MF920T can't unlock

[VikTel]

Here is a log :

15.49.15 : --------------- Read device information -----------------------
15.49.17 : Found :2.5.0B17P02-28-PC7
15.49.17 : Version :BD_RLFUAMF920TV1.0.0B01
15.49.18 : Firmware :BD_RLFUAMF920T1AV1.0.1B01
15.49.18 : Dashboard :BD_RLFUAMF920TV1.0.0B01
15.49.18 : Unknown sygnature! : ERROR FW

Please help me.

[TestBox2]

T-version we not unlock directly. Possible try via flashing, but for sure i need get locked samples for researh.

[TestBox2]

Now we can unlock MF920T

http://forum.gsmhosting.com/vbb/f695/

[alirazamanzoor]

Originally Posted by TestBox2

T-version we not unlock directly. Possible try via flashing, but for sure i need get locked samples for researh.

modify only the fs section of the jffs2 modem "ufi_jffs2.img" the remaining sections are saved unchanged.
press the power button on the modem for 10-12 seconds until it is completely turned off and connect the modem by wire to the PC without a SIM card
Must go firmware. If this does not happen, reconnect the modem, run the SCSI.exe utility from the archive and the firmware will start it will take 1-minute in my case it take 2 mint .

[TestBox2]

Originally Posted by alirazamanzoor

modify only the fs section of the jffs2 modem "ufi_jffs2.img" the remaining sections are saved unchanged.
press the power button on the modem for 10-12 seconds until it is completely turned off and connect the modem by wire to the PC without a SIM card
Must go firmware. If this does not happen, reconnect the modem, run the SCSI.exe utility from the archive and the firmware will start it will take 1-minute in my case it take 2 mint .

Exist to much easy way, just replace RSA and auth by yourself keys ;-)

The not Qualcomm where RSA stored in CPU Bootrom, but.. in so0n ZTE this blackdoor will be fixed ..

[alirazamanzoor]

Originally Posted by TestBox2

Exist to much easy way, just replace RSA and auth by yourself keys ;-)

The not Qualcomm where RSA stored in CPU Bootrom, but.. in so0n ZTE this blackdoor will be fixed ..

maybe it will possible to get RSA Key Pairs and auth ,But according to my knowledge ,Hash of root certificate in code signature is checked first like qualcomm Phones(new sec) ,It is compared to hash that is stored in onchip OTP memory (qfprom). This check is implemented in PBL (initial platform bootloader, stored in chip's ROM) code. If hashes match then metadata in OEM certificate is checked,same as zong 21.318 sec you can check via UART. Next step is to check code's signature. There's no way to overcome this protection. The only way to produce bootable code that may pass the SB authentication is to sign it with OEM private key from the pair generated by CA with root certificate . But such "OEM" keys are really secret, there's no way to get them.

[TestBox2]

mf920t-mf903-mf833ft-need-test UNLOCK!