<div dir="ltr">Hello everyone,<div><br></div><div>meanwhile I have an idea how the FCC unlock for the FM350-GL works:</div><div><br></div><div>1. Retrieve radio state (only continue iff locked [== 0])</div><div>2. Get challenge from modem via mbim_message_intel_mutual_authentication_fcc_lock_set_new</div><div>3. Compute a SHA256 hash</div><div>4. Unlock the modem using mbim_message_intel_mutual_authentication_fcc_lock_set_new</div><div>5. Validate radio state == 1<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><br></div><div>There is also a dev code from DMI that probably influences the hash computation.</div><div dir="ltr"><br></div><div>Is there a way to try this procedure through mbimcli? I am currently running libmbim 1.28.4-1.</div><div dir="ltr"><br></div><div dir="ltr">Thanks,<br>Thilo</div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Oct 17, 2022 at 5:52 PM Bjørn Mork <<a href="mailto:bjorn@mork.no">bjorn@mork.no</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Aleksander Morgado <<a href="mailto:aleksandermj@chromium.org" target="_blank">aleksandermj@chromium.org</a>> writes:<br>
<br>
> See also <a href="https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/merge_requests/157" rel="noreferrer" target="_blank">https://gitlab.freedesktop.org/mobile-broadband/libmbim/-/merge_requests/157</a><br>
<br>
Nice.  That will make it much easier to experiment with this.<br>
<br>
I found that UUID in the Windows code earlier, but Google didn't turn up<br>
much.  Only relevant hit was this:<br>
<a href="https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/258" rel="noreferrer" target="_blank">https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/258</a><br>
<br>
which makes sense, assuming that the L860 and FM350 use the same<br>
methods.<br>
<br>
The log shows that the L860 supports CID 1 on this service, as expected:<br>
<br>
                          Service: 'unknown'<br>
                             UUID: [f85d46ef-ab26-4081-9868-4d183c0a3aec]:<br>
                      DSS payload: 2<br>
                Max DSS instances: 1<br>
                             CIDs: 1<br>
<br>
<br>
None of this helps with the hard part, of course.  Let's hope Lenovo<br>
comes up with something reasonable this time.<br>
<br>
<br>
Bjørn<br>
</blockquote></div>