Main Page - Revision history

XVilka: Added Droid 4 page

2013-07-21T21:08:41Z

Added Droid 4 page

XVilka: Added link to disassembler for c55x+ platform

2013-05-15T16:04:12Z

Added link to disassembler for c55x+ platform

Skrilax CZ: /* About this site */

2013-02-26T13:56:58Z

‎About this site

Skrilax CZ: /* Information for volunteers */

2013-02-26T13:53:37Z

‎Information for volunteers

Skrilax CZ: /* Bruteforce */

2013-02-26T13:52:58Z

‎Bruteforce

Skrilax CZ: /* 2ndboot */

2013-02-26T13:52:44Z

‎2ndboot

Skrilax CZ: /* 2ndboot */

2012-10-10T23:22:04Z

‎2ndboot

Skrilax CZ: /* About this site */

2012-04-17T09:13:40Z

‎About this site

Eiyee: add defy link

2012-02-23T21:32:23Z

add defy link

Eiyee: add defy/defy+ models, similar to milestone2

2012-02-23T20:58:22Z

add defy/defy+ models, similar to milestone2

@@ Line 29: / Line 29: @@
 [[Image:hardware.png]]
 |style="vertical-align:top"|
-'''<span style="font-variant:small-caps; font-size:150%">Hardware</span>'''<br /><small>All about devices internals - PCB, chips </small><small><hr />[[device_information|Overview]] | [[Motorola Milestone | Milestone]] | [[Motorola Droid | Droid]] | [[Motorola Droid X | Droid X]] | [[Motorola Droid 2 | Droid 2]] | [[Motorola Milestone 2 | Milestone 2]] | [[Motorola Sholes Tablet XT701 | Sholes Tablet XT701]] | [[Motorola Milestone XT720 | Milestone XT720]] | [[Motorola Titanium XT800 | Titanium XT800]] | [[Motorola Ruth ME511 | Ruth ME511]] | [[Motorola Charm | Charm]]  | [[Motorola Atrix | Atrix]] | [[Motorola DEXT | DEXT]] | [[Motorola Defy | Defy]]</small>
+'''<span style="font-variant:small-caps; font-size:150%">Hardware</span>'''<br /><small>All about devices internals - PCB, chips </small><small><hr />[[device_information|Overview]] | [[Motorola Milestone | Milestone]] | [[Motorola Droid | Droid]] | [[Motorola Droid X | Droid X]] | [[Motorola Droid 2 | Droid 2]] | [[Motorola Milestone 2 | Milestone 2]] | [[Motorola Droid 4 | Droid 4]] | [[Motorola Sholes Tablet XT701 | Sholes Tablet XT701]] | [[Motorola Milestone XT720 | Milestone XT720]] | [[Motorola Titanium XT800 | Titanium XT800]] | [[Motorola Ruth ME511 | Ruth ME511]] | [[Motorola Charm | Charm]]  | [[Motorola Atrix | Atrix]] | [[Motorola DEXT | DEXT]] | [[Motorola Defy | Defy]]</small>
 |}

@@ Line 86: / Line 86: @@
 Also, our second problem, that [[TMS320C55x+]] is closed platform, and no datasheets for it available.
 It very different from original [[TMS320C55x]] architecture and have other opcodes.
-We only have '''asm55p''' utility from TI, which can produce binary from TMS320 assembler.
+But [http://rada.re/ radare2] utility have support for this platform and can do disassembly and simple analysis (you must use version from git).
-So, it is very important task - make full reverse of it. [[File:asm55p.idb.bz2]] [[File:dis55.idb.bz2]] [[File:dis55.c.gz]]
+We have also '''asm55p''' utility from TI, which can produce binary from TMS320 assembler.
 * '''[[Baseband Processor Boot ROM]]'''

@@ Line 22: / Line 22: @@
 [[Image:community.png]]
 |style="vertical-align:top"|
-'''<span style="font-variant:small-caps; font-size:150%">Community</span>'''<br /><small>Join our community! Discuss with us. </small><small><hr /> [[Credits | Our team]] | [irc://irc.freenode.net/#milestone-modding Our IRC channel] | [http://www.damogran.de/milestone-modding/ <span title="Starts on Jan 21 2010, 11:33:51 UTC. Refreshes every 15 minutes. Timezone: UTC+1. Thanks to Kasperle.">IRC log #1</span>] | [http://bacon.ojnk.org/milestone-modding.log <span title="Starts on Jan 21 2010, 13:09:10 UTC. Timezone: UTC-6. Thanks to Orgg.">IRC log #2</span>] | [http://milestone.bekaakut.de/ <span title="There is now a new channel log. Thanks to rebel1">IRC log #3</span>] | [http://mmlogs.doshaska.net/ <span title="Backup log. Started 23.09.2011.">IRC log #5</span>] | [http://gitorious.org/+droid-developers Our projects on Gitorious] | [http://hg.droid-developers.org/ Our projects on Bitbucket]</small>
+'''<span style="font-variant:small-caps; font-size:150%">Community</span>'''<br /><small>Join our community! Discuss with us. </small><small><hr /> [[Credits | Our team]] | [irc://irc.freenode.net/#milestone-modding Our IRC channel] | [http://188.40.36.100/logbot/ <span title="Thanks to Skrilax_CZ.">IRC log #1</span>] | [http://milestone.bekaakut.de/ <span title="There is now a new channel log. Thanks to rebel1">IRC log #2</span>] | [http://mmlogs.doshaska.net/ <span title="Backup log. Started 23.09.2011.">IRC log #3</span>] | [http://gitorious.org/+droid-developers Our projects on Gitorious] | [http://hg.droid-developers.org/ Our projects on Bitbucket]</small>
 |}

@@ Line 67: / Line 67: @@
 * '''[[2ndboot]]'''
 * '''[[Vulnerability hunting]]'''
 * '''[[open_recovery | Open Recovery]]'''
 * '''[[2ndinit]]'''

← Older revision		Revision as of 13:52, 26 February 2013
Line 107:		Line 107:

	As far as we know now this attack is, if not a waste of time, at least a very long shot. The idea is that reverse engineering the boot ROM, mbmloader and/or mbm might allow us to find some exploitable vulnerability in order to gain control of the boot process. Since we already have the source code for lbl, it might be useful too. Mike Baker([mbm]) has written a [http://pastebin.ca/raw/1833228\|user mode memory dumper] and dumped Droid public ROM. As we found - all roms for omap3430 are identical. Same situation for the omap3630. See here: [[Booting chain\|Boot chain]]		As far as we know now this attack is, if not a waste of time, at least a very long shot. The idea is that reverse engineering the boot ROM, mbmloader and/or mbm might allow us to find some exploitable vulnerability in order to gain control of the boot process. Since we already have the source code for lbl, it might be useful too. Mike Baker([mbm]) has written a [http://pastebin.ca/raw/1833228\|user mode memory dumper] and dumped Droid public ROM. As we found - all roms for omap3430 are identical. Same situation for the omap3630. See here: [[Booting chain\|Boot chain]]
−
−	~~== '''[[Bruteforce]]''' ==~~
−
−	~~This is distributed computation of the 1024 bit RSA secret key, which can be used for signing our bootloaders and kernel images.~~

	== '''[[open_recovery \| Open Recovery]]''' ==		== '''[[open_recovery \| Open Recovery]]''' ==

@@ Line 102: / Line 102: @@
 == '''[[2ndboot]]''' ==
-A minature bootloader that is called from the original kernel and boots custom one. As of 11/10/2012, '''czechop''' created a patch to keep Wrigley 3G modem working under the child kernel (when called at “sh hijack” time). Now the only issue on Motorola Milestone is sluggishness for cca. 10 - 20 minutes after the boot until the kernel suspends, after which it operates normally.
+A minature bootloader that is called from the original kernel and boots custom one. As of 11/10/2012, '''czechop''' created a patch to keep Wrigley 3G modem working under the child kernel (when called at “sh hijack” time). No issues on Motorola Milestone with the child kernel.
 == '''[[Vulnerability hunting]]''' ==

@@ Line 13: / Line 13: @@
 # '''Motorola Milestone''' (our primary target)
 # Motorola Milestone 2
 # Motorola Defy (MB525)
 # Motorola Defy+ (MB526)

@@ Line 22: / Line 22: @@
 # Motorola Charm (MB502)
 # Motorola DEXT (MB200) aka. Cliq
 | width=50% style="vertical-align:top"|