Jump to: navigation, search


SBF seems to stand for Single Binary File, containing the firmware image. None of the SBFs contain a subsidy lock and flashing a SBF will not unlock the phone. These files could be flashed into the milestone via RSD Lite Interface. The updates of this page can be seen above the download page links.

The device should be put into Bootloader Mode and then attached via USB to the PC. After the PC recognizes the phone, you could use rsd_lite for flashing the SBF to your Milestone.

SBF Depacker

A tool writen by Skrilax_CZ can be used to repack SBFs and compile custom ones. Can be downloaded here for .NET 3.5 or for Mono

RSD web service

Officially distributed builds are exposed by a public web service at used by Motorola's end-user update tool. Motorola's internal service tool use a similar service at, but it appears to be restricted to authorized sessions.

<code xml Request>
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<soap-env:Envelope xmlns:soap-env="">

Known functions

Function fungrp opcode Parameter name Parameter value
MSU version check 02 01 consumerclientversion Version string, e.g. C01.11.79
Use_case_set Inapplicable
countrycode Three-letter code
USB driver version check 02 05 hardware 00
OS Four-digit MS Windows version, e.g. 0601 for Win7
driverversion Version string, e.g. DD04.05.00
Warranty status 07 13 serialnumbertype IMEI
serialnumber IMEI string
Firmware version check 10 01 flex ro.gsm.flexversion
apsetup Inapplicable
apresourceflex Inapplicable
aplogo Inapplicable
apsecuresetup Inapplicable
rofs Inapplicable
rofsextension Inapplicable
bootloader Four-digit version, eg. 9073
lang Inapplicable
kjava Inapplicable
pri Inapplicable

The only parameter required for firmware version checks is flex. The service will only respond successfully if the query is unambiguous and matched phone model is cleared for user upgrades. (see Known return codes)

Known return codes

fungrp opcode operation status Returned message Comment
06 50 00 success Update URL to .sbf included in return xml scheme
06 50 01 Cannot ID the phone as the flex is blank.
06 50 02 No Phone found with the given phone parameters
06 50 03 Multiples phones found with the same configuration. This needs to be investigated, since the rsd servers reply this when the supplied date are not unique. For example for a brazilian Milestone with flex version USASHLSRETBRLA02C.0R (Vivo). Trying to fetch .sbf files from the servers for the DroidX shows the same results. (Note - for NA queries, you must always supply firmware version along the flex, otherwise you get the Multiples phones found with the same configuration. as result, even if the flex version is invalid (like just NA).)

Example queries

GB Retail (SM1658AXXB1)

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<soap-env:Envelope xmlns:soap-env="">
</parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \

CA Telus (81130CHEPA)

$ curl -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<soap-env:Envelope xmlns:soap-env="">
</parameterlist></srpoperation></srpmessage></soap-env:Body></soap-env:Envelope>' \

OTA updates

Just downloaded on phone in /cache/fota/ and have this structure:

  • __binary_firmware_file__
  • boot.img
  • bp.img
  • mbm.img
  • cdt.bin
  • lbl.bin
  • logo.bin
  • recovery-from-boot.p
  • updater-script
  • mtd.cfg

CERT.SF - contain sha1 digest of all files in

CERT.RSA - certificate ASN1.DER ( parsed struct ). It parsed by command "openssl asn1parse -inform DER -in CERT.RSA"

If any files unneeded in update - does not include this file. This is a sample OTA update package(SHOLS_U2_01.03.1_to_SHOLS_U2_01.14.0_REQ563):

Retail SBF Files


Custom SBF Files

Vulnerable Recovery SBF Flash

This SBF file will flash only the vulnerable recovery from 2.0.1 without modifying other partitions.

2.1 kernel fix of scheduled CPU wake-ups

This SBF file will flash only the boot.img (kernel+init) from SHOLS_U2_03.10.0: mediafire, rapidshare