ok, so then how are they gonna unlock the bootloader so they can load the new rom???
they have to unlock it somehow, we just need to copy whatever that somehow is
edit..
ok so i think i get what your saying..
so is the so im assuming the ota update is gonna come down encytped as well?
I don't know if it'll come over the wire encrypted or not - but I believe it doesn't have to be. My understanding of the DroidX hardware is very limited, and my understanding of crypto is by no means exhaustive, but it's my understanding that code doesn't have to be encrypted to be signed.
Basically what happens is you have a public and private key for code signing purposes (you can use the same thing for message authentication, it's my understanding that code signing is just a specific type of message authentication - message authentication basically just means a method of telling with a reasonable level of certainty that a message came from a specific person and hasn't been tampered with). The public key is derived from the private key in such a fashion that it's mathematically trivial to check that a message is also derived from the private key, but mathematically difficult to derive the private key from either the message or the public key.
The public key is likely stored in some part of "real ROM" - that is
actual read-only-memory as opposed to the bit we clobber when we want to put a new OS on - perhaps in the BIOS or something similar (heck it may even be literally "on-chip", given that there's much hooha about this whole "eFuse" thing), I honestly have no idea... I'm not familiar with the architecture of these phones at all. The boot process probably works something like the BIOS looks up the boot loader, confirms it's signed by Motorola, and then executes it. The boot loader then probably searches for the kernel and other things it needs to boot the OS, checking at least the kernel to see if it's signed as well.
By using a digital signature instead of a hash (which I think is where you were thinking, that Motorola must have some OTA way of updating the hash that hackers could exploit to get the loader to accept their own kernels), all they have to do is push out another kernel that's also signed by the same key. The boot loader will happily accept any code that's signed in this way, and there's no privileged operation necessary on the phone. The privileged operation happens back in Moto's lab, the signing of the code with their private key - either you have the private key to sign your kernel or you don't.
Cracking the key is practically impossible. Yes, if the key resides in the first few (relatively speaking, like there are a "few" stars in the sky!) tries you
could get lucky... but like I posted on another forum, you'd have better odds of getting everyone together and each buying lottery tickets, and then if someone wins, using the money to bribe someone at Motorola to give you a copy of the key.
Now of course that's not to say that there aren't ways to side-track the boot-loader, which I think is what the guys are tampering with (and may be how they did the custom recovery thing)... but anyway, like someone else posted on another android forum, at this point you'll have better chances working with the boot loader than against it.
For all intents and purposes though, the OTA 2.2 update probably isn't going to be of any use to cracking the device wide-open, unless in the process of them doing the update they introduce a bug in the boot loader which can be leveraged to convince it to run an unsigned kernel. Again, I'm not familiar with the X's boot process, but I imagine they don't necessarily have to touch the boot loader - just push another kernel + android userland and call it a day.
