18
Mar
11

Motorola XT300/Spice – Juicy Details

Note: This post will be updated on the go as I find new and juicier details about the spice.

Now, the more juicier details about this phone and a small description on how android works.

Canadian build is SESLA_U3_01.53.1_R01 101112. (Moto_Version.01.53.101.XT300.Mobilicity.en.NA)

Brazillian build is SESLA_U3_01.44.4 101026.

(Moto_Version.01.44.400.XT300.Brasil.en.BR)

(diff tells me a lot of the files in the two rom dumps differ, including system binaries)

Also the APN files(which specify network operator connectivity) are diferent, so using a phone/rom in the wrong country will have drawbacks.(like connecting EDGE/GPRS/UMTS/etc)

Recovery Mode:

Power up pressing POWER+X until exclamation mark appears. Then Alt+L to go to the recovery menu.

Here you can wipe your phone, cache, flash an update.zip, run a command or just reboot to normal mode.

Since it’s a MOTOROLA(meh) stock recovery partition, it does not accept unofficial signed update.zips(AFAIK).

USB Flashboot:

Power up holding both volume buttons.

Now, these steps are based on a clean phone, just hard reset(or bought).

Fastboot is a protocol that enables direct maintenance actions from the pc through a PC cable. The greatness of this is that you can flash files directly from your computer.

When booting in fastboot mode, the following will appear:

USB FastBoot: V0.5
Machine ID: 1007002 v0
Build Date: Oct 26 2010, 17:31:11

MSM Id: 21
MSM Version: 2.0
Modem Build Id:76XXM-22220MSNCJOLYM
Serial Number: UNKNOWN

ptn 0 name=’boot’ start=297 len=56
ptn 1 name=’system’ start=353 len=1440
ptn 2 name=’userdata’ start=1793 len=1781
ptn 3 name=’cdrom’ start=3574 len=81
ptn 4 name=’misc’ start=3655 len=3
ptn 5 name=’recovery’ start=3658 len=44
ptn 6 name=’cache’ start=3702 len=320
ptn 7 name=’fota_bbuf’ start=4402 len=3
ptn 8 name=’fota_usd’ start=4025 len=3
ptn 9 name=’fota_bua’ start=4028 len=5
ptn 10 name=’fota_ua’ start=4033 len=5
ptn 11 name=’fota_up’ start=4038 len=48
ptn 12 name=’kpanic’ start=4086 len=3

Flashboot responds to the following getvar keys:

version: 0.5

product: XT300

I tried to boot several kernels/kernel+ramdisks/boot.img/recovery.img and all of the threw the error FAILED (remote: invalid boot image)

This appears to be a sympton of having a locked bootloader… thanks motorola!


EDIT:

It appears that this device does NOT have a locked bootloader(apparently Qualcomm chips do not have this problem). Was told me by #milestone-modding @ irc.freenode.net.


EDIT2:

I can’t confirm wether the bootloader is really locked or not BUT I know that the recovery and boot partitions are signed, which means that they can’t be tampered with. No yummy custom image loading. It’s weird actually, I tried removing the certificate from the end of the image. Thus, the error ‘CANNOT READ BOOT IMAGE HEADER’ appears in the flashboot screen. But when I flash custom recovery images build with cyanogen it gets stuck at the motorola static logo(probably before the fastboot verification).

For the record, the partition list for the device is(/proc/mtd):

dev: size erasesize name
mtd0: 00700000 00020000 “boot”
mtd1: 0b400000 00020000 “system”
mtd2: 0dea0000 00020000 “userdata”
mtd3: 00a20000 00020000 “cdrom”
mtd4: 00060000 00020000 “misc”
mtd5: 00580000 00020000 “recovery”
mtd6: 02800000 00020000 “cache”
mtd7: 00060000 00020000 “fota_bbuf”
mtd8: 00060000 00020000 “fota_usd”
mtd9: 000a0000 00020000 “fota_bua”
mtd10: 000a0000 00020000 “fota_ua”
mtd11: 00600000 00020000 “fota_up”
mtd12: 00060000 00020000 “kpanic”

The /system/build.prop :

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=SESLA_U3_01.44.4
ro.build.display.id=SESLA_U3_01.44.4
ro.build.version.incremental=101026
ro.build.version.sdk=7
ro.build.version.codename=REL
ro.build.version.release=2.1-update1
ro.build.version.full=Moto_Version.01.44.400.XT300.Brasil.en.BR
ro.build.date=Tue Oct 26 17:59:42 BRST 2010
ro.build.date.utc=1288123182
ro.build.type=user
ro.build.user=wmm125
ro.build.host=zbr05lnxdroid07
ro.build.tags=test-keys
ro.product.model=XT300
ro.product.brand=MOTO
ro.product.name=RETBR
ro.product.device=sesame
ro.product.board=XT300
ro.product.cpu.abi=armeabi
ro.product.manufacturer=motorola
ro.product.locale.language=pt
ro.product.locale.region=BR
ro.wifi.channels=
ro.board.platform=msm7k
# ro.build.product is obsolete; use ro.product.device
ro.build.product=sesame
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=sesame-user 2.1-update1 SESLA_U3_01.44.4 101026 release-keys
ro.build.fingerprint=MOTO/RETBR/sesame/XT300:2.1-update1/SESLA_U3_01.44.4/101026:user/release-keys
ro.mot.ota_prefix=Moto_Version
# end build properties
#
# system.prop for surf
#
# Set appropriate display density
ro.sf.lcd_density=120
rild.libpath=/system/lib/libril-qc-1.so
rild.libargs=-d /dev/smd0
wifi.interface=eth0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
DEVICE_PROVISIONED=1
android.keylayout.surf_keypad = /system/usr/keylayout/surf_keypad.kl
android.keychar.surf_keypad = /system/usr/keychars/surf_keypad.kcm
# Define the presence of minipad device
ro.mot.hw.minipad=1
# IKSESAME-73 – Feature 33905 – Enabling software Opengl
debug.egl.hw=0
# IKSESAME-73 – Feature 33905 – GridView in landscape mode
ro.mot.fid.33905.mme_gridview=true
# IKSESAME-73 – Feature 33905 – flag for enabling VOD for VZW
ro.mot.fid.32675.vod=false
# IKSESAME-497 – Advanced Photo Editor
ro.mot.fid.31645.pic_editor=true
# IKSESAME-73 – Feature 33905 – Multimedia permanent de blur for Camera, Media Gallery
ro.mot.fid.34006.mme_deblur=true
# IKSESAME-497 – Advanced Video Editor
ro.mot.fid.31747.video_editor=true
# IKSESAME-1689 – PT-CAN: Browser header is incomplete. X_WAP_PROFILE unavailable
ro.mot.hw.uaprof=http://uaprof.motorola.com/phoneconfig/motoxt300/Profile/motoxt300.rdf
windowsmgr.max_events_per_sec=70
# IKSESAME-2650 – Proximity sensor doesn’t work during a call sometime
mot.proximity.delay=550
mot.proximity.distance=40
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=2.1_r11
ro.media.enc.hprof.file.format=3gp
ro.media.enc.hprof.codec.vid=m4v
ro.media.enc.hprof.codec.aud=amrnb
ro.media.enc.hprof.vid.width=640
ro.media.enc.hprof.vid.height=480
ro.media.enc.hprof.vid.fps=30
ro.media.enc.hprof.vid.bps=2000000
ro.media.enc.hprof.aud.bps=12200
ro.media.enc.hprof.aud.hz=8000
ro.media.enc.hprof.aud.ch=1
ro.media.enc.hprof.duration=60
ro.media.enc.lprof.file.format=3gp
ro.media.enc.lprof.codec.vid=m4v
ro.media.enc.lprof.codec.aud=amrnb
ro.media.enc.lprof.vid.width=320
ro.media.enc.lprof.vid.height=240
ro.media.enc.lprof.vid.fps=15
ro.media.enc.lprof.vid.bps=225000
ro.media.enc.lprof.aud.bps=12200
ro.media.enc.lprof.aud.hz=8000
ro.media.enc.lprof.aud.ch=1
ro.media.enc.lprof.duration=30
ro.media.enc.dprof.file.format=3g2
ro.media.enc.dprof.codec.vid=m4v
ro.media.enc.dprof.codec.aud=amrnb,qcelp
ro.media.enc.dprof.vid.width=320
ro.media.enc.dprof.vid.height=240
ro.media.enc.dprof.vid.fps=22
ro.media.enc.dprof.vid.bps=400000
ro.media.enc.dprof.aud.bps=12200
ro.media.enc.dprof.aud.hz=8000
ro.media.enc.dprof.aud.ch=1
ro.media.enc.dprof.duration=60
ro.media.enc.file.format=3gp,3g2
ro.media.enc.vid.codec=mpeg4,h263
ro.media.enc.aud.codec=amrnb,qcelp
ro.media.enc.vid.h264.width=176,640
ro.media.enc.vid.h264.height=144,480
ro.media.enc.vid.h264.bps=64000,4000000
ro.media.enc.vid.h264.fps=1,30
ro.media.enc.vid.h263.width=176,640
ro.media.enc.vid.h263.height=144,480
ro.media.enc.vid.h263.bps=64000,4000000
ro.media.enc.vid.h263.fps=1,30
ro.media.enc.vid.m4v.width=176,640
ro.media.enc.vid.m4v.height=144,480
ro.media.enc.vid.m4v.bps=64000,4000000
ro.media.enc.vid.m4v.fps=1,30
ro.media.enc.aud.amrnb.bps=12200,12200
ro.media.enc.aud.amrnb.hz=8000,8000
ro.media.enc.aud.amrnb.ch=1,1
ro.media.enc.aud.amrwb.bps=6600,23850
ro.media.enc.aud.amrwb.hz=16000,16000
ro.media.enc.aud.amrwb.ch=1,1
ro.media.enc.aud.aac.bps=8192,131072
ro.media.enc.aud.aac.hz=16000,16000
ro.media.enc.aud.aac.ch=1,1
ro.media.dec.aud.wma.enabled=1
ro.media.dec.vid.wmv.enabled=1
ro.media.capture.maxres=3m
ro.media.capture.fast.fps=4
ro.media.capture.slow.fps=120
ro.com.google.clientidbase=android-motorola
ro.com.google.clientidbase.yt=android-motorola
ro.com.google.clientidbase.am=android-motorola
ro.com.google.clientidbase.vs=android-motorola
ro.com.google.clientidbase.gmm=android-motorola
ro.opengles.version=65537
ro.telephony.call_ring.multiple=false
ro.telephony.call_ring.delay=3000
net.bt.name=Android
ro.config.sync=yes
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.config.ringtone=BeatPlucker.ogg
ro.build.svn=01

The /system/default.prop :

ro.build.config.version.app=GAS_LA_USASES01RETBRLA_A039
ro.build.config.date=Thu Nov 18 09:46:28 -0200 2010
ro.build.config.version.media=GAS_LA_USASES01RETBRLA_M015
sms.convert.char.for.latam=0
persist.sys.timezone=America/Sao_Paulo
ro.default_usb_mode=2
ro.mot.carrier.ecc=0x310x390x300x000x390x310x310x000x310x310x320x00
ro.build.config.version=GAS_LA_USASES01RETBRLA_P019


EDIT3:
Due to a request, here are some details from the About phone screen:

Revision number:0
Model number: XT300
Firmware version: 2.1-update1
Baseband version: A309_U3_01.44.4
Kernel version: 2.6.29 wmm125@zbr05lnxdroid #2
Build number: SESLA_U3_01.44.4


EDIT4:
Here is the file list of /system/lib – pastebin.com/5geQuJK4

And the following is reported by Quadrant:

Vendor: Android
Renderer: Android
PixelFlinger 1.2
Version: OpenGL ES-CM 1.0

Where ‘renderer’ probably indicates that it is down by software, not by the adreno 200, which should be integrated in the MSM7225


EDIT5:
When sth goes wrong with the boot, the devices goes into mode 22b8:9002 Motorola PCS, which apparently is a MSM7225 flash interface. Could not find a driver for this in windows, using Motorola’s drivers and RSDlite…
Here is a link to the lsusb info: pastebin.com/283416

Apparently the bootloader resides in the boot partition. Possibly similar to the milestone mbm/mbmloader.
UPON ERASE OF THE BOOT PARTITION MY PHONE DID NOT ENTER FASTBOOT.
Will check on this after my phone comes back from repair =/

Trying to restore a yaffed system image set me to bootloop. Will try to dump the partition manually, when I get my phone back.


1 Response to “Motorola XT300/Spice – Juicy Details”



Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


The Author

Older Ramblings

Tweets

Linux User Sig

%d bloggers like this: