UART. Again....

[progzone122]

we need to try UART again to know for sure it works or not. What if Motorola didn't block UART?

[progzone122]

What bothers me is that the KPCOL testpoint is located in the logic block with UART

[progzone122]

It seems that access to the UART is blocked, and we can't access it even when I was in PCS mode - nothing happened.
And yes, towards the end of my experiments, my TX test point came off... :((((
Anyway, the UART test points are useless for us.

[progzone122]

We would really need to decompile the bootloader then if we want to find something interesting, both test points and fastboot derivation key.

Iirc the preloader decompilation didn't have anything useful, because it reads efuses so we have no luck with that

Is there any way we can get more people involved in this?

[shomykohai]

If we could find someone with experience at decompiling, maybe yes ig?

[progzone122]

If we could find someone with experience at decompiling, maybe yes ig?

Any people at all, because we're not enough.
Always need an outside perspective

[shomykohai]

Maybe this (even if it's from 8 years ago) could help?
https://github.com/martinmullins/moto_aboot/blob/3bb6de797f8d0f4ebc3725c25e6bfca30699cc4f/retdec/src/U/unlock_phone.c#L109

Edit: This too
https://github.com/martinmullins/moto_aboot/blob/3bb6de797f8d0f4ebc3725c25e6bfca30699cc4f/retdec/src/M/mot_sst_validate_hash_password.c#L32

[shomykohai]

If we could find someone with experience at decompiling, maybe yes ig?

Any people at all, because we're not enough. Always need an outside perspective

I'd say XDA is a starting point for sure

[shomykohai]

@progzone122
Look what I found

https://github.com/DavidBuchanan314/lk-mt6765/blob/20ecf47387a0e88f8db1e774e9bd86ba0609c935/lk/app/mt_boot/sys_commands.c#L312C1-L328C1

[shomykohai]

Could be this what enables us to use UART?

[shomykohai]

https://github.com/DavidBuchanan314/lk-mt6765/blob/20ecf47387a0e88f8db1e774e9bd86ba0609c935/lk/app/mt_boot/sys_commands.c#L508C1-L528C1

This one too

[progzone122]

Maybe

diablo-pc :: ~ 1 » fastboot oem p2u on
OKAY [  0.000s]
Finished. Total time: 0.000s

I won't be able to try it as my TX testpoint is broken off :(

[shomykohai]

Neither can I, I don't have the tools to be able to use UART.

At least we're getting some new fastboot commands that might help 🤔