Taking a Bit-For-Bit Image of the Blackberry Memory

[GuyFaux]

Hi folks,

I am trying to get a bit-for-bit image of the memory on a Blackberry. My employer wants independent confirmation that the wiping utility on the Blackberry OS works (including slack space). My employer also wants independent confirmation that the wipe done through javaloader.exe works as described.

Please don't tell me things like: "RIM says it works like this..here is the documentation!" I am not allowed to take the word of RIM.

My methodology is to load an OS, personalize things, make a few phone calls and then make a bit-for-bit image of the OS. Then I will wipe and look for remnants of the personalized info.

My methodology for testing the javaloader.exe wipe should be easier. I will simply load an OS then wipe with javaloader and look at things with a hex viewer.

Anyway, pursuant to this end, I need to find out how to take a bit-for-bit image of the memory! Does anyone know of any tools out there that will accomplish this task? I am hoping there is a developer tool out there with this capabilities.

Thanks for all your help!

[QuiteSimple]

You can use the Desktop Manager to make a backup, wipe and compare personalized things with the clean installation.

Here is the evidence that wipe cleans it all - if you have any third-party apps with trial, and the trial is over - OS wipe makes it possible to install those apps again. Of course it is valid for any registered apps as well - you have to register those apps once again.

[GuyFaux]

I don't believe that the Desktop Manager backup is a true image capture of the memory. It probably leaves out things such as slack space and unallocated memory. I am interested in looking at this stuff.

The evidence of wipes resetting trial periods doesn't really address data left in unallocated memory. That is why a bit-for-bit image is essential.

Any other ideas?

[QuiteSimple]

You can try BBSAK, it has an option "Dump Phone". Well, I didn't try it by myself but probably it's worth trying.

[GuyFaux]

BBSAK wasn't very useful in this matter, but after some work I've made a little progress on this front. I found a tool called "RIM Wireless Command-Line Programmer" version 3.9.0.49.

There is a switch called csavefs that seems to make an image of the file system for "secure" phones.

BTW, secure phones appears to be pretty much all the modern ones. The file dump starts with an unencrypted header "REDFEDMP" and towards the end of the file in plaintext you can find EKEY. My guess is the data after this point consists of the encryption key and perhaps the encryption key length.

Fascinating stuff really. Anyway...back to my project:

My first problem is that when I "imaged" a BB Storm with 1GB of internal memory my image only consisted of 103MB. Obviously there is data missing! Second, when I added several plain text files (adding about 48 more MB of data) the resulting image was still only 103MB!

As far as conclusions...well...I can tell you this so far: It doesn't appear that javaloader.exe does any sort of wipe at all. After "wiping" with javaloader and then imaging the BB I still got an image with the plaintext file header and tons of encrypted data. Obviously those bits haven't been overwritten with 1's, 0's or even psuedo-random data.

If anybody has played around with the Command-Line programmer and knows more about it let me know...for me it has been way more useful than javaloader.

[AmigaDude]

Just an educated guess, but I doubt you will get what you want. Giving anyone, even someone who professes to be doing good, unrestricted access to the memory of a BB is equivalent to failing a security check. Try searching for any documented tests by the DOD, used to qualify the BB, and I suspect you will find that answer.

I would say 'best of luck', but in this case I hope your current method continues to fail.

[Shao128]

The command-line programmer (cfp) is proprietary RIM software, and its not meant for public use. Pirated/illegal software is not discussed on this site.