Capturing and inspecting OTA firmware updates

Operating Systems Android
22

I have no ideas which Kyoceras have fastboot, waiting for someone to reply with models.

23

If you capture one sonim url with your phone, I can probably pull firmware for those too.

I generated about 12000 combinations each for e4810 and e4811.

24

I can’t unlock fastboot on my phone.
I would need a firehose to flash in EDL, and once I have that, then I dont need to pull any ROMs from Sonim, I can read it back straight from my phone.

25

Right. I’m looking for phones that can use fastboot, but have no firmware available.

I think some of the Kyocera flips have fastboot, no?

26

I think I remember that my e4830 doesnt have fastboot at all, but I’m not sure.

27

I’m in middle of trying some firehoses from other devices with the same chip and hash, will see if I get anywhere.

28

You’d have to get really lucky for that to work, at least I think so.

29

E4810

https://cdn2.vzwdm.com/Kyocera_E4810_1.022VZ_1.100VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.022VZ_1.102VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.100VZ_1.102VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.102VZ_1.200VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.200VZ_1.308VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.308VZ_1.402VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4810_1.402VZ_1.502VZ.bin

E4811

https://cdn2.vzwdm.com/Kyocera_E4811_1.023VZ_1.118VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.023VZ_1.151VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.118VZ_1.151VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.151VZ_1.200VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.200VZ_1.300VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.300VZ_1.401VZ.bin

Gimme any model you want…

These may not be all… I stopped at about 120000 combinations for both.

Benefits of getting to use Linux at work lol

30

Flip phones rarely have updates to download.

Any way to get the links if there’s no update available?

31

What phone?
What carrier?

One update would reaaaally help

32
  • Sonim Xp3900
  • T-Mobile variant
33

I’m not sure. It’s very hard to guess these things, can’t really query their servers, have to just try a ridiculous amount of combinations.

If someone gets me one link from a phone that wasn’t updated, I could write something.

34

if you get the app that does the updates you can find the link in the apk somewhere

35

Without root?

If you get the APK, just search for “http” in the smali

36

Good point

37

I’ve been URL hunting for the past hour, not too much success.

38

Sonim’s updates are way more complicated than Kyoceras.

I did manage to get the domains:

40

Nice work on getting the servers. Unfortunately, without at least one name, I wouldn’t know where to start.

41

???

42

I meant one working link