To complete the process, the user issues a final fastboot command:Īt this point, the bootloader unlocks, and the user may use fastboot to flash custom kernel and system images that have not been signed by Motorola or the carrier. if it's a developer edition device), the website will provide a 20-character "unlock token". If the user's device is supported by the bootloader unlocking program (i.e. The user must then submit this blob to the Motorola bootloader unlock website ( ). In response to this command, an ASCII blob will be returned to the user.
Next, the standard "fastboot" utility can be used to issue the following command: The user must boot into "bootloader mode" using a hardware key combination (usually Vol Up + Vol Down + Power) at boot. However, the consumer editions ship with a locked bootloader, preventing these types of modifications.įrom the perspective of the user, unlocking the bootloader on a developer edition device is fairly straightforward. The developer editions of these models support bootloader unlocking, allowing the user to voluntarily void the manufacturer warranty to allow installation of custom kernels and system images not signed by authorized parties. Additionally, these three devices were released in both "consumer" and "developer" editions. These three devices are the first Motorola Android phones to utilize the Qualcomm MSM8960 chipset, a break from a long tradition of OMAP-based Motorola devices. In this blog post, I will present my findings, which include details of how to exploit a vulnerability in the Motorola TrustZone kernel to permanently unlock the bootloaders on these phones. The consumer editions of these devices ship with a locked bootloader, which prevents booting kernel and system images not signed by Motorola or a carrier. I recently spent some time dissecting the bootloader used on Motorola's latest Android devices, the Atrix HD, Razr HD, and Razr M.
0 kommentar(er)
