Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,813,216 Members 53,713 Now Online
XDA Developers Android and Mobile Development Forum

Bootloader cracked and next steps

Tip us?
fattire's Avatar
Recognized Developer
Thanks Meter 4,393
Posts: 1,523
Join Date: Oct 2010
Thumbs up 2nd bootloader gains on-screen text abilities....

nemith confirmed for me tonight: The UB2 console feature I just added (well, sorta ported and made to work with this device really) is a go, which is currently manifested as true, textual boot info (similar to the one I did for NookColor UBoot). So you'll get a "Booting into SD Recovery..." type of feedback in actual text on-screen.

Before I was achieving a similar result by showing different images based on how you chose to boot. But that wasted a lot of space.

So UB2 has dropped in size as a result, from ~260K to ~176K. No menu or anything exists yet, so it will go up. But much better. Assuming there aren't big problems discovered tomorrow, the hard part is done now.

More very interesting discoveries to come relating to SD boot, once I fully comprehend the significance of what I've learned/am realizing... better to wait till I'm awake though and can think about it more.... it's late and I could be totally wrong.

Anyway, implemented now in 2ndbootloader (UB2):

* safety stuff; do-the-right-thing behaviors
* 512 buffer size default for boot partitions
* new boot modes
* New keypresses for recovery boot vs. normal boot on SD/emmc
* text now works
* instant feedback on what is loading...
* themed
* smaller size
* misc fixes

Another good day I think. Especially, and I emphasize-- I have no NT
The Following 21 Users Say Thank You to fattire For This Useful Post: [ Click to Expand ]
(Last edited by c0ldburn3r; 14th January 2012 at 10:29 PM.)
c0ldburn3r's Avatar
Senior Member
Thanks Meter 303
Posts: 1,208
Join Date: Nov 2010
Location: Wet Side of Washington
This is my thank you to everyone that is working on and helping with the NT

So glad Jerry took my tip!
Device: AT&T SGS IV
Rom: ShoStock/Jeboo Powered
GalaxyTab2 7.0 P3113 - Stock/Next Powered
B&N Nook HD+ - ModdedStock
AT&T SGS II - ShoStock/Pandora
AT&T Samsung Rugby Smart - Anyone want it?
AT&T Samsung Captivate - Retired
Just remember, use that little search button. It will save you from getting flamed... maybe
The Following User Says Thank You to c0ldburn3r For This Useful Post: [ Click to Expand ]
PG101's Avatar
RC-RT Liaison - Devil's Advocate
Thanks Meter 9,849
Posts: 11,380
Join Date: Aug 2008
Default Moderator Message

Guys... Enough with the ETAs... It will be ready when its ready.. I will be cleaning this thread of unwanted messages.

Next time it will be construed as spamming the thread.

HTC One M8 & Nokia 8800 Arte (Carbon Black)
Retired: Motorola V3i, Nokia N91, Nokia 8800 Sirocco, Nokia N95, HTC Diamond, Sony Xperia X1, HTC HD, HTC HD2, iPhone 4, HTC Desire HD, HTC Sensation, HTC One X, HTC Butterfly, HTC One, SG Note 3!
Follow Me

| New? Here is a good starting point!! | Something needs a moderator's attention? |
Want a thread actioned? Don't forget to include the thread link in the PM you're about to send me!!

And remember - You are the result of 3.8 billion years of Evolutionary Success - ACT LIKE IT!!
The Following 9 Users Say Thank You to PG101 For This Useful Post: [ Click to Expand ]
AdamOutler's Avatar
Recognized Developer
Thanks Meter 9,624
Posts: 5,197
Join Date: Feb 2011
Location: Louisiana


I dropped the /etc/*.so files into my Ubuntu project. The Volume and power buttons are now working and the device goes into standby/resumes correctly. Just a tip... maybe it will work for CM9.

Also, I found the proper kernel module for wifi in /etc/wifi. It's likely issuing an insmod on this Kernel Object file will make wifi work.
Flash with Odin on Windows, Linux and Mac. Use JOdin3, Available in a web browser or offline
Check out my developer pages. Add me to your circles on Google Plus.
Wanna see the longest Linux BASH script ever made? click here.
The Following User Says Thank You to AdamOutler For This Useful Post: [ Click to Expand ]
O_G's Avatar
Senior Moderator - Life Can't Beat Me
Thanks Meter 4,973
Posts: 4,978
Join Date: Jul 2007
Location: Glosta
As requested i have cleaned this thread. Please dont be offended if your post had been deleted. I just deleted all non dev posts.

Lets keep the thanks posts down. It just makes it more difficult to track the good development going on.

As Robo says Thank you for your co-operation
Age, catamite - fac mihi hunc diem felicissimum
The Following 9 Users Say Thank You to O_G For This Useful Post: [ Click to Expand ]
Senior Member
Thanks Meter 442
Posts: 200
Join Date: Jul 2011

Default Actual bootloader hook?

So I have been doing some research today because people have been asking the question "How do I make a boot.img?" and have stumbled upon an interesting hole in the boot... Was curious if someone could find out what is actually stored in the SAR RAM...

* The SAR RAM is maintained during Device OFF mode.
* It is split into 4 banks with different privilege accesses
* ---------------------------------------------------------------------
* Access mode Bank Address Range
* ---------------------------------------------------------------------
* HS/GP : Public 1 0x4A32_6000 - 0x4A32_6FFF (4kB)
* HS/GP : Public, Secured
* if padconfaccdisable=1 2 0x4A32_7000 - 0x4A32_73FF (1kB)
* HS/EMU : Secured
* GP : Public 3 0x4A32_8000 - 0x4A32_87FF (2kB)
* HS/GP :
* Secure Priviledge,
* write once. 4 0x4A32_9000 - 0x4A32_93FF (1kB)
* ---------------------------------------------------------------------
* The SAR RAM save regiter layout is fixed since restore is done by hardware.
- Source (Line 23)

As I have learned that...

Code: Public Use of SAR RAM
At system level, the OMAP4430 SAR RAM memory is divided into four banks. The public ROM code uses only the first bank, which is always public-accessible. More specifically, the software booting configurationstructure must be located in the upper 1.5KB of the first bank. 
The public ROM code offers some flexibility about the location of the software booting configuration structure. The PUBLIC_SW_BOOT_CFG_ADDR pointer defines the start address of the structure within the SAR RAM bank (see Table 27-14).
As mentioned previously, the software booting configuration feature is optional. Hence, the public ROM code decides to use the feature based on the value read on a warm reset at the address pointed to by the PUBLIC_SW_BOOT_CFG_ADDR pointer. If the value matches the range 0x4A326A00 – 0x4A326FFF, the ROM code tries to extract the structure located at that address. The value pointed to by PUBLIC_SW_BOOT_CFG_ADDR is always overwritten to zero on a cold reset.
The recommended address for storing the software booting configuration structure described hereafter is defined as PUBLIC_SAR_RAM_1_FREE. It is, however, possible to locate the structure at any location within the 1.5-KB range.
It is moreover possible to use the public SAR RAM area for any other purpose, such as storing traces for HLOS use. Obviously, care must be taken not to overwrite the locations used for low-power modes and/or software booting configuration if used.
Id be interested to see if we could modify that 1.5K code, to point to a different uboot or software header.
Current list of devices:
HTC Rezound
Samsung Infuse 4G
Samsung Galaxy Nexus - CM10 Nightly
Barns & Noble Nook Tablet - CM9
Transformer TF201 - CM10 Nightly

Current projects:
[Dev] [NARS] [Mac & Linux] Nook Automated Rooting System

If I have seen further it is only by standing on the shoulders of giants.
-Sir Isaac Newton
The Following User Says Thank You to Loglud For This Useful Post: [ Click to Expand ]
Thanks Meter 34
Posts: 67
Join Date: Nov 2011
It's been mentioned that the first/second posts in this thread are being updated periodically...

I've seen Nemith's last edit timestamp update multiple times over the past few days, however the same information is in those posts as i saw on day 2 of this thread.

Am i perhaps loading a cached version of the page? Or is no real information changing in those posts? Sorry/thanks...
dodgepot's Avatar
Senior Member
Thanks Meter 69
Posts: 281
Join Date: Jan 2011
Location: Las Vegas
Haha, sorry. It was late and I was half asleep when I posted that.

This is his last entry regarding it:

@AndroidNemith After wasting the morning looking for omap4 keypad support of u-boot. I think it's time to tackle wifi #NT #CM9

If this post helped click the thanks button!
The Following 7 Users Say Thank You to dodgepot For This Useful Post: [ Click to Expand ]
Senior Member
Thanks Meter 536
Posts: 158
Join Date: May 2010
Location: Washington DC

Originally Posted by CelticWebSolutions View Post
Likely to be more like a c team lol. I wouldn’t know wher to start to get it to boot a whole new Rom.

Lerning how ot build a CWM zip might be a good start
Hey guys. I've been working on getting CM7 going by porting the Book Color build. I've been skirting the by putting a modified boot.img and system.ext4.tx in a CWM backup folder.

I've been able to get Bauwks 2ndboot wraper to fire up but the boot.img doesn't seem to get past the kernel.

Anyone who wants to help is welcome. We can start a new thread and ill post my files.
Thanks Meter 9
Posts: 67
Join Date: Feb 2011
Location: Holliston. MA
Thumbs up I can help team C or B or maybe A...

Originally Posted by dodgepot View Post
I can offer help where possible.

Thanks for the work, guys.
I can help team C or B or maybe A...

Why to solve the cut and paste issue, that is why I want to help.

Again thanks to all that are making the Nook Tablet better...
Owner of: Nexus 7 - Unlocked and Rooted, Asus Transformer Pad TF300 - Rooted, B&N Nook Tablet - just an e-reader and limited sideload, B&N Nook Color - just an e-reader.

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes