7

I have bought a new phone which seems to be used. The manufacturer checked my IMEI and confirmed that the phone has been purchased/activated before.

The body looks new so I don't mind keeping it but I am worry about malicious software/apps. I know I can factory reset the phone, but is there any way to tell if the ROM is original?

FYI, the phone is a Moto G 2nd gen w/ 5.0.1 lollipop.

Improve this question
5
  • 1
    if your bootloader is unlocked by default, you can boot into download mode, and you will see KNOX warranty void: x on the top. Values are either 0 or 1 dependent on if it is tampered or not. Doing OTA updates SHOULD also switch to normal android OS, unless the hacker managed to make OTA updates download from his repository
    – John K
    Dec 23, 2015 at 22:23
  • It depends on what you meant by "tampered". Do you consider using custom ROM (e.g. CyanogenMod) as "tampered"? Or to put it simply, do you mean original ROM as "stock ROM" (the one from factory)?
    – Andrew T. ♦
    Dec 24, 2015 at 5:45
  • Which phone? Model?
    – beeshyams
    Dec 24, 2015 at 8:50
  • @AndrewT. Yes, I mean stock ROM/factory's ROM.
    – Omne
    Dec 24, 2015 at 21:01
  • @beeshyams I had included that in the tags but it was removed, added it to the body now.
    – Omne
    Dec 24, 2015 at 21:01

4 Answers 4

Reset to default
5
+25

I am assuming your device is NOT rooted by you

You can

  • Factory reset your device (of course after taking back up of data )
  • Root your device, flash a custom recovery and take a complete back up of your device with TWRP
  • Generate MD5 check sum using TWRP or alternate apps like Hash Stamp MD5 & SHA1 generator
  • Download stock lollipop (assuming that your device variant matches with that mentioned and the ROM version on your device matches)
  • Generate and verify stock MD5 and SHA1 with TWRP nandroid back up
  • If it matches, it is confirmed both are same and no tampering took place
  • If not flash only kernel from TWRP, and generate MD5 and SHA1. Repeat with downloaded image and verify
  • Repeat above with /sys and /data
  • This should pinpoint the tampering that happened

It is a little tedious but IMO, worth the effort as it proves beyond doubt that either present ROM has not been tampered with or if tampered, in which portion (s) of the ROM it happened. This may not be a practical solution but is based on the premise that (near) fool proof validation is only possible when compared with original stock ROM. Other variations of this could be see if OTA updates work or comparing partition sizes

Improve this answer
3
  • 1
    The irony here is that if OP is already going to download stock ROM and flash TWRP, then why not simply flash the stock ROM and be at peace, because figuring out file integrity isn't worth anything at that point. Of course, there can be a possibility where the new owner would like to return the device, should the integrity be found compromised, but that doesn't appear to be the case here.
    – Firelord ♦
    Dec 26, 2015 at 4:24
  • 1
    @Firelord..absolutely agree but from an academic perspective to my mind, this is the only sure way of knowing, addressing the "how" portion of the question. I will wait with interest to see if there is an alternative way which gives equal assurance and unless OP declines this as not a viable option, it stays as an answer. I have researched ways ever since this Q appeared as non-featured and saw nothing that gives full assurance (of course, I could have missed in not exploring alternatives). Explaining at length to address similar concerns from others
    – beeshyams
    Dec 26, 2015 at 4:35
  • I don't think that the checksums would match even if the backed up ROM was backed up from a clean stock ROM as the files are completely different. The stock update file is probably of EXE type, while the backup is IMG or ZIP. The contents are also different internally because the OEM packs files diferently than a recovery, therefore it is probably impossible that a nandroid backup has the same hash value as an update file.
    – Chapz
    Dec 29, 2015 at 11:08
5

TheBro21's comment applies only if it's a KNOX enabled device. For most Android devices, when you boot into downloading mode it will read a few lines in "SYSTEM STATUS: custom" or "Custom Binary Download YES (and the number of time here, if it hasn't be reset with triangle away)". If in bootloader mode it says Unlock state: true, it might be that the ROM is custom, but then again it may have been done by a stock flash.

You can also go into the settings and about and look at the system status, ROM, kernel, or base-band and if it has a weird name, google it, it's probably a custom ROM or kernel, if not, it probably isn't or close enough you'd never notice.

If you really are concerned and want a fresh device on official firmware, google how to flash your device with Odin, than download the latest stock firmware.

Improve this answer
1
  • That's not enough. I would flash the stock bootloader and recovery if possible too
    – Freedo
    Dec 25, 2015 at 10:12
1

How to tell if phone's ROM is original or tampered?

This is how I would proceed. If the official stock ROM is available from trusted sources, you can download it and verify the integrity of the binaries on your phone by comparing it's MD5/SHA checksums with that of the one you downloaded.

But in your case, if the official ROM is available you could simply flash it and you can use your phone safely. But in case the ROM is not available(or even if it is available), the most safest option for you is to download the Official CyanogenMod ROM for your device and flash it. It will keep your phone free of "malicious software/apps."

Improve this answer
0

To check if it is tampered - very hard. There are ways with calculating the checksum but I don't know will it work for sure. But, if you want to be 100% sure it was not tempered, I would suggest to manually download the official ROM and flash it. This does not void your warranty and AFAIK all phones can be manually flashed with official software.

Improve this answer
8
  • This doesn't answer the question at all and "if you want to be 100% sure it was not tempered, I would suggest to manually download the official ROM and flash it." isn't making any sense. How would flashing the ROM would verify that previous was tampered with? You're simply wiping out all the evidence here.
    – Firelord ♦
    Dec 26, 2015 at 14:20
  • 1
    1. Update file doesn't have the same checksum as the nandroid backup - not a valid check. 2. Root checkers and other indicators can be easily modified and set by other (maybe malicious) methods, making them also not good proofs. My answer is no, there is NO WAY to be 100% sure that the ROM hasn't been tempered with. The only way is to download the update, compare checksums of the downloaded file with that on the website, and flash it. Maybe my previous answer wasn't clear enough.
    – Chapz
    Dec 26, 2015 at 19:22
  • @Chapz I am a newbie. I searched the internet but I couldn't find the stock ROM on Motorola websites, I could only find it on third-party websites. is it possible to get it from the Motorola? also, would flashing it wipe the phone's memory clean?
    – Omne
    Dec 28, 2015 at 21:22
  • 1
    Link: motorola-global-portal.custhelp.com/app/standalone/bootloader/… You need to log in with your Google account or make a Motorola account, and you can download firmwares from their site. Flashing an entire ROM wipes it clean so do make a backup of your files.
    – Chapz
    Dec 29, 2015 at 10:53
  • 1
    Unfortunately, this goes beyond my knowledge, you can just google it as I would do it. The full wipe happens when you install the ROM, as it reinstalls all the partitions on your phone. OTA updates should not be a problem as the ROM is official, only difference is that you installed it in a different way.
    – Chapz
    Dec 30, 2015 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .