[Nexus S Android Development] Ezekeel:
I got my Nexus S about three month ago and unlocked the bootloader a day later. Since then, I always wondered where the information about the device being (un)locked is stored. The most secure way of storing this important information would be on an additional flash chip which is only accessible during boot, while the most convenient way would be to simply store this data on the same flash device as the Android OS.

After some sniffing around, it turned out that the dmesg log from boot contains a valuable hint where this bootloader flag might be stored:

<5>[ 2.074344] 0x000000000000-0x000000200000 : "bootloader"
<5>[ 2.075017] 0x0000004c0000-0x000000600000 : "misc"
<5>[ 2.075591] 0x000000600000-0x000000e00000 : "boot"
<5>[ 2.076224] 0x000000e00000-0x000001600000 : "recovery"
<5>[ 2.076820] 0x000001600000-0x00001eb80000 : "cache"
<5>[ 2.079148] 0x00001eb80000-0x00001f900000 : "radio"
<5>[ 2.079770] 0x00001f900000-0x00001ffc0000 : "efs"

There is a suspicious gap between the 'bootloader' and the 'misc' partition from 0x000000200000-0x0000004c0000, i.e. some flash memory space which is not assigned to any partition visible to the kernel.

So I took a look at the kernel and implemented a tweak which detects such unpartitioned memory space between two subsequent partitions and additionally adds this space as an extra partition which the kernel then exposes as an extra device under /dev/mtd/.

With this modification I was able to make an image of this mysterious hidden memory space using 'nanddump' (http://xdaforums.com/showthread.php?p=17243922). Then I did re-lock the bootloader and again made an image of that region. Comparing these two images, it turns out that they differ by exactly one bit at 0x001C007C - in the locked state this bit is set to 1, in the unlocked state set to 0. I confirmed this by restoring the image of the unlocked state with 'nandwrite' and rebooting the device which then showed an unlocked bootloader.

Thus, we are able to directly change the lock state of the bootloader without using fastboot - even from the device while the Android OS is running. Unfortunately, since this method needs a modified kernel it cannot be used to unlock the bootloader of a device which is fresh ootb and running stock Android.

Changes to the kernel: http://www.pastie.org/2482856

Image of unlocked state: http://www.multiupload.com/CO6268QVNW

Image of locked state: http://www.multiupload.com/AG0ST0R3ZQ

Danger, Will Robinson! I got these images from my i9020 (UK version). If you flash these images on a different hardware model you might end up in a world of hurt. So be careful!

No further patches will be published here. I have set up a git repo for all my tweaks. Each mod has its own branch to keep the tweaks cleanly separated and one can simply pull the latest patches from the corresponding branch.

https://github.com/Ezekeel/GLaDOS-nexus-s/tree/hiddenpart

I do not accept donations and since I reached my 50GB limit of free space on SpiderOak, thanks to all of you kind people who got an account using my referral link, I could not ask for more.

Instead if you really want to donate your hard earned money to someone who deserves and needs it, consider donating to the Free Software Foundation at fsf.org: These guys are at the frontline when it comes to keeping Linux free and fighting these greedy bastards who think they are entitled to collect royalties and other fees from Linux users due to some silly patents - and if Linux falls, Android will be next.