SBF

From MILEDROPEDIA
Revision as of 18:31, 12 August 2010 by XVilka (Talk | contribs)

Jump to: navigation, search
SBF

SBF seems to stand for Single Binary File, containing the firmware image. None of the SBFs contain a subsidy lock and flashing a SBF will not unlock the phone. These files could be flashed into the milestone via RSD Lite Interface. The updates of thes page can be seen above the download page links.

The device should be put into Bootloader Mode and then attached via USB to the PC. After the PC recognizes the phone, you could use this programs for flashing the SBF to your Milestone.

SBF-Recalc

The latest SBF-Recalc (1.2.9.1) is available for windows here ((see http://modmymoto.com/forums/showthread.php?t=525344 for the original post by its author and for Linux/OS X versions)): http://www.megaupload.com/?d=Y8RDIZGA

Previous version 1.2.9 for windows and OS X: http://www.megaupload.com/?d=7J9EOZT0

Previous version 1.2.9 for Linux ((According to the developer you need libstdc++5 for the linux version)): http://www.megaupload.com/?d=03M0GM36

Note: Everything works except checksums recalculating. RSD Lite prints the correct ones in its log though, so the SBF file can be edited by hand to use those CRC codes if really needed (by tryout & error).

SBF / MBN Depacker

The latest version (1.2 ALPHA 3) is availabe for .NET 3.5 here ((see http://www.modmymoto.com/forums/showthread.php?t=530781 for post by author)): http://rapidshare.com/files/386624716/MotoAndroidDepacker-1.2alpha3.rar.html

Supports repacking for the Milestone SBF, including the checksum recalculation.

Comments

Flashing the "Service" version will not wipe userdata partition. Looking on the flex version (ro.gsm.flexversion): B1B8 is for WCDMA 900 / 2100 and B1B2B5 is for WCDMA 850 / 1900 / 2100, some firmwares doesn't have that string in the flex version, so it cannot be determined from that (All Latin American firmwares and Retail Thai are WCDMA 850 / 1900 / 2100).

Flashing an SBF file from a different country could cause problems with cellular communications. For example, some people have applied the HK SBF in Europe and in Latin America and their phones stopped working with 3G (due to different frequencies, presumably).

Here's an attempt to parse the firmware filename structure with an informal shell/re syntax:

${ro.build.id}_${ro.gsm.flexversion}_${ro.build.config.version#3}_${ro.build.config.version#4}_A[0-9][0-9][0-9]_HWp2a_{Service|}1FF.sbf
RSD web service

Officially distributed builds are exposed by a public web service at https://rsd.motorola.com/cs/servlets/SRPConsumerServlet used by Motorola's end-user update tool. Motorola's internal service tool use a similar service at https://rsd.motorola.com/cs/servlets/SRPServlet, but it appears to be restricted to authorized sessions.

<code xml Request>
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">
 <soap-env:Body>
  <srpmessage>
   <srpoperation>
    <fungrp></fungrp>
    <opcode></opcode>
    <parameterlist>
     <parameter><name></name></value></parameter>
    </parameterlist>
   </srpoperation>
  </srpmessage>
 </soap-env:Body>
</soap-env:Envelope>
</code>

Known functions

^ Function ^ fungrp ^ opcode ^ Parameter name ^ Parameter value ^ | MSU version check | 02 | 01 | consumerclientversion | Version string, e.g. C01.11.79 | | ||| Use_case_set | //Inapplicable// | | ::: ||| countrycode | Three-letter code | | USB driver version check | 02 | 05 | hardware | 00 | | ||| OS | Four-digit MS Windows version, e.g. 0601 for Win7 | | ::: ||| driverversion | Version string, e.g. DD04.05.00 | | Warranty status | 07 | 13 | serialnumbertype | IMEI | | ||| serialnumber | IMEI string | | Firmware version check | 10 | 01 | flex | ro.gsm.flexversion | | ||| firmware | ro.build.id+gsm.version.baseband | | ::: ||| apversion | ro.build.id+gsm.version.baseband | | ::: ||| apsetup | //Inapplicable// | | ::: ||| apresourceflex | //Inapplicable// | | ::: ||| aplogo | //Inapplicable// | | ::: ||| apsecuresetup | //Inapplicable// | | ::: ||| rofs | //Inapplicable// | | ::: ||| rofsextension | //Inapplicable// | | ::: ||| apflex | ro.build.config.version | | ::: ||| bootloader | Four-digit version, eg. 9073 | | ::: ||| lang | //Inapplicable// | | ::: ||| kjava | //Inapplicable// | | ::: ||| pri | //Inapplicable// |

The only parameter required for firmware version checks is flex. The service will only respond successfully if the query is unambiguous and matched phone model is cleared for user upgrades. (see Known return codes)


Known return codes

^ fungrp ^ opcode ^ operation status ^ Returned message ^ Comment ^ | 06 | 50 | 00 | success | Update URL to .sbf included in return xml scheme | | 06 | 50 | 01 | Cannot ID the phone as the flex is blank. | | | 06 | 50 | 02 | No Phone found with the given phone parameters | | | 06 | 50 | 03 | Multiples phones found with the same configuration. | This needs to be investigated, since the rsd servers reply this for some phones. For example for a brazilian Milestone with flex version USASHLSRETBRLA02C.0R (Vivo). Trying to fetch .sbf files from the servers for the DroidX shows the same results. (Note - for NA queries, you must always supply firmware version along the flex, otherwise you get the Multiples phones found with the same configuration. as result, even if the flex version is invalid (like just NA).) |

Example queries

    • GB Retail (SM1658AXXB1)**

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?> <soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"> <soap-env:Body><srpmessage><srpoperation><fungrp>10</fungrp><opcode>01</opcode><parameterlist> <parameter><name>flex</name><value>UCASHLSEMEAB1B803F.0R</value></parameter> <parameter><name>apflex</name><value>GAS_EMEA_USASHLS00RTGB_P008</value></parameter> </parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \ https://rsd.motorola.com/cs/servlets/SRPConsumerServlet

    • CA Telus (81130CHEPA)**

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?> <soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"> <soap-env:Body><srpmessage><srpoperation><fungrp>10</fungrp><opcode>01</opcode><parameterlist> <parameter><name>flex</name><value>USASHLSTLSB1B2B5051.0R</value></parameter> </parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \ https://rsd.motorola.com/cs/servlets/SRPConsumerServlet


OTA updates

Just downloaded on phone in /cache/fota/update.zip and have this structure:

 * CERT.RSA
 * CERT.SF
 * MANIFEST.MF
 * __binary_firmware_file__
 * boot.img
 * bp.img
 * mbm.img
 * cdt.bin
 * lbl.bin
 * logo.bin
 * install-recovery.sh
 * recovery-from-boot.p
 * updater-script
 * mtd.cfg

CERT.SF - contain sha1 digest of all files in update.zip

CERT.RSA - certificate ASN1.DER ( parsed struct http://pastebin.ca/1849789 ). It parsed by command "openssl asn1parse -inform DER -in CERT.RSA"

If any files unneeded in update - update.zip does not include this file. This is a sample OTA update package(SHOLS_U2_01.03.1_to_SHOLS_U2_01.14.0_REQ563): [[1]]

Retail SBF Files

Updates

03/08/2010: Added Milestone XT720 firmware for South-East Asia (STR_U2_01.18.2)\\ 28/07/2010: Added Blur_Version.0.18.4.ME511.ChinaRetail.en.CN and bootloader for ME511\\ 24/07/2010: Added STR_U2_01.18.2 (Singapore) for XT720\\ 23/07/2010: Added SHOLS_U2_02.38.0 (Italy)\\ 21/07/2010: Added SHOLS_U2_02.36.0 (DACH, O2 DE, VF DE) \\ 16/07/2010: Added XT800 firmwares and Droid X bootloaders\\ 11/07/2010: Added Thai 02.36.0 firmware\\ 10/07/2010: Added bootloader 90.78ch and new XT702 firmware\\ 05/07/2010: Added SHOLS_U2_02.36.0 (Starhub SG)\\ 01/07/2010: Added SHOLS_U2_02.36.0 (Central Europe, Southeast Asia)\\ 21/06/2010: Added SHOLS_U2_02.27.6 (Israel)\\ 09/06/2010: Corrected - XT701 firmwares are Taiwan.\\ 09/06/2010: Corrected - XT701 firmwares are not signed.\\ 06/06/2010: Added XT701 new 2.1 Taiwan firmware and bootloader 80.99\\ 31/05/2010: Added XT701 new 2.1 firmware and bootloader 80.98\\ 26/05/2010: Added SHOLS_U2_02.34.3 (Hong Kong / Maccau); SHLA_U2_03.05.0 (TIM Brasil, Service Version only)\\ 26/05/2010: Initial creation.\\

Downloads

[(A853, XT702)]\\ \\ [(A855)]\\ \\ [Tablet (XT701)]\\ \\ [/ Milestone XT720 (XT720)]\\ \\ [(XT800)]\\ \\ [X (MB810)]\\ \\ [(ME511)]\\ \\


Custom SBF Files

Vulnerable Recovery SBF Flash

This SBF file will flash only the vulnerable recovery from 2.0.1 without modifying other partitions. \\ Download (Milestone): [[2]]\\ Download (XT800): [[3]]

2.1 kernel fix of scheduled CPU wake-ups

This SBF file will flash only the boot.img (kernel+init) from SHOLS_U2_03.10.0: [[4]], [[5]] ~~DISCUSSION|SBF Firmwares~~