[ABANDONED] Bootloader unlock - discuss bootloader matters here

walter79 · Mar 9, 2012

marhensa said:
new defy variant.
any news of its bootloader?

http://m.gsmarena.com/motorola_defy_xt535-4622.php

Sent from XDA-Developers Android Application

it is a new defy. http://m.gsmarena.com/motorola_introduces_new_defy_in_china-news-3950.php

It has 2 camera.

marhensa · Mar 9, 2012

mihovil13 said:
It's a Defy+ with front camera...nothing new i guess...but, XT series are common to be unlocked...let's wait..

joydeep1985 said:
Its just released in China . We have to wait till Mfunz guys or someone else from china gets their hands on it

walter79 said:
it is a new defy. http://m.gsmarena.com/motorola_introduces_new_defy_in_china-news-3950.php

It has 2 camera.

hope that true mihovil13,
XT series are commonly unlocked.

Sent from XDA-Developers Android Application

walter79 · Mar 9, 2012

marhensa said:
hope that true mihovil13,
XT series are commonly unlocked.

Sent from XDA-Developers Android Application

qualcom cpu MSM7227A 1000 mhz

marhensa · Mar 9, 2012

walter79 said:
qualcom cpu MSM7227A 1000 mhz

different hardware.. :'(

Sent from XDA-Developers Android Application

jayeshrc · Mar 10, 2012

a friend of mine got a backflip engineering device, a company exec gave it to him (it says its not for sale and is an engineering version on the side of the phone) and he's willing to help.. can his phone help us in any way?

eiyee · Mar 10, 2012

jayeshrc said:
a friend of mine got a backflip engineering device, a company exec gave it to him (it says its not for sale and is an engineering version on the side of the phone) and he's willing to help.. can his phone help us in any way?

The backflip is based on Qualcomm MSM 7200A (or so says google), so different hardware platform as well, unfortunately.

Eramix3 · Mar 11, 2012

@Otto.BR
Cara meu Defy é TIM também, tem como você me add no msn e me explicar como você desbloqueou? Grato!

CallMeVentus · Mar 11, 2012

MSM7227A = ARMv6

Herpderp Defy.

Otto.BR · Mar 14, 2012

I missed Epsylon3 post about the sec.ko module, but Eiyee PMed with a link:

My last SBF was 3.4.2 179-002 DEBLUR CEE (Froyo CEE for CM7).

[34250.065948] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00
[34250.068542] SecGetModelId = 00 00 00 00
[34250.069427] SecGetProcID = 19 70 00 13 8c 40 6b 01 00 00 dc ff 02 00 0a 09
[34250.073425] SecProcessorType = 44
[34250.073577] Inserting sec module

P.S. Please people, stop PMing me with "help unlock my phone!" stuff, If I Knew how to do it, it would be posted here already. here is my post explaining what happened with my phone.

Kaffeekranz · Mar 14, 2012

So you've got a blank model Id and your SWRVs differ from ours.
Epsylon tried to change the fuse data, but he changed his values to something different than yours before he bricked his device.
It might be time for him to chime in as he fumbled around with those before.
Simply changing them to your values might be too easy, right?

Though it's nice to see you've got a "normal" HS device after all.

/e

Forget that, I haven't even noticed someone with an unlocked phone has already run the module.
But knowing that this seems to be common behaviour from Asia to South America is still nice to know, as there really seems to be a common unlock option at Motorola.
Whatever.. Eiyee, get on it!

skeevydude · Mar 14, 2012

Bravo has 9.10 Bootloader

I've seen that the Defy uses the same bootloader as the Bravo (9.10), so could anything from the Bravo be of any help? And hexdumps of smaller partitions are from our 2.2.1 (only) sbf are identical to the Defy JRDNEM_U3_3.4.3-36-1.7.sbf.

I only noticed cause a google search on hexdumping led me to a post by Epsylon3 about cg31.smg being hexdumped for the partition table, so I hexdumped ours and it was the same, so I did a few others and so were they (a month ago so I don't remember exactly which ones).

Also if anyone knows how to find cg levels, I'd be thankful. Tried the Defy tool posted around here, but no luck except 45. Have a thread here if someone who knows cares to chime in.

eiyee · Mar 14, 2012

Otto.BR said:
[34250.065948] SecGetSWRV = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00

Thanks Otto! As Kaffekranz noted this matches the value observed on the Chinese eng phones.

Kaffeekranz said:
Forget that, I haven't even noticed someone with an unlocked phone has already run the module.
But knowing that this seems to be common behaviour from Asia to South America is still nice to know, as there really seems to be a common unlock option at Motorola.
Whatever.. Eiyee, get on it!

Happily! Send me a PM to learn my typical hourly rate

.. just joking of course.

Actually I don't see where to go with regard to eFuses. There is still no evidence that a normal locked Defy can be turned into a engineering phone only by some software mechanism - for all we know, the Chinese phones and Otto's phone could just have been produced with different initial eFuse values.

Until we can get evidence that it can been done, personally I remain sceptical about the possibility of resetting eFuse values. TI's OMAP security mechanism relies on them being irreversible and it would be a major fail with, I presume, some very big and unhappy TI customers if it turned out the eFuses could not be relied on.

skeevy420 said:
Also if anyone knows how to find cg levels, I'd be thankful. Tried the Defy tool posted around here, but no luck except 45. Have a thread here if someone who knows cares to chime in.

You could try this quick python hack. Not tested much, perhaps it even works.

Code:

#!/usr/bin/python

import sys
import struct

for path in sys.argv[1:]: 
    img = open(path).read()

    off = 0
    while True:
        i = img[off:].find("\xb4\x01\x00\xca\x02\x14\xda\x95\x1b\x6d\xdc\x97\x07\xce\x40\xea")
        if i < 0:
            break
        off = off + i
        print "%s version %d (@%#x)" % (path, struct.unpack("<I", img[off-4:off])[0], off-4)
        off = off + 16

    if off == 0:
        print "%s sig not found" % path

skeevydude · Mar 14, 2012

eiyee said:
Thanks Otto! As Kaffekranz noted this matches the value observed on the Chinese eng phones.

Happily! Send me a PM to learn my typical hourly rate .. just joking of course.

Actually I don't see where to go with regard to eFuses. There is still no evidence that a normal locked Defy can be turned into a engineering phone only by some software mechanism - for all we know, the Chinese phones and Otto's phone could just have been produced with different initial eFuse values.

Until we can get evidence that it can been done, personally I remain sceptical about the possibility of resetting eFuse values. TI's OMAP security mechanism relies on them being irreversible and it would be a major fail with, I presume, some very big and unhappy TI customers if it turned out the eFuses could not be relied on.

You could try this quick python hack. Not tested much, perhaps it even works.

Thanks, will test when I get home. Python2.x or 3.x ?

nameite · Mar 15, 2012

EmoBoiix3 said:
MSM7227A = ARMv6

Herpderp Defy.

No read here

I brought my gf the XT615, it has the same cpu (MSM7227A) has the new Defy XT535 and Defy mini.

Short bench on Setcpu is around 400ms and long bench is around 450ms
Compared to my Defy@1200ghz, my short bench was 180ms and long bench was 450ms

Anyways I dont think the new Defy will be helpful to us...

skeevydude · Mar 15, 2012

eiyee said:

You could try this quick python hack. Not tested much, perhaps it even works.

Code:

#!/usr/bin/python

import sys
import struct

for path in sys.argv[1:]: 
    img = open(path).read()

    off = 0
    while True:
        i = img[off:].find("\xb4\x01\x00\xca\x02\x14\xda\x95\x1b\x6d\xdc\x97\x07\xce\x40\xea")
        if i < 0:
            break
        off = off + i
        print "%s version %d (@%#x)" % (path, struct.unpack("<I", img[off-4:off])[0], off-4)
        off = off + 16

    if off == 0:
        print "%s sig not found" % path

Thanks, but it gave same results as the other tool. I've been hoping since both our phones have same bootloader, and are real, real similar in other aspects, maybe the sbf's were the signed the same in regards to CG level.

I really do hope you guys succeed with unlocking the bootloader. With all the knowledgeable and determined devs here, you'll turn that 1 to a 0 eventually.

Kaffeekranz · Mar 15, 2012

eiyee said:
Actually I don't see where to go with regard to eFuses. There is still no evidence that a normal locked Defy can be turned into a engineering phone only by some software mechanism - for all we know, the Chinese phones and Otto's phone could just have been produced with different initial eFuse values.

Until we can get evidence that it can been done, personally I remain sceptical about the possibility of resetting eFuse values. TI's OMAP security mechanism relies on them being irreversible and it would be a major fail with, I presume, some very big and unhappy TI customers if it turned out the eFuses could not be relied on.

Though it would be highly unlikely that Otto and the Chinese guys got a BAD phone right after sending them in because of downgrade/bootloader issues.
We can say for sure that those secure bits can't be reverted, right? HS stays HS.
The only thing Otto can do is flash unsigned images which mbmloader allows, whereas mbmloader can't be replaced with something else (which seems to be conclusive with Moto's official unlocks regarding the Razr Dev phones).
Unfortunately I can't find much on the internet describing TI's CPFROM (customer programmable fuses ROM).

Are you sure that those SWRVs actually describe efuse bits?
I really don't understand much about this whole topic, but don't sbf upgrades (v5, v6, recently v7) alter exactly these SWRVs bits?
The only thing we know for sure is that SecProcessorType can't be altered and still stays at 44 even on the "unlocked "phones, right?

_________

Funny story:
Most of the time I'm googling for documents I come across IRC logs with you discussing this topic on the milestone channel.

viper. · Mar 15, 2012

You should move your search here.. www.mail-archive.com/find.php?cx=pa...cof=FORID:9&ie=UTF-8&q=ti+omap+3630&sa=Search

There is a bunch of tehnical data maybe you could find something helpfull.

ofmb · Mar 20, 2012

Anyone has stable kexec-ed kernel for defy to play with?

AFAIK quarx managed to kexec on the defy but failed to keep it alive.
on milestone they reached to a point where they just couldn't reset/re-init the radio.
so, if a pre-alpha kernel would be released we could aim our efforts on finding a way to make the radio work instead of unlocking the bootloader itself.

tell me what you think about that..

abhishek009 · Mar 24, 2012

Any updates

Sent from my MB525

vap_66 · Mar 24, 2012

abhishek009 said:
Any updates

Sent from my MB525

Trust me, if that damned bootloader was cracked, you would've read about it on every topic in this Defy forum

.

[ABANDONED] Bootloader unlock - discuss bootloader matters here

Recognized Developer

Senior Member

Recognized Developer

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Inactive Recognized Contributor

Member

Inactive Recognized Contributor

Senior Member

Inactive Recognized Contributor

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts