Say hi to "CyanoBoot" -- a 2nd bootloader/w menu aka "ub2" - (WIP)

Search This thread

mik_os

Retired Recognized Developer
Apr 13, 2010
746
1,830
Poltava
Successful.
Now command "continue" will bring you back to menu. Emmc version for testing attached. Sources, more info, and corrected file size will be available when I get some sleep (it's 4 a.m. for me) :)
 

Attachments

  • flashing_boot_emmc.zip
    79.7 KB · Views: 80
Last edited:

fattire

Inactive Recognized Developer
Oct 11, 2010
2,280
6,473
www.eff.org
Wanna crash your bootloader?

Yeah having it continue the boot post-fastboot is an easy fix. I didn't realize you could continue once fastboot ran. All you'd really have to do is find the menu option in.. I think it was mmc.c... and then just have it call another boot profile after it executes fastboot (or re-run the menu). If you need help with this I can show you how to do it.

Incidentally a few days ago I posted a first attempt to an update to the menu, based on refinements to cyanoboot nookcolor from tonsofquestions and then adapted to the NT. . Chrmhoffmann was supposed to take a look, but I don't think he had a chance yet. It's up on goo-inside.me if someone wants to try it. Somehow I'm guessing it will crash hard, but if someone is feeling adventurous, there's a flashing_boot.img up there which includes the source.

The big difference is basically that it will grey out menu items that don't apply (based on whether the files are available on the sdcard), but there are some other optimizations to the menu interface as well.

That plus the fastboot recover I think might warrant a new "major" release. I hesitated to post it until someone tested it-- I still dont' have a nook tablet. But since a patch to the previous source is available, if it's not working, someone might want to debug it as necessary.

There is also a discussion on the cyanboot nookcolor thread about whether a portrait or landscape configuration is more desirable. There is a horizontal version implemented, but consensus seemed to be portrait was preferred.

Anyway, the probably-will-crash experimental version, along with the source diff, is here.
 

fattire

Inactive Recognized Developer
Oct 11, 2010
2,280
6,473
www.eff.org
Succesfull.
Now command "continue" will bring you back to menu. Emmc version for testing attached. Sources, more info, and corrected file size will be available when I get some sleep (it's 4 a.m. for me) :)

Hah, I guess i missed this post.

Great.. so that's done, awesome. Can you try the new menu changes? Issues that crop up should be pretty easy to fix.
 

mik_os

Retired Recognized Developer
Apr 13, 2010
746
1,830
Poltava

Attachments

  • flashing_boot_emmc.zip
    79.7 KB · Views: 45
Last edited:
  • Like
Reactions: lavero.burgos

mik_os

Retired Recognized Developer
Apr 13, 2010
746
1,830
Poltava
Will this work?

dd if=/dev/zero of=flashing_boot_emmc.img bs=1 seek=524287 count=1

cat flashing_boot_emmc.img boot.img > new_boot.img

fastboot flash boot new_boot.img

If you don't worry about your boot partition you can directly flash with "fastboot flash boot flashing_boot_emmc.img".
If you already have cyanoboot on boot partition this will probably work too.
If you don't have cyanobot on boot partition you need to get boot.img, shift it to 512Kb, and place on first byte content of flashing_boot_emmc.img.
 
  • Like
Reactions: Solar.Plexus

Demetris

Recognized Developer
Aug 15, 2008
3,094
9,469
47
Limassol
If you don't worry about your boot partition you can directly flash with "fastboot flash boot flashing_boot_emmc.img".
If you already have cyanoboot on boot partition this will probably work too.
If you don't have cyanobot on boot partition you need to get boot.img, shift it to 512Kb, and place on first byte content of flashing_boot_emmc.img.

What do you mean if i dont worry, what is the worst thing that can happen?
I have cyanoboot already, q. can fastboot replace it self when in use like recovery?
I mean can i update fastboot from fastboot? lol
 

mik_os

Retired Recognized Developer
Apr 13, 2010
746
1,830
Poltava
What do you mean if i dont worry, what is the worst thing that can happen?
I have cyanoboot already, q. can fastboot replace it self when in use like recovery?
I mean can i update fastboot from fastboot? lol

Yes, you can. I mean that this opeartion will replace first N bytes of partition and if there was android's boot it became corrupted, but cyanoboot will work.
 

damnoregonian

Senior Member
Jun 28, 2007
109
13
Seattle
If it's attempting to boot into recovery with every boot, this is due to an uncleared instruction in the /bootdata/bcb file that was NOT set by cyanoboot (it does not do this) and is not being cleared with every boot-- if you tried to boot into recovery from the reboot menu and do not have a valid recovery to boot into (and thus clear this instruction), this can happen...

Do you have a valid recovery image or other bootable SD? If you can boot into it, or any other valid image (boot off SD), this command from the shell should clear the bcb instruction:

dd if=/dev/zero of=/bootdata/BCB bs=1 count=1088

Aha! I needed this :)
I tried wiping out the BCB, making it empty... wasn't sure what would get it to stop looping.
I tried to go into recovery after my release had expired (to upgrade) - and apparently my recovery was not working.
Perhaps cyanoboot should still allow a hard-key override of BCB boot instructions?

scotty2
 
  • Like
Reactions: fattire

fattire

Inactive Recognized Developer
Oct 11, 2010
2,280
6,473
www.eff.org
Aha! I needed this :)
I tried wiping out the BCB, making it empty... wasn't sure what would get it to stop looping.
I tried to go into recovery after my release had expired (to upgrade) - and apparently my recovery was not working.
Perhaps cyanoboot should still allow a hard-key override of BCB boot instructions?

scotty2

scotty2--

Yeah there was talk of adding this, and in fact someone is working on it for nook color. So hopefully a clear bcb file option will show up. If it doesn't, I'll add it...
 

Rebellos

Senior Recognized Developer
May 13, 2009
1,353
3,428
Gdańsk
https://github.com/Rebell/acclaim_cyanoboot/commit/33228462ece75fe8274f76ad368c333130c02174
Added some more things I just remind:
Added primitive VOLUP/VOLDOWN driver.
Ported .img detection from Encore - unavailable booting modes are greyed out, EMMC normal and EMMC recovery are always ON.
Added battery level & board rev info. Enabling battery charging in case of level < 30 - doesn't seem to work on my board (FIXME).
Lowered brightness to drain less battery power.
Turned off BN board charging procedure.
Change default booting source from Encore - still untested/unfinished.
Added OMAP4 IRQ header just in case.
Added Bauwks image generation script.

Please check it out.
 

Attachments

  • device_bn_acclaim_prebuilt_boot_flashing_boot_emmc.img.tar.gz
    80.2 KB · Views: 49

meghd00t

Senior Member
Jul 13, 2011
111
141
Bangalore
This is quite awesome stuff. People, test it!

I just built rebellos' cyanoboot and booted it from sdcard, I can confirm vol keys up down select and boot internal emmc, emmc recovery, sdcard boot (twrp 2.2), sdcard recovery & sdcard altboot work fine, I have not installed /rom/altboot and so that remains greyed out. but I did change the KERNEL_OFFSET back to 0x120 before it would work

http://pastebin.com/znaEZy53

has my build steps

on the sdcard - format fat32, lba set bootable, copy MLO u-boot.bin from b&N 1.4.2 or 1.4.3 and add flashing_boot.img from the output of my script and whatever boot / recovery images you want to test
 

fattire

Inactive Recognized Developer
Oct 11, 2010
2,280
6,473
www.eff.org
Thanks meghd00t. Guess something with loading is broken so it cant handle 0x200 offset. We don't need it for now anyway I guess.

Oh yes. List of expected files it's looking for is of course:
/emmc/altboot.img
/sdcard/boot.img
/sdcard/recovery.img
/sdcard/altboot.img

so what's the consensus? Works?
 

succulent

Senior Member
Dec 22, 2010
241
448
so what's the consensus? Works?

It work for the most part like you intended thanks to Rebellos, but not everything. The detection of altboot.img on emmc isn't working. It can detect if altboot.img and boot.img are present on sdcard. It grey out like it should if they are not present. The volume keys moves to next item and home key select. I don’t know why “0x200 offset” was added to bauwks’s script, but I didn’t use it.

Edit: Attached pic, CB with own edits.
 

Attachments

  • IMG_0010.JPG
    IMG_0010.JPG
    170.5 KB · Views: 215
Last edited:

fattire

Inactive Recognized Developer
Oct 11, 2010
2,280
6,473
www.eff.org
It work for the most part like you intended thanks to Rebellos, but not everything. The detection of altboot.img on emmc isn't working. It can detect if altboot.img and boot.img are present on sdcard. It grey out like it should if they are not present. The volume keys moves to next item and home key select. I don’t know why “0x200 offset” was added to bauwks’s script, but I didn’t use it.

Edit: Attached pic, CB with own edits.

Anyway... there are a few offsets that we're talking about-- the 256 & 512 offset inthe boot.img and if I remember right there is the security header offset used for bauwks' workaround for the locked bootloader. I may have errantly confused them in IRC when talking to rebellos.

Also, who is "HD"? Not that it matters, but the menu itself was written first by j3mm4r, then I redid it for NC and redid it again for NT starting w/fresh BN/Den code, adding bauwks' bootloader hack, and menu-wise starting with a fresh menu.c. That version was enhanced by mik_os (fastboot and other mprovements), then the menu was ported back to NC by me and then refactored by "Ogilvy" on NC... and now "Rebellos" applied those refactoring and other changes back to NT. Phew! I don't know who "HD" is at all, but maybe someone will remind me...

Source is here btw and the NC version is here if anyone is curious of the history.
 
Last edited:
  • Like
Reactions: nook_lover

Top Liked Posts

  • There are no posts matching your filters.
  • 56
    Say hi to "CyanoBoot" -- a 2nd bootloader/w menu aka "ub2" - (WIP)

    “CyanoBoot”
    (aka a "second bootloader")
    Quick Guide
    by fattire
    (@fat__tire on Twitter)

    Alpha 0: "I don't have a NT" Edition​

    jFMQO13t3Gbub.jpg

    (Thanks to indirect for the image.)

    What is CyanoBoot?

    CyanoBoot (working title) is a “second bootloader” in early development, which is based on the open-source “u-boot” project, as further customized by BN & Bauwks. It is similar to the bootloader provided by Bauwks but has additional enhancements to make booting unsigned partitions easier and to generally enhance the booting experience on the Nook Tablet (aka “acclaim”) device.

    CyanoBoot is intended for use with the forthcoming CyanogenMod 9, but it can also be used to boot CM7 or Ubuntu Linux or even the stock firmware (provided of course you are not legally or contractually bound from doing so. I haven’t read or agreed to any BN user agreements, so can’t speak to this.)

    CyanoBoot includes an on-screen menu system, the ability to boot into three basic modes (normal, recovery, and “altboot”), configuration options, fastboot, and more.

    The same version of CyanoBoot should start from both SD card and emmc (although it must be packaged and installed differently for each.) It should work on both the 1gb and 512mb RAM models. NOTE: It has been reported that some devices may require a USB cable to be plugged in to boot from SD Card. If true, this issue is not understood and is not addressed, nor is it likely to be.

    NOTICE: CYANOBOOT (WORKING TITLE) IS HIGHLY EXPERIMENTAL AND IS NOT INTENDED TO BE USED BY NON-DEVELOPERS AND/OR THOSE UNWILLING TO ACCEPT FULL RESPONSIBILITY FOR ANY UNTOWARD CONSEQUENCES OF USING (OR ATTEMPTING TO USE) THE SOFTWARE. ALL SUCH ACTIVITY MUST OCCUR *ENTIRELY AT YOUR OWN RISK* AND YOU ACCEPT ALL CONSEQUENCES FOR DOING SO. THE USE OR ATTEMPTED USE MAY HAVE UNINTENDED RESULTS, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, DAMAGE TO HARDWARE, AND/OR EXPLOSIVE DIARRHEA. CYANOBOOT IS NOT ENDORSED, AFFILIATED, SPONSORED, NOR ASSOCIATED WITH THE "DAS U-BOOT" PROJECT, GOOGLE, BARNES AND NOBLE LLC, TEXAS INSTRUMENTS, DENX., NOR ANY OF THEIR PARTNERS, OWNERS, EMPLOYERS, AFFILIATES, CLIENTS, SUBCONTRACTORS, OFFICERS, DIRECTORS, ADMINSTRATORS, INFORMATION PROVIDERS, ETC. EXCEPT INSOFAR AS THEY HAVE PROVIDED AND LICENSED SOURCE CODE TO BE FURTHER MODIFIED AND DISTRIBUTED. SEE THE RELEVANT GNU PUBLIC LICENSE FOR LICENSING DETAILS AND OTHER DISCLAIMERS. THIS SOFTWARE IS OBVIOUSLY INTENDED FOR USE ONLY BY THOSE WHO ARE AUTHORIZED TO DO SO.

    Whew!


    LIST OF THINGS


    • Started with “UB1” (aka u-boot, “first boot”) source code
    • Includes changes to support new 512MB model
    • Includes Bauwks’ repairs to fix “locked bootloader” malware
    • Many duplicate UB1 functions removed
    • One-build-boots-all (emmc or SD card, custom OS or stock)
    • Boot device indicator (top-left corner)
    • Bootcount indicator (top-left corner)
    • On-screen feedback to let you know what it’s loading.
    • Console-based boot menu
    • Support for key-combo shortcuts for menu/recovery
    • Alternate “Altboot” multiboot support allows 2nd OS.
    • Emmc setting for default boot profile (normal/altboot)
    • Emmc setting for default boot device (emmc or sd)
    • Emmc setting for automatic bootcount clearing
    • Boot fallback for stock firmware (0 bytes + sec. header)
    • Boot fallback for bauwks’ uboot (256 bytes)
    • Numerous visual enhancements
    • Unused bulky images removed (smaller file)
    • FASTBOOT support (w/menu selection)
    • On-screen build timestamp so you know version
    • Perhaps much more, or maybe not

    There are likely bugs all over the place, but this is how it's supposed to work:


    Key Shortcuts

    Hold down home (“n”) key for the menu.

    Hold down home (“n”) + “power” to have UB1 start recovery. If UB2 is also installed, it should respect this key combo and continue to load recovery.

    The default behavior if no keys are pressed is to boot “normally”-- if booting from emmc, the boot partition (p4) from emmc will be booted. If booting from SD the boot.img on SD file will be booted.


    The Boot Menu

    Use the Home (“n”) key to navigate through the menu options. You can select an option with the power key.

    The option you choose will override any other configuration you have made.

    NOTE: Just so you don’t ask-- the reason the home and power keys are used to navigate through the menu rather than the volume up and down keys is due to a required driver not being included with u-boot 1. While the home and power keys use a very simple “gpio” method to detect if they are pressed, the volume keys are more like keyboard keys and thus are more difficult to detect. (The Nook Color bootloader, in contrast, did have the appropriate driver, so volume key detection was possible.)


    Boot Indicators

    Since you can boot from either SD or EMMC, it may be difficult to ascertain which version you are starting from.

    Never again. You can now see whether you have loaded CyanoBoot from EMMC or SD by lookin at the top left corner:

    E” -> CyanoBoot is starting from emmc
    S” -> CyanoBoot is starting from SDCard

    The # that follows this indicator is the current “bootcount”. After 8 unsuccessful boots or so, stock behavior is to run recovery with a reflash instruction. See below for instructions on clearing the bootcount at every boot automatically.


    Fastboot (used for development)

    For those familiar with “fastboot”, you can select the fastboot option from the CyanoBoot menu to go into fastboot mode. You can then (hopefully) flash to the boot or recovery partitions via USB cable using a command such as:

    $ fastboot flash boot boot.img


    Installation (SD Card boot)

    (If you are preparing your own SD card for booting, you should be aware that for OMAP devices such as the acclaim, the SDcard must be formatted using a very specific configuration, which is detailed elsewhere.)

    For SD Card, CyanoBoot is packaged inside a “flashing_boot.img” file to be placed in the first vfat partition of the SD-card along with the signed “mlo” and “u-boot.bin” files from the 1.4.2 update.zip.

    (I'm told the mlo file may be called called MLO_es2.3_BN in the BN update.zip and should be renamed to “mlo”.)

    Next, the boot (“boot.img”), recovery (“recovery.img”) and/or alternate boot (“altboot.img”) image files may optionally be placed in this partition.


    Installation (EMMC boot)

    To boot from emmc, the “flashing_boot_emmc.img” file, which contains a packaged version of CyanoBoot, should be put at byte 0 of the third partition (recovery) and ALSO at byte 0 of the fourth partition (boot). Then, the boot/recovery partitions must be shifted “to the right” (to make room for Cyanoboot) so that it starts 512Kb in from the start of the file. Use a padding of zeros so that the boot image contents begin exactly at 512Kb.

    The boot and recovery partitions are expected to use this offset. For the alternate boot from emmc, the “altboot.img” may be the identical file used in an SD-boot, placed into the /bootdata vfat partition without any offset.

    NOTE: Again, use the flashing_boot_emmc.img file for emmc boot partitions, *not* flashing_boot.img, which is for SD card boot.


    Offset Info

    Again, when used on the emmc, CyanoBoot must be placed at byte 0, at both the boot and recovery partitions. The “actual” boot.img and recovery.img that would normally be at byte 0 of those partitions should be moved so that it starts 512Kb in.

    Always use this offset in recovery (p3) and boot (p4) partitions. In other words, put CyanoBoot at offset 0 and then pad with zeros, then put the normal boot.img or recovery.img at offset 512.)

    On SD Card, the “boot.img” and “recovery.img” files should have no padding or offset or anything. Use as normal. This is similar to how “uImage” and “uRamdisk” files are used on the NookColor, only use a single file for both with a header in front.


    Installation Summary

    One more time. Here are the locations for the boot images:

    SDCARD

    (p1-vfat)/boot.img file (no offset/padding)
    (p1-vfat)/recovery.img file (no offset/padding)
    (p1-vfat)/altboot.img file (no offset/padding)

    EMMC

    (p4-/boot partition)<- CyanoBoot at byte 0, boot.img contents at 512.
    (p3-/recovery partition)<- CyanoBoot at byte 0, recovery.img contents at 512.
    (p6-vfat)/bootdata/altboot.img (no offset/padding, same as SDCard)


    Configuration

    You can control the "default boot" behavior (ie, what happens when you don’t hold down any keys). If you are a developer that does not want to constantly clear the bootcnt, you can also cause CyanoBoot to clear the bootcount automatically at every boot. To do this, three configuration files may be added to /bootdata (partition 6) on the emmc.

    CONFIG #1: BOOT DEVICE

    This will cause CyanoBoot to always boot from the emmc boot partition rather than SD. In this way, you can boot “through” a bootable SD card to whatever is on the emmc.

    To Make Default Always Boot To EMMC

    $ echo -n “1” > /bootdata/u-boot.device

    CONFIG #2: ALTBOOT

    Aside from the normal boot and recovery boot, a third boot option is available, called “altboot” (alternate boot). This is a kernel/ramdisk pair that can be used for a third firmware, an overclocked kernel, or whatever you like. If you choose the “altboot” as a default and it does not exist, your boot will fail.

    As discussed above, the altboot.img file goes in the following location:

    SDCard: file on p1 called “altboot.img” (no special padding or offset)

    EMMC: file at /bootdata/altboot.img (no special padding or offset)

    To Make Default Always Boot to “altboot”

    echo -n “1” > /bootdata/u-boot.altboot

    CONFIG #3: CLEAR BOOTCOUNT -- You can automatically zero out the bootcount with every boot. To set this:

    To Make Default Automatically Clear BootCount

    echo -n “1” > /bootdata/u-boot.clearbc

    NOTE: A version of “Nook Tablet Tweaks” is planned to automate the above options much as Nook Color Tweaks does for the encore device in CM7.


    Thanks/Credits

    Thanks to chrmhoffman, nemith, xindirect, Celtic, and loglud for testing, as I don’t have a device and have never actually run this. Thanks to j4mm3r for the first encore menu code. It was pretty much rewritten for acclaim, but the first menu was invaluable in showing me how to add the code for the console. Thx to pokey9000 for stuff that helped get fastboot working.

    Also thanks to BN as well as all the talented u-boot developers at Denx and elsewhere for the GPL’d code upon which this was based.

    http://www.denx.de/wiki/U-Boot is where you can find the main u-boot project.

    Also, a huge thanks to Bauwks for his code contribution as well as for making this possible in the first place!

    Remember, this is all experimental. I'll try to update this post if there's something that needs to be updated.

    (source)

    If you have an issue, be sure to mention the timestamp at the bottom so everyone knows which version you're using. There will be bugs.
    11
    Okay...

    Wrong. I know what I'm talking about.

    Really? You're really going to double-down on this?

    ROMs don't overwrite bootloaders in my experience.

    Glad you qualified it with "in my experience". Your limited experience obviously doesn't include the Nook Color, which does replace uboot. And your experience clearly doesn't including careful reading of threads relating to the Nook Tablet's locked bootloader, otherwise you'd understand why the second bootloader is necessary. You'd understand that is does NOT replace the original stock bootloader, but suppliments it in a way that is absolutely necessary.

    I've flashed custom bootloaders via ADB, but I've NEVER seen a ROM (at least for my device) actually include a bootloader.

    So none out of all the your device(s) had to deal with a locked bootloader. So?

    It's just not necessary. Once you've rooted your device and installed CWM recovery (or an equivalent), you just flash the ROM's zip file.

    A lot of "devs" have a reputation for delivering the smackdown on people who drop into a forum throwing around attitude without knowing what they're talking about.. and believe me, I'm trying hard really to be polite and not condescend here... So yeah, I get it- you've installed CWM on a device or two and you think you understand the process. But not every device is the same. I'm about to jump on a plane, so I'll try to make this as simple as I can:

    Unlike many devices that work exactly how you describe (root, install a recovery, and flash the rom), the Nook Tablet has extra security-- a design flaw from Barnes and Noble-- that has to be fixed/circumvented. That is, there is a signed booting process where once the power turns on, the pre-bootloader (aka "x-loader" aka "mlo") will not run unless it is signed by Barnes and Noble, and contains a digital signature that can be verified as authentic. The pre-bootloader then loads the bootloader (u-boot) which also has a digital signature which is checked. The bootloader and pre-bootloader can not be replaced-- the hardware will not run unsigned or improperly signed files. The signed bootloader (u-boot, remember), then loads the boot.img (or recovery.img) file which ALSO has a digitial signature that is ALSO signed by barnes and noble. (If you are booting from SD card, there is a FAT file called flashing_boot.img that works the same way).

    So there is a boot chain: hardware->mlo->uboot->kernel/ramdisk (aka boot.img/recovery.img) and every step of it is signed. If you replace any of these parts with a custom version, the boot stops.

    Without going into technical detail, CyanoBoot implements Bauwks' fix for this. The technical detalis as far as implementation go are in the first post, which you should read. The menu stuff is just extra.

    Crap. Plane is leaving.

    So you're saying that with CWM recovery installed on the device, I can't install a ROM via the typical zip file method? This is a complete surprise.

    Surprise! (You can of course flash via the typical zip menu as the zip will install everything for you. The second bootloader is part of boot.img/system.img/flashing_boot.img, but this is described in detail in my previous posts and in the original post which you claim to have read, so you know this already)

    See this article: http://raywaldo.com/2012/09/root-for-nook-tablet-1-4-3/ and jump to the section "Flash Jelly Bean Android 4.1.1". Looks like you can flash a ROM here via the way I've always done it.
    I
    I did read it. Clearly you didn't read my post completely. You may have read the words, but you don't seem to have actually thought about my questions...

    Yeah, I guess you're right and I don't know what I'm talking about. You put me in my place and shut me down.

    I have learned a lot here. You have learned nothing.

    Damn. Gotta shut off electronic devices.
    10
    https://github.com/Rebell/acclaim_cyanoboot/commit/33228462ece75fe8274f76ad368c333130c02174
    Added some more things I just remind:
    Added primitive VOLUP/VOLDOWN driver.
    Ported .img detection from Encore - unavailable booting modes are greyed out, EMMC normal and EMMC recovery are always ON.
    Added battery level & board rev info. Enabling battery charging in case of level < 30 - doesn't seem to work on my board (FIXME).
    Lowered brightness to drain less battery power.
    Turned off BN board charging procedure.
    Change default booting source from Encore - still untested/unfinished.
    Added OMAP4 IRQ header just in case.
    Added Bauwks image generation script.

    Please check it out.
    8
    Commited patch. Together with fix for fastboot screen corruption during loading big files (moved framebuffer far away from it).
    Binaries are already in ics and jb branch. :)
    6
    Thanks meghd00t. Guess something with loading is broken so it cant handle 0x200 offset. We don't need it for now anyway I guess.

    Oh yes. List of expected files it's looking for is of course:
    /emmc/altboot.img
    /sdcard/boot.img
    /sdcard/recovery.img
    /sdcard/altboot.img