• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root [WIP][DEV] Custom Recovery/Bootloader unlocking Work In Progress Thread

Much of the information is based off the msm 8260/8660, but it is for the msm8960. And it is under a general section, not a certain brand, and says nothing about a specific brand. Therefore, the msm 8960 boards should be the same between brands.
 
I bet we can do this. this is basically the Asgard trick for the moto cliq. we went around system and booted directly from sdcard. SD Card Boot

If MMC is included in the booting device list, the ROM looks for an SD Card on the first MMC controller. If a card is found, the ROM then looks for the first FAT32 partition within the partition table. Once the partition is found, the root directory is scanned for a special signed file called "MLO" (which is the x-loader binary with a header containing the memory location to load the file to and the size of the file). Assuming all is well with the file, it is transfered into the internal SRAM and control is passed to it. Both MMC1 and MMC2 can be used for booting.kudos
 
What exactly happened when you used the tool to blow the qfuse and how are you sure its still locked?

Not at home right now, so can't tell you exactly, but it said something not found, I decompiled it and some address didn't match up. I know I am still locked because I booted to fastboot and flashed to the recovery partition, but got a security error.
 
Hi,

Just wondering which device took the longest time to unlock bootloader.

And how long was it.

Does anyone know?
 
Hi,

Just wondering which device took the longest time to unlock bootloader.

And how long was it.

Does anyone know?

LG or all brands??
And most of the LG bootloaders were unlocked by fastboot OEM unlock.
Older LGs that were unlocked that got locked by an ICS update took, well idk, 3 months?? But they already had a way to unlock the bootloader by flashing the gingerbread bootloader. We don't have a gingerbread boot loader and LG phones that use msm8960 with gingerbread use a boot loader that's 3MBs. Our bootloader is 512kbs...
 
LG or all brands??
And most of the LG bootloaders were unlocked by fastboot OEM unlock.
Older LGs that were unlocked that got locked by an ICS update took, well idk, 3 months?? But they already had a way to unlock the bootloader by flashing the gingerbread bootloader. We don't have a gingerbread boot loader and LG phones that use msm8960 with gingerbread use a boot loader that's 3MBs. Our bootloader is 512kbs...

Well most were prolly like the spectrum, not truely unlocked, but rather the older unlocked bl from GB was used. ;)

I dont know of any LG bootloader that was locked and unintended to be unlocked being cracked. ;)
 
LG or all brands??
And most of the LG bootloaders were unlocked by fastboot OEM unlock.
Older LGs that were unlocked that got locked by an ICS update took, well idk, 3 months?? But they already had a way to unlock the bootloader by flashing the gingerbread bootloader. We don't have a gingerbread boot loader and LG phones that use msm8960 with gingerbread use a boot loader that's 3MBs. Our bootloader is 512kbs...


Is it possible to flash a gb bootloader and a different kernel that doesn't run security checks at the same time???
 
The bootloader is checked by the sbl3, which is checked by sbl2, which is checked by sbl1, which is probably checked by something.

Want something new to play with?

adb shell
/sbin/wallpaper -framework
 
Is it possible to flash a gb bootloader and a different kernel that doesn't run security checks at the same time???
Just from reading the post you quoted,i would doubt it
Gingerbread bootloader partition 3 meg
Our bootloader partion half meg
You would have to stand on it and jump up and down to smash it into that itty bitty little spot
 
So... do we have a way to trace security errors, to find what caused them? I believe I have blown the qfuse, using wallpaper, that contains our bootloader "lock", but... still security errors. Should there be any visual key that the qfuse actually blew? Ex: phone restart.
 
Yes, and I also read this http://forum.xda-developers.com/showthread.php?p=34772926#post34772926 and used info from both. While looking around after this didn't work, I discovered that the security message I am getting does not appear to be in aboot, the kernel, wallpaper, morningcall, sbl1-3, or the tz partition. This makes me wonder: what is checking the signatures? I have opened all these partitions in a hex editor and searched them, finding nothing.
 
Back
Top Bottom