Bounty for bootloader unlock ?

Search This thread
By:
Advanced…
D

dtrail1

Senior Member
Oct 7, 2011
4,809
7,868
Frankfurt
Semseddin said:
What do you think would happen if i try to flash mbmloader_ns.img to my locked device using the following fastboot commands ? I would definitly have done it if it had warranty, sadly when it's dead,i have no smartphone. lol :)

fastboot flash mbm allow-mbmloader-flashing-mbm.bin
fastboot flash mbmloader mbmloader_ns.bin
fastboot flash mbm mbm.bin
Click to expand...
Click to collapse

I guess there are three possible results:

1. It's running normal (still locked)
2. The bootloader you flashed is signed with a higher secure level and can't be removed - whether your device works with it or not
3. It doesn't work (flash failure) and you can downgrade to your original one.

I don't exactly about this bootloader. As I know (like I read in your post) there is a sign tool which you can get by a TI representative.

Fortunately I know a dev from TI :)
Let me ask him for further details.

I have to say that I once were trying to break in the bootloader in 2012 together with an employee from Motorola. Also Kholk tried that together with the same guy from Motorola. We all failed :(
What I know for sure is that you can downgrade any bootloader by using the right mbm_allow bin file - at least for me it always worked.

According to a conversation with Hashcode I think that the most interesting possibility could be a sdcard external bootloader - but he also said that he didn't have a deeper look at this.

Another update: currently a kexec workaround and new kernels are in development including planned fixes for HD video recording and hdmi.

Gesendet von meinem XT910 mit Tapatalk 4
 
  • Like
Reactions: Crumplet, Sp_Ark, Mr-Glass and 1 other person
DumbleCore

DumbleCore

Senior Member
Nov 27, 2012
1,590
1,041
Hobb’s End
Semseddin said:
What do you think would happen if i try to flash mbmloader_ns.img to my locked device using the following fastboot commands ? I would definitly have done it if it had warranty, sadly when it's dead,i have no smartphone. lol :)

fastboot flash mbm allow-mbmloader-flashing-mbm.bin
fastboot flash mbmloader mbmloader_ns.bin
fastboot flash mbm mbm.bin
Click to expand...
Click to collapse

This is what i thought in here

http://xdaforums.com/showthread.php?t=2439436

if the bootloader is unlocked then,but wouldn´t that be to easy?Would try,but same with u,no warranty and need my phone
 
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
Some articles as a proof for how motorola decieved all of us with the bootloader unlock campaign for xt910.

http://www.engadget.com/2011/10/24/motorola-razr-open-for-unlocked-bootloader-business-if-the-carr/
http://www.electronista.com/articles/11/10/23/verizon.razr.only.locked.version.of.device/
http://ausdroid.net/2011/10/21/motorola-razr-to-be-unlockable/

This treachery could be another reason to crack the hell of it !

Btw, i found a nice website that could provide valuable information of some special builds for the cause.
http://www.handsetdetection.com/properties/vendormodel/Motorola/XT910/page:1
 
Last edited:
  • Like
Reactions: heblu and Crumplet
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
Check here how an opportunity of a bl unlock method is covered with kexec chat. History seems to repeat itself.

http://xdaforums.com/showthread.php?t=2124717

We might just need an exe and a bin file leaked.

Add :


Check here for an important thread that might give us some serious clues. He could even flash the SE unlocked bootloader dump while unbricking the device.

http://xdaforums.com/showthread.php?p=35744630#post35744630
http://xdaforums.com/showthread.php?t=2047750

i contacted cellzealot and Dan Rosenberg, too.
 
Last edited:
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
A chat log between me and nicole about the subject. Maybe more of us can tell motorola about their dissatisfaction of the issue. I will send a fax to motorola uk headquarters about this as advised.

Nicole : Hi, my name is Nicole . How may I help you?
Sinan AKDAŞ: Hi Nicole
Sinan AKDAŞ: i am sinan
Sinan AKDAŞ: I am from Turkey and i own a razr XT910. Can you help me about it or do i have to connect to another geography represantative for support
Nicole : I can help you, no problem at all. What seems to be the question?
Nicole : *problem
Sinan AKDAŞ: Motorola announced that xt910 would come with an unlockable bootlaoder solution before they started to sell it. So i decided to buy the device depending on the official words from motorola representatives. Check here
Sinan AKDAŞ: http://ausdroid.net/2011/10/21/motorola-razr-to-be-unlockable/
Sinan AKDAŞ: 2 years have passed since i bought my xt910 outright without any operator or network obligations. This is my property and i want its bootloader unlocked as i promised. I want to install my own software and kernel on it.
Sinan AKDAŞ: But motorola never kept its promise about the bootloader unlocking stuff
Sinan AKDAŞ: so i ask for your assistance to seal the promise of a 2 years lie from old motorola
Sinan AKDAŞ: i never needed motorola warranty as it is already non existent here
Sinan AKDAŞ: i've requsted his before and before but we couldn't come up with a solution
Nicole : It was not a promise I am afraid, it was a misinformed employee saying that he believes it would be a software update. However, Motorola decided to go with Developer edition devices. You are free to do what your property as you wish
Sinan AKDAŞ: That misinformed employee was a vice president
Sinan AKDAŞ: i think it was more of lie instead of misinformation. Now, i wonder if google owned new motorola intends to clear the old trash ?_
Nicole : You are free to do what your property as you wish
Sinan AKDAŞ: Is there a possibility of bootlooader unlocking in official service center ?
Nicole : There is plenty of instructions and guides out there. Please be aware that Motorola does not do that
Sinan AKDAŞ: or can motorola replace my phone with a developer edition one since when i bought my device it was said to be unlockable but after months they try to sell me the same device with unlocked bootloader, instead of unlocking my devices bootloader
Sinan AKDAŞ: I ask for a replacement of my device replaced with a developer edition then, if they can't unlock mine ?
Nicole : do I understand correct that you wish to have a phone replaced with a brand new one that is older than 2 years ?
Sinan AKDAŞ: Yes, since it was motorola's word to offer an unlock solution for my device. Now that 2 years have passed without fullfilling the promise, it is motorola's responsibility imo
Nicole : I am really sorry that you feel so misled. I can try to forward this, I don't want to be in the way. But I think that this will not be successfull
Sinan AKDAŞ: Well nicole, i've chatted with you about this from time to time and you always try to be helpful as much as you can.
Sinan AKDAŞ: i can't deny that but there're always but...
Sinan AKDAŞ: you forward our concerns to other employees and they don't even reply back to me
Sinan AKDAŞ: Can you give me an email address for that guy in motorola who deals with this kind of customer dissatistactions ?
Nicole : Just a moemnt please..
Sinan AKDAŞ: ok
Nicole : Thank you for waiting. I spoke to the technicians and we went through your complaint. Even if this option was considered, the repair centre cannot unlock the bootloader (no official Motorola tools available and third party apps cannot be used). As well, since over a year we do not have the developer edition in stock anymore, so this option is not possible as well. They said it is possible to send a letter or fax to the UK headquartes, in this way they have to answer you.
Nicole : Would that be ok for you?
Sinan AKDAŞ: well, i will fax their headquarters about this. Please gimme their fax number.
Sinan AKDAŞ: btw christy wyatt was a software executive vice president for motorola when that article was published.
Nicole : I see your point there and it is not wrong to believe things like that, but company practice usually demands that only things which have been advertised officially (such as written on the website) can be considered. The fax number is: 0044 131 777 0269
Nicole : I wish you best of luck
Nicole : Please include your IMEI there as well
Sinan AKDAŞ: Thank you, will try my luck again. I am not done with this and it is tottally unacceptable practice of motorola mobility to false advertiese and sell products over those false advertisements.
Nicole : Please include this wording as well
Nicole : Is there any more that I could help you with today?
Sinan AKDAŞ: Thank you again nicole
Sinan AKDAŞ: you've been very helpful. Wish you a good day. Sinan out...
Nicole : To you too. Thanks, bye
Click to expand...
Click to collapse
 
  • Like
Reactions: DigitalJosee and Crumplet
hawklen

hawklen

Senior Member
Nov 7, 2012
100
10
Barrie
That's pretty interesting. You mentioned a developers edition phone with an unlocked bootloader? I've noticed a developer version firmware on that razr firmware page, wondering if you flash that if it would work..

681.4 MiB BD4480F67A474D55D951CC5E82431DE0 Developer Edition SPDREM_U_01.6.5.1-73_SPU-11-M1-2-ULB_1C.85P_0A.6B_DATDE_CFC_HWp2b_SIGNED.xml.zip

http://sbf.droid-developers.org/umts_spyder/list.php
 
D

dtrail1

Senior Member
Oct 7, 2011
4,809
7,868
Frankfurt
hawklen said:
That's pretty interesting. You mentioned a developers edition phone with an unlocked bootloader? I've noticed a developer version firmware on that razr firmware page, wondering if you flash that if it would work..

681.4 MiBBD4480F67A474D55D951CC5E82431DE0 Developer Edition SPDREM_U_01.6.5.1-73_SPU-11-M1-2-ULB_1C.85P_0A.6B_DATDE_CFC_HWp2b_SIGNED.xml.zip

http://sbf.droid-developers.org/umts_spyder/list.php
Click to expand...
Click to collapse

We tried that two years ago... Doesn't help. And there's nothing we can expect from big Moto.

Gesendet von meinem XT910 mit Tapatalk 4
 
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
Semseddin said:
What do you think would happen if i try to flash mbmloader_ns.img to my locked device using the following fastboot commands ? I would definitly have done it if it had warranty, sadly when it's dead,i have no smartphone. lol :)

fastboot flash mbm allow-mbmloader-flashing-mbm.bin
fastboot flash mbmloader mbmloader_ns.bin
fastboot flash mbm mbm.bin
Click to expand...
Click to collapse

This is what i get when trying to flash ns bootloader to my device. :(
 

Attachments

  • fail.png
    fail.png
    13.6 KB · Views: 402
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
dtrail1 said:
You have to flash the "allow.. " file first in order to be allowed to flash another bootloader to the device.
But I wouldn't try to flash this one to be honest...

Gesendet von meinem XT910 mit Tapatalk 4
Click to expand...
Click to collapse

That was the output of the last command after allowmbm and reboot bootloader. You wont get that screen without allowmbm, it will fail at the beginning. I dont care much about it nowadays cause i am thinking of getting an LG G2 32gb. Google Motorola can see my middle finger for their pathetic dualcores.






Sent from my XT910 using xda app-developers app
 
Last edited:
D

dtrail1

Senior Member
Oct 7, 2011
4,809
7,868
Frankfurt
Semseddin

Semseddin

Senior Member
Feb 16, 2010
1,959
582
Istanbul
motomodtr.forumcommunity.net
Nexus 6
Verizon Motorola Droid Turbo
Hey dtrail1,

Are these files available in other kernel releases ?

Latest Files
README.txt.txt (Datum: 2013-08-08, Größe: 1.8 KB)
system_core.tgz (Datum: 2013-08-08, Größe: 912.8 KB)
motorola_security_moto_crypto.tgz (Datum: 2013-08-08, Größe: 3.6 MB)
motorola_external_wbxmlparser.tgz (Datum: 2013-08-08, Größe: 70.4 KB)
motorola_external_lbl.tgz

motorola_security_moto_crypto.tgz has some nice information in it if you check it with notepad++
 
You must log in or register to reply here.

Similar threads

mikevipsr
  • Poll
HOW TO UNLOCK THE BOOTLOADER AND WHAT IT Is
Replies
12
Views
91K
xRn_Jr
xRn_Jr
A
[Q] Unlock Motorola Droid RAZR XT912 locked to Verizon
Replies
76
Views
208K
B
b-d-p
K
[Bootloader Bypass] Kexec for Motorola RAZR by kholk & [mbm]
Replies
265
Views
112K
M
MetaruSonikkuX
whirleyes
[RECOVERY][ICS] BMM - Boot Menu Manager - v0.2.7 [ARCHIVE]
Replies
1K
Views
266K
By.TRabZonLu™
By.TRabZonLu™
J.Y.Daddy
[CWM On Boot][Any Razr][for Bootstrap] CWM Recovery Auto Boot PKG.
Replies
121
Views
141K
Z
zwastik

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 8
    R
    rhouse1983
    chat with moto/4.2/unlocked bootloader

    here's a photo of the printed version of the chat. i did print it prematurely but there wasn't much else said beyond my question for documentation which of course they were unable to provide. sorry if it's difficult to read. you can just open photo and zoom as i'm sure you all already know cuz you're tech smart so i don't know why i said that lol
    View
    7
    D
    dtrail1
    DigitalJosee said:
    So, What's the difference between a locked and a unlocked bootloader?
    Click to expand...
    Click to collapse

    The difference is that a locked bootloader will alaways check the partition signatures for Moto's signature, especially the following partitions:

    • boot
    • recovery
    • cdrom
    • cid

    This results in cases of flashing something to these partitions, like a kernel, the bootloader will prevent any flashing process in the case that the boot.img has no Moto signature.

    In example: If the system partition would have been checked for signatures by the bootloader we wouldn't be able to flash any custom rom to the device.
    Also the recovery partition is controlled/checked by the bootloader, that's why we cannot flash a common CWM to our device - our solution is a hijacked recovery, where the hijack is being executed on boot to load the recovery instead of booting into the system. The recovery itself is laying on another partition, like /pds or somewhere in /system (i.e. /system/bmm)


    An unlocked bootloader won't check any signatures which allows to flash everything to any partition. The benefits of this are the use of common custom recoveries and flashing custom kernels to the boot partition. The biggest disadvantage of an unlocked bootloader is that it's potentially simple to HARD brick your device - just by flashing a wrong boot.img or something which changes the partition tables (e.g. when accidently flashing a rom from another device) in example.

    So we are safe in some ways by having a locked bootloader - and also catched by less possibities. Kexec doesn't make any difference between the use of a custom kernel loaded from the boot partition or loaded from somewhere else by a kernel module. The way the kernel works is affected by its code - If our bootloader were unlocked and we could flash JBX-Kernel directly to the boot partition - it would have exactly the same problems without any further difference - Thanks to Moto's closed source driver parts like ducati, etc. THis is what I always try to explain, but I am not against a unlocked bootloader of course ;) But I think it's almost impossible to crack the bootloader or its RSA keys, but more simple to try a SDCARD custom bootloader. However, maybe it would be an idea to create a bounty for much more skilled kernel devs - even when Hashcode & co are leaving OMAP support - or someone who is able to crack, decrypt or leak Moto's closed source drivers as full open sources. If we had these we could make a fully working custom kernel experience - independant of the bootloader. I'm sure this fact can be confirmed by every experienced dev.

    Kexec itself is working great. It just let the kexec kernel takeover and throws the stock kernel comnpletely out off the kernel memory so we have the full amount of ram free for use. Everything else which follows after booting the kexec kernel is dependant on the kernel itself, and has nothing more to do with kexec because after the kernel is loaded and starts booting, kexec's work is done.

    I wish I had help by skilled and experienced kernel devs, so we could fix these last few issues.
    View
    7
    D
    dtrail1
    er111a said:
    Awesome idea, if we could get this done, we would have so much power! :3
    Click to expand...
    Click to collapse

    It wouldn't change that much. The sources are still the same, the drivers are still the same and Moto will not release any closed source driver code - even when the bootloader is unlocked! I don't know why people don't believe it, but even when the bootloader is unlocked, the problems will be exactly the same. One difference is for sure: with unlocked bootloader it's much more easier to hard brick your RAZR.

    On kexec we reached a real stable state finally. Full HD video recording has been fixed! Only thing to fix is hdmi now... Oh, and let's say the bootloader suddenly is unlocked: hdmi still won't work - because an unlocked bootloader doesn't make any difference to the sources and drivers we have to play with.

    To explain it again: kexec is only a function which drops the stock kernel out of memory and loads the custom kernel. From that point there's no more difference to an unlocked bootloader. On unlocked device the kernel could be loaded from its partition instead of system. Therefore the HWMOD setup can be reverted back to original configuration, on kexec it's tricky to get UARTs loading correctly and it's more difficult to get the apanic label working correctly but this only affects the kernel logs and these can be grabbed by UART in example, but that's all. So except the HWMOD setup the kernel is absolutely the same, depending on related developer and what kind of features her builds into it. And unfortunately we don't have many developers anymore - and they won't come back when the bootloader gets unlocked. Be happy with what we got for our device! There's always the latest Android version available, we have custom kernel and tons of mods and other stuff which is almost up to date!
    Otherwise use stock or try learning development and throw your 2 cents if you like to improve something :)
    I don't see any progress here and I don't believe in Moto doing anything for this anymore.
    If you don't believe in kexec, just try it! Latest CM11 has 1080p video cam, if you want more customization, use latest JBX kernel (from CF mirror in test folder) with CM11. For those who don't need 1080p and can live with 720p but likes a real stable Rom and stable kernel use slimKat with latest JBX release in example. :)

    Gesendet von meinem XT910 mit Tapatalk 4
    View
    6
    D
    dtrail1
    Semseddin said:
    Adding your name in the OP, tydiamond11. Thanks for the donation. Any amount of donations would help. 1000 USD could be a fair prize in return for the job done IMHO.What do you guys think about the bounty goal? The name of the baby is a question and we all as a community should put our hands into our pocket this time if we really want bootloader unlock. Our phone XT910 and XT912 are EOL'd (end of life) but still much better than many phones selling today. Believe me in this, i sell all brands and new phones as a part of my job. It is a piece of hardware with lacking software support for recent android versions IMHO. It is buried with 4.1.2 version by motorola. Google directed new motorola will not update it. So ,an unlocked bootloader for xt910 and xt912 would bring many new developers deving for our device since it is popular. Imagine stable cm11 in DROID RAZR MAXX with stable KitKat android.


    Sent from my XT910 using xda app-developers app
    Click to expand...
    Click to collapse

    Currently starting to work on KitKat project...

    I am not sure about that many devs would come back to the RAZR when it gets its bootloader unlocked - since Kexec is working I thought at least some good devs would come back - but they didn't. I guess they left our device because of the bootloader lock - and Kexec came too late a little. Let's hope that we can work some out (whether it's a bootloader unlock or not) - and I try to keep the current working devs on the projects ;)
    View
    6
    D
    dtrail1
    However, I still don't know what kind of benefits an unlocked bootloader should give to us. Kexec allows us to boot custom kernels - and all issues on kexec are NOT related to the bootloader thing. What differences are related to this? Well, an unlocked bootloader would allow us to flash the custom kernel directly to the boot partition and replace the stock kernel - but the issues would be the same - as long as they're not getting fixed by the developers (Yes, I know, I'm one of them.. :) But me I'm not a "master dev" and I still have to learn a lot about this stuff). What else? We could modify the baseband - if we had sources for it (what we don't have, baseband is closed source :( ) - but this means in fact we could edit, replace, flash ANY device partition, but is this really an advantage? Not at all! It would be much easier to totally hardbrick the device (there would be no way back, no fastboot/RSD unbrick solution if any partition would be broken by wrong flashed images or sth).
    What more? Well, one real advantage would be the ability of custom recoveries installable to the recovery partition! We could have SS/BMM replacing the stock recovery which would let us get rid of the SS/BMM splashscreen (but is this really important/necessary?). If this was the case we probably never would have got such great multi-boot recoveries we have now, just because devs would have built existing recovries like TWRP, CWM, etx to our device and the only ability of having multi-boot support would be similar to Siyah- or Dorimanx-Kernel-like dual boot support (which is kinda buggy and really not compatible to all combinations of roms. I know these common problems from the SGS2 in example, where Dori supports dual boot, but it doesn't work in combo with AOSP roms + Stock(-based) rom and others! Or Sammy-AOSP roms cannot work if you have AOKP on the other rom slort installed (because the dual boot slots are not fully seperated and are using some "shared depencies". Genious Hashcode or Whirleyes even would not have been put all their knowledge and research into the production of such great recoveries like Safestrap and Bootmenu - which allows us to have up to 6(!!!) roms istalled at the same time, independant of what kind of roms you use on your slots!
    What more can I say? Yes, another benefit would have been that we weren't forced to research kexec boot and hack the device over a period of almost 2 years until we got the first custom kernel booted and running! (I don't mean myself when I say "we", as I didn't produce anything on the actual kexec hack! I just took the chance to develop the first real customized kernel for the RAZR when we were able to boot such things!). So we porbably would still have more great devs developing for the RAZR and also there would exist more rom projects because many devs wouldn't have been sold their RAZR - what most of them did when they realized Moto would not unlock the bootloader! And when kexec became ready and usable, the "big selling" was already over! Thanks Moto, for making us loosing many great devs to other manufacturer's devices, and loosing many nice projects for our phone!

    Ok, but besides these things, all current issues on Kexec roms would also exist with a unlocked bootloader - except someone more skilled would fix them! (And additionally to my last statement above I think we would have more of these bugs fixed already because more devs would still develop for the RAZR in case Moto would have unlocked the bootloader two years ago).

    But now back to reality! Also when kexec came "kinda late" - when many devs already left - we really have a lot of nice projects been realized for the RAZR - and also there are still some great devs, while also some still join the RAZR and spend their sparetime to bring us nice roms, apps and whatever else too. Let's be thankful for what we got so far, and let's hope we will always get the latest updates and that always someone's there and not leaving our great device alone! I want to take the chance here and throw a big "THANK YOU" again to everyone who provides or provided any stuff to us and our phone!

    I would of course welcome a bootloader unlock - but on the other hand, I guess it wouldn't bring us all the great devs back who left the RAZR because of the bootloader lock. For me it doesn't matter anymore. I will not leave the RAZR scene soon, and I will give my best to fix those bugs I am able to repair. Now that I am SlimRom maintainer for OMAPs (unofficial) I am also working more on rom side bugs - and also continue fixing the JBX-Kernel and probably a newer stock base kernel for kexec. (Right now I am finally fixing and adding the RAZR's CPU temp sensor and thermal framework, which is part of the device but not used until now - so another fix is coming up soon and making it better..). Hang on and/or stay tuned! ;)

    Also a BIG THANK YOU to the nice community here on XDA! Without you all these things would never be happended!
    View

New posts