Wednesday, August 26, 2015



Next post will elaborate on what exactly we need to unlock this damn bootloader.



So the 'standard' motorola procedure for unlocking the bootloader goes like this:

fastboot oem get_unlock_data
(bootloader) 3A45990705949553#54413436333034
(bootloader) 494E3300585431303435000000#A07E
etc...
we send this bigass string: 3A45990705949553#54413436333034... to moto via their website
and ideally (not for this phone/carrier model) get a string back, then
fastboot oem unlock STRING

unfortunately, us poor bastards with XT1045 and many other devices instead get an error notice from moto saying that we're screwed.

that's where sunshine comes in - somehow, those bastards are (presumably) generating this unlock key.

now, these question is: is that unlock_data all that's required to generate the unlock string? or is moto using other data from their own database to hash it?

like this stuff:
C:\Program Files\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 4113
(bootloader) product: peregrine
(bootloader) secure: yes
(bootloader) hwrev: 0x82D0
(bootloader) radio: 0x1
(bootloader) emmc: 8GB Toshiba REV=06 PRV=51 TYPE=17
(bootloader) ram: 1024MB Elpida S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8926
(bootloader) serialno: 
(bootloader) cid: 0x0010
(bootloader) channelid: 0x84
(bootloader) uid: 
(bootloader) unlocked: no
(bootloader) iswarrantyvoid: no
(bootloader) mot_sst: 0
(bootloader) max-download-size: 536870912
(bootloader) reason: Volume down key pressed
(bootloader) imei:
(bootloader) meid:
(bootloader) date:
(bootloader) sku:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Mon Aug 24  8:54:16 UTC 2015"
(bootloader) ro.build.fingerprint[0]: 

motorola/peregrine_cricket/peregri
(bootloader) ro.build.fingerprint[1]: ne:4.4.4/KXB21.14-

L1.45/15:user/re
(bootloader) ro.build.fingerprint[2]: lease-keys
(bootloader) ro.build.version.full[0]: 

Blur_Version.21.1.45.peregrine_cr
(bootloader) ro.build.version.full[1]: icket.cricket.en.US
(bootloader) ro.build.version.qcom[0]: 

AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.020
(bootloader) version-baseband:
(bootloader) kernel.version[0]: Linux version 3.4.42-

(hudsoncm@
(bootloader) kernel.version[1]: ilclbld30) (gcc version 4.7 

(GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Sun Jun 29 17:26:32 

CDT 2014
(bootloader) sdi.git: git=MBM-NG-V41.13-0-
(bootloader) sbl1.git: git=MBM-NG-V41.13-0-
(bootloader) rpm.git: git=MBM-NG-V41.13-0-
(bootloader) tz.git: git=MBM-NG-V41.13-0-
(bootloader) aboot.git: git=MBM-NG-V41.13-0-
(bootloader) qe: qe 0/0
(bootloader) ro.carrier: att
all: listed above
finished. total time: 0.331s


How do we find out? Well we sandbox sunshine, of course, because hopefully their using the same parameters to perform their unlocking.


3 comments:

  1. You'd probably find it easier and safer to find a bootloader exploit of your own, as opposed to aimlessly trying to steal others' hard work. No updates since August, how's the RE going?

    --beaups

    ReplyDelete