Manually deriving bootloader key?

[shomykohai]

Fastboot seem to give the same output as this source code:

https://github.com/l33tnoob/MT65x2_kernel_lk/blob/master/bootable/bootloader/lk/app/mt_boot/sec_unlock.c

We could derive the key manually if only we knew what sec_get_serial_number_from_unlock_key and reverse its process

[shomykohai]

Doing
fastboot oem key <key-len> gives error no matter what the size is

[shomykohai]

We also know that the device supports fastboot unlocking, as the sec_unlock file gets compiled into the lk binary only if fastboot unlocking is supported.

We just need to hope it wasn't patched somehow.

[progzone122]

At this point we get an error

...
#define UNLOCK_KEY_SIZE 32
#define SERIAL_NUMBER_SIZE 16
#define DEFAULT_SERIAL_NUM "0123456789ABCDEF"

char fb_unlock_key_str[UNLOCK_KEY_SIZE+1] = {0};
...
    if(UNLOCK_KEY_SIZE != strlen(fb_unlock_key_str))
    {
        //fastboot_fail("Unlock key length is incorrect!");
        ret = ERR_UNLOCK_KEY_WRONG_LENGTH;
        goto _wrong_key_length;
    }

[shomykohai]

yup, same as in fastboot oem unlock

oem unlock does not give any error, it disconnects from pc and hangs up

I meant like oem unlock to intend that it requires a key too

[cxzstuff]

I remember that with a specific size (using "fastboot flashing unlock ....") we get the wrong key error 🤔

The size/length should be 20 like this one: D6GPA5VLQAS4EBG3D254
https://xdaforums.com/t/guide-un-locking-motorola-bootloader.4079111/post-89868316

Noticed that G13/G23 has a cid partition like above G31. G24 doesn't have it.

[shomykohai]

I remember that with a specific size (using "fastboot flashing unlock ....") we get the wrong key error 🤔

The size/length should be 20 like this one: D6GPA5VLQAS4EBG3D254 https://xdaforums.com/t/guide-un-locking-motorola-bootloader.4079111/post-89868316

Noticed that G13/G23 has a cid partition like above G31. G24 doesn't have it.

Our problem compared to G24 is that we have the default MTK bootloader, not the motorola one.
We found out that we can manually install an oem key though! https://github.com/orgs/moto-penangf/discussions/4#discussioncomment-11735620

Also, our cid partition is just full of null bytes so it's useless. Would be interesting comparing the file and logs of G31 and G24 surely

[cxzstuff]

cid_template.dat file - whatever it is - from G31 and G31w firmware contains this. Does the cid partition change if unlocked?
00 F0 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32

[shomykohai]

as fair as i know, it doesn't change, as it contains device specific informations.
I guess the 32 at the end is the 0x0032 cid people look to be sure the device is unlockable by official manners 🤔