• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[BOOT] Worse news (was "Bad news everyone.")

Search This thread

pokey9000

Senior Member
Apr 17, 2007
767
396
Austin
I now have proof that the Nook Tablet is efuse locked and bootloaders signed. We can only boot signed bootloaders, kernels, and ramdisks from microSD.

Don't buy this if you expect any real development to happen on it. The only possible way is through kexec, and that's a lot of trouble to go through considering all the other tablet options.


For what it's worth, the u-boot in the recently posted update image from the Kindle Fire does not appear to have the signed header that the one on the NT has.

Things I learned in the process:

-USB boot is enabled, as is SD boot
-I can boot from a microSD if I format it the same as for Nook Color (modified CHS, fat on p1) and copy the MLO, u-boot, and boot.img renamed to flashing_boot.img
-There is a serial port inside that will let you at the u-boot console and a shell after the OS boots
-x-loader is signed. A known-good x-loader on microsd will not even execute, and the next item in the boot list checked (emmc)
-u-boot is signed. I know this because a known-good u-boot from Pandaboard that should be close enough to boot causes x-loader to take the code path where the secure ROM call with a pointer to the image returns nonzero
-kernel and ramdisk are signed individually in the boot.img. I can modify a byte in the boot.img on the microsd that's in the middle of the kernel or the ramdisk section and u-boot will fail the same exact call that x-loader uses to validate u-boot, but this time emitting a message complaining that the image is corrupt
-Comparing the first part of u-boot grabbed from the NC, NT, and the KF, shows that the signature that's at address 0 of the KF and NC versions is seen about 300 bytes into the NT version, with some unknown junk above. I assume that's the signature, and that the call to the secure ROM returns the image pointer (which is passed by reference, a good clue) plus the size of the header.
 
Last edited:

boomn

Senior Member
Feb 2, 2011
275
83
That's certainly... interesting. Definitely not the direction I assumed they would go given those quotes from the B&N guys that have been thrown around.

I'll hold off any true disappointment until more people have had more time to poke at this thing. Nothing against you pokey, and thanks for your investigations so far.
 

diamond_lover

Senior Member
Apr 2, 2009
1,579
117
Top Secret
Close enough to the one for Pandaboard minimal Linux, which I tried.

I hope we can find a workaround, there will be a way to do that, because they installed android in some way.
BTW, have you tried a bootable SD card? I think it's the right path to follow.
EDIT: I see you can't boot by sd card.. what about if you try some file from Nook Color?
 
Last edited:

pokey9000

Senior Member
Apr 17, 2007
767
396
Austin
I hope we can find a workaround, there will be a way to do that, because they installed android in some way.
BTW, have you tried a bootable SD card? I think it's the right path to follow.
EDIT: I see you can't boot by sd card.. what about if you try some file from Nook Color?

Trust me, I've tried every trick used when we figured out how to boot on the NC.
 
  • Like
Reactions: diamond_lover

discothan

Senior Member
Feb 15, 2011
90
14
might need some combination of keypress while the thing powers on...


I bet BN built-in some backdoor 'boot off SD' mode. This would allow them to grab the Nook Tablets and reformat the onboard space/memory however they see fit.

This was done in the past with the NC.
 

boomn

Senior Member
Feb 2, 2011
275
83
might need some combination of keypress while the thing powers on...


I bet BN built-in some backdoor 'boot off SD' mode. This would allow them to grab the Nook Tablets and reformat the onboard space/memory however they see fit.

This was done in the past with the NC.

I agree, but it sounds like the problem is not with it blindly skipping the SD card but with it not seeing a signed image on the SD card. In that case B&N might just be providing their stores with SD cards with a properly signed image that doesn't need any other tricks
 

jasoraso

Senior Member
May 24, 2007
581
177
Salt Lake City, UT
If B&N really is requiring signed images to boot from the SD card, I guess there might a different method to change the bootloader - after all, most (all?) phones won't boot off of a SD card, and it is still possible to change bootloaders on many of them.

BUT, I don't think this device is going to have nearly the same dev support as a year ago to discover/crack the bootloader issue.

I'll wait a little bit longer, but the quick progress rooting the Kindle Fire makes me think that that might be my next device to replace my lost Nook Color.

Sorry B&N - you might have lost me!
 

nexus14

Senior Member
May 9, 2010
256
17
If B&N really is requiring signed images to boot from the SD card, I guess there might a different method to change the bootloader - after all, most (all?) phones won't boot off of a SD card, and it is still possible to change bootloaders on many of them.

BUT, I don't think this device is going to have nearly the same dev support as a year ago to discover/crack the bootloader issue.

I'll wait a little bit longer, but the quick progress rooting the Kindle Fire makes me think that that might be my next device to replace my lost Nook Color.

Sorry B&N - you might have lost me!

agreeed. there's so many low-cost devices out there and devs are going to have to pick "sides": kindle fire, nook tablet, and who can forget the hp touchpad
 
  • Like
Reactions: BobK46

RussianMenace

Senior Member
Oct 13, 2010
507
83
Considering most people havent had this in their hands more than 24 hours, I think it's a bit premature to make any calls.

That being said, I'll be holding on to my $$ a wee bit longer it seems.
 

Ellerbestyle

Senior Member
Jun 16, 2010
107
4
I really hope it can be rooted and then be able to put ICS on it. I guess I will hold onto my money a little longer also.

Even though I want the NT more, I would get a KF since it can be rooted.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    I now have proof that the Nook Tablet is efuse locked and bootloaders signed. We can only boot signed bootloaders, kernels, and ramdisks from microSD.

    Don't buy this if you expect any real development to happen on it. The only possible way is through kexec, and that's a lot of trouble to go through considering all the other tablet options.


    For what it's worth, the u-boot in the recently posted update image from the Kindle Fire does not appear to have the signed header that the one on the NT has.

    Things I learned in the process:

    -USB boot is enabled, as is SD boot
    -I can boot from a microSD if I format it the same as for Nook Color (modified CHS, fat on p1) and copy the MLO, u-boot, and boot.img renamed to flashing_boot.img
    -There is a serial port inside that will let you at the u-boot console and a shell after the OS boots
    -x-loader is signed. A known-good x-loader on microsd will not even execute, and the next item in the boot list checked (emmc)
    -u-boot is signed. I know this because a known-good u-boot from Pandaboard that should be close enough to boot causes x-loader to take the code path where the secure ROM call with a pointer to the image returns nonzero
    -kernel and ramdisk are signed individually in the boot.img. I can modify a byte in the boot.img on the microsd that's in the middle of the kernel or the ramdisk section and u-boot will fail the same exact call that x-loader uses to validate u-boot, but this time emitting a message complaining that the image is corrupt
    -Comparing the first part of u-boot grabbed from the NC, NT, and the KF, shows that the signature that's at address 0 of the KF and NC versions is seen about 300 bytes into the NT version, with some unknown junk above. I assume that's the signature, and that the call to the secure ROM returns the image pointer (which is passed by reference, a good clue) plus the size of the header.
    6
    Hmm, after looking at the OMAP4430 TRM (Any better links than http://nishanthmenon.blogspot.com/2010/08/public-omap4-trm-released.html ? - I'll look tonight, I don't remember ever seeing that on TI's site directly), things may not be as bad as they seem.

    In section 27.4.8.2, it looks like there are a lot of reasons for requiring a CH other than code signing.

    So this may not be a case of "No signed code? GTFO!" but more of "I am stupid, please hold my hand!" - e.g. we need a valid CH with clock/memory/etc settings.

    This might be extractable from wherever the device initially boots from...
    3
    Quitters aren't the kind of developers I want working on it anyway. I want someone who cares and will stick with it.

    And how much are you willing to PAY???

    Most developers have lives, unlike some of those here. I'm not trying to start an argument, but as the person who provided the repartitioning tools for the NC, I do find the whining here (not to mention the instant gratification desires) a bit excessive.
    3
    Someone from the community will probably soon get their hands on one of the bootable SD cards that the B&N techs use to reimage a hosed up NT. There is a good chance that poking into the image will provide a way in.

    *Grabs ski mask*

    Be right back.
    3
    ROOTED!!!

    We've got some real hard working geniuses toiling over the NT. The device has been rooted: http://forum.xda-developers.com/showthread.php?p=19521142&posted=1#post19521142 . Indirect's post lists the details, instructions and provides d/l links: http://forum.xda-developers.com/showpost.php?p=19513995&postcount=1 .