Sylvain Munaut писал 01.10.2012 15:50: Enter Galaxy S II GT-i9100. For some reason, the baseband does not verify, well, anything. Both AP and BP have capabilites for checking the signature, but keys are zeroed. You can load whatever you want on the BP, dump RAM, etc. Sammy has omitted the NOR flash for the BP and used a RAM chip instead, hence the BP is "flashed" at every boot. For some reason, the baseband has been compiled with debugging info turned on. Prior to flipping any bit in any register it writes a textual description to the debug port, which is trivially accessible through USB. No soldering required. For some reason, the boot process is guided by the AP. Unless you do something really evil, you have completely zero chances of bricking your beloved $600 phone. It's also a pretty nice cellphone. -- WBR, Peter Zotov.

Sylvain Munaut писал 01.10.2012 18:22: Quite unfortunately, no. Here are all sensible HW-related links I was able to collect: http://forum.xda-developers.com/showthread.php?t=1108103 http://forum.xda-developers.com/showthread.php?t=1104139 http://forum.xda-developers.com/showthread.php?t=1264021 http://forum.xda-developers.com/showthread.php?t=1649278 http://forum.xda-developers.com/showthread.php?t=1316501 http://forum.xda-developers.com/showthread.php?t=1313588 http://forum.xda-developers.com/showpost.php?p=25970245&postcount=22 http://forum.xda-developers.com/showthread.php?t=1483053 http://www.anandtech.com/show/4686/samsung-galaxy-s-2-international-review-… http://forum.xda-developers.com/showthread.php?t=820275&page=10 http://forum.xda-developers.com/showthread.php?t=1372365&highlight=i9100 The baseband boot/RIL protocol is reverse-engineered at https://github.com/grindars/android_hardware_samsung_freeril -- WBR, Peter Zotov.

Maciej Grela писал 02.10.2012 01:34: My colleague/friend Sergey Gridassov[1] has been developing a replacement RIL[2] for SGS2 and found everything of the above. He probably won't be posting to this list because he's not a native English speaker, but if there is enough interest (and it seems that there is), I could prepare and post the relevant instructions. It's pretty trivial actually. [1]: http://github.com/grindars [2]: https://github.com/grindars/android_hardware_samsung_freeril -- WBR, Peter Zotov.

On Mon, Oct 1, 2012 at 10:22 PM, Sylvain Munaut wrote: We were discussing this on IRC and Peter pointed out this: http://forum.xda-developers.com/showthread.php?t=1483053 -- bye, pabs http://wiki.debian.org/PaulWise

Paul, On Mon, 1 Oct 2012, Paul Wise wrote: k I am looking at the list of devices covered by this xda-dev posting - most interesting is the Samsung Galaxy Nexus - again, this is a reference handset, something that in the past was in the hands of developers only, but now many people around the world are using. So that's very interesting, which was the point of my OP - the google nexus phones represent a particularly ripe avenue for osmocom since they are reference handsets, and presumably the "warez" that you need are in many more hands than previous chipset docs and code. Perhaps there is a flaw in my assumption ? The bad news is that the list of devices from the xda-dev posting does NOT include the Galaxy S II GT-i9100, which was mentioned earlier in this thread. I wonder: - how did the calypso docs leak in the first place ? Was it indeed a real breach of intellectual property, or did they just get published by TI since they were uninteresting in some way ? How nefarious is the story there ? - What would it actually cost to get the documentation and code needed for either of these two items we are discussing above ? If I go to Qualcomm and sign up as a developer (under a corp name, etc.) .... is it $10k ? $100k ? Or are the docs you need not available at any price ? I would like to think that the "warez" needed for one of these targets are so widely distributed (because of the android ecosystem and the aggressive push there) that simply putting out a loud and wide "call for leaks" would yield some results...

On Thu, 4 Oct 2012, Mh wrote: Ok. So if there was to be a free-as-in-freedom Galaxy Nexus, with full control of all layers, it would be the result of a real, material breech, or leak. Someone would have to do Something Bad. But the point here is an end user (like me) having a secure and free-as-in-freedom phone, so unless we're going to create a community-backed reference platform (which would be great, of course) this doesn't help a lot. Are there any 3G handsets currently for sale that have this (more open) system underneath ? You're approaching this as if I want to build and market cell site equipment, or build my own infrastructure ... of course that is interesting, but really all I want is a somewhat modern phone that I can control and feel somewhat secure in using, which means either isolataing the basebadn processor (see my other thread about using USB GSM modems with a galaxy music player) or breaking the baseband of a platform more useful than calypso... I do wonder, however, if these open reference chipsets exist, why we are looking at calypso as the basis for the "other" osmocom projects (like the baseband dev kit that has been proposed...) it seems like your example would be less of a dead end...

On Thu, 4 Oct 2012, Mh wrote: Well, I disagree. First of all, if we assume that the Internet is available in some fashion, you can have a general purpose unix computer in your hand, with no mobile chipset, and use SIP. It's not common, but it's workable and it is indeed free all the way through (depending on your configuration and your OS choice). If you consider that the Samsung Galaxy Player is *hardware identical* to one of the worlds most popular android phones (except for the missing mobile chipset), I would say that's a "widely usable phone". And further, if we choose strategy "B", where we encourage, or facilitate a leak of baseband IP, then you can go that route. And that is why I think the reference platform of google nexus phones is very interesting and very unique ... the ps3 breaks, and other breaks like that, were possible because millions of people had these hardware identical boxes in their own houses - you can't let the cat that far out of the bag and expect the secrets will stay secret. CSS, playstation, iTunes, and whatever dvd-jon is working on this week all show that to be true. One clarification: I wasn't saying that pursuing an open mobile platform was a dead end, I was saying that pursuing calypso was a dead end.

you have a point here , but Students are using stuff ranging from Sagem trace phone and its software and API goodness down to Matlab working simulations for more than two decades . there is a misconception that i observe in recent years when attention to telecom networks bolded in blackhat style communities and later in open source "software" society : it is one thing to learn , say , GSM by coding hacking reversing setting up openbts reflashing motorola or nokia whatever old phones -- and there is another thing referred to as Building total Open Cellphones total Open BSCs etc for real use and wide spread Cells . and 1st is valuable , and it is not new , its just getting more attention as the business is growing . the 2nd is just delusion . regarding to another point in this thread : i'd love to see leaks . its just good to have other's property all over the place ( i personally don't like it if its done to me but quite frankly i'd enjoy take a look at any interesting leaks , whether GSM or other things that is getting more common nowadays on web , and i am not ashamed of calling my own dual standard , bullshit - because it is and humans were/are always full of it , hats off to Louie CK by the way ) -- therefore i see it as a good idea to make a wave and encourage some retard engineer with access to internal network of one of these 2-3 vendors to leak shit . remember Microsoft's source partial leak ? i've still got it and although it never had any use for me , very suddenly when i am going through archives some nights i take a look at some random .cpp , there are always a comment or even dialogue between coders inside a function that worth a long good laugh . then what ? having access to someone's IPs , specially with nowadays lawyers , Licensing or Patents disputes , government who sells kilohertz of air for billions.. is not realistically do any good . add to this and the previous mails , the fact that life is too short and many things happen to a Person or small teams , like the one who developed one of the best Linux Files systems then killed his ex wife in some Stupid move and now doing time . to have something "Steady" for wide area use for long time it needs infrastructure , funds , motivated people , buying and selling stocks.. . for cellphone style communications , such establishments already exist . the ones to my understanding many "Hackers" want to bypass , while paying tax to their government , that pays membership fees to remain a member of , say , ITU and play other roles in restrictions ( no matter how we judge this ) . this was my "dead end" answer to John based on . it is not just about "Calypso" . On پنجشنبه, مهر ۱۳, ۱۳۹۱ at ۱۶:۳۸, Peter Stuge wrote:

John Case wrote: I don't think anyone in the osmocom family of projects excludes anything. If you want to go for making an open 3G or LTE platform then go for it! It's no small undertaking however. //Peter