G24 DA SLA Bypass

[shomykohai]

I've found the APIs that moto g24 spft uses for validating DA SLA.
Though, I'm having an hard time finding the credentials needed.

Someone, like @cxzstuff who has a g24, could try dumping network traffic during a rescue with RSA? We might be able to bypass DA SLA and make g24 work with mtkclient this way

[cxzstuff]

try dumping network traffic

Tried with Fiddler. RSA didn't like it. Blacklisted three accounts of mine....

[shomykohai]

Do they really placed security measures like that too??

What about Wireshark?

[shomykohai]

@cxzstuff could you try mtkclient again, but first applying a little patch?

There's this file here: https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Auth/sla_keys.py

You would have to add this in the da_sla_keys list:

    SlaKey(vendor="G24",
           da_codes=[],
           name="Moto G24",
           d=21285935122662264864057010353628894046000309676608514009863068975210666417913992390203952016184103585209090567456567655640013653254389492000330698369108534400952734580691061611305270427006293274003837251061472898178055883452926583157069288429704943815305237986749864472793502417868363277703857993800596854717455227000386605194799101756888463582260204208854094963305819533909836121398593369779835885060955127693070927806187215287927106022661033162137977188155754455157501898266271848816663792930331047190853544282318635289788145216933852870788132800493768471635534748961829891319455548129601994556070502373744923475337,
           # "00a89df958cec69e5e82f12cc64f21b577a99916043912cc47ed278f88cb79ba847e7601abd8c502beef0bc706038a9c5269486c191b65da800dcd465028ccd5e530beb93e02053ac49d1ff4f17be3245b0bbd0ca7ea51558c439783648502e9ff92ac3696cadf09603d1f89c1d1d09095ee5ee68cace1b3a401ef401de86d3911ea96021dc5b5af36e6babf3d48d6a58a9075d5deeacadbfd09f93748929ef466a9d339d92370334e0e50afc0c43cfb1b9f2bff5e3b5a7012b93e92d8644f032993033245eec56d899837d1080c5aba7e09fe2e2eac06921159775392d64e819daa905a2931352ae02e3a21318b207e0fbfa113e8a32a37987243da2bb57d7d89",
           n=27716841114500344765566038575545425862643744318131811064043948092197282887898697011320983157192537336111902575339275485241294128734436513028266336433137947170436497709458387570684339829820815050334574753587565304243810940252616667269969799046662551962481559713449481789622057339608569750866816501553907454007165785963469328609654526247959103207964930235031378798604098615371009080202164164858220545960117335763391558057794040598744405105128408738639336292387025499581025311622360049763406211499993117726494678511901460658618003333913774822703760038655009487487524407468957728357988965151989430864537201197625439572663,
           # "00db8f46cf8da80af8cca1aec9ff7b358cfe4cc5659ade5ef9c196905caaf979658349284723bef9524532b21f460c0897468be95d0aa92682144d1bfcb84afc7712ff3b5dc34153e5efe64b465a6d8cf2bd8c2fb1bf27d9c77f26e90baa3ddada18525d3f689441ef7b6dc5c4b8c496b0a9c92f29d26dac8ff8b137d6a93cf26ad391bf6124207ff9eb26e10b65269c6bad38eff0c50aab604a0128b874f24263037c605bc9f855252f78173141d166b632dbb549370af71efdc522532cb55c48b9a39a21ee8e0cc8bb34c394aec92155a16f95b646aa9e5f88c989eaf2d7f615bf5afe619e27dfab5adbbd7999db9590ab0f30c95c98da39616cad6494be52b7",
           e="010001"),

[cxzstuff]

@cxzstuff could you try mtkclient again, but first applying a little patch?

There's this file here: https://github.com/bkerler/mtkclient/blob/main/mtkclient/Library/Auth/sla_keys.py

You would have to add this in the da_sla_keys list:

To brom_sla_keys? There is G13 already. From where these are obtained?
How does it know which one to use?

   SlaKey(vendor="Motorola",
          da_codes=[],
          name="G13",
          d=22050419731562155394106709972952859421194100106456997203564621188227249424701291592884703493390930536680058773297929760551724618568230133040793183340115990462390794010584599304604825181361962475363874162191142504833442946164654238351829079842919675978362478753291817673354538846468019979634676288548417418363463924320170824947490552875292996775107232100185748900473687003803356957304359156634677724577486444094774736019891872575736258571932346764362017119622746749282450857160410786146449479956173648609409863284469607303105156090816916242350888950390600656505661831657766048625847690202923995919597384708979191222433,
          # "AEAC47CD11A5DD6C5EEEC43D8F2C536A2917CEF95AD02F5A7C978E88C35702B590F7A72A2AF28AEB9B5F5B2D8056D03F916595D189C9B6927AC0874980537178AACE8E1831DD654E0B72FF2F44670196A57A43C340355CAF828B331A5715AED4E06D5D18896BCF25B201A0DC9760B0B2EF1CFB4EAB6940D7F8E2EBD86DC1E678AA69F6B0BBF55C688BF72C2123CF42E367F789E2592CE281C7C4752E14F6FD00D54610977DEF753E3890F12F704688537E860D81142805750B805E7CAE3AACDE1CD7A272D227E9F8CCAADCB4D06489664627BAC46CAF5DA0F0740CEEDEBC7ED1C1D1EB1E37C6A8A9E6A0454F742B3248448B20C93D5FF6E5C789907A862C90A1",
          n=27568072452258469631124979998042952077199499020924689540824391049462976832251975336186280290850084215612380996291995854965249453016140752176544503177435743360047796014339620080615918121154500853642163696442596458208114276283726532217928699077936413670239255437895571439500885394524506398422697060713422974958102681053769215158188151660543990224375640194825863469761475571057891851563655933517408680203498008205536450438567523758655066623624002686806613414719125769676194560764819157656002478522800571189379236284227865790549388127212000079839286099840462834583520893472589236519103688311338314257196815867652714275027,
          # "DA61964924F441559A1F8B5264CEB01DACE8E417413BBA4657F4556811D07B85074FD6987F315A7492E003D03C57FC83D3B889F2D4F136D0989E515A08628A7B16A300217162DC35C340B1127046AA86649B763AF97F7C9871964483DE6695CDA2E8CCE82E1F6A0F701AF8BE767BB16927489524F8FC9A2C280F5692E850E4C4E2606436CF2E253147AFAB32E6B92A19FA180C43CF480619B71B3D6A7863C7CC376C0A36BCF8BA3DA89CBF3E6DAA4691DCD769C0AE4535E502A9966AFF3F123C7A0EDA2DF04593B0E1FC60DC688F2BA7617DFE67D31854443ED95D2645323728C594CA49DAA9351A572E3182D0A1B3146C92CEF87380CBD2DEFFEBC4E8F420D3",
          e="010001"),

[shomykohai]

Not on brom_sla_keys, but to da_sla_keys (Right under the init method)
It automatically finds how which value is the right one because it loops the list and seeks for the bytes

I've obtained the values decompiling the sla_challenge.dll from g24 flash tool

@cxzstuff

[progzone122]

@shomykohai @cxzstuff @R0rt1z2
Discussion was moved to https://github.com/orgs/moto-fogorow/discussions

[shomykohai]

Perfect! I'll move this discussion later too. In the meantime could you ask other people on the telegram group to try this method for mtkclient?