Unlocking the Motorola Bootloader with a TrustZone Exploit | Hacker News Reader

Unlocking the Motorola Bootloader with a TrustZone Exploit

bits-please.blogspot.com

74 pointslaginimaineb28 comments

Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware.

This is the sort of thing Senators are for.

Note that the engineering fuse is blown on the Nexus 4 and 5, too. This stops you reflashing the lk bootloader, but doesn't stop you chainloading into something more interesting, like https://github.com/grub4android/grub

Personally, I would rather vote with my dollars than ask for more rules.

Vote for devices? Companies?

Jake, the election is rigged!

Walk with me down this garden path, if you please... :)

Regulation of the manufacture and distribution of medicine is a good thing.

'Regulation' just means that corporations and individuals aren't blindly trusted to do the right thing with regards to medicine.

That's because bad medicine generally has a profound impact on people's lives.

Somebody could put some bad medicine in a bottle, but there are actually organizations checking for this and there are severe penalties.

Cellphones aren't medicine, but the impact that a bad device can have on people's lives is growing every day.

It would appear that each person's identity is largely composed of their memories and their internal processes, which were also shaped by their experiences.

As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous.

Today, Samsung (for example) would never get away with filtering all negative news articles about a particular political candidate out of all their users' feeds. Nor would they get away with inserting positive chatter about their own devices.

For how long will that be true?

We have to establish some sort of minimum quality standard for the devices through which we are going to experience life. Yes, rules!

If you want some extra food for thought on FDA activity, have a quick look through the Drug Recall List

The last 60 days had 46 drug recalls :

http://www.fda.gov/Drugs/DrugSafety/DrugRecalls/default.htm

Or medical equipment :

http://www.fda.gov/medicaldevices/safety/default.htm

I read every one for food for a University paper and I'm surprised anyone is still alive!

Regardless of the arguments over whether something like this is the proper place of Government, it seems likely that, if anything, this is going the exact opposite way. The vast majority of users have neither the ability or interest to keep devices safe and free of malware etc, and are welcoming locked-down devices and walled garden app stores. Those who want to hack and tinker are the tiny minority.

True. Is this lack of desire to control our brain extensions set stone? It's possible (I consider it inevitable) that power will over-step it's expected boundaries. The statistical person might then care about their root access. In my experience, if presented in the right way, they care now.

If you want a unlocked phone, then buy one. Asking for more restrictions makes you _less_ free, and costs more. What you are suggesting is to take money from others so you can be ignorant about what electronics you are buying.

"As devices become our primary source of information, the devices become more important. More powerful and potentially more dangerous."

Ya, hence governments want power over them. How's that kill switch working for ya? Oh, no InternetID? Sorry, you need that to surf since the Safe Internet Act of 2021, and no, we can't sell you a phone without the Safe Internet Chip, because rules.

Your comment has been downvoted, I guess. I don't see why. I think the is important so I'm willing to walk/think through your argument. Of course! :) That's discourse.

The kill switch and blackbox chips are exactly the sort of thing I want to avoid.

I'm not sure how we'd get there from the rule I want. I guess the rule I want is "No machine shall disobey its owner". And device manufactures could be punished if they sell devices that are found to disobey their owners.

Seems to me that would address the fritz chip, and the kill switch, etc.

Related: are all rules inherently bad? Or do we just have a lot of bad ones and no reason to think new ones would be better?

I appreciate that. I prob lost a few points on snark. To your question, if you ask for people to make rules for you, don't be surprised when they make rules you don't like. The vast majority of the time, power acts to increase it's influence.

Interesting part about QFuses. How are they actually implemented in the hardware?

Generically, it would be referred to as "OTP NVM", or one time programmable non-volatile memory.

There are apparently a few different ways to implement that.

A little dry, but the only thing I could find with some comparison of approaches: http://www.kilopass.com/wp-content/uploads/2010/04/compariso...

AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.

Could easily be an actual fuse. A array of skinny pieces of metal with a big monster current source to pop them on command.

Please, please, please tell me this will lead to my Motorola Droid Turbo being unlocked. I want CyanogenMod so badly!

I also want to be able to edit my hosts file and make it so I don't waste any bandwidth any more.

It will work on the Turbo! :)

But you'll either need a version old enough to be vulnerable to this TrustZone exploit, or you can wait a couple of weeks until I release a new exploit (which also works on the Turbo).

Make sure to claim this: http://forum.xda-developers.com/droid-turbo/general/bounty-u...

You have made my day/week. It is comforting to know that only a few more weeks and I might have a fully functional cyanogenmod install on my phone.

>It will work on the Turbo! :)

Since people seem to put the Turbo/Mini/Maxx in the same group, would it work on any of them? :)

I believe so

crossing fingers for 8960 compatibility someday :-)

I'm in the same place. I really wanna try and see if it works, but I'm scared of bricking my phone.

This guy could make a lot of money from the bounty threads.

5k+ was the last reading IIRC.

Don't think I'll collect it, but I will release all the details so people can do it themselves.

Pretty sure sunshine works on the turbo but $25 is probably turning people off.

Oooh sunshine is about to take a hit I guess.

added: wish you could subscribe to users on HN, I missed all your previous goodies

wow you make it all look so easy, but it's not at all

Thanks! I'm also on twitter in case that helps (@laginimaineb).

As for Sunshine - I'm publishing a new (even broader) zero-to-TZ saga, complete with exploits, but I'm not going to create a product out of it. So ultimately, as long as there are people behind Sunshine who are willing to make it work with relative ease, I'm sure most people won't mind spending a few dollars to unlock their device.

As for the more tech-savvy crowd; I hope they choose to do it themselves with the exploits provided - it is much more fun that way, IMHO.

Have you considered contributing to android-rooting-tools?

https://github.com/android-rooting-tools

Reply on news.ycombinator.com