[WIP] Secure Boot and Linux for Surface RT

[ShapeShifter499]

I've been informed that this secure boot unlock is only for Windows 8.0 and NOT 8.1. Attempting this on Windows 8.1 can result in a brick! This may also be risky for Windows 8.0 You've been warned.​

We need some serious help and organization. This thread will be dedicated to getting Linux on these Surface RT tablets. We already have the secure boot unlock so why don't we have a full Linux install? I believe it's because all the information is strewn about the internet with incomplete information and broken links. So please keep this thread topic only on the topic of secure boot unlock and Linux booting on Surface RT.


Ok so about the unlock, for those who are asking you can get it here, check the end of the post. To run the secure boot unlock: Move the SecureBoot zip to the desktop, unpack it, and run the script InstallPolicy.cmd as an administrator. (right click and "run as administrator"). In my case it was not working properly because I was trying to run it off a removable usb thumb drive, you should run it from the desktop. Your tablet should reboot then you should get the "secure boot debug policy applicator" install menu with a bunch of warning text. If your RT device has a removable keyboard then please use the volume keys as the "arrow keys" to select accept and confirm it by taping the "windows key" below the screen, I had to do that for my Surface RT. It now should reboot back to windows and at this point you'll want to open a CMD in administrator mode (search for CMD, right click and "run as administrator") and run the command as mentioned in the included readme file.

 bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on

Now reboot one last time and your good.

So now what? How do you boot? You can boot anything now by going to settings in the side bar menu, clicking "change PC settings", navigating to "general" settings, and at the bottom of that you should see an "advanced startup". Selecting "restart now" underneath "advanced startup" should bring you to a menu that will allow you to select a USB drive to boot off of. Included at the bottom is also a grub bootloader that's been created for these RT devices and a couple of other possibly related zips.

WE NEED PEOPLE WORKING ON GETTING THE KERNEL TO BOOT! SHARE THIS TO ANYONE YOU KNOW WHO COULD HELP! I was trying to use the source for a related (but not totally the same) hardware known as the "Cardhu Development Board" from Nvidia. The source code for that can be found here, and their own released version of Ubuntu Linux for Cardhu can be found here. I couldn't get the compiled kernel from source to boot but maybe some drivers can be had from that repository.

I DID NOT CREATE ANY OF THESE HACKS, I'm just more a hobbyist learning computers and programming who also loves Linux. Credit seems to go to users @Wack0Distractor, @black_blob, and the folks at ROL for the original hacks. Credit goes to @[email protected]@f for recovering the files, his original post is here, seems ROL had a bit of a issue and a lot was lost but their IRC is still up.

 

[ShapeShifter499]

List of possibly related and useful information

• Secure Boot Golden Keys: https://web.archive.org/web/20170604013028/https://rol.im/securegoldenkeyboot/

Below is a index of posts in this thread that should be of interest.

• Page 9 Post #85 -- Getting into APX mode (AKA RCM mode): https://forum.xda-developers.com/showpost.php?p=77286176&postcount=85

 

[ShapeShifter499]

Reserved #2

 

[XDA-00]

How do we use the GRUB, ci_tools_arm & EFIESP??

I have Windows RT 8.1

 

[ShapeShifter499]

How do we use the GRUB, ci_tools_arm & EFIESP??

I have Windows RT 8.1

My Surface RT was a used tablet and it came with Windows 8.0 afaik, so everything just worked. I actually don't know what "ci_tools_arm" are but I do know with EFIESP and GRUB you just unzip the contents of just one (take your pick) to the root of a USB drive and they will boot whatever you configure them to boot. "EFIESP" can be used to boot the Windows IOT from https://forum.xda-developers.com/wi...ows-phone-windows-10-mobile-surface-t3365743/ while GRUB can be used to boot ANYTHING, even Windows, so long as you have the proper kernel or files. If you try to boot GRUB you'll just get the GRUB loader screen and the attachable keyboard doesn't work in GRUB, a USB keyboard might though. Right now we need someone to compile a working kernel with drivers for the RT line of devices.

EDIT: Booting stuff requires that you unlocked "secure boot" as mentioned above.

 

[Qiangong2]

Reserved

You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Sent from my Q5 using XDA Free mobile app

 

[2390]

Is there any way to revert to RT 8 from 8.1?

 

[Qiangong2]

Is there any way to revert to RT 8 from 8.1?

Nope

Sent from my Q5 using XDA Free mobile app

 

[ShapeShifter499]

You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Sent from my Q5 using XDA Free mobile app

Added warning to op. Thank you for letting me know.

 

[Sam Za Nemesis]

You are going to get people bricked with this method.

DO NOT under any circumstance use this guide if you are on RT 8.1. It will end up in crashing your device and possibly even bricking it (that has been reported). RT 8.1 automatically relocks the secure boot and if you try and install the EFI, it will brick your device.

DO NOT follow this guide unless you are on RT 8.0. Even if you are on RT 8.0, it is still risky.

Quit the fearmongering, MSFT's security update has already been worked around

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

What do you mean by this

 

[Qiangong2]

Quit the fearmongering, MSFT's security update has already been worked around

The new dev tool, when run together with unlocking secure boot, bricks your device.

What do you mean by this

The ARM processor is configured to the NT kernel. Unlike most which are configured to a Unix kernel.

Sent from my Q5 using XDA Free mobile app

 

[ShapeShifter499]

The kernel for RT is structured differently than a standard linux ARM kernel. That's one of the reasons why linux will most likely not happen for RT devices.

Isn't the device not loading any kernel when GRUB is loaded on a Surface RT? I thought when GRUB was proven to load, that any kernel would load on the Tegra processor, I've seen documentation online where most of the Tegra code (from Nvidia or from Open Source) was ported into the latest Linux kernel.

 

[Qiangong2]

Isn't the device not loading any kernel when GRUB is loaded on a Surface RT? I thought when GRUB was proven to load, that any kernel would load on the Tegra processor, I've seen documentation online where most of the Tegra code (from Nvidia or from Open Source) was ported into the latest Linux kernel.

We could just adapt a Linux kernel (like with Android) if the RT kernel was a Linux kernel, but it isn't. RT blocks different kernels from being loaded (like a locked bootloader, just more complex)

Sent from my Q5 using XDA Free mobile app

 

[ShapeShifter499]

We could just adapt a Linux kernel (like with Android) if the RT kernel was a Linux kernel, but it isn't. RT blocks different kernels from being loaded (like a locked bootloader, just more complex)

Sent from my Q5 using XDA Free mobile app

Is there any documentation stating this? Is the RT kernel active when we boot up GRUB?

 

[[email protected]@f]

There is Linux (Android) kernel available for TF502T Asus tablet which is almost the same as Surface RT and totally same as TF600T. Here you can still download it from Asus website: https://www.asus.com/us/support/Download/28/1/0/17/32/

 

[ShapeShifter499]

There is Linux (Android) kernel available for TF502T Asus tablet which is almost the same as Surface RT and totally same as TF600T. Here you can still download it from Asus website: https://www.asus.com/us/support/Download/28/1/0/17/32/

I could give it a shot later, sure. Thanks for the information.

 

[Qiangong2]

Is there any documentation stating this? Is the RT kernel active when we boot up GRUB?

We have restricted access (basically cannot do anything), but yes. It is active.

Sent from my Q5 using XDA Free mobile app

 

[ShapeShifter499]

We have restricted access (basically cannot do anything), but yes. It is active.

Sent from my Q5 using XDA Free mobile app

I'm guessing there is no known button combo to boot up some sort of debug mode, like the fastboot mode on android devices.

Has anyone seen if there are any JTAG or serial connections somewhere on the board?

 

[Qiangong2]

I'm guessing there is no known button combo to boot up some sort of debug mode, like the fastboot mode on android devices.

Has anyone seen if there are any JTAG or serial connections somewhere on the board?

Not as far as I know

Sent from my Q5 using XDA Free mobile app

 

[ShapeShifter499]

Not as far as I know

Sent from my Q5 using XDA Free mobile app

Microsoft has really screwed this tablet then, I'm out of ideas for now. For anyone coming across this, if you have ideas or possible solutions please share them.