Help with Moto G bootloader unlock keygen

Search This thread

IdealInShade

Member
Jun 26, 2017
7
0
Chicago
Booted from Motorola Company Google Drive

Well, that was fast. I guess it's good I got in like 5 minutes after an update and that I downloaded everything. BTW, I did nothing illegal, nor used any special tools. I sent in a request and thought that the actual URL that the short link translated too didn't look right. I just played with it a bit and got in. I don't want to upload anything yet in case I am liable but looking at the Linux fastboot with just the strings command, this is all open source code, same stuff, with some new functionality.

Speaking of which, try the strings command on all the apps from the company that made your phone. I suspect theirs a reason they drag their feet on releasing their updated code public and that is because they are busy scrubbing. The fastboot binary seems to walk through the process of flashing a locked bootloader.
 

ashok1235

New member
Oct 7, 2017
1
0
3a55940006799885#5a59323232324c
375253004d6f746f4733000000#3e65
b8166dfdf45fd97b052bc6a6985ca25
836e5#acd3180b00000000000000000
0000000
 

afphultl

New member
Jul 11, 2010
2
0
help unlock bootloader xt1045

my phone moto xt1045 can't unlock bootloader, error Your device does not qualify for bootloader unlocking. (3A45990755947373#5441343633303732553500585431303435000000#F0E8026CC35DA5B5E3BFB0A8A6FBA6ECDB95B843#B14A8006150000000000000000000000) thank you
 

Shindaiwa

New member
Oct 11, 2017
1
0
help unlock bootloader

help unlock motorola xt1528 - key 9900054558689300#54413030353043
35315400585431353238000000#7F92
49B86F306775364E03905DB1931AFB9
C3CE1#55A7911100000000000000000
0000000
 

sprockkets

Senior Member
Jan 16, 2012
119
27
Guys, unless that guy in China can get you an unlock code (that was years ago), or your phone can be broken via the sunshine tool (get at web address http://theroot.ninja/), you are NOT going to unlock the device. The unlock code is NOT on your device and cannot be extracted - the key moto gives you is processed on the device via it's hash, and if the result matches what it has, grants an unlock.
Depending on the device you can either downgrade it safely by not flashing all the files or buy a device that isn't carrier locked (no att or verizon or cricket).
And in 2017, I wouldn't buy any Moto device unless you really like how they are going with Lenovo. Buy a used OnePlus or heck, you can find new Sony Z3 compacts for $135. And both are easily unlocked if you like.
 
  • Like
Reactions: mariusavenir

Silverwolves1963.08

New member
Jun 29, 2017
4
0
xt1028

my line 3 is BDB40741D6AB844EC8A0FD600147F4F and im not sure how to convert to get my key please assist full code
A000005103F2A700
54413936353131
32573600585431303238000000
7480
BDB40741D6AB844EC8A0FD600147F4F
3D658
7662C1060F000000000000000
0000000
(bootloader) A000005103F2A700#54413936353131
(bootloader) 32573600585431303238000000#7480
(bootloader) BDB40741D6AB844EC8A0FD600147F4F
(bootloader) 3D658#7662C1060F000000000000000
(bootloader) 0000000
 
Well, that was fast. I guess it's good I got in like 5 minutes after an update and that I downloaded everything. BTW, I did nothing illegal, nor used any special tools. I sent in a request and thought that the actual URL that the short link translated too didn't look right. I just played with it a bit and got in. I don't want to upload anything yet in case I am liable but looking at the Linux fastboot with just the strings command, this is all open source code, same stuff, with some new functionality.

Speaking of which, try the strings command on all the apps from the company that made your phone. I suspect theirs a reason they drag their feet on releasing their updated code public and that is because they are busy scrubbing. The fastboot binary seems to walk through the process of flashing a locked bootloader.

(bootloader) Unlock data:
(bootloader) 3A15580478502281#
(bootloader) 5A59323234425644485800585431363530000000#
(bootloader) 5BE58C317FD607D2CD28ED7E76E2BE96F4B5581F#
(bootloader) 4E5DC43C000000000000000000000000
OKAY [ 0.058s]

thank you, reverse engineer, and solidarity ... and yes, me too please, if you can help. i'm going to review this thread more thoroughly now
 

Silverwolves1963.08

New member
Jun 29, 2017
4
0
help unlock getvar and moto unlock data

(bootloader) version: 0.5
(bootloader) version-bootloader: 411A
(bootloader) product: falcon
(bootloader) secure: yes
(bootloader) hwrev: 0x83C0
(bootloader) radio: 0x3
(bootloader) emmc: 8GB Sandisk REV=06 PRV=07 TYPE=17
(bootloader) ram: 1024MB Hynix S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8626 CS
(bootloader) serialno: TA965112W6
(bootloader) cid: 0x0002
(bootloader) channelid: 0x00
(bootloader) uid: 7662C1060F000000000000000000
(bootloader) unlocked: no
(bootloader) iswarrantyvoid: no
(bootloader) mot_sst: 0
(bootloader) max-download-size: 536870912
(bootloader) reason: UTAG "flashfail" configured as fastboot
(bootloader) imei:
(bootloader) meid:
(bootloader) date:
(bootloader) sku:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Fri Feb 26 19:36:21 UTC 2016"
(bootloader) ro.build.fingerprint[0]: motorola/falcon_verizon/falcon_cdm
(bootloader) ro.build.fingerprint[1]: a:5.1/LPBS23.13-33.7-2/2:user/rele
(bootloader) ro.build.fingerprint[2]: ase-keys
(bootloader) ro.build.version.full[0]: Blur_Version.221.201.2.falcon_cdm
(bootloader) ro.build.version.full[1]: a.Verizon.en.US
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.045
(bootloader) version-baseband: MSM8626BP_1032.390.81.01P VZW_CUST
(bootloader) kernel.version[0]: Linux version 3.4.42-ge27f578 (hudsoncm@
(bootloader) kernel.version[1]: ilclbld33) (gcc version 4.8 (GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Fri Feb 26 13:34:35 CST 2016
(bootloader) sdi.git: git=MBM-NG-V41.1A-0-gdc5aeaf
(bootloader) sbl1.git: git=MBM-NG-V41.1A-0-g199f3c5
(bootloader) rpm.git: git=MBM-NG-V41.1A-0-g8b7736e
(bootloader) tz.git: git=MBM-NG-V41.1A-0-g99c1a7c
(bootloader) aboot.git: git=MBM-NG-V41.1A-0-g80481ae
(bootloader) qe: qe 0/1
(bootloader) ro.carrier: vzw



:confused:A000005103F2A700#5441393635313132573600585431303238000000#7480BDB40741D6AB844EC8A0FD600147F4F3D658#7662C1060F0000000000000000000000
 

haseebjan1

New member
Aug 22, 2018
4
0
I don't understand the line 3 method how you unlock this and get key?

---------- Post added at 04:46 PM ---------- Previous post was at 04:42 PM ----------

I may have found something interesting
these are the conversions when using a hex to text converter
140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
To Text

��1�_;]�� k���*+�E

57345A55454F32545A414C4F474A4A5750524D4F
To text
W4ZUEO2TZALOGJJWPRMO
and when i search the machine code on google it gave me no corrections and the first result was to a equation... this may get good
My search https://www.google.com/search?q=+�...�E&aqs=chrome..69i57&sourceid=chrome&ie=UTF-8
The first result https://en.wikipedia.org/wiki/Euler's_identity

---------- Post added at 09:27 AM ---------- Previous post was at 09:20 AM ----------

i translated the text to java (webpage: http://snible.org/java2/uni2java.html and got this "\u0014\n\uFFFD\uFFFD1\uFFFD_;]\uFFFD\uFFFD\u000Fk\uFFFD\uFFFD\uFFFD*+\uFFFDE"

---------- Post added at 09:30 AM ---------- Previous post was at 09:27 AM ----------

the text variation of the 3-ed line can be converted via hex to text to java unicode

---------- Post added at 09:34 AM ---------- Previous post was at 09:30 AM ----------

i just tried it twice with other 3ed lines... they may be using java unicode to encrypt.


please explain line 3 methods when you get it?

---------- Post added at 04:47 PM ---------- Previous post was at 04:46 PM ----------

Can you explain with this example how you can get the 1st line (K) in this unlock data. I will really like to understand it better. the data below is provided by another user on page 3.
fastboot oem get_unlock_data

3A45890085904167#
54413838333041324D5A00585431303332000000#
5D0E47A39BBB9DA7B9632E8C19BD2873B018B7BA#
C2FDC7010F0000000000000000000000

Unlock Code: KAYG2LJBKENAFTW2VTJE
how you get this code please explain line 3 method how to convert this
 

Top Liked Posts

  • There are no posts matching your filters.
  • 14
    Wouldn't it be nice to have a keygen to unlock the bootloader without obtaining the key from motorola?
    I have been investgating the relationship between the bootloader return code and unlock key and have discovered the following:
    Note: For security I have replaced my IMEI and serial number, all other numbers are real. I'm not sure if anyone else has had a go at this but found nothing on XDA.
    Code:
    fastboot oem get_unlock_data
    1A23457698214365#54413839303042
    42443700585431303332000000#140A
    858731D55F3B5DF78F0F6BB9EAE32A2
    B8945#3D372B020F000000000000000
    0000000
    If I use the # character as a separator I get:
    Code:
    1A23457698214365
    5441383930304242443700585431303332000000
    140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
    3D372B020F0000000000000000000000
    Line 1: With the exception of the 2nd character 'A' inserted, these characters are my IMEI number re-arranged a little.
    The last 5 pairs of digits are swapped so an IMEI of 123456789123456 converts to 1A23457698214365

    Line 2: Converting this line from hex to ascii gives me TA8900BBD7�XT1032���
    This is serial and model number with a 00 byte as a spacer and 3 filler at the end.

    Line 4: This is my bootloader UID (obtained from 'fastboot getvar uid' command)

    Lines 1&2&4 I suspect have no relationship whatsoever with the unlock key.
    Probably used to validate and log you on the motorola server when you request the unlock key, ultimately serving the purpose of voiding the warranty.

    Line 3: Coincidence? Could this 20 byte string be relative to the 20 byte unlock key via some simple algorithm assuming lazy programming and/or limited space for code in the bootloader hardware? I couldnt tie this number to anything on my phone so I am guessing this code is derived from the unlock code during the 'fastboot oem get_unlock_data' command.

    I tried online with varied IMEI and serials in the code and also using original values but with varied numbers in line 3 but could not get another unlock code. I don't think I can progress without more examples.

    This was my unlock code: W4ZUEO2TZALOGJJWPRMO
    Converted to hex: 57345A55454F32545A414C4F474A4A5750524D4F
    Code:
    So somehow 140A858731D55F3B5DF78F0F6BB9EAE32A2B8945
    becomes    57345A55454F32545A414C4F474A4A5750524D4F
    Could possibly involve the UID in the equation but I wouldn't bother if I were writing the bootloader and if so, then why have line 3 anyway?

    I tried, a few sums but now I have a headache so I return to my life assisted by alcohol. Surely the solution has to be simple. Just thought I would post and see if anyone else could pick up from where I left off.

    Have fun.......
    5
    For the moment the program only analyzes and prepare the datas obtained via "$ fastboot oem get_unlock_data".
    A few years ago I studied the cipher cards, but almost nothing. I think we will have to collaborate all of us.
    This is an entertainment that not everyone has time to devote, but if you like you spend one minute.

    Imei used, hash and UID bootloader. Model and serial number in hex ​​line 2 does not use it.
    All data is used except line 2 (Serialnumber and Model) in the page of motorola unlock device.
    I have written some incorrect data and tells me "Your device does not qualify for bootloader unlocking",
    but if I return to write well, tell me if I can unlock. So as you can see in the code of the page
    Code:
    type:"POST",url:"/cc/productRegistration/verifyPhone/"+phoneSN+"/"+phonePUID+'/'+phoneHash+'/'...
    Uses these 3 values full. My program, for the moment only prepare and presents the data to send.


    Note: in
    Code:
    https://motorola-global-portal-pt.custhelp.com/cc/productRegistration/verifyPhone/phoneSN(IMEI)/phonePUID/phoneHASH
    i received "Not qualified", but in
    Code:
    https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-b
    are ok for unlocking.
    4
    So, we are just wasting time here. There are nothing to do about this... Even if we have sucess with a keygen, our warranty will be void...

    For warranty and for USA and GLOBAL gsm units your probably right but you have to remember there are versions of the moto g that are not allowed to be unlocked by moto like the verizon and the AIO versions and I am sure a working unlock would be very helpful to owners of those units that have no unlock options
    4
    Can someone who unlocked and was willing to give out their code also dump their persist, UTAGS, CID and PDS partitions and upload it here?

    The CID partition is where the unlock_data command is getting those hashes (the entire hex strings are taken directly out of there). The PDS and UTAGS partitions are also partitions where the data is specific to the phone (both contain the serial #) and I'm curious if I can find any correlation to someone's unlock code stored somewhere in there. If nothing pans out then it looks like a very painful process to crack.. if the exact algorithm/which keys they are using to hash with the unlock code were known and if its even using that hash in the CID to match, then its very possible to use hashcat to find your key. I just have a feeling (more like hoping) its easier than brute-forcing it out there and its written as a backup somewhere.


    FYI, there are some interesting strings just by dumping that fastboot partition:

    0123456789abcdef0123456789ABCDEF<null>
    token "%s" is found. Replace it with "%s".
    dbval_read_partition
    Malloc for DBVC: db_len %x failed!
    No CID partition found!
    failed to read CID 1st part of block for partition %s
    Dlmot_sst_oem_lock_handler
    mot_sst_validate_hash_password
    %02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X#%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X
    %s: temp buffer malloc failure!
    %s: hash_ptr malloc failure!
    %s: hash calculation faliure!
    %s: hash calculation failure!
    hash at offset i: %02d : %02x does not match
    Error while unlocking device
    mot_sst_validate_token: Token header incorrect
    mot_sst_validate_token: Format version incorrect
    mot_sst_validate_token: Length incorrect
    mot_sst_validate_token: Binding information incorrect
    mot_sst_validate_token: Unable to validate token integrity
    mot_sst_validate_token: Token integrity invalid
    unlock failed in sst oem unlock handler %02x
    unlock data invalid!
    Cannot provide unlock data
    Cannot provide unlock data!
    general failure in sst oem unlock handler %02x
    General system failure! %02x
    Unlock completed! Wait to reboot
    General Unlock failure!
    unlock failed in sst oem unlock handler
    Done Setup my special MOT SST values
    mot_sst_create_token: Unable to retrieve PUID
    mot_sst_create_token: Unable to retrieve FUID
    mot_sst_create_token: Getting PSV
    mot_sst_create_token: Unable to retrieve PSV
    mot_sst_create_token: Generate token code
    mot_sst_create_token: token code generated!
    mot_sst_create_token: Writing token
    mot_sst_create_token: Unable to generate token code
    create_token status: %d
    mot_sst_create_token: Creating token
    mot_sst_create_token: Getting flash uid
    mot_sst_oem_lock_handler: invalid state
    mot_sst_oem_lock_handler: load and validate failed
    %s failure to delete or create token
    mot_sst_pal_gen_aes_cmac: START
    Success generating cmac
    FAIL generating cmac
    %s: failed to freeze utags: %d
    ERROR: Cannot write device info
    ERROR: out of memory
    ERROR: Cannot read device info
    ERROR: Device info corrupted
    failed to thaw utags from partition "%s", error: %d
    failed to load utags from secondary storage
    generating empty utags in memory
    dbval_validate_generic_datablock - Check Cert Chain
    dbval_validate_generic_datablock - Check DB Signature
    dbval_db_validate_gen_hdr - Check Type
    dbval_db_validate_gen_hdr - Read Processor UID
    dbval_db_validate_gen_hdr - Read Flash UID
    dbval_db_validate_gen_hdr - PAL UID
    dbval_db_validate_gen_hdr - DB UID
    dbval_db_validate_gen_hdr - Success
    dbval_db_validate_gen_hdr - Flash UID Length returned INVALID, must be 16 bytes
    dbval_db_validate_gen_hdr - Processor UID Length returned INVALID, must be 16 bytes

    I'm not understanding if you successfully got that information. But here is why this is probably a dead end.

    Technically it shouldn't be possible to do this because those memory locations are protected by ARM Trusted Zone. Not even kernel root can grab them. Only the bootloader has the privilege to do this, and I doubt that function was put in.

    The unlock key isn't stored on the phone. The unlock key gets hashed with the information on the phone and the result must match what is in that partition. So even if you got that value, it wouldn't do you any good.

    Don't take my word for it, take Dan Rosenberg's who hacked the bootloader the first time:

    "As a result, there is no way for a user to generate his or her own valid unlock token without either breaking RSA to violate the integrity of the CID partition, or by performing a pre-image attack against SHA-1, both of which are computationally infeasible in a reasonable amount of time.
    4
    [DEPRECEATED] Random key generator for Linux (Code included) and Windows as well

    I have just created a Random key generator based on the keys listed in the Google document. I have included the CPP file in the archive itself, my coding is not so good, i tried my best to explain. I made script for Linux since i don't have any idea how to easily do it on windows while The program will work on any platform. It works on the basis of some facts which may be false:-

    1. The first and last 2 elements are always character
    2. At most 3 integers are there in the key.

    I do not guarantee that this will work as it is entirely luck. I will still love to see a keygen though. This is all i could do! Please improve it if you can and i feel at least 10-15 examples are needed for a perfect keygen.
    The attachment consists of cpp file, a script, an executable, and a information file.

    To start put your device in fastboot mode and just execute the script inside the folder as a root or using sudo otherwise fastboot will not recognize your device.

    FOR LINUX
    Code:
    sudo /bootul.sh

    FOR WINDOWS

    Code:
    KeygenRun.bat

    UPDATE: Just made some changes in the program as script was not working and same set of numbers were being generated again and again, Please download.

    UPDATE 2: As per the request i have compiled it for Windows as well. There is a separate archive which has a file KeygenRun.bat which should be Run after the device is put on fastboot mode. Copy the content to your fastboot folder. Just Shift+Right-click in the fastboot folder and open command prompt and type KeygenRun.bat. It will start running fastboot commands.