[Decompiled] Asus - UnLock_Device_App_V6

1wayjonny · Feb 22, 2012

Decompiled the APK using Brut.alll APK tool and just thought I would share for anyone wants to shift through the codes and commands.

They basically flag the system and kick into recovery to start the unlock process but have a look yourself.

Brut.alll APK Tool: http://code.google.com/p/android-apktool/

Not sure if this will be useful for the original Transformer as Asus stated that this works with ICS only, being the original transformer does not have ICS the bootloader may not be able to handle the steps should someone figure it out.

sparkym3 · Feb 22, 2012

For anyone who would prefer to look at the code as java, here is a .jar created from the .dex with .class files. This would be in place of the .smali files.

Evo_Shift · Feb 22, 2012

Is it worth waiting for something to come of this? Like could this be reverse engineered to exclude the communication to asus about your serials?

jemael972 · Feb 22, 2012

What is different with this app and the asus app ???

skaforey · Feb 22, 2012

Nothing is different, it's just the apk reverse engineered so it is "viewable" (read modifiable) by our devs. Hopefully the devs can come up with something to unlock the bootloader and prevent your warranty from being voided (or come up with a way to relock the bootloader should warranty issues come up).

Hawkysoft · Feb 22, 2012

thanks, but no need to post this... people who needed this allready done that...

also this should not be under development.

also you misunderstood what it does... but keep reading im sure you will find out what it does exactly some day

there is a big process before it even does anything to your phone except of reading and transferring info/data

1wayjonny · Feb 22, 2012

sparkym3 said:
For anyone who would prefer to look at the code as java, here is a .jar created from the .dex with .class files. This would be in place of the .smali files.

Perfect thanks saved me an extra step, I was going to do this anyhow.

1wayjonny · Feb 22, 2012

Hawkysoft said:
also this should not be under development.

also you misunderstood what it does... but keep reading im sure you will find out what it does exactly some day

there is a big process before it even does anything to your phone except of reading and transferring info/data

Sorry about the wrong section and if anyone needs this moved please do so. I understand the process is more then just the flag but I haven't been able to read through all of the code yet (damn work) but it is good practice.

But if you have any great information to share from your end please do so, it always great to spread knowledge (even is some of the info is repeatable info more advanced users) because it help inspire other great minds.

But i understand where your coming from as well. Cheers!

**Update**
It think I see the area you are talking about now, looks like your tablet goes through a registration process with Asus before the flag is kicked on. Still looking if they hand off a code but they probably flag your device in their system as unlocked for warranty reasons as well.

jermaine151 · Feb 22, 2012

The magic happens in: UnLockFlagAndReboot.smali

Code:

.class public Lcom/asus/unlock/UnLockFlagAndReboot;
.super Ljava/lang/Object;
.source "UnLockFlagAndReboot.java"


# static fields
.field private static final MISC_PATH:Ljava/lang/String; = "/dev/block/mmcblk0p3"

.field private static final TAG:Ljava/lang/String; = "UnLockFlagAndReboot"

.field private static final USB_PATH:Ljava/lang/String; = "/dev/block/mmcblk0p4"


# instance fields
.field private mBufferReaderSize:I

.field private mContentStr:Ljava/lang/String;

.field private mContext:Landroid/content/Context;


# direct methods
.method public constructor <init>(Landroid/content/Context;)V
    .locals 1
    .parameter "context"

    .prologue
    .line 25
    invoke-direct {p0}, Ljava/lang/Object;-><init>()V

    .line 20
    const/16 v0, 0x1f4

    iput v0, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mBufferReaderSize:I

    .line 21
    const-string v0, ""

    iput-object v0, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContentStr:Ljava/lang/String;

    .line 26
    iput-object p1, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContext:Landroid/content/Context;

    .line 27
    return-void
.end method

.method public static fromHexString(Ljava/lang/String;)[B
    .locals 2
    .parameter "in"

    .prologue
    .line 81
    new-instance v0, Ljava/math/BigInteger;

    const/16 v1, 0x10

    invoke-direct {v0, p0, v1}, Ljava/math/BigInteger;-><init>(Ljava/lang/String;I)V

    .line 82
    .local v0, temp:Ljava/math/BigInteger;
    invoke-virtual {v0}, Ljava/math/BigInteger;->toByteArray()[B

    move-result-object v1

    return-object v1
.end method

.method private writeRecoveryCmd(Ljava/lang/String;)V
    .locals 10
    .parameter "encodeCpuId"
    .annotation system Ldalvik/annotation/Throws;
        value = {
            Ljava/io/IOException;
        }
    .end annotation

    .prologue
    .line 43
    const/16 v8, 0x440

    new-array v0, v8, [B

    .line 44
    .local v0, bary:[B
    invoke-static {p1}, Lcom/asus/unlock/UnLockFlagAndReboot;->fromHexString(Ljava/lang/String;)[B

    move-result-object v1

    .line 46
    .local v1, bary2:[B
    const/16 v8, 0xb

    new-array v2, v8, [B

    fill-array-data v2, :array_0

    .line 47
    .local v2, cmd1:[B
    const/16 v8, 0x9

    new-array v3, v8, [B

    fill-array-data v3, :array_1

    .line 49
    .local v3, cmd2:[B
    const/4 v7, 0x0

    .local v7, idx:I
    :goto_0
    array-length v8, v2

    if-ge v7, v8, :cond_0

    .line 50
    const/4 v8, 0x0

    aput-byte v8, v0, v7

    .line 49
    add-int/lit8 v7, v7, 0x1

    goto :goto_0

    .line 52
    :cond_0
    const/4 v7, 0x0

    :goto_1
    array-length v8, v2

    if-ge v7, v8, :cond_1

    .line 53
    add-int/lit8 v8, v7, 0x0

    aget-byte v9, v2, v7

    aput-byte v9, v0, v8

    .line 52
    add-int/lit8 v7, v7, 0x1

    goto :goto_1

    .line 55
    :cond_1
    const/4 v7, 0x0

    :goto_2
    array-length v8, v3

    if-ge v7, v8, :cond_2

    .line 56
    add-int/lit8 v8, v7, 0x40

    aget-byte v9, v3, v7

    aput-byte v9, v0, v8

    .line 55
    add-int/lit8 v7, v7, 0x1

    goto :goto_2

    .line 59
    :cond_2
    const/4 v5, 0x0

    .line 61
    .local v5, fos:Ljava/io/FileOutputStream;
    :try_start_0
    new-instance v6, Ljava/io/FileOutputStream;

    const-string v8, "/dev/block/mmcblk0p3"

    invoke-direct {v6, v8}, Ljava/io/FileOutputStream;-><init>(Ljava/lang/String;)V
    :try_end_0
    .catchall {:try_start_0 .. :try_end_0} :catchall_0
    .catch Ljava/io/FileNotFoundException; {:try_start_0 .. :try_end_0} :catch_0
    .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_1

    .line 62
    .end local v5           #fos:Ljava/io/FileOutputStream;
    .local v6, fos:Ljava/io/FileOutputStream;
    :try_start_1
    invoke-virtual {v6, v0}, Ljava/io/FileOutputStream;->write([B)V

    .line 66
    new-instance v5, Ljava/io/FileOutputStream;

    const-string v8, "/dev/block/mmcblk0p4"

    invoke-direct {v5, v8}, Ljava/io/FileOutputStream;-><init>(Ljava/lang/String;)V
    :try_end_1
    .catchall {:try_start_1 .. :try_end_1} :catchall_1
    .catch Ljava/io/FileNotFoundException; {:try_start_1 .. :try_end_1} :catch_3
    .catch Ljava/io/IOException; {:try_start_1 .. :try_end_1} :catch_2

    .line 67
    .end local v6           #fos:Ljava/io/FileOutputStream;
    .restart local v5       #fos:Ljava/io/FileOutputStream;
    :try_start_2
    invoke-virtual {v5, v1}, Ljava/io/FileOutputStream;->write([B)V

    .line 68
    const-string v8, "UnLockFlagAndReboot"

    const-string v9, "============= writeRecoveryCmd  success ======================="

    invoke-static {v8, v9}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I
    :try_end_2
    .catchall {:try_start_2 .. :try_end_2} :catchall_0
    .catch Ljava/io/FileNotFoundException; {:try_start_2 .. :try_end_2} :catch_0
    .catch Ljava/io/IOException; {:try_start_2 .. :try_end_2} :catch_1

    .line 74
    if-eqz v5, :cond_3

    .line 75
    invoke-virtual {v5}, Ljava/io/FileOutputStream;->close()V

    .line 78
    :cond_3
    :goto_3
    return-void

    .line 69
    :catch_0
    move-exception v4

    .line 70
    .local v4, e:Ljava/io/FileNotFoundException;
    :goto_4
    :try_start_3
    invoke-virtual {v4}, Ljava/io/FileNotFoundException;->printStackTrace()V
    :try_end_3
    .catchall {:try_start_3 .. :try_end_3} :catchall_0

    .line 74
    if-eqz v5, :cond_3

    .line 75
    invoke-virtual {v5}, Ljava/io/FileOutputStream;->close()V

    goto :goto_3

    .line 71
    .end local v4           #e:Ljava/io/FileNotFoundException;
    :catch_1
    move-exception v4

    .line 72
    .local v4, e:Ljava/io/IOException;
    :goto_5
    :try_start_4
    invoke-virtual {v4}, Ljava/io/IOException;->printStackTrace()V
    :try_end_4
    .catchall {:try_start_4 .. :try_end_4} :catchall_0

    .line 74
    if-eqz v5, :cond_3

    .line 75
    invoke-virtual {v5}, Ljava/io/FileOutputStream;->close()V

    goto :goto_3

    .line 74
    .end local v4           #e:Ljava/io/IOException;
    :catchall_0
    move-exception v8

    :goto_6
    if-eqz v5, :cond_4

    .line 75
    invoke-virtual {v5}, Ljava/io/FileOutputStream;->close()V

    :cond_4
    throw v8

    .line 74
    .end local v5           #fos:Ljava/io/FileOutputStream;
    .restart local v6       #fos:Ljava/io/FileOutputStream;
    :catchall_1
    move-exception v8

    move-object v5, v6

    .end local v6           #fos:Ljava/io/FileOutputStream;
    .restart local v5       #fos:Ljava/io/FileOutputStream;
    goto :goto_6

    .line 71
    .end local v5           #fos:Ljava/io/FileOutputStream;
    .restart local v6       #fos:Ljava/io/FileOutputStream;
    :catch_2
    move-exception v4

    move-object v5, v6

    .end local v6           #fos:Ljava/io/FileOutputStream;
    .restart local v5       #fos:Ljava/io/FileOutputStream;
    goto :goto_5

    .line 69
    .end local v5           #fos:Ljava/io/FileOutputStream;
    .restart local v6       #fos:Ljava/io/FileOutputStream;
    :catch_3
    move-exception v4

    move-object v5, v6

    .end local v6           #fos:Ljava/io/FileOutputStream;
    .restart local v5       #fos:Ljava/io/FileOutputStream;
    goto :goto_4

    .line 46
    :array_0
    .array-data 0x1
        0x62t
        0x6ft
        0x6ft
        0x74t
        0x2dt
        0x75t
        0x6et
        0x6ct
        0x6ft
        0x63t
        0x6bt
    .end array-data

    .line 47
    :array_1
    .array-data 0x1
        0x72t
        0x65t
        0x63t
        0x6ft
        0x76t
        0x65t
        0x72t
        0x79t
        0xat
    .end array-data
.end method


# virtual methods
.method public readFileContent()V
    .locals 8

    .prologue
    .line 86
    const/4 v1, 0x0

    .line 88
    .local v1, fr:Ljava/io/FileReader;
    :try_start_0
    new-instance v2, Ljava/io/FileReader;

    const-string v5, "/dev/block/mmcblk0p3"

    invoke-direct {v2, v5}, Ljava/io/FileReader;-><init>(Ljava/lang/String;)V
    :try_end_0
    .catchall {:try_start_0 .. :try_end_0} :catchall_0
    .catch Ljava/io/FileNotFoundException; {:try_start_0 .. :try_end_0} :catch_7
    .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_3

    .line 89
    .end local v1           #fr:Ljava/io/FileReader;
    .local v2, fr:Ljava/io/FileReader;
    :try_start_1
    new-instance v3, Ljava/io/BufferedReader;

    iget v5, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mBufferReaderSize:I

    invoke-direct {v3, v2, v5}, Ljava/io/BufferedReader;-><init>(Ljava/io/Reader;I)V

    .line 90
    .local v3, in:Ljava/io/BufferedReader;
    const-string v4, ""

    .line 91
    .local v4, line:Ljava/lang/String;
    :goto_0
    invoke-virtual {v3}, Ljava/io/BufferedReader;->readLine()Ljava/lang/String;

    move-result-object v4

    if-eqz v4, :cond_1

    .line 92
    new-instance v5, Ljava/lang/StringBuilder;

    invoke-direct {v5}, Ljava/lang/StringBuilder;-><init>()V

    iget-object v6, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContentStr:Ljava/lang/String;

    invoke-virtual {v5, v6}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v5

    invoke-virtual {v5, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v5

    invoke-virtual {v5}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v5

    iput-object v5, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContentStr:Ljava/lang/String;
    :try_end_1
    .catchall {:try_start_1 .. :try_end_1} :catchall_1
    .catch Ljava/io/FileNotFoundException; {:try_start_1 .. :try_end_1} :catch_0
    .catch Ljava/io/IOException; {:try_start_1 .. :try_end_1} :catch_6

    goto :goto_0

    .line 95
    .end local v3           #in:Ljava/io/BufferedReader;
    .end local v4           #line:Ljava/lang/String;
    :catch_0
    move-exception v0

    move-object v1, v2

    .line 96
    .end local v2           #fr:Ljava/io/FileReader;
    .local v0, e:Ljava/io/FileNotFoundException;
    .restart local v1       #fr:Ljava/io/FileReader;
    :goto_1
    :try_start_2
    invoke-virtual {v0}, Ljava/io/FileNotFoundException;->printStackTrace()V
    :try_end_2
    .catchall {:try_start_2 .. :try_end_2} :catchall_0

    .line 101
    if-eqz v1, :cond_0

    .line 103
    :try_start_3
    invoke-virtual {v1}, Ljava/io/FileReader;->close()V
    :try_end_3
    .catch Ljava/io/IOException; {:try_start_3 .. :try_end_3} :catch_2

    .line 110
    .end local v0           #e:Ljava/io/FileNotFoundException;
    :cond_0
    :goto_2
    return-void

    .line 94
    .end local v1           #fr:Ljava/io/FileReader;
    .restart local v2       #fr:Ljava/io/FileReader;
    .restart local v3       #in:Ljava/io/BufferedReader;
    .restart local v4       #line:Ljava/lang/String;
    :cond_1
    :try_start_4
    const-string v5, "UnLockFlagAndReboot"

    new-instance v6, Ljava/lang/StringBuilder;

    invoke-direct {v6}, Ljava/lang/StringBuilder;-><init>()V

    const-string v7, "content of Unlock Flag: "

    invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v6

    iget-object v7, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContentStr:Ljava/lang/String;

    invoke-virtual {v6, v7}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v6

    invoke-virtual {v6}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v6

    invoke-static {v5, v6}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
    :try_end_4
    .catchall {:try_start_4 .. :try_end_4} :catchall_1
    .catch Ljava/io/FileNotFoundException; {:try_start_4 .. :try_end_4} :catch_0
    .catch Ljava/io/IOException; {:try_start_4 .. :try_end_4} :catch_6

    .line 101
    if-eqz v2, :cond_3

    .line 103
    :try_start_5
    invoke-virtual {v2}, Ljava/io/FileReader;->close()V
    :try_end_5
    .catch Ljava/io/IOException; {:try_start_5 .. :try_end_5} :catch_1

    move-object v1, v2

    .line 107
    .end local v2           #fr:Ljava/io/FileReader;
    .restart local v1       #fr:Ljava/io/FileReader;
    goto :goto_2

    .line 104
    .end local v1           #fr:Ljava/io/FileReader;
    .restart local v2       #fr:Ljava/io/FileReader;
    :catch_1
    move-exception v0

    .line 106
    .local v0, e:Ljava/io/IOException;
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V

    move-object v1, v2

    .line 107
    .end local v2           #fr:Ljava/io/FileReader;
    .restart local v1       #fr:Ljava/io/FileReader;
    goto :goto_2

    .line 104
    .end local v3           #in:Ljava/io/BufferedReader;
    .end local v4           #line:Ljava/lang/String;
    .local v0, e:Ljava/io/FileNotFoundException;
    :catch_2
    move-exception v0

    .line 106
    .local v0, e:Ljava/io/IOException;
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_2

    .line 97
    .end local v0           #e:Ljava/io/IOException;
    :catch_3
    move-exception v0

    .line 99
    .restart local v0       #e:Ljava/io/IOException;
    :goto_3
    :try_start_6
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V
    :try_end_6
    .catchall {:try_start_6 .. :try_end_6} :catchall_0

    .line 101
    if-eqz v1, :cond_0

    .line 103
    :try_start_7
    invoke-virtual {v1}, Ljava/io/FileReader;->close()V
    :try_end_7
    .catch Ljava/io/IOException; {:try_start_7 .. :try_end_7} :catch_4

    goto :goto_2

    .line 104
    :catch_4
    move-exception v0

    .line 106
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_2

    .line 101
    .end local v0           #e:Ljava/io/IOException;
    :catchall_0
    move-exception v5

    :goto_4
    if-eqz v1, :cond_2

    .line 103
    :try_start_8
    invoke-virtual {v1}, Ljava/io/FileReader;->close()V
    :try_end_8
    .catch Ljava/io/IOException; {:try_start_8 .. :try_end_8} :catch_5

    .line 107
    :cond_2
    :goto_5
    throw v5

    .line 104
    :catch_5
    move-exception v0

    .line 106
    .restart local v0       #e:Ljava/io/IOException;
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_5

    .line 101
    .end local v0           #e:Ljava/io/IOException;
    .end local v1           #fr:Ljava/io/FileReader;
    .restart local v2       #fr:Ljava/io/FileReader;
    :catchall_1
    move-exception v5

    move-object v1, v2

    .end local v2           #fr:Ljava/io/FileReader;
    .restart local v1       #fr:Ljava/io/FileReader;
    goto :goto_4

    .line 97
    .end local v1           #fr:Ljava/io/FileReader;
    .restart local v2       #fr:Ljava/io/FileReader;
    :catch_6
    move-exception v0

    move-object v1, v2

    .end local v2           #fr:Ljava/io/FileReader;
    .restart local v1       #fr:Ljava/io/FileReader;
    goto :goto_3

    .line 95
    :catch_7
    move-exception v0

    goto :goto_1

    .end local v1           #fr:Ljava/io/FileReader;
    .restart local v2       #fr:Ljava/io/FileReader;
    .restart local v3       #in:Ljava/io/BufferedReader;
    .restart local v4       #line:Ljava/lang/String;
    :cond_3
    move-object v1, v2

    .end local v2           #fr:Ljava/io/FileReader;
    .restart local v1       #fr:Ljava/io/FileReader;
    goto :goto_2
.end method

.method public reboot()V
    .locals 3

    .prologue
    .line 38
    iget-object v1, p0, Lcom/asus/unlock/UnLockFlagAndReboot;->mContext:Landroid/content/Context;

    const-string v2, "power"

    invoke-virtual {v1, v2}, Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Landroid/os/PowerManager;

    .line 39
    .local v0, pm:Landroid/os/PowerManager;
    const/4 v1, 0x0

    invoke-virtual {v0, v1}, Landroid/os/PowerManager;->reboot(Ljava/lang/String;)V

    .line 40
    return-void
.end method

.method public writeUnlockFlag(Ljava/lang/String;)V
    .locals 1
    .parameter "encodeCpuId"

    .prologue
    .line 31
    :try_start_0
    invoke-direct {p0, p1}, Lcom/asus/unlock/UnLockFlagAndReboot;->writeRecoveryCmd(Ljava/lang/String;)V
    :try_end_0
    .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_0

    .line 35
    :goto_0
    return-void

    .line 32
    :catch_0
    move-exception v0

    .line 33
    .local v0, e:Ljava/io/IOException;
    invoke-virtual {v0}, Ljava/io/IOException;->printStackTrace()V

    goto :goto_0
.end method

Noxious Ninja · Feb 22, 2012

I think the real magic comes in where the argument to writeUnlockFlag is obtained. That class looks pretty simple.

Lock-N-Load · Feb 22, 2012

your both wrong.. the real magic will come when someone can make a method or version that does not talk to Asus and giveaway who you are and that you unlocked

Predseda3D · Feb 22, 2012

^^^ Yes, but let me expand a bit on unlock or lock.

Noxious Ninja · Feb 22, 2012

NotifyDMServer seems to be the important part. I think it's getting an unlock key (secretCpuId) back from Asus, so it may not be possible to hack out the phoning home. I haven't looked too closely at that class, though. We need to see if this is actually from Asus, derived from data sent back from Asus, same for all users, etc.

Does the app support relocking? I haven't actually tried it.

1wayjonny · Feb 22, 2012

Lock-N-Load said:
your both wrong.. the real magic will come when someone can make a method or version that does not talk to Asus and giveaway who you are and that you unlocked

Yea after I got a few minutes from work, I thought about what Hawkysoft said earlier and its clear as day this phones home to get the unlock code and I am sure your blacklisted from warranty support at the same time.

Predseda3D said:
^^^ Yes, but let me expand a bit on unlock or lock.

Are you saying this phones home details where locked or unlocked? If so do you know what it shares?

Noxious Ninja said:
NotifyDMServer seems to be the important part. I think it's getting an unlock key (secretCpuId) back from Asus, so it may not be possible to hack out the phoning home. I haven't looked too closely at that class, though. We need to see if this is actually from Asus, derived from data sent back from Asus, same for all users, etc.

Does the app support relocking? I haven't actually tried it.

Have not seen anything yet about the re-locking but agreed on the the lock key

skaforey · Feb 23, 2012

Noxious Ninja said:
NotifyDMServer seems to be the important part. I think it's getting an unlock key (secretCpuId) back from Asus, so it may not be possible to hack out the phoning home. I haven't looked too closely at that class, though. We need to see if this is actually from Asus, derived from data sent back from Asus, same for all users, etc.

Does the app support relocking? I haven't actually tried it.

I must be missing something here, so someone correct me where I went wrong...

First off, I do see it phoning home, however, I don't see us ever using anything that is returned from that call to write the recovery partition.

1) The recovery image is written in writeRecoveryCmd (in UnLockFlagAndReboot). This procedure takes in one argument.

2) The writeRecoveryCmd is called from writeUnlockFlag (same class) which just passes in what it receives.

3) This writeUnlockFlag procedure is called from the writeUnlockFlag in the UnLockActivity which passes in this.mNotifyDMServer.getSecretCpuID()

4) the getSecretCpuID() method inside NotifyDMServer returns the local class variable mSecretCpuId.

5) I only ever see mSecretCpuId being initialized to 0.

Now someone find where this is being set to something other than 0. If it doesn't, and my logic is correct, we would all be able to simply use a program that passes in 0 to the writeRecoveryCmd procedure inside UnLockFlagAndReboot.

xsteven77x · Feb 23, 2012

skaforey said:
I must be missing something here, so someone correct me where I went wrong...

First off, I do see it phoning home, however, I don't see us ever using anything that is returned from that call to write the recovery partition.

1) The recovery image is written in writeRecoveryCmd (in UnLockFlagAndReboot). This procedure takes in one argument.

2) The writeRecoveryCmd is called from writeUnlockFlag (same class) which just passes in what it receives.

3) This writeUnlockFlag procedure is called from the writeUnlockFlag in the UnLockActivity which passes in this.mNotifyDMServer.getSecretCpuID()

4) the getSecretCpuID() method inside NotifyDMServer returns the local class variable mSecretCpuId.

5) I only ever see mSecretCpuId being initialized to 0.

Now someone find where this is being set to something other than 0. If it doesn't, and my logic is correct, we would all be able to simply use a program that passes in 0 to the writeRecoveryCmd procedure inside UnLockFlagAndReboot.

Ok for the layman does that man their is hope of POSSIBLY making a tool that would not phone home and void us?

Sent from my Transformer Prime TF201 using xda premium

Noxious Ninja · Feb 23, 2012

skaforey said:
I must be missing something here, so someone correct me where I went wrong...

First off, I do see it phoning home, however, I don't see us ever using anything that is returned from that call to write the recovery partition.

1) The recovery image is written in writeRecoveryCmd (in UnLockFlagAndReboot). This procedure takes in one argument.

2) The writeRecoveryCmd is called from writeUnlockFlag (same class) which just passes in what it receives.

3) This writeUnlockFlag procedure is called from the writeUnlockFlag in the UnLockActivity which passes in this.mNotifyDMServer.getSecretCpuID()

4) the getSecretCpuID() method inside NotifyDMServer returns the local class variable mSecretCpuId.

5) I only ever see mSecretCpuId being initialized to 0.

Now someone find where this is being set to something other than 0. If it doesn't, and my logic is correct, we would all be able to simply use a program that passes in 0 to the writeRecoveryCmd procedure inside UnLockFlagAndReboot.

Look at NotifyDMServer$CredCpuIdReceiver.smali. onReceive seems to be a callback invoked via a C2DM message. I.e., the app phones home, then waits for a push notification with the unlock key.

Of course I would prefer to be proven wrong.

xsteven77x · Feb 23, 2012

Noxious Ninja said:
Look at NotifyDMServer$CredCpuIdReceiver.smali. onReceive seems to be a callback invoked via a C2DM message. I.e., the app phones home, then waits for a push notification with the unlock key.

Of course I would prefer to be proven wrong.

Dam.

Sent from my Transformer Prime TF201 using xda premium

skaforey · Feb 23, 2012

Noxious Ninja said:
Look at NotifyDMServer$CredCpuIdReceiver.smali. onReceive seems to be a callback invoked via a C2DM message. I.e., the app phones home, then waits for a push notification with the unlock key.

Of course I would prefer to be proven wrong.

Right, I see that...but...starting from the write recovery process and working backwards, it doesn't appear that the variable gets set anywhere. It wouldn't be that difficult to at least modify the app to log additional info add it is ruining to verify if it is using a call back key or not

Sent from my Galaxy Nexus

Mistar Muffin · Feb 23, 2012

Noxious Ninja said:
Look at NotifyDMServer$CredCpuIdReceiver.smali. onReceive seems to be a callback invoked via a C2DM message. I.e., the app phones home, then waits for a push notification with the unlock key.

Of course I would prefer to be proven wrong.

This is the same conclusion I came to when I took a look. I followed the same trace mentioned by the previous poster but also ended up with the C2DM message. It looks like ASUS is computing the secret cpu ID on their end.

[Decompiled] Asus - UnLock_Device_App_V6

Senior Member

Attachments

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts