Difference between revisions of "SBF"

Jump to: navigation, search
Line 208: Line 208:
== Retail SBF Files ==
== Retail SBF Files ==
=== Updates ===
03/08/2010: Added Milestone XT720 firmware for South-East Asia (STR_U2_01.18.2)
28/07/2010: Added Blur_Version.0.18.4.ME511.ChinaRetail.en.CN and bootloader for ME511
24/07/2010: Added STR_U2_01.18.2 (Singapore) for XT720
23/07/2010: Added SHOLS_U2_02.38.0 (Italy)
21/07/2010: Added SHOLS_U2_02.36.0 (DACH, O2 DE, VF DE)
16/07/2010: Added XT800 firmwares and Droid X bootloaders
11/07/2010: Added Thai 02.36.0 firmware
10/07/2010: Added bootloader 90.78ch and new XT702 firmware
05/07/2010: Added SHOLS_U2_02.36.0 (Starhub SG)
01/07/2010: Added SHOLS_U2_02.36.0 (Central Europe, Southeast Asia)
21/06/2010: Added SHOLS_U2_02.27.6 (Israel)
09/06/2010: Corrected - XT701 firmwares are Taiwan.
09/06/2010: Corrected - XT701 firmwares are not signed.
06/06/2010: Added XT701 new 2.1 Taiwan firmware and bootloader 80.99
31/05/2010: Added XT701 new 2.1 firmware and bootloader 80.98
26/05/2010: Added SHOLS_U2_02.34.3 (Hong Kong / Maccau); SHLA_U2_03.05.0 (TIM Brasil, Service Version only)
26/05/2010: Initial creation.
=== Downloads ===
=== Downloads ===

Latest revision as of 22:16, 3 December 2011


SBF seems to stand for Single Binary File, containing the firmware image. None of the SBFs contain a subsidy lock and flashing a SBF will not unlock the phone. These files could be flashed into the milestone via RSD Lite Interface. The updates of this page can be seen above the download page links.

The device should be put into Bootloader Mode and then attached via USB to the PC. After the PC recognizes the phone, you could use rsd_lite for flashing the SBF to your Milestone.

SBF Depacker

A tool writen by Skrilax_CZ can be used to repack SBFs and compile custom ones. Can be downloaded here for .NET 3.5 MotoAndroidDepacker.zip or for Mono MotoAndroidDepackerMono.zip.

RSD web service

Officially distributed builds are exposed by a public web service at https://rsd.motorola.com/cs/servlets/SRPConsumerServlet used by Motorola's end-user update tool. Motorola's internal service tool use a similar service at https://rsd.motorola.com/cs/servlets/SRPServlet, but it appears to be restricted to authorized sessions.

<code xml Request>
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">

Known functions

Function fungrp opcode Parameter name Parameter value
MSU version check 02 01 consumerclientversion Version string, e.g. C01.11.79
Use_case_set Inapplicable
countrycode Three-letter code
USB driver version check 02 05 hardware 00
OS Four-digit MS Windows version, e.g. 0601 for Win7
driverversion Version string, e.g. DD04.05.00
Warranty status 07 13 serialnumbertype IMEI
serialnumber IMEI string
Firmware version check 10 01 flex ro.gsm.flexversion
firmware ro.build.id+gsm.version.baseband
apversion ro.build.id+gsm.version.baseband
apsetup Inapplicable
apresourceflex Inapplicable
aplogo Inapplicable
apsecuresetup Inapplicable
rofs Inapplicable
rofsextension Inapplicable
apflex ro.build.config.version
bootloader Four-digit version, eg. 9073
lang Inapplicable
kjava Inapplicable
pri Inapplicable

The only parameter required for firmware version checks is flex. The service will only respond successfully if the query is unambiguous and matched phone model is cleared for user upgrades. (see Known return codes)

Known return codes

fungrp opcode operation status Returned message Comment
06 50 00 success Update URL to .sbf included in return xml scheme
06 50 01 Cannot ID the phone as the flex is blank.
06 50 02 No Phone found with the given phone parameters
06 50 03 Multiples phones found with the same configuration. This needs to be investigated, since the rsd servers reply this when the supplied date are not unique. For example for a brazilian Milestone with flex version USASHLSRETBRLA02C.0R (Vivo). Trying to fetch .sbf files from the servers for the DroidX shows the same results. (Note - for NA queries, you must always supply firmware version along the flex, otherwise you get the Multiples phones found with the same configuration. as result, even if the flex version is invalid (like just NA).)

Example queries

GB Retail (SM1658AXXB1)

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">
</parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \

CA Telus (81130CHEPA)

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">
</parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \

OTA updates

Just downloaded on phone in /cache/fota/update.zip and have this structure:

  • __binary_firmware_file__
  • boot.img
  • bp.img
  • mbm.img
  • cdt.bin
  • lbl.bin
  • logo.bin
  • install-recovery.sh
  • recovery-from-boot.p
  • updater-script
  • mtd.cfg

CERT.SF - contain sha1 digest of all files in update.zip

CERT.RSA - certificate ASN1.DER ( parsed struct http://pastebin.ca/1849789 ). It parsed by command "openssl asn1parse -inform DER -in CERT.RSA"

If any files unneeded in update - update.zip does not include this file. This is a sample OTA update package(SHOLS_U2_01.03.1_to_SHOLS_U2_01.14.0_REQ563): update.zip

Retail SBF Files


Custom SBF Files

Vulnerable Recovery SBF Flash

This SBF file will flash only the vulnerable recovery from 2.0.1 without modifying other partitions.

2.1 kernel fix of scheduled CPU wake-ups

This SBF file will flash only the boot.img (kernel+init) from SHOLS_U2_03.10.0: mediafire, rapidshare