Test device lock - maemo.org

Active Topics

The N900 is now 15 years old! (7)
to Nokia N900 by Danct12 - 3 days, 6 hrs ago
Sailfish OS for the Motorola Moto G7 Power (XT1955-5) - (ocean) (4)
to SailfishOS by Maemish - 4 days, 2 hrs ago
F(x)tec Pro1x (QWERTY) for sale (0)
to Buy & Sell by aln00000 - 6 days, 11 hrs ago
more...

Page 1 of 3

Next >

Thread Tools

ivir	2014-02-06 , 11:12
Posts: 2 \| Thanked: 8 times \| Joined on Feb 2014	#1

Hi,
Due I forgot device lock number I figured how you can ask on correct device lock or reset it.

For this purpose is there app /usr/lib/qt5/plugins/devicelock/encpartition

Arguments:

Code:

--is-set lockcode
--check-code <oldcode>
--clear-code <oldcode>
--is-clear-device-set ???
--unset-clear-device ???
--imei <something>
--clear-code <oldcode>
--set-code <oldcode> <newcode>
--set-config-key ???
--developermode ????
--clear-device <oldcode>

True/False are returned via exit code where 0 - success, 1 - fail
else as standard output.

Configuration is stored at directory /usr/share/lipstick/devicelock/ and encrypted/hash key is stored at /usr/share/lipstick/devicelock/.devicelock.enc, quite interesting are stored texts at binary file encpartition:
41414141, 42424241, 123456789012345 and /dev/block/platform/msm_sdcc.1/by-name/QOTP . More on http://www.onlinedisassembler.com/odaweb/4fDoTf/0

Unfortunately still don't know how reset device lock without sending to repair facility or brute-force.

Test all numbers with length 5 takes less than 3 hours on the phone with utilizing 20% of CPU.

Attached Files

FindDeviceLock.zip (14.9 KB, 308 views)

Quote & Reply |

The Following 5 Users Say Thank You to ivir For This Useful Post:
juiceme, olf, reinob, szopin, ZogG

szopin	2014-02-06 , 11:25
Posts: 2,076 \| Thanked: 3,268 times \| Joined on Feb 2011	#2

Originally Posted by ivir

Unfortunately still don't know how reset device lock without sending to repair facility or brute-force.

Boot while pressing volume down, telnet to the device and one of the options should allow you to wipe it clean/reset to factory settings

Quote & Reply |

The Following User Says Thank You to szopin For This Useful Post:
juiceme

rainisto	2014-02-06 , 16:41
Posts: 1,067 \| Thanked: 2,383 times \| Joined on Jan 2012 @ Finland	#3

Thanks for the bugreport. I'll have to implement slowdown between attempts to make brute force slower.

It's recomended to have 8-10 digit lockcode to make developer mode bruteforcing to take months untill fix arrives.

In the future we would appriciate that if you find weakness in system that you would contact security@jolla.com before posting it publically, so we would have time make a fix for it.

Last edited by rainisto; 2014-02-06 at 17:24.

Quote & Reply |

The Following 5 Users Say Thank You to rainisto For This Useful Post:
Amboss, coderus, Jordi, juiceme, szopin

ivir	2014-02-06 , 17:12
Posts: 2 \| Thanked: 8 times \| Joined on Feb 2014	#4

Originally Posted by szopin

Boot while pressing volume down, telnet to the device and one of the options should allow you to wipe it clean/reset to factory settings

Thank you, but reset to factory settings request devicelock code.

Code:

[CLEANUP] Starting cleanup!
[CLEANUP] Umounting top volume...
[CLEANUP] Deleting /mnt
[CLEANUP] Cleanup done.
Mounting /dev/mmcblk0p28 on /mnt
sh: unlock: unknown operand

Type your devicelock code and press [ENTER] key:
(please note that the typed numbers won't be shown for security reasons)

So even if I have enabled developer mode there isn't way to restore to factory state without devicelock. Latest update only increase number attemps from 3 to 5.

Quote & Reply |

The Following 3 Users Say Thank You to ivir For This Useful Post:
juiceme, olf, szopin

nieldk	2014-02-06 , 17:12
Guest \| Posts: n/a \| Thanked: 0 times \| Joined on	#5

--imei hmmm sounds interresting ......

Quote & Reply |

szopin	2014-02-06 , 17:26
Posts: 2,076 \| Thanked: 3,268 times \| Joined on Feb 2011	#6

Originally Posted by ivir

Thank you, but reset to factory settings request devicelock code.
Code:
[CLEANUP] Starting cleanup!
[CLEANUP] Umounting top volume...
[CLEANUP] Deleting /mnt
[CLEANUP] Cleanup done.
Mounting /dev/mmcblk0p28 on /mnt
sh: unlock: unknown operand

Type your devicelock code and press [ENTER] key:
(please note that the typed numbers won't be shown for security reasons)
So even if I have enabled developer mode there isn't way to restore to factory state without devicelock. Latest update only increase number attemps from 3 to 5.

Oh wow, that's a surprise. My understanding was that lock code is needed for extra features like unlocking bootloader and in cases of forgotten lock code you could still reset it back to factory state (with loss of data, so data protection is kinda in place). Thanks, good to know

Quote & Reply |

The Following 3 Users Say Thank You to szopin For This Useful Post:
Amboss, juiceme, ZogG

rainisto	2014-02-06 , 17:33
Posts: 1,067 \| Thanked: 2,383 times \| Joined on Jan 2012 @ Finland	#7

Originally Posted by szopin

Oh wow, that's a surprise. My understanding was that lock code is needed for extra features like unlocking bootloader and in cases of forgotten lock code you could still reset it back to factory state (with loss of data, so data protection is kinda in place). Thanks, good to know

Its queried for anti-theft, so if your phone is stolen then they cannot just wipe it clean and start using it. So remembering your lockcode is quite important.

__________________
IRC: jonni@freenode
Sailfish: ¤ Qt5 SailfishTouchExample ¤ Qt5 MultiPointTouchArea Example ¤ ipaddress ¤ stoken ¤ Sailbox (Dropbox client) ¤
Harmattan: ¤ Presence VNC for Harmattan ¤ Live-F1 ¤ BTinput-terminal ¤ BabyLock ¤ BabyLock Trial ¤ QML TextTV ¤
Disclaimer: all my posts in this forum are personal trolling and I never post in any official capacity on behalf of any company.

Quote & Reply |

The Following 3 Users Say Thank You to rainisto For This Useful Post:
Amboss, juiceme, szopin

szopin	2014-02-06 , 17:37
Posts: 2,076 \| Thanked: 3,268 times \| Joined on Feb 2011	#8

Originally Posted by rainisto

Its queried for anti-theft, so if your phone is stolen then they cannot just wipe it clean and start using it. So remembering your lockcode is quite important.

Is Jolla going to check every device that is sent to them for reflash in the european IMEI DB of stolen phones? Or users should inform Jolla about the theft? Is Jolla able to recover data, or just reflash?

Quote & Reply |

The Following 2 Users Say Thank You to szopin For This Useful Post:
Amboss, juiceme

rainisto	2014-02-06 , 18:18
Posts: 1,067 \| Thanked: 2,383 times \| Joined on Jan 2012 @ Finland	#9

Originally Posted by szopin

Is Jolla going to check every device that is sent to them for reflash in the european IMEI DB of stolen phones? Or users should inform Jolla about the theft?

You report theft to your local police, and they will report imei to operators imei db, and they will use blocklist depending what country you are in.

Quote & Reply |

The Following 2 Users Say Thank You to rainisto For This Useful Post:
Amboss, juiceme

szopin	2014-02-06 , 18:23
Posts: 2,076 \| Thanked: 3,268 times \| Joined on Feb 2011	#10

Originally Posted by rainisto

You report theft to your local police, and they will report imei to operators imei db, and they will use blocklist depending what country you are in.

Yeah, that's what usually happens and why stolen phones from europe end up in India and Africa (at least that's what I heard), it seems Jollas are going to make an extra step in Helsinki on the way there, are you going to utilise this occasion to return the Jollas to the owner?

edit: however interesting concept and actual anti-theft measure this looks like not really implementable, problems with identifying the real owner will get only bigger once second hand market revves up

Last edited by szopin; 2014-02-06 at 18:28.