guide: how to have unlocked fastboot without flashing

Search This thread

cwill0303

Senior Member
Nov 12, 2010
70
3
IL
Yeah, really. Tell me about it. Just like this guy (the2dcour). He hasn’t been seen since last December in this thread. http://xdaforums.com/showthread.php?t=1216143. They come in open a thread, put some couple of posts saying (oh, I fixed this, I did this, I did that) then attach couple of files that don’t even work for us and then leave us hanging here. I even sent this guy (the2dcour) an email asking him to help us out and his work will be rewarded, but no answer.

To be fair, the2dcour did in fact unlock 2.3.4. He may have tried 2.3.5 but we need a leak from Motorola for the same to be done for this version. Be nice since pretty much all of these people are doing this in their spare time and for free. The 2.3.5 unlock will come in time, hopefully.
 

herach

Senior Member
May 18, 2005
145
7
California
To be fair, the2dcour did in fact unlock 2.3.4. He may have tried 2.3.5 but we need a leak from Motorola for the same to be done for this version. Be nice since pretty much all of these people are doing this in their spare time and for free. The 2.3.5 unlock will come in time, hopefully.

Yes. I understand that. I'm not trying to be mean or anything but at least say something. Tell us what is going on or just say (you know what I've moved on to a different project, I don't do this any more) don’t just abandon the thread. Then, we'll think of something else not just leave us hanging here and waiting. I don't even think a newer version will help. I've had some Sprint engineering 2.3.5 SBF and tried that and it didn't work. So I guess we are locked for good unless someone comes up with an unlock. I just wish I had the knowledge to do this. Till then we just have to sit and wait.
 

Lightsword1942

Senior Member
Apr 25, 2010
456
117
Yes. I understand that. I'm not trying to be mean or anything but at least say something. Tell us what is going on or just say (you know what I've moved on to a different project, I don't do this any more) don’t just abandon the thread. Then, we'll think of something else not just leave us hanging here and waiting. I don't even think a newer version will help. I've had some Sprint engineering 2.3.5 SBF and tried that and it didn't work. So I guess we are locked for good unless someone comes up with an unlock. I just wish I had the knowledge to do this. Till then we just have to sit and wait.

ENG SBFs do not work on retail photons. We need an unlocked retail SBF.
 

herach

Senior Member
May 18, 2005
145
7
California
ENG SBFs do not work on retail photons. We need an unlocked retail SBF.

The way that I see it, it looks like there is no Unlocked retail SBF. I'll see if I can go to Sprint store tonight and see if they can fix it or exchange it either warranty or Insurance. Either way, I need to get this fixed. I'm paying $100.00 a month and I can't even use it. I know it was my mistake but I need to fix it.
 

skuddy

Senior Member
Nov 11, 2009
143
26
From the 2.3.5 rom can you run this over an adb shell and post the output?
"cat /sys/firmware/fuse/ReservedOdm"
I have been compiling the output from phones in various states in order to determine what each value means in relation to what you can flash.
so far i have this
Code:
10000000000030001000100004000-photon tried to flash photon 2.3.5 eng? currently unlocked but can't flash normal SBF
10000000000010001000100004000-standard unlocked photon
10000000000010001000100000000-standard locked photon
10000000000010001000100004000-standard unlocked electrify
30000000000030003000100004000-electrify stuck on 2.3.5 no additional info
1000000000003000100004000-electrify stuck on 2.3.5 unlocked bootloader previously installed

I havent seen my code posted yet. here you go

# cat /sys/firmware/fuse/ReservedOdm
cat /sys/firmware/fuse/ReservedOdm
20000000000020003000100000000
#
tried flashing boot unable to boot 2. about to flash 2.3.5 sbf to revive my phone

will post ReservedOdm after i flash that


it let me RSD 2.3.5 sbf file.

after flashing got this

# cat /sys/firmware/fuse/ReservedOdm
cat /sys/firmware/fuse/ReservedOdm
20000000000030003000100000000
#
 
Last edited:

herach

Senior Member
May 18, 2005
145
7
California
Hey guys. I went to the Sprint store. They wouldn't exchange it. So, I came back home and flashed a CG9.smg and corrupted the boot loader. Now, it is stuck on Boot logo. I called the CS and I told them that it is stuck on the boot loader, so they went through some trouble shooting and it didn't work and they said they will ship me another device. I am waiting for it. I will receive it in the next couple of days. hopefully they won't find out what I did. We'll see. By the way, I am in Vegas and all drunk so wish me luck guys. Hopefully I will go home with crap load of money. Riiiigggghhhhtttt.
 
Last edited:
  • Like
Reactions: phince1

munit85

Member
Aug 1, 2010
15
0
# cat /sys/firmware/fuse/ReservedOdm
cat /sys/firmware/fuse/ReservedOdm
30000000000030003000100000000
#

Hope it helps.


Photon flashed 2.3.5 electrify pudding from other thread. Never unlocked, but rooted. Any other info I'd be happy to give
 

schale01

Senior Member
Dec 20, 2010
242
41
http://xdaforums.com/showthread.php?t=1599648

this is what i want, we need to get kexec working on our phones, if we do then we can load kernels from our sdcards/internal storage etc etc

which means stock kernel to boot and load up and then cm7/9 kernel to load up afterwards ;)

Well that is quite ingenious. I still long for a true unlock, I miss all the functionality of a custom recovery. I for one never got why manufacturers don't add backup/recovery options to their own recoveries. It would be a nice feature even on a stock phone to have the option to do a nandroid backup.
 

erfannf2

Senior Member
Jan 2, 2011
111
18
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):

scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$
Correct me if I'm wrong: You SIM Unlocked Photon with this process? Is that applicable to Droid 2 Global?
 

ryan8r

Senior Member
Apr 9, 2011
556
135
http://xdaforums.com/showthread.php?t=1599648

this is what i want, we need to get kexec working on our phones, if we do then we can load kernels from our sdcards/internal storage etc etc

which means stock kernel to boot and load up and then cm7/9 kernel to load up afterwards ;)

Is kexec similar to 2nd-init ?
The Devs back in the Defy forum use 2nd-init to load custom roms on locked bootloader. Hence wondering...

Sent not from your device!
 

asiwalk213

Member
Feb 8, 2008
27
2
Is kexec similar to 2nd-init ?
The Devs back in the Defy forum use 2nd-init to load custom roms on locked bootloader. Hence wondering...

Sent not from your device!

the bases of it are the same how they actually work are gonna be a tad bit different either timing or how they are loading the new kernel and rom
 
  • Like
Reactions: ryan8r

Lightsword1942

Senior Member
Apr 25, 2010
456
117
Hey guys. I received my replacement device last week. No luck unlocking 2.3.5 bootloader yet before I sent the defective one back?

Hey Lightsword. I just found this. Have you seen this? Would this be any help to you? Sorry, I forgot to copy the link.

http://xdaforums.com/showpost.php?p=25389107&postcount=1

Checkout the second link.

It might help for getting a photon stuck on the electrify rom back to a photon rom. Probably need the SBF version of it though.

I know this is majorly talking about unlocking Bootloader but I saw UNLOCK the RADIO and it made me think he already unlocked SIM via this process. So, what it means? Enabling Capability of using other networks in US?

It does not unlock the radio. It has nothing to do with that. I think what he may have been talking about had something to do with where the bootloader unlock value is stored(in the radio?). But in any case it will not help with using the photon in the US on GSM.
 

cmbinf

Member
Sep 18, 2010
27
3
Just checking in.

Well no new results here. I did call USCC and talked with a "tech" about unlocking the bootloader and of course he wasn't any help. He told me to call Motorola; so I did. I told the lady that I wanted it unlocked in no ambagious or uncertain terms and was quite clear with what I was asking them to do. She told me, "sure we can unlock your bootloader; just send it in". So I did. Well they sent it back locked and nothing changed, seems retardation runs from the bottom up at good O'moto. Hope we get a leak soon from someone that's not Blur-blind or an exploit that's been missed/overlooked.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 18
    I recently discovered this, and I thought it would be of some benefit to those who are wanting to unlock, modify partitions, etc without the need to flash derpunlock.sbf or modify your photon in any way. What you need to do this:
    1) fastboot for Windows or Linux
    2) unlocked RDL3 (ramloader) which I am providing

    The process is very simple, reboot your Motorola Photon, and hold the volume down button and power button. You will see "fastboot" on the screen, now press volume up. Connect your phone to your computer, and issue the following command which I discovered:

    scottgl@scottgl-A105:~$ fastboot flash rdl.bin RDL3_unlocked.smg
    sending 'rdl.bin' (3072 KB)...
    OKAY [ 0.193s]
    writing 'rdl.bin'...
    OKAY [ 0.000s]
    finished. total time: 0.193s

    This will load the unlocked ramloader (unlocked will be displayed at the top even if your phone is locked) which is normally only loaded into ram when flashing an SBF! Amazing, I know. Now you can do all kinds of stuff and you've made no modifications, just issue a "fastboot reboot" and nothing has been modified. Now you are able to erase boot, recovery, oem unlock, etc. Here is an example after you have executed the above. This is just me restoring my default boot and recovery partitions which you can't do from your locked bootloader:

    scottgl@scottgl-A105:~$ fastboot erase recovery
    erasing 'recovery'...
    OKAY [ 0.739s]
    finished. total time: 0.739s
    scottgl@scottgl-A105:~/Desktop/SMG$ fastboot flash recovery CG58_0x00000120.smg sending 'recovery' (8192 KB)...
    OKAY [ 8.760s]
    writing 'recovery'...
    OKAY [ 1.013s]
    finished. total time: 9.773s
    scottgl@scottgl-A105:~/Desktop/SMG$ fastboot erase boot
    erasing 'boot'...
    OKAY [ 0.761s]
    finished. total time: 0.761s
    scottgl@scottgl-A105:~/Desktop/SMG$ fastboot flash boot CG59_0x00000130.smg
    sending 'boot' (8192 KB)...
    OKAY [ 8.800s]
    writing 'boot'...
    OKAY [ 0.697s]
    finished. total time: 9.497s
    4
    what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?

    The process of loading the unlocked ramloader is the same regardless of your firmware, even if the bootloader is 'locked'. The ramloader is just that, its written to ram, and so when the phone is reset the code is cleared out of memory. This means to unlock your radio, you don't have to flash anything to your ram, flashing rdl.bin basically just loads the ramloader to executable memory, then jumps to it. I'm still working on figuring out how to use this to chain load a custom recovery.
    4
    Confirmed! I got rid of the aweful 2.3.5 electrify bootloader. Just did this:

    scottgl@scottgl-A105:~/Desktop/SMG_BP011UP$ fastboot flash boot CG59_0x00000130.smg
    sending 'boot' (3294 KB)...
    OKAY [ 0.206s]
    writing 'boot'...
    OKAY [ 0.734s]
    finished. total time: 0.940s
    3
    You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):

    scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
    sending 'rdl.bin' (3072 KB)...
    OKAY [ 0.193s]
    writing 'rdl.bin'...
    OKAY [ 0.000s]
    finished. total time: 0.193s
    scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot oem unlock
    ...
    (bootloader) Unlocking your device can permanently VOID your warranty.
    (bootloader) This process cannot be reversed. If you wish to proceed,
    (bootloader) reissue the unlock OEM command containing the unique ID
    (bootloader) of your device: XXXXXXXXXXXXXXXX
    OKAY [ 0.006s]
    finished. total time: 0.006s
    scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
    ...
    (bootloader) Device is already unlocked
    OKAY [ 0.003s]
    finished. total time: 0.003s
    scottgl@scottgl-A105:~/Desktop/SMG_derpunlock$
    3

    Looks like the link is dead. However I think I found a way to get it myself. Flashed the 2.3.4 system to my phone and it's downloading the update right now.

    Edit: Ill know if it's the right update in probably about an hour. It is an extremely slow download, they must be severely limiting connections to phones outside of the states.