Root They know how the efuse works? Getting closer to more customr roms?

[Wolfedude88]

nenolod William Pitcock



this means that we can replace mbmloader with an ENG patched mbmloader once we know the permutation value, which is a matter of bruteforcing


3 minutes ago Favorite Retweet Reply

 

[Wolfedude88]

From what I can tell, sounds good to me.

 

[D13]

Spoiler

Holy Shit

This is awesome...please happen in the next two weeks...I don't want to get rid of my X thinking that the unlock is just around the corner

 

[D13]

yesssss!!!

nenolod

we are so close now to the sholes platform unlock. follow us @ irc.freenode.net #sholesunlock

 

[nitsuj17]

haha the 2nd i start getting ready to sell my dx theres finally some great news. i actually had sbfed and reset my phone yesterday to get it ready to sell. im still sticking to my 2 weeks to see some development because last time it seemed like "any day" something would be out. But this does sound great.

Would love to be running miui or cm6 overclocked to about 1.3

 

[D13]

haha the 2nd i start getting ready to sell my dx theres finally some great news. i actually had sbfed and reset my phone yesterday to get it ready to sell. im still sticking to my 2 weeks to see some development because last time it seemed like "any day" something would be out. But this does sound great.

Would love to be running miui or cm6 overclocked to about 1.3

same thing here, was getting ready to sell mine
but 2 weeks...please @nenolod, you can do it

 

[ericsch333]

_mrbirdman_ Homework assignment: find QMI peek/poke nvram commands - GET TO IT FOLLOWERS!


TheRealBeesley Good news tonight fellow sholes (motorola, X, D2, etc) users... Christmas may very well come early

nenolod thanks to chinese sources, we now have the device-side implementation of RSDlite's protocol

 

[mazz0310]

yes, seems like they are getting close...can't wait to see what comes of it.

 

[mazz0310]

I'm trying to join the irc chat so I can help out but it says invite only. Is anyone able to get in?

 

[Retrokid223]

same thing here, was getting ready to sell mine
but 2 weeks...please @nenolod, you can do it

haha the 2nd i start getting ready to sell my dx theres finally some great news. i actually had sbfed and reset my phone yesterday to get it ready to sell. im still sticking to my 2 weeks to see some development because last time it seemed like "any day" something would be out. But this does sound great.

Would love to be running miui or cm6 overclocked to about 1.3

Spoiler

Holy Shit

This is awesome...please happen in the next two weeks...I don't want to get rid of my X thinking that the unlock is just around the corner

yea if you sell it, you will look like a dumb a## like me

 

[nitsuj17]

yea if you sell it, you will look like a dumb a## like me

yeah if they unlocked the day i sold it id be a TAD upset

 

[Steven58]

Y'know! I gotta tell you. I don't understand a word of any of that, but I am very, very content to take advantage and enjoy the fruits of all of their work and donate for their time! Works for me!

 

[D13]

Can someone give me a walkthroug on joining the irc chat

 

[tom108]

Can someone give me a walkthroug on joining the irc chat

1. goto freenode Web IRC (qwebirc)
2. type in a screenname.
3. for the channel type #sholesunlock
then do the the captcha and hit connect.

 

[nitsuj17]

Can someone give me a walkthroug on joining the irc chat

go to freenode Web IRC (qwebirc) create a userid join channel sholesunlock and your good to go!

 

[eulerphi8]

http://nenolod.net/~nenolod/sholes/README

Lots of good info.

 

[Piiman]

haha the 2nd i start getting ready to sell my dx theres finally some great news. i actually had sbfed and reset my phone yesterday to get it ready to sell. im still sticking to my 2 weeks to see some development because last time it seemed like "any day" something would be out. But this does sound great.

Would love to be running miui or cm6 overclocked to about 1.3

They'll probably have it unlocked the day you finally sell it. Please sell it ASAP. Thanks you

 

[Piiman]

nenolod William Pitcock



progress and FAQs on the sholes bootloader unlock attempt: http://nenolod.net/~nenolod/sholes/README


8 minutes ago http://twitter.com/#http://twitter.com/#http://twitter.com/#

nenolod William Pitcock



#liesyoushouldntfallfor "it is impossible to unlock the bootloader on motorola phones."


9 minutes ago Favorite Retweet Repl

 

[vanilla_android_fan]

nenolod William Pitcock



progress and FAQs on the sholes bootloader unlock attempt: http://nenolod.net/~nenolod/sholes/README


8 minutes ago http://twitter.com/#http://twitter.com/#http://twitter.com/#

nenolod William Pitcock



#liesyoushouldntfallfor "it is impossible to unlock the bootloader on motorola phones."


9 minutes ago Favorite Retweet Repl

Can someone PM me the README file? My access to that site is blocked by the MAN.

 

[Airmaxx23]

Can someone PM me the README file? My access to that site is blocked by the MAN.

Done....

 

[vanilla_android_fan]

You're the man! Thank you for the quick response!

 

[Piiman]

Can someone give me a walkthroug on joining the irc chat

I would love that also.

 

[Piiman]

Can someone PM me the README file? My access to that site is blocked by the MAN.

For anyone else


Greetings! Current status is something like: 0% | ********************************** | 100%
In other words, we have a general idea of how to achieve bootloader unlock on these devices, but this has not quite yet culminated into usable code. That's where you guys will be coming into this in the next day or two. We are presently looking for QMI protocol documentation so we can interact with the radio directly. RadioComm is not useful for what we want, as it's a Motorola tool and isn't going to show us the secure area of the radio's NVRAM.
If you would like to watch, then join us on IRC at irc.freenode.net #sholesunlock. We will op-moderate the channel while we are discussing to ensure high signal-to-noise quality while allowing contributions of value to be added to the discussion. This should answer some questions you may have and such:

Q: When can I haz unlock? Must haz 9.001THz overclock ROM!!!
A: NVRAM dump tools will happen first, then we will release an exploit. (In the meantime consider that most actual performance issues are from the scheduler and fixing them has already been covered on my blog, which you can do just by rooting your phone.) Q: How does this work? Why are you attacking the BP? A: It is well known in the mobile phone industry that the safest place to store secret data is in the BP's NVRAM area. (Well, really, the BP's NVRAM is just a file in the EFS structure now, but...)

Q: Ok, you get access to the BP. What happens next?
A: Replacing the checksum on mbmloader with 0xFF or 0x00 should disable the security checks, allowing us to replace it.

Q: Ah, so once replaced, mbmloader will be unlocked then, right? A: Yes, which means we will be able to flash a new mbm image onto the MTD. Specifically one from a dev phone. Q: So once a dev phone MBM is flashed, then what?
A: Then the phone is unlocked as far as eFuse and such go. This allows the flashing of custom boot.img, recovery etc. Custom ROMs are already possible with Koush's hacked up recovery that runs in /system. With Milestone and Charm it will be more tricky - nobody on this team has access to a dev Milestone.

Q: So what is protected by the eFuse anyway?
A: mbmloader and nothing else. mbm enforces it's own protections completely in software.

Q: What is x-loader?
A: In OMAP devices, x-loader is the usual bootstrap for uBoot, much like mbmloader is the bootstrap for mbm. Sholes hardware uses mbmloader+mbm instead of x-loader+uBoot as it contains their verification code.

Q: What is that bootsys.s file?
A: That is template platform initialization code for the MSM6k series AP from Qualcomm. mbmloader is based on similar code from Qualcomm, dating back to previous collaborations between Motorola and Qualcomm.

Q: Does that mean that the underlying code used by RSDlite is also written by Qualcomm? A: Not sure, don't really care. The protocol RSDlite uses to speak to mbmloader is nearly identical though. We also have a sample implementation of that protocol as implemented device-side.

Q: What about the OMAP processor? It could put the sha1sum back after verification!

A: What about it? It could, *but* the calculated sha1sum would be based on the replaced data anyway. There isn't a checksum burned into the ROM on the OMAP, because that would make updating the bootloader software impossible. Anyone who says otherwise has no understanding of the lack of cost benefit that would produce.

Q: I got banned from the IRC channel.
A: That is too bad. Do not complain to freenode staff about it, as they are not going to unban you. If you promise to stop trolling, /msg someone on IRC and we will give you a second chance.
Q: What about the security on Motorola's Android 1.6 devices?
A: The CLIQ and Ming phones are running on a different platform and are generally uninteresting to us.

Q: So why are you guys doing this?
A: Because software freedom is important - and Motorola should have embraced it instead of taken advantage of the Android ecosystem. What they are in effect doing is selling hardware that is misleading to consumers. We feel that it is necessary to correct this in order to empower consumers to take full advantage of free software on their phones.

 

[Airmaxx23]

I would love that also.

Post # 15 has the instructions....

 

[nitsuj17]

yeah it looks like things are happening fast. glad i havent sold my x yet if they can do that