ATF and BEST using stealed source codes violating MY copyrights

[karwos]

Hi.

Back in 2008, one Philipino guy, called monxxx asked me on sonork for some help relating to BB5 USB FLASHING. I am not bitch, so helped him, sending my KarwosSuite 4 USB BB5 sources, but with notice - only for personal use, and change text, reanalyze code, rewrite it, etc.

Here is Sonork Conversation log:

[IMG]http://www.**********/fl_bb5_monxxx.PNG[/IMG]

This sources sent him is pretty old. Used in KS4, but completly rewritten from scratch for Cyclone (too many bugs, also my coding skills back in 2008 wasn't so nice).

In my source we have functions such as:

unit fl_bb5;

interface
type
NokiaMemorySpace=0..$FFFFFFFF;
function ReadUBUSData:word;
function BB5_USB_ScanAndOpenConnection(DevType, Filter: String; Verbose:boolean):boolean;
function BB5_USB_BootRom_GetFirstBlock:integer;
procedure BB5_USB_Process_BootBlock;
function BB5_ExtractRAWLoader(core: string):boolean;
function BB5_ExtractUpdateAgent(core: string):boolean;
function BB5_ParseFile(core: string):boolean;
function BB5_CheckPasubCert(core: string):boolean;
function BB5_CheckUpdateAgent(core:string):boolean;
function BB5_SendAll*****(core: string):boolean;
function BB5_ADL_Check_Loader:boolean;
function BB5_EraseFile(core: string):boolean;
function BB5_EraseSegment(startSegment, stopSegment:NokiaMemorySpace; FlashCfg,Byte1,Byte2,Byte3:byte):boolean;
function BB5_EraseSector(startSector,EraseSectorSize:NokiaM emorySpace; FlashCfg,Byte1,Byte2,Byte3:byte):boolean;
function BB5_WriteFile(core: string):boolean;
function BB5_ADL_RestartMCU(mode: byte):boolean;

If you will analyze KarwosSuite4 you will notice many messages like ExtractRawLoader,EraseFile,etc.. All from my sources.

Let's analyze now my source function-by-function and check how ATF just copied it, violating MY copyrights (file is 100% written by me), without asking me, without giving any credits, etc.

ATF Example Flashing Log

Number of Image Files: 3
Processing Image File :
rm781__06.97.mcusw
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 283
Entry Point: 0x0277
Page Format : -1
MAX PAGE : 0x00020000
Processing Image File :
rm781__06.97.ppm_meac
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 57
Entry Point: 0x0141
Page Format : -1
MAX PAGE : 0x00020000
Processing Image File :
rm781__06.97.image_meac_059J881_003
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 339
Entry Point: 0x0172
Page Format : -1
MAX PAGE : 0x00020000
[]: Found 1 active devices.
[Nokia USB Phonet]: Opening Connection
[Nokia USB Phonet]: Port opened OK! point 1
SW: V 06.97 27-09-11 RM-781 (c) Nokia
IMEI: 358630041505308
CONFIG KEY : 0000000000000000
PROVIDER KEY : 2440700000000000
NETWORK NAME : Nokia Default;Finland
LOCK COUNTERS : KEYPRESS 0/3, FBUS 0/10
SIMLOCK TABLE :
Block [1] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [2] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [3] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [4] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [5] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [6] 1:Open 2:Open 3:Open 4:Open 5:Open
Block [7] 1:Open 2:Open 3:Open 4:Open 5:Open
SIMLOCK STATE : Not Locked
START FULL PM BACKUP
Please Wait...
Reading : PM 0~400... OK!
FULL PM Backup Saved to:
C:\AdvanceBox Turbo Flasher\Nokia\Backup\358630041505308\USB_FULL_BACK UP_V 06.97 27-09-11 RM-781 (c) Nokia_358630041505308_Not Locked_64228.pm
　
Reading battery value : 4141 mV
Rebooting Phone...
　
　
AUTO SELECTED DEAD USB FLASHING...
If Flashing DOES NOT Start in 5 Seconds,
Then Perform Steps 1, 2, 3 and 4...
1. Remove USB and Battery...
2. Insert USB.
3. Insert Battery. (Some phones boot automatically)
4. Please Power on phone shortly...
AdvanceFBox SendBootCodeEx
Initialise*****trap_DCT5 DIR
BootFlashMode_DCT5
BootRom Verified! point 2
BootFlashModeDCT5Ex Succeeded First Time
SYSTEM_ID_RESPONSE_BB5 (0xC0) - 0 (0x00) bytes returned
Number of Sub Blocks 7 (0x07)
1 SYSTEM_ASIC_ID 01
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00000003
ID DWORD 1 : 00000226
ID DWORD 2 : 00010007
ID DWORD 3 : 400C1921
ID DWORD 4 : 03032108
2 EM_ASIC_ID 02
Block Length : 5 (05)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00001051
3 EM_ASIC_ID 02
Block Length : 5 (05)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00001060
4 PUBLIC_ID 12
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 34590000
ID DWORD 1 : FFFB3C40
ID DWORD 2 : 9D49C3C5
ID DWORD 3 : 46AB48AF
ID DWORD 4 : 4BEDC2DF
5 ASIC_MODE_ID 13
Block Length : 2 (02)
BB ASIC Index : 0 (00) CMT
Mode Id : 00
6 ROOT_KEY_HASH 14
Block Length : 17 (11)
BB ASIC Index : 0 (00) CMT
Hash : 3A B5 DB 70 B4 5D 23 F1 AD EE BB 57 34 16 07 06
7 ROM_ID 15
Block Length : 9 (09)
BB ASIC Index : 0 (00) CMT
CRC 0 : 2CAC45E2
CRC 1 : 3BC33C8B
START FLASHING
RawLoaderExtract: rm781__06.97.mcusw point 3
CMT Secondary Loader: C:\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\BB5_USBLoaders\RAPUv21_2n d.fg
Secondary Loader Sent....
MCU_CONFIGURATION_RESPONSE_BB5:
MessageID : C1
(...)

Now, let's analyze my sources (attn. point 1 you can also see cyclone messages. 100% same!!).

Point 1

if Verbose then Put_To_Log('['+CurrDev+']: Found '+IntToStr(NMWCount)+' active devices.');

if (NMWCount>0) then
begin
if NMWCount=1 then
begin
x:=1;
end
else
begin
BB5_Selection.BB5_Devices.Clear;
for i:=1 to NMWCount do
begin
BB5_Selection.BB5_Devices.Items.Add(NMWDeviceDesc[i]);
end;
BB5_Selection.Show;
while not BB5_Semaphore do;
x:=BB5_Selection.Bb5_Devices.ItemIndex+1;
end;
CurrDev:=NMWDeviceDesc[x];
if Verbose then Put_To_Log('['+CurrDev+']: Opening Connection');
R:=USBOpenPort(NMWDeviceLink[x], 0);
if not R then
begin
USBClosePort;
if Verbose then Put_To_Log('['+CurrDev+']: Failed to open port');
exit;
end
else
begin
if Verbose then Put_To_Log('['+CurrDev+']: Port opened OK!');
Result:=True;
end;
end
else
begin
if Verbose then Put_To_Log('['+CurrDev+']: Not Found!');
exit;
end;
end;

Point 2

if USBControlPacket($222040, $8, 0) then
begin
Put_To_Log('['+CurrDev+']: BootRom Verified!');
end
else
begin
Put_To_Log('['+CurrDev+']: Cant verify BootRom!');
USBClosePort;
exit;
end;

Point 3

Result:=false;
Put_To_Log('RawLoaderExtract: Processing '+ExtractFileName(core));
AssignFile(f, core);
Reset(f, 1);
BlockRead(f, buf, 1);
if buf[0]<>$B2 then
begin
Put_To_Log('RawLoaderExtract: Invalid Image File');
USBClosePort;
exit;
end;
Form1.NStatus.Panels.Items[0].Text:='Extracting RAW Loader...';
BlockRead(f, buf, 4);

This is just BEGINNING!! We can find MUCH MORE using just simple code analyze and GOOGLE! I will post rest of evidences in second post.

So fact is: ATF used MY sources not for private usage, without any agreement/credits/payment/anything. They don't had my AGREEMENT for use MY WORK in their COMMERCIAL product.

@gsmfun/others: you know my sonork. since you not responding me anymore, message me how you want solve this situation.

@monxxx: you are biggest b..., no doubts, no respect for you.

[karwos]

I don't wanna say much more, but seems BEST is also using my implementation.

Files Set for Flashing :
MCU : rm198__06.00.mcusw.bin
PPM : rm198__06.00.ppm_k
CNT : rm198__06.00.image_k
Flashing phone now...
Check files done...
-> SWversion check skipped : Dead mode selected
Getting product info...
Dead Mode is Selected
Waiting for USB device...
--- Press phone's power button! ---
Connection opened successfully
Waiting for communication response.
[BB5 FLASH]: Bootrom Ok!
[BB5 FLASH]: GetFirstBlock Failed, Aborting
-> Error answer from BootRom
Connect phone on selected interface...

if rxBuf[0]<1 then
begin
Put_To_Log('['+CurrDev+']: GetFirstBlock Failed, Aborting');
USBClosePort;
exit;
end;

Seems they changed a little messages. I will investigate it cleary today.

[karwos]

ATF next one, taken from 5130c hang done via ATF usb flashing (bwenwmano pa lang) - GSM-Forum GSMReloaded

7 ROM_ID 15
Block Length : 9 (09)
BB ASIC Index : 0 (00) CMT
CRC 0 : 273F6D55
CRC 1 : DFAAF68F
START FLASHING
RawLoaderExtract: Processing rm495__07.97.mcusw
RawLoaderExtract: Image matches with RootKey Hash, Extraction is done
Parsed OK
RAW LOADER SENT..
UpdateAgentDa***xtract: Processing rm495__07.97.mcusw
UpdateAgentDa***xtract: Found matching Rootkey Hash CERT Block
UpdateAgentDa***xtract: Found DATA Block
UpdateAgentDa***xtract: Consolidating DATA Blocks
PASUBTOCCertExtract: Processing rm495__07.97.mcusw
PASUBTOCCertExtract: Found matching Rootkey Hash CERT Block
00000400
Update Agent Sent..
Waiting for phone to ADL ... (Make take a while)
Found Nokia BB5 ADL Loader USB Generic..
EraseFile: Processing rm495__07.97.mcusw
Erasing area 0x00000000 - 0x000006BF, Type: NOR, Subsystem: CMT
Erasing area 0x000006C0 - 0x0001FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00040000 - 0x000BFFFF, Type: NOR, Subsystem: CMT
Erasing area 0x000C0000 - 0x0013FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00140000 - 0x0137FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x01380000 - 0x0151FFFF, Type: NOR, Subsystem: CMT
Processing : rm495__07.97.mcusw
Total blocks to write : 1178
>> CMT Rootkey Hash CERT : NOLO
>> CMT Rootkey Hash CERT : KEYS
>> CMT Rootkey Hash CERT : PRIMAPP
>> CMT Rootkey Hash CERT : PASUBTOC
>> CMT Rootkey Hash CERT : PAPUBKEYS
>> CMT Rootkey Hash CERT : UPDAPP
>> CMT Rootkey Hash CERT : DSP0
>> CMT Rootkey Hash CERT : MCUSW

Snippet from my source.

Put_To_Log('PASUBTOCCertExtract: Processing '+ExtractFileName(core));
AssignFile(f, core);
Reset(f, 1);
BlockRead(f, buf, 1);
if buf[0]<>$B2 then
begin
Put_To_Log('PASUBTOCCertExtract: Invalid Image File');
USBClosePort;
exit;
end;
Form1.NStatus.Panels.Items[0].Text:='Searching for PASUBTOC Certificate';
BlockRead(f, buf, 4);

begin
Result:=False;
Put_To_Log('UpdateAgentDataExtract: Processing '+ExtractFileName(core));
AssignFile(f, core);
Reset(f, 1);
BlockRead(f, buf, 1);
if buf[0]<>$B2 then
begin
Put_To_Log('UpdateAgentDataExtract: Invalid Image File');
USBClosePort;
exit;
end;
Form1.NStatus.Panels.Items[0].Text:='Searching or UpdateAgent Certificate and Data Block';
BlockRead(f, buf, 4);

Put_To_Log('EraseFile: Processing '+ExtractFileName(core));
application.processmessages;

try
AssignFile(f, core);
Reset(f, 1);
BlockRead(f, buf, 1);
if buf[0]<>$B2 then raise E.Create('Bad image file');
BlockRead(f, buf, 4);
HdrLen := HexToInt(IntToHex(buf[0], 2)+IntTo

SHAME ON YOU ATF AND BEST

[karwos]

If anybody will come now and say i bought this source, let see KarwosSuite4 flashing logs.

Dated 2007 year !! So clearly we see who is author of sources.

http://forum.gsmhosting.com/vbb/2952342-post1.html

Interface set: UFSx
2 Compatible SmartCard Readers present in system.
No card [FT SCR2000 0]
Card found [OMNIKEY AG Smart Card Reader USB 0]
Card ID: xxxxxxxxx [TYPHOON1]
KarwosSuite 3 DCT4 is activated (970)
KarwosSuite 3 BB5 is activated
Activation Read OK, Authenthicated OK (FW Version 1.15)
Looking for FTDI Devices...
0 devices found.
[BB5 BootRom]: Found 1 active devices.
[Nokia USB ROM Generic]: Opening Connection
[Nokia USB ROM Generic]: Port opened OK!
[Nokia USB ROM Generic]: BootRom Verified!
RAP_SYSTEM_ASIC_ID: 000000010000022600010006010C192101001101
RAP_EM_ASIC_ID: 00000232
RAP_EM_ASIC_ID: 00000353
RAP_PUBLIC_ID: 052001090A3B00583AB72144B0A67815EF97F23F
RAP_ASIC_MODE_ID: 00
RAP_ROOT_KEY_HASH: BAF3A9C3DBFA8454937DB77F2B8852B1
RAP_ROM_ID: 191EC665DFAAF68F
RawLoaderExtract: Processing rm174__05.51.mcusw
RawLoaderExtract: Image found (17349 bytes), matching with RootKey Hash...
RawLoaderExtract: Image matches with RootKey Hash, Extraction is done
UpdateAgentDataExtract: Processing rm174__05.51.mcusw
UpdateAgentDataExtract: Found matching Rootkey Hash CERT Block
UpdateAgentDataExtract: Found DATA Block
UpdateAgentDataExtract: Warning: Data is splitted into bricks!
PASUBTOCCertExtract: Processing rm174__05.51.mcusw
PASUBTOCCertExtract: Found matching Rootkey Hash CERT Block
RAW Loader @ 00000C50:00003880
Update Agent Cert @ 00026EAC:00000400
Update Agent Payload @ 000272BF:00004000, Data Bricked!
PASUBTOC Certificate @ 000179F8:0000E3C0
PatchRAWLoader: Found matching RootkeyHash substitution data, ID:E5
PatchRAWLoader: Found matching RootkeyHash substitution data, ID:EA
PatchRAWLoader: Patched OK
ExtractBrickedUA: New Size=0x0003BA40
BootRom Prepared OK, WAIT PLEASE NOW for ADL Loader Start...
[BB5 ADL Loader]: Found 1 active devices.
[Nokia BB5 ADL Loader USB Generic]: Opening Connection
[Nokia BB5 ADL Loader USB Generic]: Port opened OK!
ADL Server has confirmed its flashmode
EraseFile: Processing rm174__05.51.mcusw
EraseFile: 1 flash chips to erase
EraseFile: Found 9 areas to erase
Erasing area 0x00000000 - 0x000006BF, Type: NOR, Subsystem: CMT
Erasing area 0x000006C0 - 0x0001FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00020000 - 0x0007FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00080000 - 0x000DFFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00100000 - 0x001FFFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00200000 - 0x0031FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x00320000 - 0x0105FFFF, Type: NOR, Subsystem: CMT
Erasing area 0x01060000 - 0x01067FFF, Type: NOR, Subsystem: CMT
Erasing area 0x01068000 - 0x0107FFFF, Type: NOR, Subsystem: CMT
EraseFile: Processing rm174__05.51.ppm_f
EraseFile: 1 flash chips to erase
EraseFile: Found 1 areas to erase
Erasing area 0x01080000 - 0x014FFFFF, Type: NOR, Subsystem: CMT
EraseFile: Processing rm174__05.51.image_f_black
EraseFile: 1 flash chips to erase
EraseFile: Found 1 areas to erase
Erasing area 0x01500000 - 0x01FDFFFF, Type: NOR, Subsystem: CMT
All areas erased OK!
WriteFile: Processing rm174__05.51.mcusw
WriteFile: Counting data+cert blocks...
WriteFile: Total 945 data+cert blocks to write, writing...
WriteFile: Writing matching Rootkey Hash CERT (NOLO)
WriteFile: Writing matching Rootkey Hash CERT (KEYS)
WriteFile: Writing matching Rootkey Hash CERT (PRIMAPP)
WriteFile: Writing matching Rootkey Hash CERT (PASUBTOC)
WriteFile: Writing matching Rootkey Hash CERT (PAPUBKEYS)
WriteFile: Patching PAPUBKEYS Prologue
WriteFile: Writing matching Rootkey Hash CERT (UPDAPP)
WriteFile: Writing matching Rootkey Hash CERT (DSP0)
WriteFile: Writing matching Rootkey Hash CERT (MCUSW)
WriteFile: Writing matching Rootkey Hash CERT (PMM_CONF)
WriteFile: Writing matching Rootkey Hash CERT (SBIF_CONF)
WriteFile: Processing rm174__05.51.ppm_f
WriteFile: Counting data+cert blocks...
WriteFile: Total 197 data+cert blocks to write, writing...
WriteFile: Processing rm174__05.51.image_f_black
WriteFile: Counting data+cert blocks...
WriteFile: Total 296 data+cert blocks to write, writing...
All areas written OK!
Flashing finished, Restarting phone in TEST mode...
RestartMCU: Success!

see and compare messages now.

[i-tec]

What u write seems to be trustable .
But from 2008 its to late to tell us now!
I know u karwos u r a good coder but why posting old stories?

[karwos]

Originally Posted by i-tec

What u write seems to be trustable .
But from 2008 its to late to tell us now!
I know u karwos u r a good coder but why posting old stories?

Because i just noticed it 2 months ago, accidentialy seeing such "Strange" messages".
If someone steal your work, and you see it after 2 years, what you do? You doing nothing?
Especially put in at least two commercial products - ATF and Best by infinity.

2008 but code is still used till today... even u see latest rapu21 flashing logs.. all is same.
it's very buggy code anyway, i just left VID/PID looking function in cyclone , rest recoded from scratch.

[anjam786]

Bro Ur not child
If I says Plz send me Xperia algo for personal use
Can u send me without any charge
Not possible
Plz don't cry now
This is a gsm game
Best dongel improve day by day (after copy Ur sorce)

[kaisak]

Originally Posted by anjam786

Bro Ur not child
If I says Plz send me Xperia algo for personal use
Can u send me without any charge
Not possible
Plz don't cry now
This is a gsm game
Best dongel improve day by day (after copy Ur sorce)

Yes we are mature persons, we live in some country and have some laws- nationals & international, everyday we live with them, but not everybody respect it (its normal).
When somebody ask You for help on street, did You help him? Or maybe some of Your friends?
Im happy that we have on this world trustable person, which help each others. This is reason why some of Us work in team.
But lesson like this teach Us- dont help, dont trust... This is really sad that two big project use some stolen source.

[oOXTCOo]

we all exchange sources and if some log messages looks perfekt, we use same.
i can also count some texts from my src (thanks to zulea) who put it 1:1
in his projects including my typing errors , but i dont care.. its funny for me to see this
part later in other projects... isnt it?

for me, i wish times back 1999 where gsm was coding for fun.

[GSM boy]

ok agree, in 2008 cyclone was not born and may be you sold him your soft.2010 cyclone born and you now dont want your soft use other soft coders.

is this right ?? or wrong

because now cyclone is better than karawos suite in multi box

[karwos]

Originally Posted by oOXTCOo

we all exchange sources and if some log messages looks perfekt, we use same.
i can also count some texts from my src (thanks to zulea) who put it 1:1
in his projects including my typing errors , but i dont care.. its funny for me to see this
part later in other projects... isnt it?

yes to exchange or sell/buy sources is normal, if both sides is ok with this.
i also sent some sources months back to Bph&co, he credited me, before he also send me some tuff like old dct4 unlock, etc - is all good , because we both know how it works.

but now see diffrent situation. i didn't exchanged this sources with noone, just send to ONE guy and noted - only for private use.
now i see this. it's kinda diffrent situation, don't you think.

because i promised something to BEST team after they copied RAPUv21, then also after released free broadcom, maybe tomorrow will release BEST sources.

[oOXTCOo]

but inst mooonx a coder of atf team? i tought so..

[karwos]

Originally Posted by oOXTCOo

but inst mooonx a coder of atf team? i tought so..

I don't know internals of ATF team, but he is Filipino, and ulymar and X-Shadow are as well, so very possible, don't you think.

i had also little chat with arash, he also sent some ufs/jaf rutines to monxxx, later included into BEST. same story.

[Brka]

Originally Posted by karwos

yes to exchange or sell/buy sources is normal, if both sides is ok with this.
i also sent some sources months back to Bph&co, he credited me, before he also send me some tuff like old dct4 unlock, etc - is all good , because we both know how it works.

but now see diffrent situation. i didn't exchanged this sources with noone, just send to ONE guy and noted - only for private use.
now i see this. it's kinda diffrent situation, don't you think.

because i promised something to BEST team after they copied RAPUv21, then also after released free broadcom, maybe tomorrow will release BEST sources.

bad to see same old stories still happening ... copy/paste still active.

good part of the story - there is still confident people,
and there are still old-school coders and people,
which still have their codex and their word.

p.s. i am glad that i am still here, and that i have old-skool people in contacts.

b.r.
ALex

[karwos]

Originally Posted by GSM boy

why dont you answer me

no , look i didn't sold any sources to any atf or best team.
if i would sell this source to anybody to use in commercial product - no problem.
one guy, filipino guy monxxx contact me, and asked for help with usb bb5 flashing.
he say he need it for hobby, private use, school etc, only for study to see how it works.
so as you can see in sonork logs - i sent him, and only for him.

and now i see this sources used in atf, best, blabla.

catch my point now ?

problem : source stolen by filipino guy, used in at least 2 commercial products.