4 locks by Cooler v1.0 cracked have solution?

[gsmunlocker]

HI

Have somebody solution for this? (not free)
DIV don't work.
I try with Reset GDFS, flash and Remove SPLoks and nothing.

Best regards

[CyberGSM]

Hi!

There is no working solution!

You have to wait for new software

Hollowman

[krusty.spritz]

why does this happen and what does g.d.f.s. mean?? sorry for being thick.

[vve]

...what does g.d.f.s. mean??...

GDFS is a compact filesystem that is used to store internal
data in "new" Ericsson/SE phones. Mentioned data includes hardware customization data (e.g. radio channel parameters, settings for display, audio circurity etc.), security/identification data (IMEI, lock codes, lists of forbidden nets etc.) and user data - sounds, pictures, SMS, phonebook, calendar and so on. Some of GDFS units ("files"), or sometimes parts of them, are protected by checksums that are stored in other units.
A lot of (if not all) serious problems one can face in "working" with phones are solved on GDFS level. The "levels" of problems are ranging from very simple (User Lock, Net/Batt monitors, audio codecs' switching) through relatively simple (e.g. net unlock codes' calculation, T68->T68i conversion, customizations reset) to
complicated, like running TEMS on a stock phones.

why does this happen...

"4 locks"(ETX problem) is another kind of problem, however. Its roots are in "tie" of GDFS data to some hardware key. Firmware uses a known algorithm to calculate a function of predefined GDFS units, then it passes result to some hardware circuit. The output of circuit are 2 bits in hardware register that must be 0s for phone to work properly. This output is hardware-dependent, i.e. GDFS from one phone will not "work" (with rare exclusions) in another. This is true for inproperly modified GDFS as well.
The worst thing in all this "tale" is that circuit mentioned above inplements one more function: it controls the phone's transmitter. This means literally the following: if you even overcome bits' checking in firmware (simple patch), your phone will start in normal way - all the "locks" will be open! But...the transmitter will be disabled with all of respective consequences...
The circuit itself is proven to be located inside the main phone's ASIC (one with AVR core). The proof is simple (in logic, not in implementation ))): if you resolder ASIC from phone, say, #1 to phone #2 - phone #2 will work with GDFS read from phone #1 without any problem.
As a conclusion - two things: one good, one bad.
Good: This problem is guaranteed to have a solution: there IS at least one combination of function (See above) output data that is "right" for given specific phone.
Bad: The size of this data is 134 bytes (1072 bits), so the bruteforce attacks are not applicable.

Finally, I hope this stuff is not less buggy than that "bootstrap algorithm" and continue my investigatons. Of course, I'm always ready to discuss any sensible result or idea .

[cmk]

how about t66 4 lock after full flash(imei change) it not stored in hardware register?

[vve]

how about t66 4 lock...

T66 is built on totally different platform...I can't say anything definite on this for now, but the principles of protection seem to be similar.

[all-gsm]

@ After Cooler 4 locks closed Not Repaire to me Sorry

**Never say Never **

[krtko]

Originally posted by all-gsm
@ After Cooler 4 locks closed Not Repaire to me Sorry

**Never say Never **

this will be long time cooler is really dangerous SW for SE phones. repair this 4locks = empty board solution

krtko

[vve]

repair this 4locks = empty board solution

Absolutely true. To be more clear, if you want your "empty board" to be compatible with Emma in future - you will need to do one more thing ...
Does anybody have a reliable solution for this problem?

[krtko]

yes, this f******g transmitter offline

[vve]

@krtko

this f******g transmitter offline

Sorry, I don't get it . Is there a real solution somewhere?

[krtko]

no friend because cooler f+uck very well phone and erase a very very hard protected CRC in gdfs

[vve]

cooler f+uck very well phone and erase a very very hard protected CRC in gdfs

Cooler itself doesn't have direct connection to problem discussed.
Write GDFS from one phone to another - and nearly in 100% of cases you'll face it! "Very very hard protected CRC" will be left unchanged, though.

[PhantomGSM]

makes you wonder DIV didn't just build in a read GDFS function instead of 4 locks eh ! lol

at leaset then we could mess around to find a solution ourselves...instead of wait for support.


WBR