Thread Closed

[R&D] Unlock Bootloaders

13th July 2012, 03:50 AM   |  #1  
Rules:
Do not post in here unless you have something constructive to say. "Thanks", "Hey this is wonderful", and any other comments like that are not wanted. They take up space and make it more difficult to find information. I'm requesting that this thread be heavily moderated. In order to work efficiently, information density must be kept high. We are all guilty of adding in a few off-topic sentances from time-to-time, but this thread is strictly business and I expect the moderators to moderate me as well.

What is this?
This is the place where we can research and develop a method to unlock the bootloader of the Verizon Galaxy SIII. Hopefully, this will be development at its finest.


Why not just buy a developer edition
GTFO! Not a single person got started developing by buying a developer phone. They started developing because they were unhappy with the features of their device and wanted something better. They wanted something more. This developer phone is a tax on developer innovation. We do not stand for that. We will break the security and we will enable XDA-Developers to do what they do best.

Until security is broken and available for everyone, this device will get updates last, users will be unhappy because there are no additional features and Samsung violates the spirit of Open Source and copyright laws. Take a look at the bottom line of GPL-Violations.org FAQ located here: http://gpl-violations.org/faq/sourcecode-faq.html


What are the goals?
  • Attain a bootloader recovery - 75% JTAG (the extra 25% will be for a user-friendly method)
    The Galaxy S3 is bootable from SDCard. In case of emergency this is needed. We need to verify that this works on the Verizon GS3 to bring up Odin. This will set up infrastructure for research.
  • Attain a full stock restoration via Odin or Heimdall - 90%
    For use with Odin3.
    Bootloader - BOOTLOADER_I535VRALF2_618049_REV09_user_low_ship.t ar.md5 - 1.97 MB - Thanks nbsdx
    PDA - SCH-I535_VZW_1_20120705143513_fti2qg2lmf.zip
    NEED CSC PACKAGE (MODEM, PARAMS and Other Miscellaneous partitions). This is enough to recover a device though.
    To include bootloaders and recovery to a working and stock condition with the EMMC wiped entirely. Heimdall is a work in progress for this device. This will complete the infrastructure needed for research.
  • Collect information
    This will be the longest and most difficult part of this development. The information provided by Qualcomm is not readily available. Samsung is notoriously secretive about their bootloaders. Mainly we, as a community, will generate information. Please post any relevant datasheets, theory-of-operation, or manuals which you can find.
  • Provide a way to remove security checks from Odin3.] 100% - insecure aboot.img which may break in the future
    By removing security checks from Odin3 on the computer or the Loki daemon on the device we can flash anything through Odin or Heimdall.
  • Provide a way to bypass security checks within bootloaders. 200% we have two exploits, only one has been released.
    This is the ultimate goal. Once we can bypass the security checks, kernels can be flashed giving us the control required to develop


Initial information
[BOOTLOADER] Locked bootloader research and news: http://forum.xda-developers.com/show....php?t=1756919


My own research

SBL1 is the first booting partition. Qualcomm provides the Modem partition so it comes first on the EMMC. SBL1 is the first bootloader and that is specified by Qualcomm standards. Qualcom mmake sthe primitive bootloader and allows their customers (Samsung) to make a Secondary bootloader. Samsung chose to use three secondary bootloaders.

The following 0p* are located in /dev/block/mmcblk*

0p1 = modem
Built by se.infra
HUDSON_GA_D2_USA-VZW-HARDKEY-PROD-USER
I take this to mean this Qualcomm modem was built in Hudson Georgia.
I was not able to find signatures on this block . This does NOT mean that there are no signatures on this block. The file is 33 megs. The file is unencrypted.
The modem uses the BLAST Kernerl ver : 02.04.02.02.00 Unfortunately we need someone who speaks French(???) to understand how this works http://blast.darkphpbb.com/faq.php
Judging by the contents of this file, it is an operating system of it's own including keyboard, mouse and a lot of debugging information. We need to find out more about the BLAST Kernel and this partition.


Samsung Proprietary partitions SBL1,2,3
Overall I'm not entirely familiar with this new 3 SBL setup. If someone could help me out, that would be great. This 3 SBL setup looks like they tried to adapt (slopily) their IBL+PBL+SBL setup to the Qualcomm and added overhead.

op2=sbl1
This block is signed by Samsung, we will not be able to modify it.
Some Strings we expect to see on UART are:

0p3=sbl2
This block is signed by Samsung, we will not be able to modify it.

Some of the strings we may see over UART are:
Code:
RPM loading is successful.
cancel RPM loading!
SBL2, End
SBL2, Delta
.sbl2_hw.c
sbl2_hw_init, Start
sbl2_hw_init, Delta
sbl2_hw_init_secondary, Start
h/w version : %d
sbl2_hw_init_secondary, Delta
.SBL2, Start
scatterload_region & ram_init, Start
.scatterload_region & ram_init, Delta
.sbl2_mc.c
sbl2_retrieve_shared_info_from_sbl1, Start
.sbl2_retrieve_shared_info_from_sbl1, Delta
0p4=sbl3
This block is signed by Samsung, we will not be able to modify it.

Possibly useful information:
SVC: R1-R14
FIQ:R13-R14
IRQ:R13-R14
UND:R13-R14
ABT:R13-R14
SYS:R13-R14

This block appears to be a full OS of its own. I'm not sure of its purpose.

op5= aboot
This block is signed by Samsung, we will not be able to modify it

This block contains HTML information. It would appear that it is possible to put the device into a mode where it will provide a webserver which displays state information.

This block appears to be a complete operating system

This block contains the Loke Daemon which communicates with Odin3.


0p6= rpm
This block is signed by Samsung we will not be able to modify it

0p7= boot
This is the kernel. There are several things we can do here... I belive this package itself is not signed, but the zImage itself is... here is the bootimg.cfg file

Code:
adam@adam-Desktop:~/Desktop/VZWGS3$ cat ./bootimg.cfg 
bootsize = 0xa00000
pagesize = 0x800
kerneladdr = 0x80208000
ramdiskaddr = 0x81500000
secondaddr = 0x81100000
tagsaddr = 0x80200100
name = 
cmdline = console=null androidboot.hardware=qcom user_debug=31
It may be possible to use that cmdline variable as an exploit.




0p8= tzTrust Zone
0p9= pad
0p10= param -boot mode parameters - this could be a potential exploitation point.
0p11= efs -serial numbers
I've honestly got no clue about most of the following partitions.
0p12= modemst1
0p13= modemst2
0p14= system - Android stuff
0p15= userdata - App Stuff
0p16= persist
0p17= cache - Storage for updates
0p18= recovery - recovery partition
0p19= fota
0p20= backup
0p21= fsg
0p22= ssd
0p23= grow

External UART log from initial power up:
Code:
[1630] AST_POWERON
[    0.000000] heap->name mm, mb->start c0000000
[    0.000000] Reserving memory at address ea000000 size: 100000
[    0.000000] sec_dbg_setup: str=@0x88d90004
[    0.000000] sec_dbg_setup: secdbg_paddr = 0x88d90004
[    0.000000] sec_dbg_setup: secdbg_size = 0x40000
[    0.000000] etb_buf_setup: str=@0x8fffb9c0
[    0.000000] etb_buf_setup: secdbg_paddr = 0x8fffb9c0
[    0.000000] etb_buf_setup: secdbg_size = 0x4000
[    0.174515] rdev_init_debugfs: Error-Bad Function Input
[    0.174881] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
[    0.176957] sec_debug_init: enable=0
[    0.177475] ec_debug_nit: restrt_reason: 0xdf0085c
[    .216358] msm8960_iit_cam:292]settingdone!!
[    0.25006] i2c 2c-14: Inalid 7-bi I2C addrss 0x00
    0.25237] i2c ic-14: Can' create evice at x00
[   0.252220]i2c i2c-1: Failed o registeri2c clien cmc624 t 0x38 (-6)
[    .252250] 2c i2c-19:Can't crete deviceat 0x38
    0.25433] rdevinit_debufs: Error-ad Functin Input
    0.25222] max892 19-006: DVS mode disabledbecause VD0 and VI1 do not ave prope control.
[    0.79536] ms_etm msm_tm: ETM tacing is ot enable beacaussec_debug s not enaled!
[   0.284449 smd_chanel_probe_orker: alocation tble not iitialized
                                                                  [    0.38766] pm_untime: fil to wak up
[   0.362032]hdmi_msm dmi_msm.1 externalcommon_stte_create sysfs grup de39e68                                                                   
[    0362673] Iside writback_drivr_init                                                                                                         
[   0.36275] Insidewritebackprobe                                                                                                               
[    1.244803] TZCOM: unable to get bus clk                                                                                                     
[    1.431680] cm36651_setup_reg: initial proximity value = 3                                                                                   
[    1.549671] msm_otg msm_otg: request irq succeed for otg_power                                                                               
[    1.566702] mms_ts 3-0048: [TSP] ISC Ver [0xbb] [0x20] [0x20]                                                                                
[    1.571341] mms_ts 3-0048: [TSP] fw is latest. Do not update.                                                                                
[    1.583488] [__s5c73m3_probe:3818] S5C73M3 probe                                                                                             
[    1.587089] [s5c73m3_sensor_probe_cb:3793] Entered                                                                                           
[    1.591942] [s5c73m3_i2c_probe:3675] Entered                                                                                                 
[    1.596123] [s5c73m3_init_client:3381] Entered                                                                                               
[    1.600579] [s5c73m3_i2c_probe:3695] Exit                                                                                                    
[    1.604608] [s5c73m3_sensor_probe:3726] Entered                                                                                              
[    1.609095] [s5c73m3_spi_init:226] Entered                                                                                                   
[    1.613154] [s5c73m3_spi_probe:191] Entered                                                                                                  
[    1.617335] [s5c73m3_spi_probe:201] s5c73m3_spi successfully probed                                                                          
[    1.623561] [s5c73m3_sensor_probe :  3749] Probe_done!!                                                                                      
[    1.672638] mmc0: No card detect facilities available                                                                                        
[    1.682984] aat1290a_led_probe : Probe                                                                                                       
[    1.693850] msm_soc_platform_init                                                                                                            
[    1.697298] msm_afe_afe_probe                                                                                                                
[    1.843064] msm_asoc_pcm_new                                                                                                                 
[    1.849748] msm_asoc_pcm_new                                                                                                                 
[    2.023134] set_dload_mode <1> ( c00176d4 )                                                                                                  
[    2.052220] cypress_touchkey 16-0020: Touchkey FW Version: 0x06                                                                              
[    2.123851] init: /init.qcom.rc: 466: invalid command '/system/bin/log'                                                                      
[    2.129620] init: /init.qcom.rc: 573: ignored duplicate definition of service 'sdcard'                                                       
[    2.137402] init: /init.qcom.rc: 586: ignored duplicate definition of service 'ftm_ptt'                                                      
[    2.145490] init: /init.target.rc: 73: ignored duplicate definition of service 'thermald'                                                    
[    2.154677] init: could not open /dev/keychord                                                                                               
[    2.239951] init: Device Encryption status is (0)!!                                                                                          
[    2.243705] init: [disk_config] :::: fsck -> /dev/block/mmcblk0p15 (ext4):::::                                                               
[    2.251823] init: [disk_config] ext_check -> /system/bin/e2fsck -v -y /dev/block/mmcblk0p15                                                  
[    2.588921] init: [disk_config] ext_check ->ok                                                                                               
[    2.611597] init: [disk_config] :::: fsck -> /dev/block/mmcblk0p17 (ext4):::::                                                               
[    2.617762] init: [disk_config] ext_check -> /system/bin/e2fsck -v -y /dev/block/mmcblk0p17                                                  
[    2.655333] init: [disk_config] ext_check -> ok                                                                                              
[    2.664947] init: [disk_config] :::: fsck -> /dev/block/mmcblk0p11 (ext4):::::                                                               
[    2.671081] init: [disk_config] ext_check -> /system/bin/e2fsck -v -y /dev/block/mmcblk0p11                                                  
[    2.704532] init: [disk_config] ext_check -> ok                                                                                              
[    3.259056] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'                                                  
[    3.270471] init: cannot find '/system/bin/dmbserver', disabling 'dmb'
External UART log from battery-pull and reinsert
Code:
[1630] AST_POWERON
[    0.000000] heap->name mm, mb->start c0000000
[    0.000000] Reserving memory at address ea000000 size: 100000
[    0.000000] sec_dbg_setup: str=@0x88d90004
[    0.000000] sec_dbg_setup: secdbg_paddr = 0x88d90004
[    0.000000] sec_dbg_setup: secdbg_size = 0x40000
[    0.000000] etb_buf_setup: str=@0x8fffb9c0
[    0.000000] etb_buf_setup: secdbg_paddr = 0x8fffb9c0
[    0.000000] etb_buf_setup: secdbg_size = 0x4000
[    0.174484] rdev_init_debugfs: Error-Bad Function Input
[    0.174851] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
[    0.176926] sec_debug_init: enable=0
[    0.177445] sc_debug_iit: restat_reason  0xdf0086c
[    0216206] [sm8960_int_cam:299]setting one!!
[   0.217915 select_req_plan:ACPU PVS:Nominal
    0.25206] i2c ic-14: Invaid 7-bit 2C addres 0x00
[   0.25207] i2c i2-14: Can'tcreate deice at 0x0
[    0252250] 2c i2c-19 Failed t register 2c clientcmc624 at0x38 (-16
[    0252250] ic i2c-19: an't creae device t 0x38
[   0.25243] rdev_iit_debugs: Error-Bd Functio Input
[   0.25292] max895 19-0060:DVS modesdisabled ecause VI0 and VID do not hve propercontrols.
                                                                                           [    0.29536] msmetm msm_em: ETM trcing is nt enable!
[    0.35797] pm_rntime: fal to wakeupllcation tale not intialized
[    .362093] dmi_msm hmi_msm.1:external_ommon_stae_create:sysfs grop de39e60                                                                   
[    0.62734] Inide writeack_driverinit                                                                                                         
[   0.36285] Inside riteback_robe                                                                                                               
[    1.244803] TZCOM: unable to get bus clk



possible exploitations
Possible entry point MODEM - Someone with a JTAG setup test viability of modifying a single byte on /dev/block/mmcblk0p1
Possible entry point PARAMS - Samsung stores their boot parameters in PARAMS partition. It may be possible to modify PARAMS for insecure boot
Possible entry point BOOT - Modify CMDLINE parameter to load information from another location.
Possible entry point BOOT - We may be able to shove an insecure bootloader into memory, boot into that, and then use the recovery partition as our kernel partition. Bauwks 2nd U-Boot. U-Boot is available for the Exynos 4412, we need to find one for Qualcomm.
Possible entry point SYSTEM - It may be possible to use a 2nd init hack from this partition to load custom kernels into memory and reboot the kernel.


Current tasks
What do all of these partitions do?
Do we have a SDCard based recovery?
Where can we find an Odin3 CSC Flash?
Testing methods above is required
Last edited by AdamOutler; 16th August 2012 at 12:21 AM.
The Following 171 Users Say Thank You to AdamOutler For This Useful Post: [ View ]
13th July 2012, 04:33 AM   |  #2  
kzoak82's Avatar
Senior Member
Thanks Meter: 13
 
132 posts
Join Date:Joined: Jan 2011
You may want to try using google translate for the French website. I gave it a shot and it translates pretty well. See attached (sorry, I'm not a developer, but am trying to help in anyway I can). You can also try this url, but you may need to re-enter yourself

http://translate.google.com/translat...Ffaq.php%23f42
Attached Thumbnails
Click image for larger version

Name:	translate.jpg
Views:	8368
Size:	198.4 KB
ID:	1194652  
13th July 2012, 05:02 AM   |  #3  
papi92's Avatar
Senior Member
Thanks Meter: 1,366
 
2,123 posts
Join Date:Joined: Nov 2009
Donate to Me
More
What I am looking into is the upload mode available in Odin. It has no signature checks from what I can tell. Also do you mean a stock Odin file which we do have.

Sent from my SCH-I535 using Tapatalk 2
13th July 2012, 02:26 PM   |  #4  
rothnic's Avatar
Senior Member
Thanks Meter: 278
 
810 posts
Join Date:Joined: Aug 2010
Adam, appreciate you keeping us up to date. As an electrical/systems engineer the journey is great learning experience for me and all.

I'm not sure if you've come across this document. It talks about the MSM7xxx series security capabilities. I couldn't find one for the MSM8xxx, but this may give some insight into how Qualcomm approaches security.

MSM7xxx

Edit: Looks like you are aware of the concepts from your reference about IBL,PBL,SBL.
Last edited by rothnic; 13th July 2012 at 02:32 PM.
14th July 2012, 03:45 AM   |  #5  
Junior Member
Thanks Meter: 8
 
15 posts
Join Date:Joined: Feb 2010
Not sure if this will be any help, but found this regarding the blast kernel:

http://www.anyclub.org/2012/06/how-t...am-memory.html

Quote:

how to add more physical RAM memory section to Blast Kernel in the MDM9200/MDM9600
Blast Kernel has the capability to take more than one contiguous physical RAM space (section) and use it for its own system memory. In order to add more RAM mem section to Blast, the customer need to modify blast_config.c file.

Here is the example of adding 4MB additional RAM mem section.

In blast_config.c,

struct phys_mem_pool_config pool_configs[] __attribute__((weak)) = {
{"DEFAULT_PHYSPOOL", //name
{
{0x00c00000, 0x02f00000}, // 47MB, the first mem section
{0x00700000, 0x00400000} // adding 4MB, QC default value is {0}
}
},


In this example, additional 4MB is added starting from 0x700000 physical address offset.
Please note the start address has to be physical address.
By adding the second mem section, the Blast Kernel can now use 51MB in total, while it used only 47MB before adding the 4MB mem section

Found this http://code.google.com/p/blastkernel/ (locked down though, I couldn't get access) which was linked from here (also in french but translated through google) but I'm unsure as to if it is related to the blastkernel you are looking for as all the links for the source code are now broken.


Also, while looking through the vz source I found that the person responsible for a lot the vzw specific code also helped to develop this http://www.uclinux.org/ so maybe some of that source might be of some help too.
The Following 2 Users Say Thank You to Quize For This Useful Post: [ View ]
14th July 2012, 04:06 AM   |  #6  
There are relatively large pins between the processor and the other larger chip on the back side of the board. I'm not sure what I'm looking at, but it's definitely communications of some kind. These were taken with the battery out of the device when plugged into USB. Each set starts a new unplug-plugin sequence.

Code:
:�0�0�0
          �0
            �0
              �0
                �0��0
                     �0
                       �0��0
                            �0��0
                                 �0
                                   �0
                                     �0
                                       �0��0
                                            �0
                                              �0
                                                �0
                                                  �0
                                                    �0
                                                      �0
                                                        �0
                                                          �0��0�0
                                                                  �0
                                                                    �0
                                                                      �0
                                                                        �0      
                                                                          �0    
                                                                            �0 x

:�0�0�0
          �0
            �0
              �0
                �0��0
                     �0��0
                          �0
                            �0
                              �0
                                �0
                                  �0��0
                                       �0
                                         �0
                                           �0
                                             �0
                                               �0
                                                 �0
                                                   �0
                                                     �0
                                                       �0��0
                                                            �0
                                                              �0
                                                                �0
                                                                  �0            
                                                                    �0��0       
                                                                         �0     
                                                                           �0  z
                                                                             �0
p























:�0�0�0
          �0
            �0
              �0��0
                   �0�0
                        �0
                          �0
                            �0
                              �0
                                �0
                                  �0��0
                                       �0
                                         �0
                                           �0
                                             �0
                                               �0
                                                 �0
                                                   �0
                                                     �0
                                                       �0
                                                         �0
                                                           �0
                                                             �0
                                                               �0               
                                                                 �0             
                                                                   �0��0        
                                                                        �0      
                                                                          �0   �
                                                                            �0�

This is from another pin on the back. As soon as plugged in, a series of 2's come out at 115200BPS:
Code:
22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222
Here's another one:

Code:
2"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""B""B""B""B"DB"DB"DB"D""D""D""D""D""�
All of these were located between the processor and SDCard. I must examine these bettter. In particular, there are two points at the corner of the processor just above where my needle is located in this picture.
Code:
U��UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU�UUU��JUU��UUUU��UUU��Z���UUUU���UUUUU���UUUUUU���UUUU���UUUUUUٙ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
These points seem to be what I'm looking for. as far as UART.. Especially that last one. It moves just as you'd expect start-up checks to move, random strings of characters... While not intelligable in the above, after figuring out the bitrate I'm sure something will come through.


I need to analyze the bitrate at this point. I'm quitting for the night though.


I am at the wrong baud rate, but I think I pulled up some valuable boot data from the processor.
Last edited by AdamOutler; 14th July 2012 at 04:09 AM.
The Following 52 Users Say Thank You to AdamOutler For This Useful Post: [ View ]
14th July 2012, 01:45 PM   |  #7  
Senior Recognized Developer
Flag Gdańsk
Thanks Meter: 3,426
 
1,339 posts
Join Date:Joined: May 2009
Donate to Me
Just a sidenote - some of these testpoints might be CLK/PWM signals, the one with serie of "2222" seems like this.
Also - if UART coming out of FSA muxer is 115200bps - the same debug line, on testpoint before FSA must be aswell 115200bps. Unless bootloader output goes to other port with different baud rate, which sounds unlikely.
The Following 4 Users Say Thank You to Rebellos For This Useful Post: [ View ]
14th July 2012, 02:51 PM   |  #8  
Quote:
Originally Posted by Rebellos

Just a sidenote - some of these testpoints might be CLK/PWM signals, the one with serie of "2222" seems like this.
Also - if UART coming out of FSA muxer is 115200bps - the same debug line, on testpoint before FSA must be aswell 115200bps. Unless bootloader output goes to other port with different baud rate, which sounds unlikely.

You're right about the 2's.. it's probly a sync signal or something....ie...
Code:
00000010
However, I don't believe the UART is all consistant. Here's my reasoning. Samsung does not control the processor or the initial bootloader on the processor. I've spoken to some engineers and they are frustrated because things must be sent to Qualcomm to get work done on the bootloaders. It's highly likely that they simply change the bps of the UART to match the Samsung standard.

Thanks to Josh Groce at MobileTechVideos for the heads up on this trick: I was able to mount the Qualcomm Modem partition which I also belive to be the PBL as a FAT partition
Code:
adam@adam-Desktop:~/Desktop/VZWGS3$ sudo mount ./0p1 ./p1
adam@adam-Desktop:~/Desktop/VZWGS3$ ls -l ./p1
total 16
drwxr-xr-x 2 root root 16384 Jul  5  2011 image
adam@adam-Desktop:~/Desktop/VZWGS3$ ls -l ./p1/image
total 42464
-rwxr-xr-x 1 root root      244 Jun 15 08:33 dsps.b00
-rwxr-xr-x 1 root root      160 Jun 15 08:33 dsps.b01
-rwxr-xr-x 1 root root   147456 Jun 15 08:33 dsps.b02
-rwxr-xr-x 1 root root    31872 Jun 15 08:33 dsps.b03
-rwxr-xr-x 1 root root     6220 Jun 15 08:33 dsps.b04
-rwxr-xr-x 1 root root    13824 Jun 15 08:33 dsps.b05
-rwxr-xr-x 1 root root      404 Jun 15 08:33 dsps.mdt
-rwxr-xr-x 1 root root      180 Jun 15 07:50 dxhdcp2.b00
-rwxr-xr-x 1 root root     6520 Jun 15 07:50 dxhdcp2.b01
-rwxr-xr-x 1 root root   135168 Jun 15 07:50 dxhdcp2.b02
-rwxr-xr-x 1 root root     2100 Jun 15 07:50 dxhdcp2.b03
-rwxr-xr-x 1 root root     6700 Jun 15 07:50 dxhdcp2.mdt
-rwxr-xr-x 1 root root      308 Jun 15 08:33 modem.b00
-rwxr-xr-x 1 root root     6600 Jun 15 08:33 modem.b01
-rwxr-xr-x 1 root root 21960368 Jun 15 08:33 modem.b02
-rwxr-xr-x 1 root root  4962049 Jun 15 08:33 modem.b03
-rwxr-xr-x 1 root root  1358104 Jun 15 08:33 modem.b04
-rwxr-xr-x 1 root root    72208 Jun 15 08:33 modem.b06
-rwxr-xr-x 1 root root   707124 Jun 15 08:33 modem.b07
-rwxr-xr-x 1 root root     1044 Jun 15 08:25 modem_f1.b00
-rwxr-xr-x 1 root root     7060 Jun 15 08:25 modem_f1.b01
-rwxr-xr-x 1 root root     2676 Jun 15 08:25 modem_f1.b02
-rwxr-xr-x 1 root root   954800 Jun 15 08:25 modem_f1.b03
-rwxr-xr-x 1 root root   575208 Jun 15 08:25 modem_f1.b04
-rwxr-xr-x 1 root root   246484 Jun 15 08:25 modem_f1.b05
-rwxr-xr-x 1 root root    94208 Jun 15 08:25 modem_f1.b06
-rwxr-xr-x 1 root root    13568 Jun 15 08:25 modem_f1.b07
-rwxr-xr-x 1 root root    11212 Jun 15 08:25 modem_f1.b08
-rwxr-xr-x 1 root root     9548 Jun 15 08:25 modem_f1.b09
-rwxr-xr-x 1 root root    68223 Jun 15 08:25 modem_f1.b10
-rwxr-xr-x 1 root root   113468 Jun 15 08:25 modem_f1.b13
-rwxr-xr-x 1 root root   164412 Jun 15 08:25 modem_f1.b14
-rwxr-xr-x 1 root root     3604 Jun 15 08:25 modem_f1.b21
-rwxr-xr-x 1 root root    28156 Jun 15 08:25 modem_f1.b22
-rwxr-xr-x 1 root root    19136 Jun 15 08:25 modem_f1.b23
-rwxr-xr-x 1 root root    74360 Jun 15 08:25 modem_f1.b25
-rwxr-xr-x 1 root root    49740 Jun 15 08:25 modem_f1.b26
-rwxr-xr-x 1 root root    84476 Jun 15 08:25 modem_f1.b29
-rwxr-xr-x 1 root root     1064 Jun 15 08:25 modem_f1.fli
-rwxr-xr-x 1 root root     8104 Jun 15 08:25 modem_f1.mdt
-rwxr-xr-x 1 root root     1044 Jun 15 08:25 modem_f2.b00
-rwxr-xr-x 1 root root     7060 Jun 15 08:25 modem_f2.b01
-rwxr-xr-x 1 root root     2676 Jun 15 08:25 modem_f2.b02
-rwxr-xr-x 1 root root   955792 Jun 15 08:25 modem_f2.b03
-rwxr-xr-x 1 root root   579032 Jun 15 08:25 modem_f2.b04
-rwxr-xr-x 1 root root   239892 Jun 15 08:25 modem_f2.b05
-rwxr-xr-x 1 root root    94208 Jun 15 08:25 modem_f2.b06
-rwxr-xr-x 1 root root    13568 Jun 15 08:25 modem_f2.b07
-rwxr-xr-x 1 root root    11212 Jun 15 08:25 modem_f2.b08
-rwxr-xr-x 1 root root     9580 Jun 15 08:25 modem_f2.b09
-rwxr-xr-x 1 root root    68223 Jun 15 08:25 modem_f2.b10
-rwxr-xr-x 1 root root   116188 Jun 15 08:25 modem_f2.b13
-rwxr-xr-x 1 root root   158012 Jun 15 08:25 modem_f2.b14
-rwxr-xr-x 1 root root     3604 Jun 15 08:25 modem_f2.b21
-rwxr-xr-x 1 root root    28156 Jun 15 08:25 modem_f2.b22
-rwxr-xr-x 1 root root    19200 Jun 15 08:25 modem_f2.b23
-rwxr-xr-x 1 root root    74360 Jun 15 08:25 modem_f2.b25
-rwxr-xr-x 1 root root    49756 Jun 15 08:25 modem_f2.b26
-rwxr-xr-x 1 root root    84476 Jun 15 08:25 modem_f2.b29
-rwxr-xr-x 1 root root     1064 Jun 15 08:25 modem_f2.fli
-rwxr-xr-x 1 root root     8104 Jun 15 08:25 modem_f2.mdt
-rwxr-xr-x 1 root root     6908 Jun 15 08:33 modem.mdt
-rwxr-xr-x 1 root root      276 Jun 15 08:24 q6.b00
-rwxr-xr-x 1 root root     6580 Jun 15 08:24 q6.b01
-rwxr-xr-x 1 root root  3447760 Jun 15 08:24 q6.b03
-rwxr-xr-x 1 root root  1653278 Jun 15 08:24 q6.b04
-rwxr-xr-x 1 root root   757840 Jun 15 08:24 q6.b05
-rwxr-xr-x 1 root root    14472 Jun 15 08:24 q6.b06
-rwxr-xr-x 1 root root     6856 Jun 15 08:24 q6.mdt
-rwxr-xr-x 1 root root      180 Jun 15 07:50 tzapps.b00
-rwxr-xr-x 1 root root     6520 Jun 15 07:50 tzapps.b01
-rwxr-xr-x 1 root root   503808 Jun 15 07:50 tzapps.b02
-rwxr-xr-x 1 root root      452 Jun 15 07:50 tzapps.b03
-rwxr-xr-x 1 root root     6700 Jun 15 07:50 tzapps.mdt
-rwxr-xr-x 1 root root      212 Jun 15 07:44 wcnss.b00
-rwxr-xr-x 1 root root      140 Jun 15 07:44 wcnss.b01
-rwxr-xr-x 1 root root     8360 Jun 15 07:44 wcnss.b02
-rwxr-xr-x 1 root root  1778532 Jun 15 07:44 wcnss.b04
-rwxr-xr-x 1 root root      352 Jun 15 07:44 wcnss.mdt
adam@adam-Desktop:~/Desktop/VZWGS3$
Last edited by AdamOutler; 14th July 2012 at 02:54 PM.
The Following 6 Users Say Thank You to AdamOutler For This Useful Post: [ View ]
14th July 2012, 07:53 PM   |  #9  
jcase's Avatar
Forum Moderator / Senior Recognized Developer - Taco Vendor
Flag Sequim WA
Thanks Meter: 7,864
 
3,821 posts
Join Date:Joined: Feb 2010
Donate to Me
More
tz - is the trustzone, normal qualcomm
cache - should not be the dalvik cache, dalvik cache should be on teh userdata partition now on. (Could be wrong, dont have the device). Cache should be almost strictly for updates and recovery use now.

boot itself is signed, not the zImage.

I believe hopping on the developer device is a better option, not only is it made for such, it's also not purchasing a phone within Verizon's sales network (my favorite part of it all)
Last edited by jcase; 16th July 2012 at 02:21 AM.
The Following 3 Users Say Thank You to jcase For This Useful Post: [ View ]
14th July 2012, 08:36 PM   |  #10  
Member
Flag Anderson, IN
Thanks Meter: 15
 
61 posts
Join Date:Joined: Sep 2010
Donate to Me
More
But google slapped on the GPLv3 i believe. And since GPL allows multiple licenses then the TIVO clause would still apply. Correct me if I am wrong.

Thread Closed Subscribe to Thread

Tags
d2vzw, locked bootloader
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes