Difference between revisions of "SBF"

Jump to: navigation, search
(Known return codes reformat)
(Known functions)
Line 54: Line 54:
===Known functions===
===Known functions===
{| border="1" cellpadding="0" cellspacing="0"
{| border="1" cellpadding="5" cellspacing="0"
!style="background: #DEE7EC;"| Function
!style="background: #DEE7EC;"| Function
!style="background: #DEE7EC;"| fungrp
!style="background: #DEE7EC;"| fungrp

Revision as of 14:51, 23 August 2010


SBF seems to stand for Single Binary File, containing the firmware image. None of the SBFs contain a subsidy lock and flashing a SBF will not unlock the phone. These files could be flashed into the milestone via RSD Lite Interface. The updates of this page can be seen above the download page links.

The device should be put into Bootloader Mode and then attached via USB to the PC. After the PC recognizes the phone, you could use rsd_lite for flashing the SBF to your Milestone.


The latest SBF-Recalc ( is available for windows here ((see http://modmymoto.com/forums/showthread.php?t=525344 for the original post by its author and for Linux/OS X versions)): http://www.megaupload.com/?d=Y8RDIZGA

Previous version 1.2.9 for windows and OS X: http://www.megaupload.com/?d=7J9EOZT0

Previous version 1.2.9 for Linux ((According to the developer you need libstdc++5 for the linux version)): http://www.megaupload.com/?d=03M0GM36

Note: Everything works except checksums recalculating. RSD Lite prints the correct ones in its log though, so the SBF file can be edited by hand to use those CRC codes if really needed (by tryout & error).

SBF / MBN Depacker

The latest version (1.2 ALPHA 3) is availabe for .NET 3.5 here ((see http://www.modmymoto.com/forums/showthread.php?t=530781 for post by author)): http://rapidshare.com/files/386624716/MotoAndroidDepacker-1.2alpha3.rar.html

Supports repacking for the Milestone SBF, including the checksum recalculation.


Flashing the "Service" version will not wipe userdata partition. Looking on the flex version (ro.gsm.flexversion): B1B8 is for WCDMA 900 / 2100 and B1B2B5 is for WCDMA 850 / 1900 / 2100, some firmwares doesn't have that string in the flex version, so it cannot be determined from that (All Latin American firmwares and Retail Thai are WCDMA 850 / 1900 / 2100).

Flashing an SBF file from a different country could cause problems with cellular communications. For example, some people have applied the HK SBF in Europe and in Latin America and their phones stopped working with 3G (due to different frequencies, presumably).

Here's an attempt to parse the firmware filename structure with an informal shell/re syntax:

RSD web service

Officially distributed builds are exposed by a public web service at https://rsd.motorola.com/cs/servlets/SRPConsumerServlet used by Motorola's end-user update tool. Motorola's internal service tool use a similar service at https://rsd.motorola.com/cs/servlets/SRPServlet, but it appears to be restricted to authorized sessions.

<code xml Request>
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">

Known functions

Function fungrp opcode Parameter name Parameter value
MSU version check 02 01 consumerclientversion Version string, e.g. C01.11.79
Use_case_set Inapplicable
countrycode Three-letter code
USB driver version check 02 05 hardware 00
OS Four-digit MS Windows version, e.g. 0601 for Win7
driverversion Version string, e.g. DD04.05.00
Warranty status 07 13 serialnumbertype IMEI
serialnumber IMEI string
Firmware version check 10 01 flex ro.gsm.flexversion
firmware ro.build.id+gsm.version.baseband
apversion ro.build.id+gsm.version.baseband
apsetup Inapplicable
apresourceflex Inapplicable
aplogo Inapplicable
apsecuresetup Inapplicable
rofs Inapplicable
rofsextension Inapplicable
apflex ro.build.config.version
bootloader Four-digit version, eg. 9073
lang Inapplicable
kjava Inapplicable
pri Inapplicable

The only parameter required for firmware version checks is flex. The service will only respond successfully if the query is unambiguous and matched phone model is cleared for user upgrades. (see Known return codes)

Known return codes

fungrp opcode operation status Returned message Comment
06 50 00 success Update URL to .sbf included in return xml scheme
06 50 01 Cannot ID the phone as the flex is blank.
06 50 02 No Phone found with the given phone parameters
06 50 03 Multiples phones found with the same configuration. This needs to be investigated, since the rsd servers reply this for some phones. For example for a brazilian Milestone with flex version USASHLSRETBRLA02C.0R (Vivo). Trying to fetch .sbf files from the servers for the DroidX shows the same results. (Note - for NA queries, you must always supply firmware version along the flex, otherwise you get the Multiples phones found with the same configuration. as result, even if the flex version is invalid (like just NA).)

Example queries

    • GB Retail (SM1658AXXB1)**

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?> <soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"> <soap-env:Body><srpmessage><srpoperation><fungrp>10</fungrp><opcode>01</opcode><parameterlist> <parameter><name>flex</name><value>UCASHLSEMEAB1B803F.0R</value></parameter> <parameter><name>apflex</name><value>GAS_EMEA_USASHLS00RTGB_P008</value></parameter> </parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \ https://rsd.motorola.com/cs/servlets/SRPConsumerServlet

    • CA Telus (81130CHEPA)**

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?> <soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"> <soap-env:Body><srpmessage><srpoperation><fungrp>10</fungrp><opcode>01</opcode><parameterlist> <parameter><name>flex</name><value>USASHLSTLSB1B2B5051.0R</value></parameter> </parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \ https://rsd.motorola.com/cs/servlets/SRPConsumerServlet

OTA updates

Just downloaded on phone in /cache/fota/update.zip and have this structure:

 * __binary_firmware_file__
 * boot.img
 * bp.img
 * mbm.img
 * cdt.bin
 * lbl.bin
 * logo.bin
 * install-recovery.sh
 * recovery-from-boot.p
 * updater-script
 * mtd.cfg

CERT.SF - contain sha1 digest of all files in update.zip

CERT.RSA - certificate ASN1.DER ( parsed struct http://pastebin.ca/1849789 ). It parsed by command "openssl asn1parse -inform DER -in CERT.RSA"

If any files unneeded in update - update.zip does not include this file. This is a sample OTA update package(SHOLS_U2_01.03.1_to_SHOLS_U2_01.14.0_REQ563): [update.zip]

Retail SBF Files


 03/08/2010: Added Milestone XT720 firmware for South-East Asia (STR_U2_01.18.2)
 28/07/2010: Added Blur_Version.0.18.4.ME511.ChinaRetail.en.CN and bootloader for ME511
 24/07/2010: Added STR_U2_01.18.2 (Singapore) for XT720
 23/07/2010: Added SHOLS_U2_02.38.0 (Italy)
 21/07/2010: Added SHOLS_U2_02.36.0 (DACH, O2 DE, VF DE)
 16/07/2010: Added XT800 firmwares and Droid X bootloaders
 11/07/2010: Added Thai 02.36.0 firmware
 10/07/2010: Added bootloader 90.78ch and new XT702 firmware
 05/07/2010: Added SHOLS_U2_02.36.0 (Starhub SG)
 01/07/2010: Added SHOLS_U2_02.36.0 (Central Europe, Southeast Asia)
 21/06/2010: Added SHOLS_U2_02.27.6 (Israel)
 09/06/2010: Corrected - XT701 firmwares are Taiwan.
 09/06/2010: Corrected - XT701 firmwares are not signed.
 06/06/2010: Added XT701 new 2.1 Taiwan firmware and bootloader 80.99
 31/05/2010: Added XT701 new 2.1 firmware and bootloader 80.98
 26/05/2010: Added SHOLS_U2_02.34.3 (Hong Kong / Maccau); SHLA_U2_03.05.0 (TIM Brasil, Service Version only)
 26/05/2010: Initial creation.


Custom SBF Files

Vulnerable Recovery SBF Flash

This SBF file will flash only the vulnerable recovery from 2.0.1 without modifying other partitions. \\ Download (Milestone): [MediaFire]\\ Download (XT800): [Droid-Developers]

2.1 kernel fix of scheduled CPU wake-ups

This SBF file will flash only the boot.img (kernel+init) from SHOLS_U2_03.10.0: [mediafire], [rapidshare] ~~DISCUSSION|SBF Firmwares~~