Help with Moto G bootloader unlock keygen

Search This thread

markofei

Member
Dec 25, 2015
5
1
This seemed to me like it would go no where and hit a dead end.....For one reason how is it that a random Chinese fellow was sending people Unlock codes while those people were just providing him with IMEI numbers? We have to think like that Chinese man. We know now that the IMEI numbers have something to do with the codes but we might never know unless we are provided with enough info... Maybe you should provide you IMEI number along with this thread. I believe that the IMEI number plays a big role in reaching the Unlock code.

---------- Post added at 05:35 AM ---------- Previous post was at 05:24 AM ----------


I noticed that when you use fastboot cmd: fastboot oem get_unlock_data we get a long bootloader data code which provides the 1st 14 numbers of the IMEI number and ending with 2 zeros where we all know one of the zeros gets replace with the letter A. The IMEI number provided to our Devices is a 15 character number phrase. The second zero provided is the last number in our IMEI numbers which comes out to 16 characters as providing with using the fastboot cmd. This is the way they are returned to a consumer edition device. A developer edition device returns with the proper Unlock data. I think Motorola scrambles the numbers and puzzles it out. Well we now know how to generate our 1st line in our Unlock data. What do you think of this?

Can you explain with this example how you can get the 1st line (K) in this unlock data. I will really like to understand it better. the data below is provided by another user on page 3.
fastboot oem get_unlock_data

3A45890085904167#
54413838333041324D5A00585431303332000000#
5D0E47A39BBB9DA7B9632E8C19BD2873B018B7BA#
C2FDC7010F0000000000000000000000

Unlock Code: KAYG2LJBKENAFTW2VTJE
 

MrTvor88

Senior Member
Jan 6, 2016
62
12
I think this is a great idea and would love to see someone work on it. I would love to use it on my Droid Turbo 2!
 

wormy987123

Senior Member
Jun 19, 2012
231
106
this would be great if interest for it didnt decline. I would love to unlock my Moto G4 Amazon edition. when I pressed the buy button it was unlockable but by the time i received it was not
 

ZeDingo

Member
Jun 24, 2013
33
5
The first "field" of my get_unlock_data is 3A35330326485560. My cellularI networkM registrationE numberI is 3533062845506. (My SIM card slot was destroyed before the phone could be activated, so I don't care if someone has my phone's identifying number. It would be no different than picking a random valid number. I'm just not writing what it's called to at least protect it from scraper bots.)


__ 35 33 33 06 28 45 50 6
3A 35 33 03 26 48 55 60


I think it's moving the "tens" digit left.

__ 35 33 33 06 28 45 50 6_
3A 35 33 03 26 48 55 60
 

ultrasoul

Senior Member
Sep 8, 2007
62
6
Here are 2 more data points:
3A452104073606175A59323233434338394D004D6F746F20472000009FE785BCB7BB69DF44FD4B308E4F2B5680100755E07A1301000000000000000000000000
Unlock Code: 6MSWCW52YHNYJG2JFOBJ

9900054679155800#54413039383030384C4100585431353236000000#1C199BFBEE304D78A540F1ECA9FC127F622BCA12#313A2A04000000000000000000000000
Unlock Code: BKFQFGNWFDGG3KJRWEMI
 

uzairbhutta

New member
Aug 9, 2016
4
0
bootloader unlock code

9900011771059800
544136343830344E343500000000000000000000
2FF67FD2F42859FCB079CE02B8135FB45B18EA1C
09BBEF01020001000000000000000000
anyone please send me boot-loader unlock key
 

billa

Senior Member
Mar 30, 2006
862
387
Guys, the first 2 lines are easy to decipher, it's just the swapped imei and UID etc, but the problem is the public key which is the modulo exponent (e) of 2 very large prime numbers, decrypted by Moto's private key comprising of the modulo exponent (d) to yield the unlock code.

Now, if you do a quick search on public/private key cryptography, you will quickly find that factoring large integers takes an enormous amount of computational time and power even with today's fastest computers. Hate to burst the bubble, but this avenue may not be the way to go. On the other hand, patching or bypassing certain vulnerabilities could lead to results.
 
Last edited:

uzairbhutta

New member
Aug 9, 2016
4
0
bootloader unlock key

9900011771059800
544136343830344E343500000000000000000000
2FF67FD2F42859FCB079CE02B8135FB45B18EA1C
09BBEF01020001000000000000000000
Please send me boot loader unlock key.:crying::crying::crying:
 

sahir1993

Senior Member
Jul 15, 2015
136
21
Jhelum
Samsung Galaxy S9
Hey guys i'm just a nube. I hv moto x 2nd gen xt1097 at&t version ( network unlocked), here is my unlock data but don't hv unlock cause motorola only alloq unlocking of pure version.
3A95720905558751#5441393839303053553800585431303937000000#582AF1AC0D26EE1E89996F85E8CE84C67CCB7D06#E8A9FC0B0B0000000000000000000000

Sorry i mixed all lines. It will b great if some one create bootloader unlock key or keygen...
 

otro_mas

New member
Nov 26, 2016
1
0
Just for colaborate

Hola!
I post my codes and i hope you can do something useful with them!! :highfive:

3A95130205739271#5A58314236323339535800585431303235000000#E6E955680B50A5BBFD48CE5FBC163852F4B3B01A#EF75DF03120000000000000000000000

Unlock code QI3AEKXAEPB3JDNNCEVN

Saludos!
 

nemstar

Member
Aug 19, 2012
11
3
I am pretty sure I found the code below that is of importance to validate that a device is allowed to be unlocked when submitting to return an Unlock Code on the motorola website.
I think we should be able to edit this and make it work locally, or by editing within the developer console of the web browser.

https://motorola-global-portal.cust...-device-b.b0c6ca3e285678bab1dc00b16008091c.js

<-----------Code Below This Line------------->
RightNow.namespace('Custom.Widgets.product_registration.BootLoader');Custom.Widgets.product_registration.BootLoader=RightNow.Widgets.extend({constructor:function(){this._eo=new RightNow.Event.EventObject();$("#checkID").bind('click',{widget:this},this._checkProduct);$('#unlockPhone').submit(function(){var conf1=confirm('Unless you have a developer edition device, this will void your warranty. Are you sure?');if(conf1){return true;}else{return false;}});},methodName:function(){},_checkProduct:function(e)
{var phoneID=$('#phoneID').val();var phoneArray=phoneID.split('#');var phoneSN=phoneArray[0];var phoneHash=phoneArray[2];var phonePUID=phoneArray[3];var checkResults=bootLoaderCheck(phoneSN,phoneHash,phonePUID);if(!phoneSN||!phonePUID)
{if(!phoneSN){alert('Serial Number not found in your identifier, please try again.');}else if(!phonePUID){alert('PUID Not found in your identifier, please try again.');}
$("#unlockPhone").attr("action","/app/error/");}}});function fastbootConvert(phoneSN){var chars=phoneSN.split("");if(chars[1]=='A'){convertedSN=chars[0]+chars[3]+chars[2]+chars[5]+chars[4]+chars[7]+chars[6]+chars[9]+chars[8]+chars[11]+chars[10]+chars[13]+chars[12]+chars[15]+chars[14];}else if(phoneSN.substring(0,2)=='99'||phoneSN.substring(0,2)=='98'||phoneSN.substring(0,2)=='97'){convertedSN=phoneSN.substring(0,phoneSN.length-2);typeSN='MEID';}else{convertedSN=phoneSN;}
return convertedSN;}
function bootLoaderCheck(phoneSN,phoneHash,phonePUID){$('#processingContainer').removeClass('noShow');$.ajax({type:"POST",url:"/cc/productRegistration/verifyPhone/"+phoneSN+"/"+phonePUID+'/'+phoneHash+'/',dataType:"json",success:function(data){var eo=new RightNow.Event.EventObject();$('#processingContainer').addClass('noShow');},error:function(xhr){try{console.dir(xhr);}
catch(e){}
if(xhr.responseText=="Not qualified"){alert('Your device does not qualify for bootloader unlocking.');}else if(xhr.responseText=="Phone qualifies"){$("#unlockPhone").attr("action","/cc/productRegistration/unlockPhone/"+phoneSN+"/"+phonePUID+'/'+phoneHash+'/');$('#submit').removeClass('noShow');}else{alert('Your input text was not recognized as a valid dataset. Please try again.');}
$('#processingContainer').addClass('noShow');}});}
 
Last edited:

uuu665

New member
Feb 1, 2017
1
0
What is needed is more examples. If people post the line 3 and unlock code in hex, then the problem can be solved. Unless you are the kid from mercury rising or rain man, the best that can be acheived with only one example is a headache. Trust me!

please sir can you help me to unlock please

9900020282676400#54413632363037
(bootloader) 554F5800000000000000000000#491D
(bootloader) B766A8A166A796BA4217967799EEB88
(bootloader) C0234#741FAB040C000100000000000
(bootloader) 0000000:(:(
 

Preheatedbug

New member
Oct 20, 2015
3
0
Just as a question because I am currently working on this myself. Can a brute force attack be done to find the unlock code as a batch file? Just wanted to ask before I spent any more time on this for it just to fail anyway.
 

levone1

Senior Member
Dec 28, 2014
3,827
1,478
Ok, so first off, its not a generator, token is hashed with other data then compared to a stored value I believe.


I don't know if all interested parties have moved on, but fk2106 might be on to something. The element
he/she is talking about seems to be an equation :

Wouldn't it be nice to have a keygen to unlock the bootloader without obtaining the key from motorola?
I have been investgating the relationship between the bootloader return code and unlock key and have discovered the following...

Anything doing with this anymore? I picked up an xt1028 cheap at local repair shop, just to mess around with, (I'm mostly an Xperia user), and I became interested in trying to crack the thing. I've gone almost to the nth degree. I'm willing to contribute something if I can...
 

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,308
15,761
Raleigh NC
Anything doing with this anymore? I picked up an xt1028 cheap at local repair shop, just to mess around with, (I'm mostly an Xperia user), and I became interested in trying to crack the thing. I've gone almost to the nth degree. I'm willing to contribute something if I can...

Your odds of building a space ship to mars in your backyard by next weekend, are about as good as your odds at bruteforcing your token.
 
  • Like
Reactions: levone1

levone1

Senior Member
Dec 28, 2014
3,827
1,478
Your odds of building a space ship to mars in your backyard by next weekend, are about as good as your odds at bruteforcing your token.

Thanks. I read the overwhelming calculation a few pages back. Obviously not worth anyone's life's work, but I didn't know if there was still anyone out there with some other feasible hope... I know originally this thread was suggesting a possible correlation between fastboot bl data and an unlock code. Or maybe someone out there is into hacking security vulnerabilities, etc
 

zen_hakuren

Member
Jun 27, 2015
23
0
Red Magic 6S Pro
I may have found something interesting
these are the conversions when using a hex to text converter
140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
To Text

��1�_;]��k���*+�E

57345A55454F32545A414C4F474A4A5750524D4F
To text
W4ZUEO2TZALOGJJWPRMO
and when i search the machine code on google it gave me no corrections and the first result was to a equation... this may get good
My search https://www.google.com/search?q=%14+%EF%BF%BD%EF%BF%BD1%EF%BF%BD_%3B%5D%EF%BF%BD%EF%BF%BD%0Fk%EF%BF%BD%EF%BF%BD%EF%BF%BD*%2B%EF%BF%BDE&rlz=1C1CHZL_enUS733US733&oq=%14+%EF%BF%BD%EF%BF%BD1%EF%BF%BD_%3B%5D%EF%BF%BD%EF%BF%BD%0Fk%EF%BF%BD%EF%BF%BD%EF%BF%BD*%2B%EF%BF%BDE&aqs=chrome..69i57&sourceid=chrome&ie=UTF-8
The first result https://en.wikipedia.org/wiki/Euler%27s_identity

---------- Post added at 09:27 AM ---------- Previous post was at 09:20 AM ----------

i translated the text to java (webpage: http://snible.org/java2/uni2java.html and got this "\u0014\n\uFFFD\uFFFD1\uFFFD_;]\uFFFD\uFFFD\u000Fk\uFFFD\uFFFD\uFFFD*+\uFFFDE"

---------- Post added at 09:30 AM ---------- Previous post was at 09:27 AM ----------

the text variation of the 3-ed line can be converted via hex to text to java unicode

---------- Post added at 09:34 AM ---------- Previous post was at 09:30 AM ----------

i just tried it twice with other 3ed lines... they may be using java unicode to encrypt.
 

krison01

Member
May 5, 2016
35
8
hex: 3A15580618283806#5A593232343350514B5A004D6F746F2047200000#FCBBE13AE0FEC4E9C4873591B1E1192C23477A01#43EFEC29000000000000000000000000
ASCII text: X(8ZY2243PQKZMoto G ü»á:àþÄéć5‘±á,#GzCïì)
first line imei
second line sn and model
last line uid
third with remaining: AFCBBE13AE0FEC4E9C4873591B1E1192C23477A0100
ASCII: ¯Ë¾®ìNœHsY’Â4w*
 
Last edited:

IdealInShade

Member
Jun 26, 2017
7
0
Chicago
So, I got into a google drive folder and is this already known?

So I like to mess around with anything coding/IT/tech related. I'm often up late either trying to code something new, trying to break someone else's code, or just hacking away at whatever I find interesting. That said, I don't even like Moto, button placement is dumb, so sorry if the contents of their Google Drive is public somewhere and I just don't know about it.

Anyways, I go back and mess around in fastboot mode on my Droid Turbo 2 XT1585 (Update 2017-02-02) when I'm feeling bored. I first discovered that certain characters (not the getvar all stuff, or oem itself, got that long ago) when passed to the BL using fastboot oem return stuff like '0x0.07ffeb742db9p-1022' which I haven't seen mentioned in public but it's been a while.

The numbers change with the same input sent to the same fastboot oem subcommands, but I do seem to be able to control parts of it and the case of the hex address (I think) returned. If that could be new, I can go into detail.

I also got a goo.gl address while messing with it. I was told to request permission. I did through some account I don't really use, but then I remembered back in like 2013 or something Google really messed up Drive and let people share their shame. I played around a bit with the URL structure andI was able to eventually get into goo.gl/Qyzg2L

I downloaded everything right away of course. The guy who runs the account is a motorola employee, with motorola email and he just updated it right before I got in so hopefully if it's old news he made a career ending programming error and there's some code or comment that tells us all. I doubt it though. He seems pretty organized besides this little slip up if that's the case.

Edit: Use the strings command in Linux against the vendor binaries, there is often interesting stuff in there.

So, any of this new or do I need to go to sleep?
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 14
    Wouldn't it be nice to have a keygen to unlock the bootloader without obtaining the key from motorola?
    I have been investgating the relationship between the bootloader return code and unlock key and have discovered the following:
    Note: For security I have replaced my IMEI and serial number, all other numbers are real. I'm not sure if anyone else has had a go at this but found nothing on XDA.
    Code:
    fastboot oem get_unlock_data
    1A23457698214365#54413839303042
    42443700585431303332000000#140A
    858731D55F3B5DF78F0F6BB9EAE32A2
    B8945#3D372B020F000000000000000
    0000000
    If I use the # character as a separator I get:
    Code:
    1A23457698214365
    5441383930304242443700585431303332000000
    140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
    3D372B020F0000000000000000000000
    Line 1: With the exception of the 2nd character 'A' inserted, these characters are my IMEI number re-arranged a little.
    The last 5 pairs of digits are swapped so an IMEI of 123456789123456 converts to 1A23457698214365

    Line 2: Converting this line from hex to ascii gives me TA8900BBD7�XT1032���
    This is serial and model number with a 00 byte as a spacer and 3 filler at the end.

    Line 4: This is my bootloader UID (obtained from 'fastboot getvar uid' command)

    Lines 1&2&4 I suspect have no relationship whatsoever with the unlock key.
    Probably used to validate and log you on the motorola server when you request the unlock key, ultimately serving the purpose of voiding the warranty.

    Line 3: Coincidence? Could this 20 byte string be relative to the 20 byte unlock key via some simple algorithm assuming lazy programming and/or limited space for code in the bootloader hardware? I couldnt tie this number to anything on my phone so I am guessing this code is derived from the unlock code during the 'fastboot oem get_unlock_data' command.

    I tried online with varied IMEI and serials in the code and also using original values but with varied numbers in line 3 but could not get another unlock code. I don't think I can progress without more examples.

    This was my unlock code: W4ZUEO2TZALOGJJWPRMO
    Converted to hex: 57345A55454F32545A414C4F474A4A5750524D4F
    Code:
    So somehow 140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
    becomes    57345A55454F32545A414C4F474A4A5750524D4F
    Could possibly involve the UID in the equation but I wouldn't bother if I were writing the bootloader and if so, then why have line 3 anyway?

    I tried, a few sums but now I have a headache so I return to my life assisted by alcohol. Surely the solution has to be simple. Just thought I would post and see if anyone else could pick up from where I left off.

    Have fun.......
    5
    For the moment the program only analyzes and prepare the datas obtained via "$ fastboot oem get_unlock_data".
    A few years ago I studied the cipher cards, but almost nothing. I think we will have to collaborate all of us.
    This is an entertainment that not everyone has time to devote, but if you like you spend one minute.

    Imei used, hash and UID bootloader. Model and serial number in hex ​​line 2 does not use it.
    All data is used except line 2 (Serialnumber and Model) in the page of motorola unlock device.
    I have written some incorrect data and tells me "Your device does not qualify for bootloader unlocking",
    but if I return to write well, tell me if I can unlock. So as you can see in the code of the page
    Code:
    type:"POST",url:"/cc/productRegistration/verifyPhone/"+phoneSN+"/"+phonePUID+'/'+phoneHash+'/'...
    Uses these 3 values full. My program, for the moment only prepare and presents the data to send.


    Note: in
    Code:
    https://motorola-global-portal-pt.custhelp.com/cc/productRegistration/verifyPhone/phoneSN(IMEI)/phonePUID/phoneHASH
    i received "Not qualified", but in
    Code:
    https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-b
    are ok for unlocking.
    4
    So, we are just wasting time here. There are nothing to do about this... Even if we have sucess with a keygen, our warranty will be void...

    For warranty and for USA and GLOBAL gsm units your probably right but you have to remember there are versions of the moto g that are not allowed to be unlocked by moto like the verizon and the AIO versions and I am sure a working unlock would be very helpful to owners of those units that have no unlock options
    4
    Can someone who unlocked and was willing to give out their code also dump their persist, UTAGS, CID and PDS partitions and upload it here?

    The CID partition is where the unlock_data command is getting those hashes (the entire hex strings are taken directly out of there). The PDS and UTAGS partitions are also partitions where the data is specific to the phone (both contain the serial #) and I'm curious if I can find any correlation to someone's unlock code stored somewhere in there. If nothing pans out then it looks like a very painful process to crack.. if the exact algorithm/which keys they are using to hash with the unlock code were known and if its even using that hash in the CID to match, then its very possible to use hashcat to find your key. I just have a feeling (more like hoping) its easier than brute-forcing it out there and its written as a backup somewhere.


    FYI, there are some interesting strings just by dumping that fastboot partition:

    0123456789abcdef0123456789ABCDEF<null>
    token "%s" is found. Replace it with "%s".
    dbval_read_partition
    Malloc for DBVC: db_len %x failed!
    No CID partition found!
    failed to read CID 1st part of block for partition %s
    Dlmot_sst_oem_lock_handler
    mot_sst_validate_hash_password
    %02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X
    %s: temp buffer malloc failure!
    %s: hash_ptr malloc failure!
    %s: hash calculation faliure!
    %s: hash calculation failure!
    hash at offset i: %02d : %02x does not match
    Error while unlocking device
    mot_sst_validate_token: Token header incorrect
    mot_sst_validate_token: Format version incorrect
    mot_sst_validate_token: Length incorrect
    mot_sst_validate_token: Binding information incorrect
    mot_sst_validate_token: Unable to validate token integrity
    mot_sst_validate_token: Token integrity invalid
    unlock failed in sst oem unlock handler %02x
    unlock data invalid!
    Cannot provide unlock data
    Cannot provide unlock data!
    general failure in sst oem unlock handler %02x
    General system failure! %02x
    Unlock completed! Wait to reboot
    General Unlock failure!
    unlock failed in sst oem unlock handler
    Done Setup my special MOT SST values
    mot_sst_create_token: Unable to retrieve PUID
    mot_sst_create_token: Unable to retrieve FUID
    mot_sst_create_token: Getting PSV
    mot_sst_create_token: Unable to retrieve PSV
    mot_sst_create_token: Generate token code
    mot_sst_create_token: token code generated!
    mot_sst_create_token: Writing token
    mot_sst_create_token: Unable to generate token code
    create_token status: %d
    mot_sst_create_token: Creating token
    mot_sst_create_token: Getting flash uid
    mot_sst_oem_lock_handler: invalid state
    mot_sst_oem_lock_handler: load and validate failed
    %s failure to delete or create token
    mot_sst_pal_gen_aes_cmac: START
    Success generating cmac
    FAIL generating cmac
    %s: failed to freeze utags: %d
    ERROR: Cannot write device info
    ERROR: out of memory
    ERROR: Cannot read device info
    ERROR: Device info corrupted
    failed to thaw utags from partition "%s", error: %d
    failed to load utags from secondary storage
    generating empty utags in memory
    dbval_validate_generic_datablock - Check Cert Chain
    dbval_validate_generic_datablock - Check DB Signature
    dbval_db_validate_gen_hdr - Check Type
    dbval_db_validate_gen_hdr - Read Processor UID
    dbval_db_validate_gen_hdr - Read Flash UID
    dbval_db_validate_gen_hdr - PAL UID
    dbval_db_validate_gen_hdr - DB UID
    dbval_db_validate_gen_hdr - Success
    dbval_db_validate_gen_hdr - Flash UID Length returned INVALID, must be 16 bytes
    dbval_db_validate_gen_hdr - Processor UID Length returned INVALID, must be 16 bytes

    I'm not understanding if you successfully got that information. But here is why this is probably a dead end.

    Technically it shouldn't be possible to do this because those memory locations are protected by ARM Trusted Zone. Not even kernel root can grab them. Only the bootloader has the privilege to do this, and I doubt that function was put in.

    The unlock key isn't stored on the phone. The unlock key gets hashed with the information on the phone and the result must match what is in that partition. So even if you got that value, it wouldn't do you any good.

    Don't take my word for it, take Dan Rosenberg's who hacked the bootloader the first time:

    "As a result, there is no way for a user to generate his or her own valid unlock token without either breaking RSA to violate the integrity of the CID partition, or by performing a pre-image attack against SHA-1, both of which are computationally infeasible in a reasonable amount of time.
    4
    [DEPRECEATED] Random key generator for Linux (Code included) and Windows as well

    I have just created a Random key generator based on the keys listed in the Google document. I have included the CPP file in the archive itself, my coding is not so good, i tried my best to explain. I made script for Linux since i don't have any idea how to easily do it on windows while The program will work on any platform. It works on the basis of some facts which may be false:-

    1. The first and last 2 elements are always character
    2. At most 3 integers are there in the key.

    I do not guarantee that this will work as it is entirely luck. I will still love to see a keygen though. This is all i could do! Please improve it if you can and i feel at least 10-15 examples are needed for a perfect keygen.
    The attachment consists of cpp file, a script, an executable, and a information file.

    To start put your device in fastboot mode and just execute the script inside the folder as a root or using sudo otherwise fastboot will not recognize your device.

    FOR LINUX
    Code:
    sudo /bootul.sh

    FOR WINDOWS

    Code:
    KeygenRun.bat

    UPDATE: Just made some changes in the program as script was not working and same set of numbers were being generated again and again, Please download.

    UPDATE 2: As per the request i have compiled it for Windows as well. There is a separate archive which has a file KeygenRun.bat which should be Run after the device is put on fastboot mode. Copy the content to your fastboot folder. Just Shift+Right-click in the fastboot folder and open command prompt and type KeygenRun.bat. It will start running fastboot commands.