FORUMS
Remove All Ads from XDA

[BOOT] Worse news (was "Bad news everyone.")

767 posts
Thanks Meter: 398
 
By pokey9000, Senior Member on 16th November 2011, 03:54 PM
Post Reply Email Thread
I now have proof that the Nook Tablet is efuse locked and bootloaders signed. We can only boot signed bootloaders, kernels, and ramdisks from microSD.

Don't buy this if you expect any real development to happen on it. The only possible way is through kexec, and that's a lot of trouble to go through considering all the other tablet options.


For what it's worth, the u-boot in the recently posted update image from the Kindle Fire does not appear to have the signed header that the one on the NT has.

Things I learned in the process:

-USB boot is enabled, as is SD boot
-I can boot from a microSD if I format it the same as for Nook Color (modified CHS, fat on p1) and copy the MLO, u-boot, and boot.img renamed to flashing_boot.img
-There is a serial port inside that will let you at the u-boot console and a shell after the OS boots
-x-loader is signed. A known-good x-loader on microsd will not even execute, and the next item in the boot list checked (emmc)
-u-boot is signed. I know this because a known-good u-boot from Pandaboard that should be close enough to boot causes x-loader to take the code path where the secure ROM call with a pointer to the image returns nonzero
-kernel and ramdisk are signed individually in the boot.img. I can modify a byte in the boot.img on the microsd that's in the middle of the kernel or the ramdisk section and u-boot will fail the same exact call that x-loader uses to validate u-boot, but this time emitting a message complaining that the image is corrupt
-Comparing the first part of u-boot grabbed from the NC, NT, and the KF, shows that the signature that's at address 0 of the KF and NC versions is seen about 300 bytes into the NT version, with some unknown junk above. I assume that's the signature, and that the call to the secure ROM returns the image pointer (which is passed by reference, a good clue) plus the size of the header.
The Following 7 Users Say Thank You to pokey9000 For This Useful Post: [ View ] Gift pokey9000 Ad-Free
 
 
16th November 2011, 05:18 PM |#2  
DarkDvr's Avatar
Senior Member
Thanks Meter: 260
 
More
Wait.. Nook Touch or Nook Tablet?
16th November 2011, 05:24 PM |#3  
OP Senior Member
Flag Austin
Thanks Meter: 398
 
More
Quote:
Originally Posted by DarkDvr

Wait.. Nook Touch or Nook Tablet?

Tablet. I blame BN's marketing.
16th November 2011, 05:50 PM |#4  
diamond_lover's Avatar
Senior Member
Top Secret
Thanks Meter: 118
 
More
what about this?
http://code.google.com/p/pandroid/do...t.bin&can=2&q=
16th November 2011, 05:53 PM |#5  
Senior Member
Thanks Meter: 83
 
More
That's certainly... interesting. Definitely not the direction I assumed they would go given those quotes from the B&N guys that have been thrown around.

I'll hold off any true disappointment until more people have had more time to poke at this thing. Nothing against you pokey, and thanks for your investigations so far.
16th November 2011, 05:59 PM |#6  
OP Senior Member
Flag Austin
Thanks Meter: 398
 
More
Quote:
Originally Posted by diamond_lover

what about this?
http://code.google.com/p/pandroid/do...t.bin&can=2&q=

Close enough to the one for Pandaboard minimal Linux, which I tried.
16th November 2011, 06:06 PM |#7  
diamond_lover's Avatar
Senior Member
Top Secret
Thanks Meter: 118
 
More
Quote:
Originally Posted by pokey9000

Close enough to the one for Pandaboard minimal Linux, which I tried.

I hope we can find a workaround, there will be a way to do that, because they installed android in some way.
BTW, have you tried a bootable SD card? I think it's the right path to follow.
EDIT: I see you can't boot by sd card.. what about if you try some file from Nook Color?
16th November 2011, 06:11 PM |#8  
aludal's Avatar
Senior Member
Capitola CA
Thanks Meter: 12
 
More
pokey9000: what kind of a response you can get when trying to boot your test SD in BB Playbook, I wonder?
16th November 2011, 06:45 PM |#9  
OP Senior Member
Flag Austin
Thanks Meter: 398
 
More
Quote:
Originally Posted by diamond_lover

I hope we can find a workaround, there will be a way to do that, because they installed android in some way.
BTW, have you tried a bootable SD card? I think it's the right path to follow.
EDIT: I see you can't boot by sd card.. what about if you try some file from Nook Color?

Trust me, I've tried every trick used when we figured out how to boot on the NC.
The Following User Says Thank You to pokey9000 For This Useful Post: [ View ] Gift pokey9000 Ad-Free
16th November 2011, 06:50 PM |#10  
Member
Thanks Meter: 9
 
More
might need some combination of keypress while the thing powers on...


I bet BN built-in some backdoor 'boot off SD' mode. This would allow them to grab the Nook Tablets and reformat the onboard space/memory however they see fit.

This was done in the past with the NC.
16th November 2011, 07:01 PM |#11  
Senior Member
Thanks Meter: 83
 
More
Quote:
Originally Posted by discothan

might need some combination of keypress while the thing powers on...


I bet BN built-in some backdoor 'boot off SD' mode. This would allow them to grab the Nook Tablets and reformat the onboard space/memory however they see fit.

This was done in the past with the NC.

I agree, but it sounds like the problem is not with it blindly skipping the SD card but with it not seeing a signed image on the SD card. In that case B&N might just be providing their stores with SD cards with a properly signed image that doesn't need any other tricks
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes