Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,807,727 Members 52,515 Now Online
XDA Developers Android and Mobile Development Forum

[SBF]D3 2.3.4 SBF leaked by China Forums

Tip us?
 
royolpunk
Old
(Last edited by royolpunk; 15th August 2011 at 12:34 AM.)
#1  
Senior Member - OP
Thanks Meter 6
Posts: 317
Join Date: Oct 2010
Location: San Jose, CA
Default [SBF]D3 2.3.4 SBF leaked by China Forums

So with a few hours of Googling and some searching, me and a few others on IRC have found a mysterious D3 2.3.4 SBF. Of the time of writing, we're still downloading as the download is incredibly slow. Hopefully some of the people that are in the IRC will post mirrors on this thread as soon as they can get it uploaded.

http://www.diypda.com/zftp.action.ph...31bd16f2caa3f2

Download it at the very bottom of the thread. Mirrors will be up shortly. IRC people, please post mirrors if you have any.

MIRROR!!

Thanks to rigwig, we now have a mirror. Please thank him

http://www.multiupload.com/HKMICRBC6J


IMPORTANT!!:

DO NOT BY ANY MEANS FLASH THIS. THIS IS SIGNED WITH TEST KEYS, NOT RETAIL. FLASHING THIS WILL GUARENTEE A BRICK


here's your final warning message.
[13:25] whaatt: can we use rsdlite to flash this sbf?
[13:25] Adam: DO NOT FLASH THIS
[13:25] Adam: stop thinking about it
[13:25] Adam: stop thinking about thinking about it
[13:25] whaatt: lol
[13:25] whaatt: then what to do with it?
[13:25] royolpunk: DONT FLASH IT
The Following User Says Thank You to royolpunk For This Useful Post: [ Click to Expand ]
 
RigWig
Old
(Last edited by RigWig; 14th August 2011 at 11:23 PM.)
#2  
RigWig's Avatar
Member
Thanks Meter 13
Posts: 58
Join Date: Mar 2011
downloading now. I'll have mirror up in a few mins

Edit:
Here is the Multiupload mirror
http://www.multiupload.com/HKMICRBC6J
 
atquick
Old
#3  
Junior Member
Thanks Meter 1
Posts: 23
Join Date: Dec 2010
Location: Columbus, OH
*prays its real*

Time for some epic rooting methods! :P
 
royolpunk
Old
(Last edited by royolpunk; 14th August 2011 at 09:10 PM.)
#4  
Senior Member - OP
Thanks Meter 6
Posts: 317
Join Date: Oct 2010
Location: San Jose, CA
This is as real as it gets. DOWNLOAD SPEED WILL BE 50KBps MAX.

Edit:

So we've got a few people on the IRC downloading away, one is at 50%. it'll take about another hour before we get everything cleared up. I'll try to update this thread ASAP.

p3 has also just joined us on IRC. we're doing our best
 
saintlikesniper
Old
#5  
Senior Member
Thanks Meter 6
Posts: 106
Join Date: Nov 2010
Any thoughts on this giving us root?

Sent from my DROID3 using XDA App
 
whaatt
Old
#6  
Junior Member
Thanks Meter 0
Posts: 1
Join Date: Aug 2011
Quote:
Originally Posted by saintlikesniper View Post
Any thoughts on this giving us root?

Sent from my DROID3 using XDA App
We're hoping to find vulnerabilities and holes in this Chinese SBF file, and see what we can do from there in terms of getting root.
 
royolpunk
Old
#7  
Senior Member - OP
Thanks Meter 6
Posts: 317
Join Date: Oct 2010
Location: San Jose, CA
we're hoping that this is a complete image of the phone (which it should be, considering it's at 222MB. we're going to go through the SBF step by step and look for more exploits that we can use to root this phone.

edit:

whaatt you ninja'd me -____-
 
Adam.h.ogle
Old
#8  
Senior Member
Thanks Meter 68
Posts: 164
Join Date: Jul 2010
This is /system/build.prop:

Code:
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=5.5.1-1_GC-35
ro.build.display.id=cdma_solana-userdebug 2.3.4 5.5.1-1_GC-35 5.5.1-1_GC-35 test-keys
ro.build.version.incremental=5.5.1-1_GC-35
ro.build.version.sdk=10
ro.build.version.codename=REL
ro.build.version.release=2.3.4
ro.build.date=Thu Jun  9 04:21:36 CDT 2011
ro.build.date.utc=1307611296
ro.build.type=userdebug
ro.build.user=hudsoncm
ro.build.host=il93lnxdroid48
ro.build.tags=test-keys
ro.product.model=XT883
ro.product.brand=moto
ro.product.name=SLNCT
ro.product.device=cdma_solana
ro.product.board=solana
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=motorola
ro.product.locale.language=zh
ro.product.locale.region=CN
ro.wifi.channels=
ro.board.platform=omap4
# ro.build.product is obsolete; use ro.product.device
ro.build.product=solana
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=cdma_solana-userdebug 2.3.4 5.5.1-1_GC-35 5.5.1-1_GC-35 test-keys
ro.build.fingerprint=moto/SLNCT/cdma_solana:2.3.4/5.5.1-1_GC-35/5.5.1-1_GC-35:userdebug/test-keys
# end build properties
#
# system.prop for CDMA Droidwe
#
# rild.libpath=/system/lib/libril-moto-umts-1.so
rild.libpath=/system/lib/libmoto_ril.so
rild.libargs=-d /dev/ttyO0
ro.sf.lcd_density=240
ro.default_usb_mode=2
ro.mot.ril.danlist=611,*611,#611
persist.ril.ecclist=911,*911,#911,119,118,999,08,000,112,110
persist.ril.modem.mode =1
# This defines the max event window manager can
# handle in 1 s. We may adjust this # for performance
# reason later
windowsmgr.max_events_per_sec=55

# USB modes allowed for UI and switching
ro.ngp_available=1
ro.modem_available=0

# Default network type.
# 7 => GLOBAL.
ro.telephony.default_network=7
ro.com.google.clientid=android-motorola
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.cdma.home.operator.numeric=46003
ro.cdma.home.operator.alpha=CT
ro.config.vc_call_vol_steps=7
ro.cdma.subscription=0

# wlan interface
wifi.interface = tiwlan0
softap.interface = tiap0

# Time between scans in seconds. Keep it high to minimize battery drain.
# This only affects the case in which there are remembered access points,
# but none are in range.
wifi.supplicant_scan_interval = 45

# Indicate carrier OTA SP number schema
# refer to frameworks/base/telephony/java/com/android/
# internal/telephony/cdma/CDMAPhone.java for the schema:
ro.cdma.otaspnumschema=SELC,1,80,99

# The OpenGL ES API level that is natively supported by this device.
# This is a 16.16 fixed point number
ro.opengles.version = 131072

# This is a high density device with more memory, so larger vm heaps for it.
dalvik.vm.heapsize=32m

# our HTML browser (not WAP browser ) does not need to specify UAProf URL 
ro.mot.hw.uaprof=http://uaprof.vtext.com/mot/xt862/xt862.xml

# Enable HAC to also display Call Setting Menu Option.
ro.mot.hw.HAC=1
# Motorola, a19622, 12/28/2009, IKSHADOW-204 / Location Settings for android
# Property to set enabling state of the location privacy setting feature.
# Motorola, a19622, 03/16/2010, IKSHADOW-2141 / Disable feature 33067
#ro.mot.settings.locprivacy=1
# ERI feature
# 0 OFF
# 1 ON
ro.mot.eri=0

# Motorol,a6889c,02/Feb/2010,IKSHADOW-619
# Proximity Sensor feature
# 0 disable
# 1 enable
persist.mot.proximity.touch=1
# End IKSHADOW-619

# BEGIN Motorola, a22976, 25-Feb-2010, IKSHADOW-702, FID 31841
# VZW Requirement Specifications: NETWORK BASED PLUS CODE DIALING
# 0 disable
# 1 enable
ro.cdma.nbpcd=0
# END IKSHADOW-702

# BEGIN Motorola, a22976, 12-Mar-2010, IKSHADOW-1784, Power Up Tone
# Motorola, a22976, 12-Apr-2010, IKSHADOW-3298, Remove temporary power up tone
# persist.mot.powerup.tone=/system/media/bootup.ogg
# END IKSHADOW-1784
persist.mot.usb.mediasync = 1
# persist.usb.android_config = 1

# System property for SMC
ro.service.start.smc=1
ro.HorizontalBUA=true
#Proximity sensor debounce time
mot.proximity.delay=450
# disable touch below 60 pixels
mot.proximity.distance=60

#inphone calibration backup support
ro.mot.hw.calibratedImager=1

# BEGIN Motorola, qpmc46, 05-Jul-2010, IKMAIN-311
persist.ril.mux.noofchannels = 8
# END  Motorola, qpmc46, 05-Jul-2010, IKMAIN-311

#BEGIN Motorola, nfjb73, 21-jun-2010,
# this is for feature 34386, other features for vzw global phone
# could use this property too. IKMAIN-732
#1 this is verizon wireless globle phone
#0 this is not verizon wireless globle phone
ro.mot.phonemode.vzwglobalphone=1
# END Motorola, nfjb73, 21-jun-2010, IKMAIN-732

#ro.mot.phonemode.numsignalbars=4

# BEGIN Motorola, nfjb73 23-jun-2010, IKMAIN-624
# this is for feature 33860, when phone is activated, the cdma mdn is written.
persist.radio.vzw.cdma.mdn=
# END Motorola, nfjb73

# BEGIN Motorola, qmfd78, 14-Jul-2010, IKMAIN-884
# GSM SMS traffic needs to be routed/sent through North America SMSC.
# This is part of the VZW World-phone Feature. SMS are always sent to a US SMSC and then injected
# into that network. This allows for billing and give the user the impression that the device is
# still in the US.
# ro.telephony.gsm-routes-us-smsc = 1
# END  Motorola, qmfd78, 14-Jul-2010, IKMAIN-884

# BEGIN Motorola, a22600 qmfd78, 16-Jul-2010, IKDROIDPRO-423
# For north american cdma operators, this flag should be 1.
# It enables number mangling when nbpcd (plus code dialing) is not supported.
# This is part of the VZW World-phone Feature.
#ro.cdma.home.operator.isnan=1
# END Motorola, a22600 qmfd78, 16-Jul-2010, IKDROIDPRO-423

# EDM feature - IKDROIDPRO-381 - Start
ro.mot.dpmext = true
# EDM feature - IKDROIDPRO-381 -End

# BEGIN Moto,IKDROIDPRO-430, a17673
# Feature33857 on DroidWE, support DualMode switch, UMTS/CDMA
ro.mot.FTR.33857=true
# END IKDROIDPRO-430

# BEGIN Moto, IKSTABLETWO-1284, nfjb73
# without this property, the lock screen would take global phone as UMTS
# block user to operate before setup
keyguard.no_require_sim = true
# End Moto

# BEGIN Moto, IKSTABLETWO-689, nfjb73, for 34387,33857
# when phone in Global mode, FW need to know the last phone mode beore power off
# when phone power up, it would use the right mode to avoid switch
persist.radio.ap.phonetype=2
# END IKSTABLETWO-689

# Motorola, IKHALFMWK-3, w001091 
# Feature 32711, deep sleep mode support
ro.mot.deep.sleep.supported=true

# BEGIN Moto, IKMAIN-14097, gdr487, 33531 flex on for Solana
# true  feature enabled
# false feature disabled
ro.mot.fid.33531.keylock_ecm=true
# END IKMAIN-14097

# BEGIN Motorola, A24124, 01-Mar-2011, IKMAIN-13570
ro.mot.bindervm.config = 210
# END IKMAIN-13570

#BEGIN Motorola, w30471, 16-Mar-2011, IKSTABLEFIVE-1796 35691 - Set configurable parameters for Verizon products
mot.mms.con.timeout = 30000
mot.mms.socket.timeout = 120000
mot.mms.tr.vc.timeout = 55000
mot.mms.trm.timeout = 240000
mot.mms.abort.prog.lim = 90
mot.mms.retry.pic.size = 512000
mot.mms.retry.default = false
mot.mms.retry.timeout.1 = 300000
mot.mms.retry.timeout.2 = 300000
mot.mms.retry.timeout.3 = 300000
mot.mms.retry.timeout.4 = 0
# END IKSTABLEFIVE-1796

#BEGIN Motorola, w36256, 6-Apr-2011, IKSTABLEFOURV-6808
# add latin encoding type for sms in cdma mode, this is only for vzw
ro.cdma.sms.latin_encode=true
#END IKSTABLEFOURV-6808

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.kernel.android.ril=yes
persist.ril.baudrate=230400
persist.ril.mux.noofchannels=8
persist.ril.mux.ttydevice=/dev/ttyO0
persist.ril.modem.ttydevice=/dev/ttySPI0
persist.ril.features=0x30E
persist.ril.mux.retries=500
persist.ril.mux.sleep=2
persist.mot.mdm_panicd.nopanic=no
ro.config.ringtone=DROID3.ogg
ro.config.notification_sound=pizzicato.ogg
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.default_usb_mode=0
ro.media.enc.aud.fileformat=qcp
ro.media.enc.aud.codec=qcelp
ro.media.enc.aud.bps=13300
ro.media.enc.aud.ch=1
ro.media.enc.aud.hz=8000
ro.telephony.call_ring.multiple=false
ro.telephony.call_ring.delay=3000
ro.setupwizard.enable_bypass=1
ro.cdma.homesystem=64,65,76,77,78,79,80,81,82,83
ro.cdma.data_retry_config=default_randomization=2000,0,0,120000,180000,540000,960000
ro.media.camcorder.1080p=mp4,h264,30,15000000,aac,128000,44100,2
ro.media.camcorder.720p=mp4,h264,30,10000000,aac,128000,44100,2
ro.media.camcorder.d1NTSC=mp4,h264,30,6000000,aac,128000,44100,2
ro.media.camcorder.vga=mp4,h264,30,4000000,aac,128000,44100,2
ro.media.camcorder.cif=mp4,h264,30,1500000,aac,128000,44100,2
ro.media.camcorder.qvga=mp4,h264,15,500000,aac,64000,44100,2
ro.media.camcorder.mms=3gp,h264,15,128000,amrnb,12200,8000,1
ro.media.camcorder.mmsres=qvga
ro.camcorder.zoom=true
ro.media.capture.maxres=8m
ro.media.capture.fast.fps=4
ro.media.capture.slow.fps=120
ro.media.capture.flash=led
ro.media.capture.flashMinV=3300000
ro.media.capture.torchIntensity=40
ro.media.capture.flashIntensity=70
ro.media.panorama.defres=3264x1840
ro.media.panorama.frameres=1280x720
ro.camera.dynamicFocus=true
ro.camcorder.videoModes=false
media.stagefright.enable-player=true
media.stagefright.enable-meta=true
media.stagefright.enable-scan=false
media.stagefright.enable-http=true
media.stagefright.enable-record=false
ro.media.camera.focal=3451.0,3451.0
ro.media.camera.principal=1632.0,1224.0
ro.media.camera.skew=0.0
ro.media.camera.distortion=0.0,0.0,0.0,0.0,0.0
ro.media.camera.calresolution=3264,2448
ro.mot.setuptype=2
ro.horizontalBUA=true
ro.horizontalVVM=true
ro.horizontalIM=true
ro.horizontalNGM=false
ro.horizontalVMM=false
ro.horizontalMOD=false
ro.horizontalVOD=false
ro.horizontalEmail=false
ro.mot.internalsdcard=1
dalvik.vm.lockprof.threshold=500
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.mot.dpmext=true
ro.com.google.clientid=android-motorola
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.mot.hw.uaprof=http://uaprof.motorola.com/phoneconfig/MotoMB200/profile/MotoMB200.rdf
debug.mot.hprofdump=1
ro.build.version.full=Blur_Version.55.11.35.XT883.ChinaTelecom.en.CN
ro.mot.hidden_keyboards=evfwd
The Following User Says Thank You to Adam.h.ogle For This Useful Post: [ Click to Expand ]
 
Adam.h.ogle
Old
#9  
Senior Member
Thanks Meter 68
Posts: 164
Join Date: Jul 2010
This is a listing of all the files in /system: http://pastebin.com/XGXbDSNR
The Following 2 Users Say Thank You to Adam.h.ogle For This Useful Post: [ Click to Expand ]
 
saintlikesniper
Old
(Last edited by saintlikesniper; 14th August 2011 at 10:35 PM.)
#10  
Senior Member
Thanks Meter 6
Posts: 106
Join Date: Nov 2010
So if this becomes flashable and can we not inject busybox superuser and other stuff to gain root into the sbf

Sent from my DROID3 using XDA App

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes