• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[WIP] Secure Boot and Linux for Surface RT

Search This thread

ShapeShifter499

Senior Member
Sep 13, 2009
469
159
I've been informed that this secure boot unlock is only for Windows 8.0 and NOT 8.1. Attempting this on Windows 8.1 can result in a brick! This may also be risky for Windows 8.0 You've been warned.​


We need some serious help and organization. This thread will be dedicated to getting Linux on these Surface RT tablets. We already have the secure boot unlock so why don't we have a full Linux install? I believe it's because all the information is strewn about the internet with incomplete information and broken links. So please keep this thread topic only on the topic of secure boot unlock and Linux booting on Surface RT.


Ok so about the unlock, for those who are asking you can get it here, check the end of the post. To run the secure boot unlock: Move the SecureBoot zip to the desktop, unpack it, and run the script InstallPolicy.cmd as an administrator. (right click and "run as administrator"). In my case it was not working properly because I was trying to run it off a removable usb thumb drive, you should run it from the desktop. Your tablet should reboot then you should get the "secure boot debug policy applicator" install menu with a bunch of warning text. If your RT device has a removable keyboard then please use the volume keys as the "arrow keys" to select accept and confirm it by taping the "windows key" below the screen, I had to do that for my Surface RT. It now should reboot back to windows and at this point you'll want to open a CMD in administrator mode (search for CMD, right click and "run as administrator") and run the command as mentioned in the included readme file.
Code:
 bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
Now reboot one last time and your good.

So now what? How do you boot? You can boot anything now by going to settings in the side bar menu, clicking "change PC settings", navigating to "general" settings, and at the bottom of that you should see an "advanced startup". Selecting "restart now" underneath "advanced startup" should bring you to a menu that will allow you to select a USB drive to boot off of. Included at the bottom is also a grub bootloader that's been created for these RT devices and a couple of other possibly related zips.

WE NEED PEOPLE WORKING ON GETTING THE KERNEL TO BOOT! SHARE THIS TO ANYONE YOU KNOW WHO COULD HELP! I was trying to use the source for a related (but not totally the same) hardware known as the "Cardhu Development Board" from Nvidia. The source code for that can be found here, and their own released version of Ubuntu Linux for Cardhu can be found here. I couldn't get the compiled kernel from source to boot but maybe some drivers can be had from that repository.

I DID NOT CREATE ANY OF THESE HACKS, I'm just more a hobbyist learning computers and programming who also loves Linux. Credit seems to go to users @Wack0Distractor, @black_blob, and the folks at ROL for the original hacks. Credit goes to @[email protected]@f for recovering the files, his original post is here, seems ROL had a bit of a issue and a lot was lost but their IRC is still up.
 

Attachments

  • SecureBoot.zip
    389 KB · Views: 7,500
  • GRUB.zip
    1.9 MB · Views: 5,248
  • EFIESP.zip
    1.6 MB · Views: 4,381
  • ci_tools_arm.zip
    7.7 MB · Views: 4,783
Last edited:

ShapeShifter499

Senior Member
Sep 13, 2009
469
159
How do we use the GRUB, ci_tools_arm & EFIESP??

I have Windows RT 8.1

My Surface RT was a used tablet and it came with Windows 8.0 afaik, so everything just worked. I actually don't know what "ci_tools_arm" are but I do know with EFIESP and GRUB you just unzip the contents of just one (take your pick) to the root of a USB drive and they will boot whatever you configure them to boot. "EFIESP" can be used to boot the Windows IOT from https://forum.xda-developers.com/wi...ows-phone-windows-10-mobile-surface-t3365743/ while GRUB can be used to boot ANYTHING, even Windows, so long as you have the proper kernel or files. If you try to boot GRUB you'll just get the GRUB loader screen and the attachable keyboard doesn't work in GRUB, a USB keyboard might though. Right now we need someone to compile a working kernel with drivers for the RT line of devices.

EDIT: Booting stuff requires that you unlocked "secure boot" as mentioned above.
 
Last edited:

Qiangong2

Senior Member
Oct 31, 2014
1,451
380
Samsung Galaxy S20

You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Sent from my Q5 using XDA Free mobile app
 
  • Like
Reactions: ShapeShifter499

ShapeShifter499

Senior Member
Sep 13, 2009
469
159
You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Sent from my Q5 using XDA Free mobile app


Added warning to op. Thank you for letting me know.
 
Feb 1, 2014
8
0
You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

Quit the fearmongering, MSFT's security update has already been worked around

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

What do you mean by this
 
Last edited:

Qiangong2

Senior Member
Oct 31, 2014
1,451
380
Samsung Galaxy S20

ShapeShifter499

Senior Member
Sep 13, 2009
469
159
The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Isn't the device not loading any kernel when GRUB is loaded on a Surface RT? I thought when GRUB was proven to load, that any kernel would load on the Tegra processor, I've seen documentation online where most of the Tegra code (from Nvidia or from Open Source) was ported into the latest Linux kernel.
 
Last edited:

Qiangong2

Senior Member
Oct 31, 2014
1,451
380
Samsung Galaxy S20
Isn't the device not loading any kernel when GRUB is loaded on a Surface RT? I thought when GRUB was proven to load, that any kernel would load on the Tegra processor, I've seen documentation online where most of the Tegra code (from Nvidia or from Open Source) was ported into the latest Linux kernel.

We could just adapt a Linux kernel (like with Android) if the RT kernel was a Linux kernel, but it isn't. RT blocks different kernels from being loaded (like a locked bootloader, just more complex)

Sent from my Q5 using XDA Free mobile app
 

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    I've been informed that this secure boot unlock is only for Windows 8.0 and NOT 8.1. Attempting this on Windows 8.1 can result in a brick! This may also be risky for Windows 8.0 You've been warned.​


    We need some serious help and organization. This thread will be dedicated to getting Linux on these Surface RT tablets. We already have the secure boot unlock so why don't we have a full Linux install? I believe it's because all the information is strewn about the internet with incomplete information and broken links. So please keep this thread topic only on the topic of secure boot unlock and Linux booting on Surface RT.


    Ok so about the unlock, for those who are asking you can get it here, check the end of the post. To run the secure boot unlock: Move the SecureBoot zip to the desktop, unpack it, and run the script InstallPolicy.cmd as an administrator. (right click and "run as administrator"). In my case it was not working properly because I was trying to run it off a removable usb thumb drive, you should run it from the desktop. Your tablet should reboot then you should get the "secure boot debug policy applicator" install menu with a bunch of warning text. If your RT device has a removable keyboard then please use the volume keys as the "arrow keys" to select accept and confirm it by taping the "windows key" below the screen, I had to do that for my Surface RT. It now should reboot back to windows and at this point you'll want to open a CMD in administrator mode (search for CMD, right click and "run as administrator") and run the command as mentioned in the included readme file.
    Code:
     bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
    Now reboot one last time and your good.

    So now what? How do you boot? You can boot anything now by going to settings in the side bar menu, clicking "change PC settings", navigating to "general" settings, and at the bottom of that you should see an "advanced startup". Selecting "restart now" underneath "advanced startup" should bring you to a menu that will allow you to select a USB drive to boot off of. Included at the bottom is also a grub bootloader that's been created for these RT devices and a couple of other possibly related zips.

    WE NEED PEOPLE WORKING ON GETTING THE KERNEL TO BOOT! SHARE THIS TO ANYONE YOU KNOW WHO COULD HELP! I was trying to use the source for a related (but not totally the same) hardware known as the "Cardhu Development Board" from Nvidia. The source code for that can be found here, and their own released version of Ubuntu Linux for Cardhu can be found here. I couldn't get the compiled kernel from source to boot but maybe some drivers can be had from that repository.

    I DID NOT CREATE ANY OF THESE HACKS, I'm just more a hobbyist learning computers and programming who also loves Linux. Credit seems to go to users @Wack0Distractor, @black_blob, and the folks at ROL for the original hacks. Credit goes to @[email protected]@f for recovering the files, his original post is here, seems ROL had a bit of a issue and a lot was lost but their IRC is still up.
    5
    Its been a while since my last post but work is still in progress.

    What happend in the meantime?
    We were able to enable a few feature on SurfaceRT Linux:
    • Boot from UHS-I SD Cards
    • HDMI displays are working with EDID support
    • Volume keys, PowerButton, WindowsButton state can be read
    • We dumped the SPI Bootflash and generated a new signed firmware image just to find out that the Flash is OTP (one time programmable) and we can't override the OG firmware (chip replacement is difficult) :(
    • We decompiled ACPI tables especially SSDT0000.bin which contains the device specific hardware description which helped a lot to get the above-named feature to work
    • Built-in screen works. PWM brightness control also works
    LinuxOnSurfaceRT.jpeg

    we can use any rootFS which is created for ARM32 like RaspiOS:
    RaspiOsOnSurfaceRT.jpeg

    further information can be found on our GitBookPage

    A way was found to permanently disable SecureBoot on Surface RT/2 which makes booting Win10oA32 much easier.

    @frylockk19 has started porting useful Libraries and Otter Browser for Win10oA32/WinRT8.1. Otter Browser works fine. But at the moment its JIT-less and doesn't support multimedia sites.

    special thanks to everybody who contributed to Linux, WinRT, Win10oA development in the past months :)

    If you want to get involved too:
    3
    Is there a reason why we couldn't get Grub to boot something off a USB or SD card?

    As far as I know, there is no restriction that prevents Grub from booting something from storage. It can already read the file system for both the internal and external drives.

    You can load kernel, devicetree, and initrd without error on Grub2.02 from ROL.
    Just that after you issue the 'boot' command, nothing appears to happen (maybe it is failing silently in the background).
    3
    Thank for posting that @CrackTheSurface. I also have been looking into this topic again recently.

    Some more info that might help with creating a devicetree. There is a "Surface RT 2 DSDT" decompiled ACPI table on Ben's GitHub over here: https: (slash slash) gist.github.com/imbushuo/99d667424b8a6d0717584f454c543aac

    As you mentioned, you can replace BOOT.EFI with anything that is properly formed for armv7. I compiled Grub 2.04 and it booted just fine on a Surface 2. You can also boot into a UEFI shell using shell.efi from here:
    https: (slash slash)github.com/tianocore/edk2/tree/UDK2018/ShellBinPkg/UefiShell/Arm

    I have both Surface RT and Surface 2 available for testing and can maybe contribute some effort. Sorry I deleted my account a while ago and can't post links now.
    2
    There is Linux (Android) kernel available for TF502T Asus tablet which is almost the same as Surface RT and totally same as TF600T. Here you can still download it from Asus website: https://www.asus.com/us/support/Download/28/1/0/17/32/