. They are now back near the top. With all the competition(HTC, Samsung, Apple, etc.), why would they risk it? Just a devoted Moto fan's opinion.
[Atrix 4G Android Development] b14ck0ut:
Can anyone possibly post the public modulus and public exponent from the signature? also is moto still using a 1024 RSA encryption for their signatures? or have they changed?

regards

bl4ck0ut
[Atrix 4G Android Development] mr.stylo:
I hope this can help you http://and-developers.com/start. Its the Wiki from the And-Developers with some documents of the Motorola Droid-family phones and some ideas for cracking that bootloader.
[Atrix 4G Android Development] infrared411:
Experience

Hi guys,

I have owned Motorola phones since cellular one offered the analog bag phones up through the razor, q, q9h, cliq, backflip and now the Atrix. (sorry for off topic but im going somewhere with this). I am also a Moto Dev (can show my cred). Anyhow moto bootloaders have become more difficult to crack.

IMO, Brute force will take too long with a hash (besides that signing the bl with public keys we do not have). unlocking nvr and writing might have more luck but overwrite on reboot. We can not break the code cause of the checks will not match. With that it might be a better option to kexec (not really worth it) or better then that try to disable the lock on the nvr.

I have no experience with tegra or tegra 2 so I have a lot of learning to do.
[Atrix 4G Android Development] sdlopez83:
Thank you captain obvious.
[Atrix 4G Android Development] darkamikaze:
Very unnecessary. Please don't comment unless you're helping out dev. These are your future devs learn to be nicer.
[Atrix 4G Android Development] dkirchik:
There's a system restore built into the phone .sh file we can edit the restore location and file to be restored. Could be used to go back to stock.

#!/system/bin/sh

# chmod the init.d dir

busybox chmod -R 755 /system/etc/init.d

# run init.d

/system/bin/logwrapper /system/bin/busybox run-parts /system/etc/init.d
[Atrix 4G Android Development] dkirchik:
It could be boolean. Ill look wen I get home. Thank you :-)
[Atrix 4G Android Development] dkirchik:
#!/system/bin/sh

ifconfig eth0 10.0.2.15 netmask 255.255.255.0 up

route add default gw 10.0.2.2 dev eth0

qemud=`getprop ro.kernel.android.qemud`

case "$qemud" in

"")

radio_ril=`getprop ro.kernel.android.ril`

case "$radio_ril" in

"")

# no need for the radio interface daemon

# telephony is entirely emulated in Java

setprop ro.radio.noril yes

stop ril-daemon

;;

esac

;;

esac

num_dns=`getprop ro.kernel.android.ndns`

case "$num_dns" in

2) setprop net.eth0.dns2 10.0.2.4

;;

3) setprop net.eth0.dns2 10.0.2.4

setprop net.eth0.dns3 10.0.2.5

;;

4) setprop net.eth0.dns2 10.0.2.4

setprop net.eth0.dns3 10.0.2.5

setprop net.eth0.dns4 10.0.2.6

;;

esac

# disable boot animation for a faster boot sequence when needed

boot_anim=`getprop ro.kernel.android.bootanim`

case "$boot_anim" in

0) setprop debug.sf.nobootanimation 1

;;

esac

# call 'qemu-props' to set system properties from the emulator.

#

/system/bin/qemu-props

# this line doesn't really do anything useful. however without it the

# previous setprop doesn't seem to apply for some really odd reason

setprop ro.qemu.init.completed 1

Could this be used to skip boot altogether permanetly??
[Atrix 4G Android Development] t0dbld:
just so you know magic iso isnt going to open any of the files because they are not cd images :(
[Atrix 4G Android Development] itsonlym3:
ran strings over it:

http://pastebin.com/H6eWjYrp

also to edit, see:

http://portecle.sourceforge.net/
[Atrix 4G Android Development] dkirchik:
Thank you!!!

Line 400 to line 418. Gov't cert. That's due to the patriot act. Allowing the gov to gain access to the phone to listen to calls read texts, etc. When we do crack the boot we have to block that cert too aswell.
[Atrix 4G Android Development] t0dbld:
looks to me like it is just all the trusted certs pre loaded into the phone , like ones you can veiw from settings menu
[Atrix 4G Android Development] dkirchik:
Thank you!!!

Line 400 to line 418. Gov't cert. That's due to the patriot act. Allowing the gov to gain access to the phone to listen to calls read texts, etc. When we do crack the boot we have to block that cert too aswell.

SORRY DOUBLE POST.

And yeah it does look like it.
[Atrix 4G Android Development] t0dbld:
ya here is an easier to read version lol
[Atrix 4G Android Development] t0dbld:
[QUOTE

Could this be used to skip boot altogether permanetly??

um no, at best it would skip the moto boot images , you know the red wavering dot
[Atrix 4G Android Development] t0dbld:
ok look this thread is just getting filled with nothing useful right now so lets hold of on posting nothing.... wait till you get home well open an irc for brain storming etc because we just added 5 pages of nothing that than makes it harder to find the useful stuff we have posted
[Atrix 4G Android Development] xxtsfxx:
I was actually about to suggest that yesterday but never go online. Since there are so few of you, you guys could set up a time and date and get on skype/irc or whatever means of IM. This would speed up your communications and at the same time keeps the forums clean. Anything you guys find/dev just post back on there. Inv me! lol
[Atrix 4G Android Development] theSpam:
Before any rumours get started, a quick Google search revealed that the Government Root Certification Authority certificate is the basis of Taiwan's government-based public key infrastructure.

I may be wrong, but please conduct a search and tell me what you think.

Edit: Also have a look at Firefox's pre-installed certificates...
[Atrix 4G Android Development] DroidDont:
Oh, man. Top Men on this, that's for sure.

Thanks for the lulz.
[Atrix 4G Android Development] t0dbld:
look at this

http://tldp.org/LDP/LG/issue70/ghosh.html
[Atrix 4G Android Development] zambezy:
Hey a lot of this information lines up with the txt portion of the eng bootloader...

Look at it with hex editor and you can fill in the variables... =).

If we can get one from engineering phone it would be nice...

I wonder what the xoom log would look like..

Also compare Atrix Eng and Atrix ship boot.img's quite different. There is a lot that is missing in the ship bootloader...you can see some patterns emerging but regardless it doesn't help us with access to the bootloader.

Its also scary that its encrypted and backed up. I just dont understand why go through all this trouble. What are they protecting. CIA secrets are not as hard to crack... I bet the enigma machine from WW2 is a joke compared to this...
[Atrix 4G Android Development] t0dbld:
Dude im sorry been trying to get back in for thirty minutes freenide is locking me out

Sent from my GT-P1000
[Atrix 4G Android Development] zambezy:
Its cool check your PM something interesting.. read the link that is in there right at the bottom of the page...

http://www.chromium.org/chromium-os/how-tos-and-troubleshooting/debugging-tips/host-file-access

Now look at the log you posted... you may notice a command that looks interesting...
[Atrix 4G Android Development] tl_bull:
Is the TA number your phone specific number? How did you get that boot log? * just curious to see if same logs from different phones have certain anomolies that may show you smart code readers something.
[Atrix 4G Android Development] brandon15811:
Whats the irc channel? I wanna listen in and maybe contribute
[Atrix 4G Android Development] zambezy:
#1 log

/var/log/dmesg |more

#2 irc

#XDA-Atrix
[Atrix 4G Android Development] tl_bull:
thanks,

mine is indeed different, I am certain you all have looked at this already.
[Atrix 4G Android Development] shawnbuck:
There is a better way of doing this. Hook up the phone to the computer, and do this:

adb shell "cat /var/log/dmesg > /sdcard/dmesg"
adb pull /sdcard/dmesg

Here is the result:

http://pastebin.com/wuPA2zDg
[Atrix 4G Android Development] omnikai:
For what little its worth, I have a webhosting account with a private server & unlimited bandwidth - if it would be at all helpful to this project, either for file-hosting or setting up a dedicated chat channel - please let me know. I'll help however I can.

Much thanks to everyone working hard on this, your efforts are greatly appreciated!
[Atrix 4G Android Development] xXxSamxXx:
Just so everyone knows someone just posted a flash able SBF file on the development forum for thre atrix hope it helps

Sent from my Rooted Atrix 4G
[Atrix 4G Android Development] omnikai:
Painfully slow 60kb/s download, but I'll host it myself once I've got it, thankfully I've got a 100mbit upload pipe here. ETA ~3hrs.
[Atrix 4G Android Development] omnikai:
I've mirrored this file at:

http://sulli.ca/public/atrix/OLYFR_U4_1.5.2_SIGNED.rar

LancerV also hosted this (before me, admittedly) in this post:

http://xdaforums.com/showpost.php?p=12026087&postcount=41
[Atrix 4G Android Development] Djazin:
Edit: opps wrong tab
[Atrix 4G Android Development] oFUNGUSo:
I can't stand the suspense! Is any progress being made?
[Atrix 4G Android Development] ram130:
Short story.... doesn't look so..
[Atrix 4G Android Development] t0dbld:
please do not post in this forum if you are not helping and dont know anything... this is not a place for you to make up speculation and post here giving false hope and or crushing it, if you have no experience and are not helping by posting researched ideas i repeat do not post here there are plenty of other places to air your grievances or general feelings...

That being said if anyone here has experience with electronic fabrication (working with boards and resistance) please message me, i am looking to modify a usb cable but resistance or what exactly is needed is unknown i will provide more details to those that respond
[Atrix 4G Android Development] ijwhelan:
It's common for smartphone docks and such to use different current and resistance in order to notify the phone that it's in a dock. Do you think there's some sort of dev mode activated via a certain USB config?
[Atrix 4G Android Development] dkirchik:
When I had my iphone 4 I had done a USB mod, on usb mod the + -, + -, the second set carried the voltage had a resistor on it allerting the phone at what rate to charge. Changing that resistor to lower value increased the voltage from 1.5v to 1.8v, making it charge in 2/3rds the time. great for car charger and or the battery charger. I dount think moto would put into the each accessory dock a diff voltage factor to alert the phone, according to moto its software stored in the dock, as far as ive been able to find no one has decided to tear one apart. ifixit should get on that.
[Atrix 4G Android Development] shadowscreation:
any new progress
[Atrix 4G Android Development] TheKenAnthony:
Dont know if this is the right place to post this so be easy mods.. but to any DEVS i have a Motorola Atrix Test device.. it was one that was put out into public to test that remained unbranded and undercover.. im not sure if the bootloader is locked on this device and would like to see if a dev can walk me through anything i need to do that can help.. i do know that i have my AT&T sim card in it right now and ran the speed test app and got 1.7mbps upload speed so its not suffering from the speed and data cap att has put on the other atrix phones... any dev interested PM me and let me know what we can do ... thanks!!!
[Atrix 4G Android Development] rozzco:
That sounds promising. ;)
[Atrix 4G Android Development] andrew53517:
I think he might be running a new firmware or have an unreleased update. Post your setting stats: system version, kernel, etc. Might have a newer one. That's all I THINK it is...correct me if im wrong please.

Atrix4G Rooted!
[Atrix 4G Android Development] TheKenAnthony:
Think its a older version...

Basband Version - N_01.79.00R

Motorola Webtop Version - OSHWT_U1_4.278.0

Kernel Version - 2.6.32.9-00011-g48efa9d

hudsoncm@il93Inxdroid68 #1

SMP PREEMPT Sun Jan 30 2011

Build Number - olympus-userdebug 2.2.1 OLYEM_U4_0.32.0

1296426430 test-keys
[Atrix 4G Android Development] holtenc:
interesting when compared to stock retail atrix. not that I know what any of the differences mean in terms of the bootloader, but interesting none the less. seems the webtop version is higher than retail, as well as the baseband.
[Atrix 4G Android Development] TheKenAnthony:
yeah i have a stock one with att and the screen on the unlocked test one is a lot nicer too!!! that whites are white and not that yellowish tint.. and its a lot brighter when set on full brightness and some of the sensors are diff and the cameras flash looks diff on it also..
[Atrix 4G Android Development] airbillion:
Can you post any pictures of the differences?
[Atrix 4G Android Development] TheKenAnthony:
a little hesitant to post pics.. dont wanna get anyone in any trouble..
[Atrix 4G Android Development] ikenley:
Completely understandable dude.

You should PM DesignGears, Da_G & t0dbld

There the guys that will know what to do with it.
[Atrix 4G Android Development] t0dbld:
i did see this sorry guys i have been away this week, its St. Patricks Day and i own Party store on a college campus, didnt leave me much time this week
[Atrix 4G Android Development] Da_G:
Just a heads up that i've been in contact with TheKenAnthony and the ball is rolling. :)

The bootloader is definitely unlocked on that device, i've verified that much so far, all partitions are unsigned, and there is no read-protection on the bootloader and other sensitive partitions (several of them including the bootloader on the production device are read-protected, and thus likely write-protected also). The hard part will be getting it onto ours :)
[Atrix 4G Android Development] andrew53517:
Ahhhhh :-) :-) :-) :-)

Atrix4G Rooted!
[Atrix 4G Android Development] Smallsmx3:
This is pretty good news yeah?
[Atrix 4G Android Development] lsxrx7:
i have a big smile on my face hearing this

in fact i almost LOL'd at work
[Atrix 4G Android Development] sdlopez83:
Mine Irish eyes are seeing the light. Sweet!

Donated some greenback, to the da gangsta hackery fund
[Atrix 4G Android Development] zambezy:
That is what I expected.

The question is how do we flash those partitions. I know I can flash hex modified system partitions but it fails on reboot.

The recovery partition was inconclusive. Have not tried boot as it may brick the device.

What is the difference between the sbf (I don't recall the partition file packaged in there) and the img files that were extracted.
[Atrix 4G Android Development] zambezy:
Also cg42 and 44 seem to be recovery. 56 and 57 I fought were boot. I don't have my notes.

There are certain hardware keys that would nor allow me to flash. But this should not be a problem with this as its the same hardware.

Mbm can you mod sbf flash to flash single partitions instead of full recovery.
[Atrix 4G Android Development] Da_G:
@zambezy

What .sbf do you refer to? There wasn't one released for this device (the sbfs that have been released are all january 30th or newer, while this device is running a November/December bootloader/system)

Regarding the codegroups, i've documented these so far

Code Group 3 / Partition Table

Code Group 5 / Radio

Code Group 55 / Partition 11 / Kernel

Code Group 56 / Partition 10 / Recovery

Code Group 57 / Partition 12 / System

Code Group 58 / Partition 13 / osh

Code Group 62 / Partition 17 / preinstall
[Atrix 4G Android Development] zambezy:
What's in group 44?

As rsd starts the flash I have replaced the files that it decompressed from the sbf. Just to check if it would flash unsigned file and it does.

You have to wait and replace them right before it starts flashing.

BTW can you post those images somewhere so we can have access to them please...
[Atrix 4G Android Development] danielel:
Sorry for the interruption, But I have a question for DA_G:

The device with the unlocked Bootloader- is it Bell's and it came like that from the box or it is AT&T's and you hacked it?

And again sorry for the interruption and Thank you :)
[Atrix 4G Android Development] t0dbld:
your answer would have been found if you read the forum you are posting in, it is also titled [DEVS ONLY] BTW, nothing was hacked , a member got an early build device one that was not for retail, so it came with out fuse enabled or any signature checks
[Atrix 4G Android Development] danielel:
Well I looked for something but I didn't found it here, Maybe cause I was looking for something with Bell's name at the topic.

Sorry for the interruption and Thank you again!
[Atrix 4G Android Development] redeyes717:
from the link above:

Sholes signing key leak explained

The Motorola(r) sholes platform uses a trusted bootloader environment. Signatures are stored as part of the CDT stored on the NAND flash. mbmloader verifies the signature on mbm before passing control. mbm verifies all other signatures before allowing the device to boot.

There is a vulnerability in the way that Motorola generated the signatures on the sections stored in the CDT. This vulnerability is very simple. Like on the PlayStation 3, Motorola forgot to add a random value to the signature in order to mask the private key. This allowed the private key and initialization vector to be cracked.

The keys can be cracked using Mathematica. Read up on how the Elgamal signature scheme works.

Ok, what does this mean?

Please refer to the following table:

Boot chain component	Status

OMAP secure bootrom	secure

Secure keystore	replaceable

mbmloader	secure, but irrelevant, replaceable but unnecessary

mbm	secure, but irrelevant, replaceable but unnecessary

recovery	replaceable (providing new keys is recommended)

system	replaceable (providing new keys is recommended)

bootimage	replaceable (providing new keys is recommended)
[Atrix 4G Android Development] andrew53517:
http://nenolod.net/~nenolod/sholes-keyleak-explained.html

Link

Atrix4G Rooted!
[Atrix 4G Android Development] Gr8Danes:
He just updated the link again. Here is the tweet:

sholes-keyleak-explained.html has been updated to explain what you can and cannot update and with what key you must sign each codegroup
[Atrix 4G Android Development] darkamikaze:
@nenolod well it is a good sign though..maybe Atrix 4G next ?? Great job!!

@ATT_FAIL not the Atrix 4G like you reported earlier. rather, sholes-family devices (Droid 1, Milestone, DX, D2, CHARM...)
[Atrix 4G Android Development] naturefreak85:
Right but there is a chance that Moto used the same key for the Atrix if it wasn't broken originally why change it?
[Atrix 4G Android Development] b14ck0ut:
The major breakthrough right now (for the Atrix at least) is not the discovery of the DX's private key, as it is highly unlikely Moto used the same key for two separate families of devices. The big deal is the method that was used to obtain the key and whether or not the Atrix has the same flaws and is susceptible to the same exploits. Keep your fingers crossed everyone. :)
[Atrix 4G Android Development] andrew53517:
Atrix too now probably!!

Check it out! Proof!!!

http://twitter.com/#!/_mrbirdman_

:D:D:D:D:D
[Atrix 4G Android Development] andrew53517:
"Its done folks. All Moto phones are basically unlocked now. Maybe even atrix."

Direct quote from his twitter. But it seems they are still testing it right now, so we'll wait and see what happens. It definitely looks good though!

EDIT: this isn't anything new in the last 30 - 40 mins... just reposting this for him.
[Atrix 4G Android Development] brian2220:
http://twitter.com/#!/clockworkmod
[Atrix 4G Android Development] jiggytom:
Yup, there..thanks Brian. ##pbf on Freenode irc for update. It's actually looking good now...ppl are discussing it but it may be a couple of days before we know anything...esp for the Atrix.
[Atrix 4G Android Development] brian2220:
well it looks like it might be all over now here are some links :(

http://twitter.com/#!/_mrbirdman_

http://twitter.com/#!/FreeMyMoto

http://nenolod.net/~nenolod/sholes-keyleak-explained.html
[Atrix 4G Android Development] kholk:
Well, at least we know Da_G is working on this.

I trust him at the point that I've bought an Atrix.
[Atrix 4G Android Development] strauss0829:
well i just got another Atrix and hoping somewhere this will get crakced
[Atrix 4G Android Development] Mr. Clown:
Did some cleaning, back to topic please.
[Atrix 4G Android Development] andrew53517:
Anyways... now that has passed, are we still working with ken who has the unlocked bootloader Atrix from earlier? For those that don't know, this was the one that came preunlocked, nothing exciting happened here. I was just wondering if Da_G was still working with him on trying to transfer the method to our phones?

Atrix4G Rooted!
[Atrix 4G Android Development] t0dbld:
nothing happens over night guys, if youd like to help start bugging motorola to release source for atrix as we dont even have that yet
[Atrix 4G Android Development] Bakano:
Maybe you could PM me? Where would I send that email? =)

~_~
[Atrix 4G Android Development] DominicanYorkJL:
hopeless, we are already having people give up..i guess this isnt a challenge for the faint of heart