Motorola CLIQ Firmware Поделиться Опции

[Skrilax_CZ]

Скачать официальные прошивки Motorola CLIQ (Dext)



Branding: T-Mobile US
Subsidy Lock: ***UNKNOWN***
Version: 1.1.4
Requires RSD Lite 4.5.7.
Not supported by SBF Recalc.

It is in shx format, to split it:
Plug any Moto phone except CLIQ, then flash the CLIQ firmware on it and let it fail. Open the firmware directory and copy the CG2, RAMDLD and the hmg BEFORE you close the RSD Lite. Now you have the CGs in normal binary format.


http://rapidshare.com/files/308088649/tmo-...stomer.zip.html

Сообщение отредактировал Воха - 28.3.2016, 14:12

[Skrilax_CZ]

I extracted files from the CG2 - system image.
yaffs2 image is located at 0x0178f464 in flashfile CG2. (There is userdata yaffs2 image on 0x094d08cc as well, but that is empty.)

http://rapidshare.com/files/314017775/system.rar

Сообщение отредактировал Skrilax_CZ - 29.11.2009, 22:52

[yakk]

Skrilax_CZ
I've wrote simple program that extracts all partitions from the cg2.smg file.. shx MUST be splitted with RSD-Lite (all other software doesn't split this shx correctly)..
usage:

Код

cg2 <filename>

cg2.rar   ( 13.91 килобайт ) Кол-во скачиваний: 221

[Skrilax_CZ]

Thanks. I wrote one too and new SBF recalc 1.2.9.1 splits it correctly according to my extractings.

I observed:
The "headers" have fixed length 0x308 and then the binary starts. At the offset 0x2E4, there is the length of the binary. Now what are the numbers in the headers at offsets "0x300" and "0x304"? You have any idea? There are some other number, those appear to be constants.

Сообщение отредактировал Skrilax_CZ - 30.11.2009, 10:46

[yakk]

Skrilax_CZ
There is partition ID on the 0x2b offset of header.. 0x20 f.e. - partition table, it is used by ramdld.. offset 0x300 - is the checksum of partition - it is calculated as inverted 32bit sum.. value from 0x304 offset seems to be ignored by ramdld..
Added: Value at 0x304 offset is the checksum of header.. 8bit sum of all bytes of header must be equal to 0xFF..

Сообщение отредактировал yakk - 30.11.2009, 11:22

[Skrilax_CZ]

yakk
I see, thanks.

So to sum up what we know about the header:

Size = 0x308

ID - byte at offset 0x2B
Name - string at offset 0xE4
Length - integer 32bit at oggset 0x2E4
Binary checksum - integer 32bit at oggset 0x300, inverted 32bit sum of binary
Header checksum - byte at 0x304, to make the sum of header 0x00 (in 8-bit)

===

Also I noted that the *hd.mbn files, they seem to be to be some "other headers" for the *sec.mbn files. Their length is always 40 bytes (without the header), so far I just noted that at offset 0x10 in the *hd.mbn there is length of the *sec.mbn binary.

Сообщение отредактировал Skrilax_CZ - 30.11.2009, 13:30

[yakk]

Skrilax_CZ
I think that *hd files contain descriptions of the signature of the corresponding *sec file.

[Skrilax_CZ]

yakk

It looks like so, offset 0x14 of the hd.mbn looks like position of the signature (there is magic 30 30 30 35 before the signature).
But amsssec.mbn is probably unsigned (in the amsshd.mbn file the offset 0x14 (length of the *sec) has the same value as 0x10) and I can't find it at the end of the file).

Сообщение отредактировал Skrilax_CZ - 30.11.2009, 23:14

[otetznik]

Луди здрасте!!!!:)
А когда на Моторола Кликку будет код разблокирования (T-Mobile) ?
А то купил в США, а он заблакирован только под тамшнего оператора, а мне нуна пользвать все симкарты
Шо делать? можэт ктото преобрёл это тело?
Поделитесь кодом этим








+Osta
Пиши по-русски

Сообщение отредактировал Osta - 2.12.2009, 14:39

[stigr]

А когда на Моторола Кликку будет код разблокирования (T-Mobile)

будет тогда, когда ты купишь.