[SBF]D3 2.3.4 SBF leaked by China Forums

royolpunk · Aug 14, 2011

So with a few hours of Googling and some searching, me and a few others on IRC have found a mysterious D3 2.3.4 SBF. Of the time of writing, we're still downloading as the download is incredibly slow. Hopefully some of the people that are in the IRC will post mirrors on this thread as soon as they can get it uploaded.

http://www.diypda.com/zftp.action.p...763241688&md=71caf39d4e9a98681331bd16f2caa3f2

Download it at the very bottom of the thread. Mirrors will be up shortly. IRC people, please post mirrors if you have any.

MIRROR!!

Thanks to rigwig, we now have a mirror. Please thank him

http://www.multiupload.com/HKMICRBC6J

IMPORTANT!!:

DO NOT BY ANY MEANS FLASH THIS. THIS IS SIGNED WITH TEST KEYS, NOT RETAIL. FLASHING THIS WILL GUARENTEE A BRICK

here's your final warning message.
[13:25] whaatt: can we use rsdlite to flash this sbf?
[13:25] Adam: DO NOT FLASH THIS
[13:25] Adam: stop thinking about it
[13:25] Adam: stop thinking about thinking about it
[13:25] whaatt: lol
[13:25] whaatt: then what to do with it?
[13:25] royolpunk: DONT FLASH IT

RigWig · Aug 14, 2011

downloading now. I'll have mirror up in a few mins

Edit:
Here is the Multiupload mirror
http://www.multiupload.com/HKMICRBC6J

atquick · Aug 14, 2011

*prays its real*

Time for some epic rooting methods!

royolpunk · Aug 14, 2011

This is as real as it gets. DOWNLOAD SPEED WILL BE 50KBps MAX.

Edit:

So we've got a few people on the IRC downloading away, one is at 50%. it'll take about another hour before we get everything cleared up. I'll try to update this thread ASAP.

p3 has also just joined us on IRC. we're doing our best

saintlikesniper · Aug 14, 2011

Any thoughts on this giving us root?

Sent from my DROID3 using XDA App

whaatt · Aug 14, 2011

saintlikesniper said:
Any thoughts on this giving us root?

Sent from my DROID3 using XDA App

We're hoping to find vulnerabilities and holes in this Chinese SBF file, and see what we can do from there in terms of getting root.

royolpunk · Aug 14, 2011

we're hoping that this is a complete image of the phone (which it should be, considering it's at 222MB. we're going to go through the SBF step by step and look for more exploits that we can use to root this phone.

edit:

whaatt you ninja'd me -____-

Adam.h.ogle · Aug 14, 2011

This is /system/build.prop:

Code:

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=5.5.1-1_GC-35
ro.build.display.id=cdma_solana-userdebug 2.3.4 5.5.1-1_GC-35 5.5.1-1_GC-35 test-keys
ro.build.version.incremental=5.5.1-1_GC-35
ro.build.version.sdk=10
ro.build.version.codename=REL
ro.build.version.release=2.3.4
ro.build.date=Thu Jun  9 04:21:36 CDT 2011
ro.build.date.utc=1307611296
ro.build.type=userdebug
ro.build.user=hudsoncm
ro.build.host=il93lnxdroid48
ro.build.tags=test-keys
ro.product.model=XT883
ro.product.brand=moto
ro.product.name=SLNCT
ro.product.device=cdma_solana
ro.product.board=solana
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=motorola
ro.product.locale.language=zh
ro.product.locale.region=CN
ro.wifi.channels=
ro.board.platform=omap4
# ro.build.product is obsolete; use ro.product.device
ro.build.product=solana
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=cdma_solana-userdebug 2.3.4 5.5.1-1_GC-35 5.5.1-1_GC-35 test-keys
ro.build.fingerprint=moto/SLNCT/cdma_solana:2.3.4/5.5.1-1_GC-35/5.5.1-1_GC-35:userdebug/test-keys
# end build properties
#
# system.prop for CDMA Droidwe
#
# rild.libpath=/system/lib/libril-moto-umts-1.so
rild.libpath=/system/lib/libmoto_ril.so
rild.libargs=-d /dev/ttyO0
ro.sf.lcd_density=240
ro.default_usb_mode=2
ro.mot.ril.danlist=611,*611,#611
persist.ril.ecclist=911,*911,#911,119,118,999,08,000,112,110
persist.ril.modem.mode =1
# This defines the max event window manager can
# handle in 1 s. We may adjust this # for performance
# reason later
windowsmgr.max_events_per_sec=55

# USB modes allowed for UI and switching
ro.ngp_available=1
ro.modem_available=0

# Default network type.
# 7 => GLOBAL.
ro.telephony.default_network=7
ro.com.google.clientid=android-motorola
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.cdma.home.operator.numeric=46003
ro.cdma.home.operator.alpha=CT
ro.config.vc_call_vol_steps=7
ro.cdma.subscription=0

# wlan interface
wifi.interface = tiwlan0
softap.interface = tiap0

# Time between scans in seconds. Keep it high to minimize battery drain.
# This only affects the case in which there are remembered access points,
# but none are in range.
wifi.supplicant_scan_interval = 45

# Indicate carrier OTA SP number schema
# refer to frameworks/base/telephony/java/com/android/
# internal/telephony/cdma/CDMAPhone.java for the schema:
ro.cdma.otaspnumschema=SELC,1,80,99

# The OpenGL ES API level that is natively supported by this device.
# This is a 16.16 fixed point number
ro.opengles.version = 131072

# This is a high density device with more memory, so larger vm heaps for it.
dalvik.vm.heapsize=32m

# our HTML browser (not WAP browser ) does not need to specify UAProf URL 
ro.mot.hw.uaprof=http://uaprof.vtext.com/mot/xt862/xt862.xml

# Enable HAC to also display Call Setting Menu Option.
ro.mot.hw.HAC=1
# Motorola, a19622, 12/28/2009, IKSHADOW-204 / Location Settings for android
# Property to set enabling state of the location privacy setting feature.
# Motorola, a19622, 03/16/2010, IKSHADOW-2141 / Disable feature 33067
#ro.mot.settings.locprivacy=1
# ERI feature
# 0 OFF
# 1 ON
ro.mot.eri=0

# Motorol,a6889c,02/Feb/2010,IKSHADOW-619
# Proximity Sensor feature
# 0 disable
# 1 enable
persist.mot.proximity.touch=1
# End IKSHADOW-619

# BEGIN Motorola, a22976, 25-Feb-2010, IKSHADOW-702, FID 31841
# VZW Requirement Specifications: NETWORK BASED PLUS CODE DIALING
# 0 disable
# 1 enable
ro.cdma.nbpcd=0
# END IKSHADOW-702

# BEGIN Motorola, a22976, 12-Mar-2010, IKSHADOW-1784, Power Up Tone
# Motorola, a22976, 12-Apr-2010, IKSHADOW-3298, Remove temporary power up tone
# persist.mot.powerup.tone=/system/media/bootup.ogg
# END IKSHADOW-1784
persist.mot.usb.mediasync = 1
# persist.usb.android_config = 1

# System property for SMC
ro.service.start.smc=1
ro.HorizontalBUA=true
#Proximity sensor debounce time
mot.proximity.delay=450
# disable touch below 60 pixels
mot.proximity.distance=60

#inphone calibration backup support
ro.mot.hw.calibratedImager=1

# BEGIN Motorola, qpmc46, 05-Jul-2010, IKMAIN-311
persist.ril.mux.noofchannels = 8
# END  Motorola, qpmc46, 05-Jul-2010, IKMAIN-311

#BEGIN Motorola, nfjb73, 21-jun-2010,
# this is for feature 34386, other features for vzw global phone
# could use this property too. IKMAIN-732
#1 this is verizon wireless globle phone
#0 this is not verizon wireless globle phone
ro.mot.phonemode.vzwglobalphone=1
# END Motorola, nfjb73, 21-jun-2010, IKMAIN-732

#ro.mot.phonemode.numsignalbars=4

# BEGIN Motorola, nfjb73 23-jun-2010, IKMAIN-624
# this is for feature 33860, when phone is activated, the cdma mdn is written.
persist.radio.vzw.cdma.mdn=
# END Motorola, nfjb73

# BEGIN Motorola, qmfd78, 14-Jul-2010, IKMAIN-884
# GSM SMS traffic needs to be routed/sent through North America SMSC.
# This is part of the VZW World-phone Feature. SMS are always sent to a US SMSC and then injected
# into that network. This allows for billing and give the user the impression that the device is
# still in the US.
# ro.telephony.gsm-routes-us-smsc = 1
# END  Motorola, qmfd78, 14-Jul-2010, IKMAIN-884

# BEGIN Motorola, a22600 qmfd78, 16-Jul-2010, IKDROIDPRO-423
# For north american cdma operators, this flag should be 1.
# It enables number mangling when nbpcd (plus code dialing) is not supported.
# This is part of the VZW World-phone Feature.
#ro.cdma.home.operator.isnan=1
# END Motorola, a22600 qmfd78, 16-Jul-2010, IKDROIDPRO-423

# EDM feature - IKDROIDPRO-381 - Start
ro.mot.dpmext = true
# EDM feature - IKDROIDPRO-381 -End

# BEGIN Moto,IKDROIDPRO-430, a17673
# Feature33857 on DroidWE, support DualMode switch, UMTS/CDMA
ro.mot.FTR.33857=true
# END IKDROIDPRO-430

# BEGIN Moto, IKSTABLETWO-1284, nfjb73
# without this property, the lock screen would take global phone as UMTS
# block user to operate before setup
keyguard.no_require_sim = true
# End Moto

# BEGIN Moto, IKSTABLETWO-689, nfjb73, for 34387,33857
# when phone in Global mode, FW need to know the last phone mode beore power off
# when phone power up, it would use the right mode to avoid switch
persist.radio.ap.phonetype=2
# END IKSTABLETWO-689

# Motorola, IKHALFMWK-3, w001091 
# Feature 32711, deep sleep mode support
ro.mot.deep.sleep.supported=true

# BEGIN Moto, IKMAIN-14097, gdr487, 33531 flex on for Solana
# true  feature enabled
# false feature disabled
ro.mot.fid.33531.keylock_ecm=true
# END IKMAIN-14097

# BEGIN Motorola, A24124, 01-Mar-2011, IKMAIN-13570
ro.mot.bindervm.config = 210
# END IKMAIN-13570

#BEGIN Motorola, w30471, 16-Mar-2011, IKSTABLEFIVE-1796 35691 - Set configurable parameters for Verizon products
mot.mms.con.timeout = 30000
mot.mms.socket.timeout = 120000
mot.mms.tr.vc.timeout = 55000
mot.mms.trm.timeout = 240000
mot.mms.abort.prog.lim = 90
mot.mms.retry.pic.size = 512000
mot.mms.retry.default = false
mot.mms.retry.timeout.1 = 300000
mot.mms.retry.timeout.2 = 300000
mot.mms.retry.timeout.3 = 300000
mot.mms.retry.timeout.4 = 0
# END IKSTABLEFIVE-1796

#BEGIN Motorola, w36256, 6-Apr-2011, IKSTABLEFOURV-6808
# add latin encoding type for sms in cdma mode, this is only for vzw
ro.cdma.sms.latin_encode=true
#END IKSTABLEFOURV-6808

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.kernel.android.ril=yes
persist.ril.baudrate=230400
persist.ril.mux.noofchannels=8
persist.ril.mux.ttydevice=/dev/ttyO0
persist.ril.modem.ttydevice=/dev/ttySPI0
persist.ril.features=0x30E
persist.ril.mux.retries=500
persist.ril.mux.sleep=2
persist.mot.mdm_panicd.nopanic=no
ro.config.ringtone=DROID3.ogg
ro.config.notification_sound=pizzicato.ogg
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.default_usb_mode=0
ro.media.enc.aud.fileformat=qcp
ro.media.enc.aud.codec=qcelp
ro.media.enc.aud.bps=13300
ro.media.enc.aud.ch=1
ro.media.enc.aud.hz=8000
ro.telephony.call_ring.multiple=false
ro.telephony.call_ring.delay=3000
ro.setupwizard.enable_bypass=1
ro.cdma.homesystem=64,65,76,77,78,79,80,81,82,83
ro.cdma.data_retry_config=default_randomization=2000,0,0,120000,180000,540000,960000
ro.media.camcorder.1080p=mp4,h264,30,15000000,aac,128000,44100,2
ro.media.camcorder.720p=mp4,h264,30,10000000,aac,128000,44100,2
ro.media.camcorder.d1NTSC=mp4,h264,30,6000000,aac,128000,44100,2
ro.media.camcorder.vga=mp4,h264,30,4000000,aac,128000,44100,2
ro.media.camcorder.cif=mp4,h264,30,1500000,aac,128000,44100,2
ro.media.camcorder.qvga=mp4,h264,15,500000,aac,64000,44100,2
ro.media.camcorder.mms=3gp,h264,15,128000,amrnb,12200,8000,1
ro.media.camcorder.mmsres=qvga
ro.camcorder.zoom=true
ro.media.capture.maxres=8m
ro.media.capture.fast.fps=4
ro.media.capture.slow.fps=120
ro.media.capture.flash=led
ro.media.capture.flashMinV=3300000
ro.media.capture.torchIntensity=40
ro.media.capture.flashIntensity=70
ro.media.panorama.defres=3264x1840
ro.media.panorama.frameres=1280x720
ro.camera.dynamicFocus=true
ro.camcorder.videoModes=false
media.stagefright.enable-player=true
media.stagefright.enable-meta=true
media.stagefright.enable-scan=false
media.stagefright.enable-http=true
media.stagefright.enable-record=false
ro.media.camera.focal=3451.0,3451.0
ro.media.camera.principal=1632.0,1224.0
ro.media.camera.skew=0.0
ro.media.camera.distortion=0.0,0.0,0.0,0.0,0.0
ro.media.camera.calresolution=3264,2448
ro.mot.setuptype=2
ro.horizontalBUA=true
ro.horizontalVVM=true
ro.horizontalIM=true
ro.horizontalNGM=false
ro.horizontalVMM=false
ro.horizontalMOD=false
ro.horizontalVOD=false
ro.horizontalEmail=false
ro.mot.internalsdcard=1
dalvik.vm.lockprof.threshold=500
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.mot.dpmext=true
ro.com.google.clientid=android-motorola
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.mot.hw.uaprof=http://uaprof.motorola.com/phoneconfig/MotoMB200/profile/MotoMB200.rdf
debug.mot.hprofdump=1
ro.build.version.full=Blur_Version.55.11.35.XT883.ChinaTelecom.en.CN
ro.mot.hidden_keyboards=evfwd

Adam.h.ogle · Aug 14, 2011

This is a listing of all the files in /system: http://pastebin.com/XGXbDSNR

saintlikesniper · Aug 14, 2011

So if this becomes flashable and can we not inject busybox superuser and other stuff to gain root into the sbf

Sent from my DROID3 using XDA App

royolpunk · Aug 14, 2011

Yeah

Sent from my DROID3 using XDA Premium App

ckarrow2 · Aug 14, 2011

Man, this is exciting!! I hope this makes it easier for the devs!

cellzealot · Aug 14, 2011

This is a user debug build with limited su in xbin so adb shell has root but not on the phone.

These builds are easily rooted of course, but cannot be flashed on secured hardware at all.

The value of this file is more from the ability to examine the code group structure so we can look at the bootchain and CDT to get a better understanding how the phone works. This also appears to be for older P2 hardware revision, whereas the VZW released devices are P3.
That is another reason not to flash this file to our phones under any circumstances.

Thanks for digging this up and P3 and I will be taking a look at it as I qm sure many others will.

This does not mean we are any closer to root on stock hardware but is very exciting nonetheless.

royolpunk · Aug 14, 2011

I see...darn I thought we were getting pretty close to root

Sent from my DROID3 using XDA Premium App

Shoop_D_Woop · Aug 14, 2011

royolpunk said:
we're hoping that this is a complete image of the phone (which it should be, considering it's at 222MB. we're going to go through the SBF step by step and look for more exploits that we can use to root this phone.

edit:

whaatt you ninja'd me -____-

I downloaded a file a while ago called "D3 system dump" want a link?

royolpunk · Aug 14, 2011

Nah we've already been through that

Sent from my DROID3 using XDA Premium App

Shoop_D_Woop · Aug 15, 2011

royolpunk said:
Nah we've already been through that

Sent from my DROID3 using XDA Premium App

Gotcha, thanks. Trying any lead I can haha.

Sent from my DROID3 using XDA Premium App

dotson817 · Aug 15, 2011

Woo! I can't wait to see what the devs can do with this. Gonna be the first thing I check when I wake up in the morning

Sent from my DROID3 using XDA Premium App

psouza4 · Aug 15, 2011

Nothing... it was pretty disappointing actually.

Sent from my DROID3 using XDA App

royolpunk · Aug 15, 2011

Sent from my DROID3 using XDA Premium App

[SBF]D3 2.3.4 SBF leaked by China Forums

Senior Member

Senior Member

Member

Senior Member

Senior Member

New member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Member

Senior Member

Inactive Recognized Developer

Senior Member

Similar threads

Top Liked Posts