| 00:30.34 | WM | jonwil: i talked about magx opening, after you quit (didnt saw the quit message) |
| 00:30.45 | WM | here is a cutnpaste: |
| 00:31.15 | WM | <WM|work> jonwil: thats not true. |
| 00:31.15 | WM | <WM|work> jonwil: but currently the way to kernel hacking on Magx involves reflashing the bootloader area. |
| 00:31.15 | WM | <WM|work> If you dont mind risking to brick your phone i can prepare an "opened" bootloader for you. |
| 00:31.15 | WM | <WM|work> err, didnt saw the quit message :) |
| 00:33.39 | WM | jonwil: Its your call, if you dont mind risking your phone you can be the first to have a "no sig needed magx phone" :) |
| 00:34.18 | WM | Or you can be "the first one to brick a magx phone trying to free it".. ;) |
| 00:43.45 | *** join/#openezx ljp (n=lpotter@203.94.178.46) |
| 00:54.54 | *** join/#openezx WyrM (i=wyrm@201008191147.user.veloxzone.com.br) |
| 01:01.51 | jonwil | I dont think I would want to take the risk of breaking this phone |
| 01:01.59 | jonwil | Its brand new, its my only phone and its on a 12 month contract |
| 01:02.43 | ds2 | it is a GSM phone, isn't it? |
| 01:02.49 | jonwil | yes its GSM |
| 01:02.56 | jonwil | MOTOROKR Z6 |
| 01:05.50 | jonwil | more than anything else my #1 want at this point is to read the AP software and FLEX off it |
| 01:05.59 | jonwil | or find the identical S/W and flex online somewhere |
| 01:06.19 | jonwil | then from there I can edit config files and such without changing anything else other than that one item |
| 01:06.24 | jonwil | and I keep all my carrier bits |
| 01:06.52 | jonwil | somehow I dont think Moto will honour my warranty if I flash a hacked bootloader :P |
| 01:07.02 | ds2 | worse thing is you will have to move the SIM around |
| 01:07.40 | ds2 | Moto might not care since I head they were dumping their phone division anyways |
| 01:08.47 | jonwil | I doubt moto will give me a new phone if I flash a hacked bootloader and it renders the phone unusable |
| 01:10.08 | jonwil | oh and they havent announced anything about dumping their handsets, just that they are thinking about it |
| 01:14.11 | jonwil | if I knew ARM assembly, I might try and do some reverse engineering of this phone |
| 01:17.06 | *** join/#openezx eway (n=ellis@homealone.good1.com) |
| 01:23.47 | WyrM | jonwil: the main issue is the signature checking done by the bootloader. |
| 01:24.44 | WyrM | dumping the FW contents is not that hard, but if you change it you will need to sign it or the bootloader will refuse to boot. |
| 01:24.59 | *** join/#openezx ljp (n=lpotter@203.94.178.46) |
| 01:26.46 | WyrM | jonwil: but if you are worried about warranty there is nothing you can do to help us :/ |
| 01:28.09 | WyrM | my ezx phones all voided the warranty at the first week after i bought it. either because i disassembled the phone or because i flashed it. |
| 01:54.56 | jonwil | yeah, that I know |
| 01:55.05 | jonwil | right now #1 wish is to dump f/w contents |
| 01:55.12 | jonwil | WyrM, do you know how I can do that? |
| 01:55.26 | jonwil | I want to read /bin, /lib, /etc and such from phone |
| 01:56.02 | *** part/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) |
| 02:01.17 | jonwil | oh and I am not so much worried about warranty |
| 02:01.24 | jonwil | as I am about bricking an expensive phone |
| 02:02.27 | jonwil | If it is possible to read the contents of phone filesystem, it then becomes possible to edit those bits that are not signed and write back to phone |
| 02:02.42 | jonwil | I know for a fact that there are 2 filesystems that arent signed |
| 02:02.54 | jonwil | one of which contains lots of config files |
| 02:03.03 | jonwil | and the other of which contains preloaded ringtones and such |
| 02:04.45 | jonwil | so yeah forget warranty :P |
| 02:04.54 | *** join/#openezx BadCluster (n=badclust@190.50.209.50) |
| 02:05.16 | jonwil | I just want to be sure that if I flash something to my phone, I can undo that and go back to exactly what is on my phone right now |
| 02:05.48 | *** join/#openezx Guanjun (n=novell@61.14.130.203) |
| 02:10.09 | jonwil | so, anyone know how I can read the contents from this Z6? |
| 02:37.38 | jonwil | guess everyone left :( |
| 02:52.14 | *** part/#openezx BadCluster (n=badclust@190.50.209.50) |
| 02:58.55 | *** join/#openezx nooop (n=noop@219.239.105.26) |
| 03:04.49 | *** join/#openezx TimRiker (n=timr@rikers.org) |
| 03:17.57 | jonwil | as usual, not a sign of anyone around :( |
| 04:55.44 | *** join/#openezx jonwil (n=jonwil@121.221.215.28) |
| 04:56.21 | jonwil | anyone here own a motomagx phone or know anything about them? |
| 06:43.53 | ghane | jonwil: its just you and me :( |
| 06:44.06 | jonwil | which one do you have? |
| 06:44.38 | ghane | Z6 |
| 06:44.43 | jonwil | me too |
| 06:44.45 | jonwil | Great phone |
| 06:45.12 | ghane | dont really like the UI |
| 06:45.25 | jonwil | any other phone you would prefer to have? |
| 06:46.10 | ghane | well, i think my sony ericsson ones are better usability wise |
| 06:46.30 | *** part/#openezx Guanjun (n=novell@61.14.130.203) |
| 06:46.31 | jonwil | I hate SE phones |
| 06:46.46 | ghane | lol |
| 06:46.49 | jonwil | have always used motos |
| 06:46.53 | jonwil | will continue to use motos |
| 06:47.57 | ghane | ok |
| 06:48.25 | jonwil | have you done any hacking on your Z6? |
| 06:48.29 | jonwil | Do you intend to hack it? |
| 06:48.49 | ghane | trying as much as i can, but nothing yet |
| 06:49.00 | ghane | thats the only reason i bought it |
| 06:49.05 | jonwil | what have you done so far? |
| 06:49.20 | jonwil | my first goal is to be able to read the current software off it |
| 06:49.20 | ghane | trying to get shell access |
| 06:49.24 | jonwil | i.e. /bin, /usr and so on |
| 06:49.30 | jonwil | without changing whats already there |
| 06:49.33 | ghane | mess with the bootloader |
| 06:49.37 | jonwil | oh and yeah some form of shell access would be nice |
| 06:49.59 | jonwil | have you flashed it with anything or is it still running what it was when you bought it? |
| 06:50.04 | ghane | actually i was trying to execute native binaries or shell scripts |
| 06:50.17 | jonwil | yeah that is also my goal |
| 06:50.19 | ghane | i dont want to reflash |
| 06:50.25 | jonwil | neither do I |
| 06:50.31 | jonwil | I dont want to loose the carrier specific stuff |
| 06:51.53 | ghane | i want to take over at init at latest |
| 06:53.59 | jonwil | so far there are 2 big problems, the first is that no-one has a way to read the existing phone s/w off the phone yet |
| 06:54.48 | jonwil | and the second is that most of the phone stuff (including the boot loaders, kernel and root filesystem) is digitally signed |
| 06:55.06 | ghane | i know :( |
| 06:55.20 | jonwil | being able to read the existing phone s/w would be of great use |
| 06:55.32 | ghane | oh yes |
| 06:55.33 | jonwil | since we could read off the s/w, edit the bits that arent digitally signed and write it back |
| 06:56.02 | jonwil | is yours generic or carrier specific? |
| 06:56.23 | ghane | generic |
| 06:57.35 | jonwil | if you can tell me what ap s/w version its currently running I can tell you if there is a copy of that ap s/w for download anywhere |
| 06:57.51 | jonwil | I havent found a copy of the ap s/w for my own phone yet |
| 06:57.55 | jonwil | but I found a lot of others |
| 06:58.17 | ghane | didnt i post it to you some days ago? |
| 06:58.27 | ghane | i dont have the phone here right now |
| 06:58.47 | jonwil | hmmmm, I cant remember |
| 06:59.21 | jonwil | anyhow, my phone is carrier specific |
| 06:59.21 | ghane | 09:54 < ghane> R60_G_80.33.15R |
| 06:59.21 | ghane | 09:54 < jonwil> my bp SW version is r60_g_80.32.0fr |
| 06:59.21 | ghane | 09:55 < ghane> oh yes, do you know how is that? is there any update service for moto phones? |
| 06:59.24 | ghane | 09:55 < ghane> semc and nokia has that |
| 06:59.25 | jonwil | aah ok |
| 06:59.27 | ghane | 09:55 < ghane> by is r60_g_80.33.05r |
| 06:59.27 | jonwil | got that |
| 07:01.11 | ghane | brb |
| 07:20.08 | Hopscotch | good morning |
| 07:23.03 | ghane | morning |
| 07:24.20 | ghane | off to work |
| 07:24.20 | ghane | later |
| 08:00.10 | *** join/#openezx WM (i=wyrm@201.78.3.52) |
| 08:18.37 | jonwil | hi |
| 08:48.41 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 09:51.20 | *** join/#openezx florian (n=fuchs@217.146.132.69) |
| 09:51.56 | florian | good morning |
| 09:56.38 | jonwil | hi florian |
| 09:58.06 | florian | jonwil: how is the status of the z6? what can we do or what do we know? |
| 09:58.41 | jonwil | The root filesystem, the kernel and the bootloader are all digitally signed and cant be replaced |
| 09:59.33 | jonwil | Most of the work that hackers are doing involves taking stock moto firmware (from wherever legally grey source that comes from) and editing the bits that arent signed |
| 09:59.36 | jonwil | and then flashing it |
| 10:00.06 | jonwil | Which is great if you are happy with a hacked up phone with a "china mobile" firmware on it or something |
| 10:00.15 | jonwil | but I dont want to loose all my carrier specific stuff |
| 10:00.42 | florian | ok, that's not much :-/ so we need to find a way to trick or modify the bootloader. |
| 10:00.47 | jonwil | My 2 goals at this point are to 1.Find a way to gain access to the phone filesystem and read its contents without flashing anything to the phone |
| 10:01.18 | florian | do we know which algorithm they use for the signature? |
| 10:01.18 | jonwil | and 2.Having done that, find a way to write back an edited copy of the bits that arent signed (which includes a configuration area and another area with things like the default ringtones) |
| 10:01.22 | jonwil | RSA |
| 10:04.09 | jonwil | Some of the hacked firmwares seem to allow telnet and/or ftp to run on the phone |
| 10:04.36 | jonwil | If we can find a way to read the hackable bits off the phone, hack them and write them back, it should then be possible to make Telnet work |
| 10:04.38 | jonwil | and/or FTP |
| 10:04.43 | jonwil | or some other way to get at the phone |
| 10:04.59 | jonwil | from there one can somehow load other stuff on there |
| 10:07.34 | *** join/#openezx LuitvD (n=luitvd@beigetower/luitvd) |
| 10:07.53 | florian | hum... would be better to find a way to replace the whole stuff |
| 10:11.12 | jonwil | yes |
| 10:11.39 | jonwil | Another valid angle is to do what the iPhone hackers are doing and reverse engineer everything looking for holes |
| 10:12.36 | jonwil | right now though #1 goal is to be able to read files from the phone (and to replace the files that cant be replaced) and #2 is to be able to run code on the phone |
| 10:12.45 | florian | do we have a jtag connection to these? |
| 10:14.29 | jonwil | not a clue |
| 10:14.41 | jonwil | I certainly dont |
| 10:14.48 | jonwil | and wouldnt know where to start with jtag |
| 10:14.59 | jonwil | plus, I dont particularly want to open up my brand new phone |
| 10:15.41 | *** join/#openezx BadCluster (n=badclust@190.50.209.50) |
| 10:16.24 | florian | ok well, I do not have a problem to do this, I even have the tools and a lot of stuff to work on the hardware... but I would need some time |
| 10:16.38 | jonwil | do you have motomagx phone? |
| 10:17.36 | jonwil | a bunch of the "hacking" going on right now seems to be happening here |
| 10:17.38 | jonwil | http://www.modmymoto.com/forums/forumdisplay.php?f=78 |
| 10:17.42 | jonwil | and on that site in general |
| 10:18.02 | jonwil | as you can see I posted some posts myself to see if anyone knew anything usefull |
| 10:19.19 | florian | jonwil: yes, a V8 |
| 10:19.26 | jonwil | ok, thats good |
| 10:19.37 | *** part/#openezx BadCluster (n=badclust@190.50.209.50) |
| 10:19.48 | jonwil | V8 and Z6 are much the same, just one is flip and one is slide I believe |
| 10:20.59 | jonwil | There are basically 3 rules that I am sticking to with my hacking 1.Nothing that requires disassembling or opening the phone 2.Nothing that requires throwing away my current carrier-specific data and 3.Nothing that causes me to loose any functionality my phone has now |
| 10:21.41 | jonwil | If you open up your V8, get some PCB pictures if you can |
| 10:21.57 | jonwil | Also, write down all the numbers from all the chips so we can try and work out what they are |
| 10:23.00 | jonwil | but yeah I am confident that we as a community will succeed and crack open motomagx :) |
| 10:25.13 | jonwil | if I knew where to start, I would do some reverse engineering of the ARM assembly in the bootloader, ramdownloader etc myself |
| 10:25.57 | WM | I think that a good roadmap for magx hacking is: 1. kernel modules for flash access (to work around bootloader signing). 2. binary hacking on the bootloader code (to disable the signing definitively). |
| 10:26.56 | WM | i can try to do 2, but i dont plan to buy a magx phone soon :) |
| 10:27.36 | jonwil | #1 is to find way to read contents of phone out |
| 10:27.46 | jonwil | Untill we can do that, we cant hack motomagx at all |
| 10:27.49 | jonwil | IMO |
| 10:28.12 | WM | jonwil: this should already be possible. |
| 10:28.19 | jonwil | how? |
| 10:28.25 | jonwil | I have been unable to do it |
| 10:29.03 | WM | there are people with shell access, with shell access you can map the flash chip and read its contents.. |
| 10:29.51 | jonwil | only problem so far is that to get shell access you have to flash a new firmware I believe |
| 10:30.05 | jonwil | and I dont want to loose my existing carrier specific bits |
| 10:30.36 | *** join/#openezx ade|desk (n=adavey@194.200.143.249) |
| 10:30.37 | jonwil | Hence point #2 above :) |
| 10:31.26 | jonwil | only parts of filesystem you have access to is the memory card |
| 10:31.56 | jonwil | and the /ezxlocal/download/mystuff/ path |
| 10:32.02 | jonwil | which is where stuff like java applets go |
| 10:32.15 | WM | and.. can you run software from these paths? |
| 10:32.16 | jonwil | hmmm, I wonder how much access to the phone Java apps get |
| 10:32.28 | jonwil | you can put files there |
| 10:32.36 | jonwil | but I dont know how to say to the phone "run this" |
| 10:36.50 | WM | jonwil: (java) not enough. |
| 10:37.16 | jonwil | yeah, I kind of figured that only java apps signed by moto would have access |
| 10:37.53 | jonwil | I tried a couple of other things earlier, I found a way to put it into usbnet mode (and it did have an IP address) and ran nmap on it |
| 10:37.59 | jonwil | but there were zero ports open (as expected) |
| 10:39.26 | jonwil | what will help is finding more firmwares too |
| 10:46.52 | florian | http://www.linuxdevices.com/news/NS2607065576.html |
| 10:47.41 | florian | Looks like two of these strange chips that noone knows are part of this SCMA11 by Freescale. |
| 10:48.12 | florian | But its just a guess from the kernel config |
| 10:49.07 | jonwil | quite possible |
| 10:49.27 | jonwil | I have seen evidence that moto want to do native code SDK for motomagx |
| 10:49.38 | florian | btw. http://wiki.openezx.org/Razr2_Board |
| 10:50.10 | jonwil | but like apple and nokia and sony and other handsetmakers, the trick is to do it in a way that keeps the carriers happy |
| 10:55.22 | jonwil | would not surprise me if the giant freescale part (SC29364VK) is the SCMA11 |
| 10:55.32 | *** join/#openezx BadCluster (n=badclust@190.50.209.50) |
| 10:55.35 | jonwil | seems to be more of an all-in-one solution |
| 10:55.40 | *** join/#openezx LuitvD (n=luitvd@beigetower/luitvd) |
| 10:58.40 | jonwil | http://www.blackhat.com/presentations/bh-europe-04/bh-eu-04-dehaas/bh-eu-04-dehaas.pdf seems interesting |
| 10:59.25 | florian | right, in fact i vote for the theory that it is in fact a multi-chip design. there are enough chips for the typical ram+flash module, the dsp and the edge modem and transceiver |
| 11:04.55 | jonwil | so yeah my #1 goal is to find a way to read the contents of my Z6 without needing to either open the phone or flash any new software to it |
| 11:05.53 | jonwil | That or find some way to access http://www.boot-loader.com/ that doesnt cost big $$$ :P |
| 11:10.10 | jonwil | for now though it looks like its not possible to hack it at all |
| 11:21.09 | *** join/#openezx yansa (n=yans@host-89-167-37-237.pronet.lublin.pl) |
| 11:22.27 | *** join/#openezx mickeyl (i=mickey@srv043.dedi23.de) |
| 11:36.24 | *** join/#openezx tombhadAC (n=tombhad@pD95DF42A.dip.t-dialin.net) |
| 12:56.50 | *** join/#openezx blobster (i=enne@mozart.cc.tut.fi) [NETSPLIT VICTIM] |
| 12:56.50 | *** join/#openezx Dominus (i=unices@ip5652ade4.speed.planet.nl) [NETSPLIT VICTIM] |
| 12:56.50 | *** join/#openezx TommyMT (n=tk@touchdown.maintech.de) [NETSPLIT VICTIM] |
| 13:01.45 | *** join/#openezx jonwil (n=jonwil@121.221.215.28) |
| 13:15.42 | *** join/#openezx flyhorse1 (n=flyhorse@219.130.83.191) |
| 13:29.25 | *** join/#openezx z72ka (n=hermanj@r5af183.net.upc.cz) |
| 13:37.11 | *** join/#openezx flyhorse1 (n=flyhorse@219.130.83.191) |
| 14:09.14 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 14:19.30 | *** join/#openezx WM|work (i=c88e3a12@gateway/web/ajax/mibbit.com/x-5fe472029bc870a6) |
| 14:22.41 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 14:38.15 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 14:46.16 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 15:09.21 | *** join/#openezx yansa (n=yans@host-89-230-209-154.lublin.mm.pl) |
| 15:19.12 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 15:26.22 | *** join/#openezx yansa_ (n=yans@host-89-167-37-237.pronet.lublin.pl) |
| 15:39.26 | *** join/#openezx goxboxlive (n=goxboxli@134.84-48-212.nextgentel.com) |
| 15:57.22 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 16:22.24 | *** join/#openezx LuitvD_ (n=luitvd@beigetower/luitvd) |
| 16:29.03 | *** join/#openezx TimRiker (n=timr@psnet.cc) |
| 16:55.42 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 17:09.18 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 17:11.56 | *** part/#openezx ade|desk (n=adavey@194.200.143.249) |
| 17:17.18 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 17:25.46 | *** join/#openezx pH5 (n=ph5@e178219095.adsl.alicedsl.de) |
| 17:32.47 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 17:37.45 | ghane | hi |
| 17:42.19 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 18:10.01 | *** join/#openezx pleemans (n=peter@d51A5E76A.access.telenet.be) |
| 18:25.17 | *** join/#openezx flyhorse2 (n=flyhorse@125.93.107.77) |
| 19:04.59 | WM|work | webmind: could you please put a ban on flyhorse2? He is flooding the channel with reconnects for days. |
| 19:05.47 | WM|work | webmind: a ban on his alternate nick (flyhorse2) is enough, he can still enter the channel when he is really online. |
| 19:10.25 | *** join/#openezx tombhadAC (n=tombhad@pD95DDC77.dip.t-dialin.net) |
| 19:14.01 | *** mode/#openezx [+o webmind] by ChanServ |
| 19:14.13 | *** mode/#openezx [+b *!*=flyhorse@125.93.107.*] by webmind |
| 19:14.20 | webmind | WM|work, like that ? |
| 19:14.26 | webmind | WM|work, or just on his nick ? |
| 19:16.46 | ghane | lol |
| 19:16.49 | ghane | success? :-) |
| 19:17.29 | WM|work | webmind: on his alternate nick is enough, justo to stop the reconnects.. |
| 19:17.33 | WM|work | flyhorse1 and flyhorse2 |
| 19:18.11 | webmind | ghane, odd goal |
| 19:18.17 | ghane | webmind: indeed |
| 19:18.31 | *** mode/#openezx [-b *!*=flyhorse@125.93.107.*] by webmind |
| 19:18.52 | *** mode/#openezx [+b flyhorse1!*@125.*] by webmind |
| 19:18.56 | *** mode/#openezx [+b flyhorse2!*@125.*] by webmind |
| 19:19.14 | WM|work | webmind: Thanks! :) |
| 19:19.24 | webmind | np |
| 19:19.27 | *** mode/#openezx [-o webmind] by webmind |
| 19:19.33 | ghane | wonderful |
| 19:19.57 | webmind | then I can continue my idling again :) |
| 19:20.05 | ghane | no more scrolling through reconnects to see what ppl wrote |
| 19:20.12 | webmind | (actually getting dinner) |
| 19:20.16 | ghane | dinner |
| 19:20.18 | ghane | yes please |
| 19:23.37 | *** join/#openezx yansa (n=yans@host-89-167-37-237.pronet.lublin.pl) |
| 19:34.54 | *** join/#openezx yansa (n=yans@host-89-167-37-237.pronet.lublin.pl) |
| 19:47.33 | *** join/#openezx drath_ (i=vmaster@p5B07EACA.dip.t-dialin.net) |
| 19:59.48 | *** join/#openezx von___fritz (n=fritz@host253-184-dynamic.54-82-r.retail.telecomitalia.it) |
| 20:33.18 | *** join/#openezx drath_ (i=vmaster@p5B07F167.dip.t-dialin.net) |
| 21:09.17 | *** join/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) |
| 21:17.55 | *** join/#openezx AndiM (n=andi@p50816D11.dip.t-dialin.net) |
| 21:24.52 | *** join/#openezx flo_lap (n=fuchs@92.227.192.212) |
| 21:27.12 | flo_lap | re |
| 22:02.22 | *** part/#openezx WM|work (i=c88e3a12@gateway/web/ajax/mibbit.com/x-5fe472029bc870a6) |
| 22:24.30 | *** part/#openezx AndiM (n=andi@p50816D11.dip.t-dialin.net) |
| 22:54.44 | *** join/#openezx TimRiker (n=timr@psnet.cc) |
| 22:57.18 | *** join/#openezx BadCluster (n=badclust@190.50.198.205) |
| 23:03.44 | *** join/#openezx tombhadAC (n=tombhad@pD95DF375.dip.t-dialin.net) |
| 23:20.34 | *** part/#openezx stefan_schmidt (n=stefan@sirius.lasnet.de) |
| 23:49.36 | *** join/#openezx yansa_ (n=yans@host-89-230-209-154.lublin.mm.pl) |
| 23:52.36 | *** join/#openezx jonwil (n=jonwil@121.221.215.28) |
| 23:52.53 | jonwil | hi |