FM350-GL (installed in ThinkPad P1 Gen 5)

[Thilo-Alexander Ginkel]

Hello everyone,

meanwhile I have an idea how the FCC unlock for the FM350-GL works:

1. Retrieve radio state (only continue iff locked [== 0])
2. Get challenge from modem
via mbim_message_intel_mutual_authentication_fcc_lock_set_new
3. Compute a SHA256 hash
4. Unlock the modem
using mbim_message_intel_mutual_authentication_fcc_lock_set_new
5. Validate radio state == 1

There is also a dev code from DMI that probably influences the hash
computation.

Is there a way to try this procedure through mbimcli? I am currently
running libmbim 1.28.4-1.

Thanks,
Thilo

On Mon, Oct 17, 2022 at 5:52 PM Bjørn Mork <bjorn at mork.no> wrote:

> Aleksander Morgado <aleksandermj at chromium.org> writes:
>
> > See also
> https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/merge_requests/157
>
> Nice.  That will make it much easier to experiment with this.
>
> I found that UUID in the Windows code earlier, but Google didn't turn up
> much.  Only relevant hit was this:
> https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/258
>
> which makes sense, assuming that the L860 and FM350 use the same
> methods.
>
> The log shows that the L860 supports CID 1 on this service, as expected:
>
>                           Service: 'unknown'
>                              UUID: [f85d46ef-ab26-4081-9868-4d183c0a3aec]:
>                       DSS payload: 2
>                 Max DSS instances: 1
>                              CIDs: 1
>
>
> None of this helps with the hard part, of course.  Let's hope Lenovo
> comes up with something reasonable this time.
>
>
> Bjørn
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230907/3def0558/attachment.htm>