6 ms·

Unlocking the Motorola Bootloader with a TrustZone Exploit

74 points by laginimaineb 11y ago

jtchang 11y ago
Interesting part about QFuses. How are they actually implemented in the hardware?
- laginimaineb 11y ago
  AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.
  - sliverstorm 11y ago
    Could easily be an actual fuse. A array of skinny pieces of metal with a big monster current source to pop them on command.
- tyingq 11y ago
  Generically, it would be referred to as "OTP NVM", or one time programmable non-volatile memory. There are apparently a few different ways to implement that. A little dry, but the only thing I could find with some comparison of approaches: http://www.kilopass.com/wp-content/uploads/2010/04/comparison_of_embedded_nvm.pdf http://www.kilopass.com/wp-content/uploads/2010/04/compariso...
ck2 11y ago
Oooh sunshine is about to take a hit I guess. added: wish you could subscribe to users on HN, I missed all your previous goodies wow you make it all look so easy, but it's not at all
- laginimaineb 11y ago
  Thanks! I'm also on twitter in case that helps (@laginimaineb). As for Sunshine - I'm publishing a new (even broader) zero-to-TZ saga, complete with exploits, but I'm not going to create a product out of it. So ultimately, as long as there are people behind Sunshine who are willing to make it work with relative ease, I'm sure most people won't mind spending a few dollars to unlock their device. As for the more tech-savvy crowd; I hope they choose to do it themselves with the exploits provided - it is much more fun that way, IMHO.
  - deleted 11y ago
    [deleted]
  - chei0aiV 11y ago
    Have you considered contributing to android-rooting-tools? https://github.com/android-rooting-tools https://github.com/android-rooting-tools
daveloyall 11y ago
Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware. This is the sort of thing Senators are for.
- jakeogh 11y ago
  Personally, I would rather vote with my dollars than ask for more rules.
  - daveloyall 11y ago
    Vote for devices? Companies? Jake, the election is rigged! Walk with me down this garden path, if you please... :) Regulation of the manufacture and distribution of medicine is a good thing. 'Regulation' just means that corporations and individuals aren't blindly trusted to do the right thing with regards to medicine. That's because bad medicine generally has a profound impact on people's lives. Somebody could put some bad medicine in a bottle, but there are actually organizations checking for this and there are severe penalties. Cellphones aren't medicine, but the impact that a bad device can have on people's lives is growing every day. It would appear that each person's identity is largely composed of their memories and their internal processes, which were also shaped by their experiences. As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous. Today, Samsung (for example) would never get away with filtering all negative news articles about a particular political candidate out of all their users' feeds. Nor would they get away with inserting positive chatter about their own devices. For how long will that be true? We have to establish some sort of minimum quality standard for the devices through which we are going to experience life. Yes, rules!
    - jakeogh 11y ago
      If you want a unlocked phone, then buy one. Asking for more restrictions makes you _less_ free, and costs more. What you are suggesting is to take money from others so you can be ignorant about what electronics you are buying. "As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous." Ya, hence governments want power over them. How's that kill switch working for ya? Oh, no InternetID? Sorry, you need that to surf since the Safe Internet Act of 2021, and no, we can't sell you a phone without the Safe Internet Chip, because rules.
gravypod 11y ago
Please, please, please tell me this will lead to my Motorola Droid Turbo being unlocked. I want CyanogenMod so badly! I also want to be able to edit my hosts file and make it so I don't waste any bandwidth any more.
- mdadm 11y ago
  I'm in the same place. I really wanna try and see if it works, but I'm scared of bricking my phone.
  - gravypod 11y ago
    This guy could make a lot of money from the bounty threads. 5k+ was the last reading IIRC.
    - laginimaineb 11y ago
      Don't think I'll collect it, but I will release all the details so people can do it themselves.
- ck2 11y ago
  Pretty sure sunshine works on the turbo but $25 is probably turning people off.
- laginimaineb 11y ago
  It will work on the Turbo! :) But you'll either need a version old enough to be vulnerable to this TrustZone exploit, or you can wait a couple of weeks until I release a new exploit (which also works on the Turbo).
  - mdadm 11y ago
    >It will work on the Turbo! :) Since people seem to put the Turbo/Mini/Maxx in the same group, would it work on any of them? :)

74 points by laginimaineb 11y ago

jtchang 11y ago

Interesting part about QFuses. How are they actually implemented in the hardware?

laginimaineb 11y ago
AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.
- sliverstorm 11y ago
  Could easily be an actual fuse. A array of skinny pieces of metal with a big monster current source to pop them on command.
tyingq 11y ago
Generically, it would be referred to as "OTP NVM", or one time programmable non-volatile memory. There are apparently a few different ways to implement that. A little dry, but the only thing I could find with some comparison of approaches: http://www.kilopass.com/wp-content/uploads/2010/04/comparison_of_embedded_nvm.pdf http://www.kilopass.com/wp-content/uploads/2010/04/compariso...

ck2 11y ago

Oooh sunshine is about to take a hit I guess. added: wish you could subscribe to users on HN, I missed all your previous goodies wow you make it all look so easy, but it's not at all

laginimaineb 11y ago
Thanks! I'm also on twitter in case that helps (@laginimaineb). As for Sunshine - I'm publishing a new (even broader) zero-to-TZ saga, complete with exploits, but I'm not going to create a product out of it. So ultimately, as long as there are people behind Sunshine who are willing to make it work with relative ease, I'm sure most people won't mind spending a few dollars to unlock their device. As for the more tech-savvy crowd; I hope they choose to do it themselves with the exploits provided - it is much more fun that way, IMHO.
- deleted 11y ago
  [deleted]
- chei0aiV 11y ago
  Have you considered contributing to android-rooting-tools? https://github.com/android-rooting-tools https://github.com/android-rooting-tools

daveloyall 11y ago

Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware. This is the sort of thing Senators are for.

jakeogh 11y ago
Personally, I would rather vote with my dollars than ask for more rules.
- daveloyall 11y ago
  Vote for devices? Companies? Jake, the election is rigged! Walk with me down this garden path, if you please... :) Regulation of the manufacture and distribution of medicine is a good thing. 'Regulation' just means that corporations and individuals aren't blindly trusted to do the right thing with regards to medicine. That's because bad medicine generally has a profound impact on people's lives. Somebody could put some bad medicine in a bottle, but there are actually organizations checking for this and there are severe penalties. Cellphones aren't medicine, but the impact that a bad device can have on people's lives is growing every day. It would appear that each person's identity is largely composed of their memories and their internal processes, which were also shaped by their experiences. As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous. Today, Samsung (for example) would never get away with filtering all negative news articles about a particular political candidate out of all their users' feeds. Nor would they get away with inserting positive chatter about their own devices. For how long will that be true? We have to establish some sort of minimum quality standard for the devices through which we are going to experience life. Yes, rules!
  - jakeogh 11y ago
    If you want a unlocked phone, then buy one. Asking for more restrictions makes you _less_ free, and costs more. What you are suggesting is to take money from others so you can be ignorant about what electronics you are buying. "As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous." Ya, hence governments want power over them. How's that kill switch working for ya? Oh, no InternetID? Sorry, you need that to surf since the Safe Internet Act of 2021, and no, we can't sell you a phone without the Safe Internet Chip, because rules.

gravypod 11y ago

Please, please, please tell me this will lead to my Motorola Droid Turbo being unlocked. I want CyanogenMod so badly! I also want to be able to edit my hosts file and make it so I don't waste any bandwidth any more.

mdadm 11y ago
I'm in the same place. I really wanna try and see if it works, but I'm scared of bricking my phone.
- gravypod 11y ago
  This guy could make a lot of money from the bounty threads. 5k+ was the last reading IIRC.
  - laginimaineb 11y ago
    Don't think I'll collect it, but I will release all the details so people can do it themselves.
ck2 11y ago
Pretty sure sunshine works on the turbo but $25 is probably turning people off.
laginimaineb 11y ago
It will work on the Turbo! :) But you'll either need a version old enough to be vulnerable to this TrustZone exploit, or you can wait a couple of weeks until I release a new exploit (which also works on the Turbo).
- mdadm 11y ago
  >It will work on the Turbo! :) Since people seem to put the Turbo/Mini/Maxx in the same group, would it work on any of them? :)