yashsingh1/xdaforums huggingface dataset:
[Barnes & Noble Nook Tablet] The_Joe:
So your goal is to use a hardware mod to make the NT mod able the EXACT SAME WAY as the NC via the SD card port?

Could you possibly post a pic of where the scary soldering take place?

Im more asking because a lot of use avid noobish readers are having trouble keeping up.

So now that you have a bypass set up, what is your next step, where are you at on the timeline?

I hope this doesnt sound like the obnoxious whining of everyone asking for ICS, I just am trying to understand.
[Barnes & Noble Nook Tablet] AdamOutler:
Lower right corner. I don't have a better picture at my disposal.
[Barnes & Noble Nook Tablet] alloydwhitlock:
*twitch*

That statement has haunted Linux users for years.

Regardless, I appreciate the work that you have done on the UART solution and feel that it provides a good method of accessing the boot structure for users who want to have two entirely separate environments running. Following this thread, I've enjoyed reading about the progress and work you put into it. It reminds me of modding the original Xbox, in a good way.

Some people reading this thread might confuse being able to boot off the SD on the Nook Color as being similar to having a chip installed, though this is quite a different beast in the way they actually approach the boot process. nemith's method, from appearance, is similar to how the Nook Color was exploited. I wanted to point that out now since I can see those questions coming up.
[Barnes & Noble Nook Tablet] AdamOutler:
Probly a Generic IROM. Nokia is releasing a device soon with unknown specs. It's likely that the Output somewhere is selected by a boot mode of some kind

I need someone with viewmem to type this into a termainal to get the PUBLIC_SAR_RAM_1_FREE memory value as well as CONTROL_STATUS. If you have an SSHd program on your device this will be alot easier... Just use any market SSHd app and use putty or an equal ssh program on your desktop.. then you can copy-pasta this information directly into a [ code] block here.

su
echo "PUBLIC_SAR_RAM_1_FREE=`viewmem 0x4A326A0C |hexdump`"
echo "PUBLIC_SW_BOOT_CFG_ADDR= `viewmem 0x4A326A00 0x4 |hexdump`"
echo "CONTROL_STATUS=`viewmem 0x4A0022C4 |hexdump`"

This should give us a pretty good idea of how the thing boots.
[Barnes & Noble Nook Tablet] Indirect:
PUBLIC_SAR_RAM_1_FREE=0000000 6572 6f62
0000004
PUBLIC_SW_BOOT_CFG_ADDR= *
CONTROL_STATUS=0000000 0a96 0000
0000004
[Barnes & Noble Nook Tablet] AdamOutler:
According to the control status.. running it through the inteperator on page 3450, I think this is correct.

the boot SYS BOOT Configuration is 100000. Boot from MMC2.. this is the internal SDCard i think.

There is a note saying that this is only possible on GP devices. GP devices use a memory jump at IROM stage 1. This is a potential exploitation point.. It might be possible to load something at a memory location.... "6572 6f62".. We need more research but its difficult without a device.
[Barnes & Noble Nook Tablet] AdamOutler:
Please do a

viewmem 0x65726f00 0xFFFF >PossibleBoot.bin

then post the PossibleBoot.bin file.

IF that does not work, try

viewmem 0x65726f62 0xFFFF >PossibleBoot.bin
[Barnes & Noble Nook Tablet] pokey9000:
FWIW that control status decodes to a SYS_BOOT[5:0] of 0b010110 for a boot order of USB->UART->MMC1->MMC2, just like I posted earlier.
[Barnes & Noble Nook Tablet] AdamOutler:
I'm not convinced on that.

The word is 0a96 0000

byte 0 is 0a, byte 1 is 96. So, from what I'm seeing CONTROL_STATUS is a word which reads 31--0. the binary is backwards. the word 0A96 must be reversed. 0A is least significant in this word and 96 is the most significant. So the 8bits we are looking at is 0x0A... 0:7 00000101. Or am I wrong?
[Barnes & Noble Nook Tablet] pokey9000:
No sure about the utility you were using to read that register, but the NT definitely boots USB before MMC2, so MMC2 first is implausible. You can see for yourself by watching for the OMAP USB boot device on every cold reset.

Maybe it prints in 16-bit word groupings like hexdump does by default?
[Barnes & Noble Nook Tablet] AdamOutler:
yes. the viewmem dumps memory out in bytes. |hexdump takes those bytes and turns them into hex.
[Barnes & Noble Nook Tablet] AdamOutler:
If anyone wishes to chat, you can find me in #nook-tablet on freenode.net

http://webchat.freenode.net/?channels=#nook-tablet
[Barnes & Noble Nook Tablet] gordon1hd1:
Hey AdamOutler got an interesting observation for you:

http://xdaforums.com/showpost.php?p=20145429&postcount=7

From what that user said, it seem if we somehow put bad SD card into the NT, the NT will hang because it is trying to boot a signed image from the SD card, but since SD card is bad, it can't read anything from it, so the boot process is locked. (i don't have a spare sd card on hand to test the user's observation)

I think this is pretty straightforward, but what got me intrigued is the 8 failed boot, fail safe reset procedure.

I am assuming that if the user trying to boot 8 time off a bad SD card, it will trigger the reset process that will bypass sd card image loading (this is an assumption on my part), if so then the failsafe boot up process should go directly to the eMMc.

So here is 2 interesting question, first is the fail safe image signed. Normally we would assume that it is, but since the fail safe process is not normal, maybe there is a chance (albit small one) that the fail safe image is not signed, and we can just override it to have the NT boot off a customized fail safe image.

Second, what happen if we load the failsafe image onto the sd card, will it run? If so what does it do?
[Barnes & Noble Nook Tablet] Zippy Dufus:
You are way beyond what I understand, but both ways appear to work on a Linux box.

sh-4.1# ls -l vmlinuz-2.6.35.14-100.fc14.x86_64
-rwxr-xr-x. 1 root root 3787776 Oct 21 14:54 vmlinuz-2.6.35.14-100.fc14.x86_64
sh-4.1# IMAGE1=vmlinuz-2.6.35.14-100.fc14.x86_64
sh-4.1# size=`ls -la $IMAGE1 | awk -F' ' '{ printf $5}'`
sh-4.1# echo $size
3787776
sh-4.1# size=`ls -la $IMAGE1 | awk '{ printf $5}'`
sh-4.1# echo $size
3787776

I'm watching these threads with great interest and quietly cheering you all on!
[Barnes & Noble Nook Tablet] AdamOutler:
Ok, guys, I've been hearing about e-fused, locked bootloaders... I think I may have good news.. I cannot find any reference to processor support of locking the bootloader.

What this means?

It should be possible to compile a new x-loader, which will launch any uboot or kernel we would like.

What recovery is on this device? I still have not yet got one. It will be a few days. When you "adb reboot recovery" what happens?

I'm a bit confused on the partitions on this device.. Let me state my understanding of boot sequence and someone please tell me what I'm doing wrong..

The processor initiates the Internal ROM. The IROM then reads partition 1 which is the Partition Information Table. The IROM uses the PIT to find the X-Loader. The X-loader loads the bootloader partition. The bootloader partition (possibly uboot??) decides if it will launch recovery or normal boot. If Normal boot is selected... and.. I'm lost..

The partition naming is getting me..

here's the partition names as stated in the above post and a small description

EFI PART I'm unsure of what is on this partition. it is a Partition Information Table.

xloader A diagnostic primitive bootloader which contains a small amount of debugging data. Responsible for initializing a portion of the system and loading the next partition

bootloader -unknown

recovery -Android system recovery? Recovery2e? Recovery3E? Uboot?

boot --unknown

rom --unknown

boot data Boot parameters, kernel parmeters, images displayed during boot sequence

factory -unknown possibly nook system recovery

system /system folder contains all things Android, nook, and some system apps.

cache /Android cache for prefetching and cache

media mountpoint is unknown. this partition is likely where books are stored, Possibly /sdcard?

user data /data/ Apps and databases are stored on user data.

Someone please clear this up for me.
[Barnes & Noble Nook Tablet] Loglud:
Wooot something i can act like i know what im talking about. OK so lets start with adb reboot recovery. This boots up and says please see your local barns and noble store to get the devices repaired or something like that, however this may just be the recovery that they loaded on the devices (meaning the recovery is more of a message).

Secondly, I am so glad that someone besides me cannot find anything about the e-fuse, the most i can find is the white paper on the M-Shield which seemed to me to be something that could lock the boot loader through a 128bit hardware key, though i have had trouble seeing where to check if it was locked.

Third the partitions are not defined in the EFI block, which is strange. When i was working on the partitions i think i remeber the device mmcblk0 only having 1 partition pointer (to the first part aka mmcblk0p1), and i assumed that the end of the partition pointed to the next partition. I have no clue if this is how it is done, however i do know that when you

fdisk -l /dev/block/mmcblk0

it only reads one paritition.
[Barnes & Noble Nook Tablet] AdamOutler:
if you get a chance.. try grabbing a custom kernel (called zImage) from a Kindle Fire. Put it on your sdcard. Get the partition number of the recovery, then do this..

dd if=/dev/block/mmcRECOVERYBLOCK of=/path_to_sdcard/backupRECOVERY.img

where /path_to_sdcard/ is /sdcard or /mnt/sdcard or whatever they call it.

then copy backupRECOVERY.IMG off your sdcard to your computer.

dd if=/path_to_sdcard/zImage of=/dev/block/mmcRECOVERYBLOCK

and /dev/block/mmcRECOVERYBLOCK is whatever the block is that the system recovery is stored... Someone help out here and let me know what this is..

This should replace the adb reboot recovery with a usable recovery or second kernel. I'm not sure how kindle works...

If this does not work, then oh well, you may need to replace the recovery back.. It does not appear to be used anyway.
[Barnes & Noble Nook Tablet] Loglud:
I will try this when i get home. I can also make a random kernel from source if you want that will have a different name, so that when you do the info it will look strange.
[Barnes & Noble Nook Tablet] AdamOutler:
ok. so what happens when you try to boot a kernel which you put on the device? Does it boot loop or what?

Has anyone got UART on this device? I ask because when I checked out the boot loaders it appears UART is configured to output on tty01.. which I am unfamiliar with. This may need to be changed.
[Barnes & Noble Nook Tablet] Loglud:
So adam, one of the problems that we have had is that as you may notice alot of developers dropped this product when pokey said that it had a locked bootloader (though i question whether it is still). There are maybe 2 of us that know how to get into the UART, and of the two, i'm not sure if either of us has tried. The tty01 could possibly be linked to a USB adapter. i have done alot of reading on the devices, and it seems that the communication has two sides to this one. One being from the OMAP44xx to a third party USB mediator, and one back to the OMAP44xx. I would be curious to see if there is a reason that they are transmitting out on the TTY01 because of it interfacing with the USB adapter, and not the native serial on the OMAP.

As for the kernel, to be honest I'm not sure who all has tried.

Like i said i will be home tonight to help out and be a Ginnie Pig.
[Barnes & Noble Nook Tablet] jtbnet:
From http://nookdevs.com/index.php?title=Portal:NookTablet&action=history it llooks like fattire setup this page and most of it's content... on here there is a boot log/file dump that seems to have been done from the uart/serial port so might want to ask fattire where this came from... this boot log is where I found the most promising info on the Wireless chip having it's driver init'd so would seem Bluetooth is present based on the chip... don't know what antenna pins are connected though....
[Barnes & Noble Nook Tablet] Montisaquadeis:
Adam it would be easy enough for B&N techs to carry around 2 sdcards. Their signed card and a copy of the special sdcard so that they can easy check to see if if you have voided your warranty by slipping in the first card without even telling you thats what they are doing.
[Barnes & Noble Nook Tablet] AdamOutler:
Don't be rediculous. The pure logistics of deploying that to every Barnes and nobel retail store to catch a few who are not even disturbing normal operation of the device would be a pure waste of money.
[Barnes & Noble Nook Tablet] The_Joe:
And why bother?

I hardware mod my Nt and then decide to take it back because Im a D-bag.

A: My tablet is bricked (An extra SD card is not going to do them any good)

B: My tablet works, so I keep my SD card, next user buys it, takes it home, and may not ever know that it was modded.

That said, we want to work WITH the company's, not against them. If you start rooting or romming, any damage that happens as a result should be on YOU!!
[Barnes & Noble Nook Tablet] AdamOutler:
There are plenty of reasons to return a device other than what you suggest. For example, my device has a single bright pixel near the center of the screen. I personally will live with it. However this is a manufacturer defect and fully justifiable return reason.
[Barnes & Noble Nook Tablet] nemith:
No UART. USB cable was just plugged in cause i was doing some adb work.

---------- Post added at 08:33 AM ---------- Previous post was at 08:29 AM ----------

Actually I am going to start working directly on CM9. Why even bother with CM7. OMAP4 is _very_ supported in cm9 (graphics chip may be the only hurdle)

But yes. This should all be without a computer or any special adapters. I will say being an Arduino hacker myself the hack by Adam is/was very cool (bonus points for using custom microcontrollers)

---------- Post added at 08:36 AM ---------- Previous post was at 08:33 AM ----------

Um... Unless there is a new batch of tablets the 2nduboot should work on 100% of the tablets and can boot from the SDCard without any modifications. Similar to what we did with the NookColor we should be able to give people options if they want to install to EMMC or boot from SD.

That all seems completely doable with just the 2nduboot stuff.
[Barnes & Noble Nook Tablet] Indirect:
I was about to say, why would we be using CM7 when the issue we currently have is no soft buttons which is what we need and is directly supported in CM9 lol.
[Barnes & Noble Nook Tablet] AdamOutler:
I'm working on a modchip to null out security. it allows you to boot even an invalid kernel (if you want) and lay out the ramdisk on the sdcard just like a normal computer... no need for a compressed and dedicated kernel+ramdisk. I'm developing directly from SDCard.
[Barnes & Noble Nook Tablet] Kuzma30:
How about dd image from SDcard, that is using in 2nduboot method? Anybody can share it?
[Barnes & Noble Nook Tablet] WnG88:
Good luck and thanks to all the developers! Can't wait to see how this develops! Hopefully you guys can get something in place before Jan 22 or whatever the date is on nookreward.com
[Barnes & Noble Nook Tablet] nemith:
Give it to bauwks. Thats was the hurdle. Now pretty much anyone can make a bootable SD card.
[Barnes & Noble Nook Tablet] The_Joe:
This is.... still moderately shocking and difficult to grasp.

So, you still use the word "Should" and then you say that the graphics chip might be troublesome. Is there a proof of concept that I can read and not understand?
[Barnes & Noble Nook Tablet] Loglud:
Absolutely without a doubt give it to bauwks.

I wanted to give you non-techies/non-devs an idea of what he has taken advantage of. Like I have always said I am a firm believer in open source and transparency.

bauwks method uses the flashing_boot.img to his advantage, and since it is not checked by security, effectively he has made an insecure uboot. While this is not an unlocked bootloader, it is a way to get around the security, and enable custom recovery and higher level processes to be run.

I have been looking at this line of code for a long time, and as im sure hkvc and bauwks saw it is a large (but 100% necessary) flaw:

Without this line of code, it would be impossible for any one but the factory whom could JTAG flash (but since it is secured, most likely they also have to make a flashing_boot.img).

bauwks great job on the coding and implementation of this flaw. You, adam, hkvc and nemith have pushed this community to a level beyond what Indirect and I thought possable. Thank you so much.

I will be updating my guides to teach custom rom making and kernel making.

Again thanks all.
[Barnes & Noble Nook Tablet] nemith:
Actually same gfx chipset as the Galaxy Nexus. We should be good.
[Barnes & Noble Nook Tablet] Loglud:
Yeah i was gonna say that it uses the same binaries from the GNex. This really shouldn't be that hard of a port (though I have been wrong before)
[Barnes & Noble Nook Tablet] Indirect:
SHHHH!!!! shush before nemith, adam, and bauwks knows we appreciate them! >.>
[Barnes & Noble Nook Tablet] CelticWebSolutions:
Crikey don't tell them that, just keep the cage out in the yard and continue to throw them scraps and bones.

lol

Thanks go to everyone involved though, everybody is doing / has done their bit and it's showing in the leaps and bounds that are being made towards getting a new rom to take advantage of the NT as it should be.
[Barnes & Noble Nook Tablet] Maggot226:
So from what i understand, when i get home(i'm at school on my nt :p), i'll be able to make an sd card that boots cm9, without the need for a hardware mod? Oh my god, i cannot tell you all how happy i am! Thank you so much, whoever did this, your name will go down in history :D
[Barnes & Noble Nook Tablet] Montisaquadeis:
Slow down the sdcard has to be made first and this is going to take some time to port CM9 to our device so you cant just make the card right now to boot into what doesnt exist yet.
[Barnes & Noble Nook Tablet] fattire:
This is a troll, right?

It has to be.
[Barnes & Noble Nook Tablet] LiuAnshan:
Must be.

Nexus S 4G 4.0.3
[Barnes & Noble Nook Tablet] succulent:
I shouldn't brought this up...
[Barnes & Noble Nook Tablet] patruns:
My response is in the link as well.....
[Barnes & Noble Nook Tablet] Indirect:
Lol

Sent aboard the Evo Express
[Barnes & Noble Nook Tablet] succulent:
If people are stupid enough to buy their card so be it.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
quite an underhanded way of getting other people to do you work for you. Like the way the rules state it MUST be all be open source and documented with source on github so they can immediately start selling somebody elses work!

Oh well, means to an end I guess. You should all work together and split the 5k between you. I'm sure you could find a use for a few $

---------- Post added at 08:40 PM ---------- Previous post was at 08:37 PM ----------

I don't think it's quite a case of being stupid enough, its' just the easy way out for many. Get what you want and don't ahev to do anything for it, plus people are always afraid of doing something wrong and killing their Nook so they often consider things like that an investment. Was looking and the 5k they are offering, is that on top of the donations being given? Or are they getting other people to pay to get them their sdcard setup and then charge the people who donated to have their card?

I'm curious, will the new hack version HAVE to run from sd card for everything or will it be able swap to internal memory if we so wished?

Is there much of a speed hit running completely from SDcard?
[Barnes & Noble Nook Tablet] firephoto:
What is wrong with it being open source and documented publicly?
[Barnes & Noble Nook Tablet] atomicpookavirus:
Doesn't seem underhanded at all to me. Part of the philosophy behind the gpl is having the right to sell the code for profit. Offering bounties like this is a great way to spur open source development. There's nothing stopping you or me from selling "sd mod cards" on ebay or craigslist at profit.
[Barnes & Noble Nook Tablet] Indirect:
I have the feeling this guy is the one who's selling the SDcards...
[Barnes & Noble Nook Tablet] succulent:
It'll be like the NC. You install CM9 into your NT system from sdcard. It's a one time process and you remove the sdcard.

--

Even if the devs here don't make a bootable CM* card, they will have their devs to leech off the work by the devs here.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
nothing at all. im all up for it. i just slightly disagree with them making money off other peoples hard work.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
yes but i still dont quite agree with how theyre doing it.

just my personal view of it.
[Barnes & Noble Nook Tablet] AdamOutler:
Everything about the GPL stops you from selling code for profit. The open source model allows you to sell services. You profit by selling a product or service not the code. The code is freely available. Eg.. my work on UnBrickable Mod is totally open source. Software is freely available. I sell my services to modify supported devices at $30 each because I have the skill, tools, and hardware required.

A couple of things to consider... Anyone who purchases a SDCard on EBay for more than a Buck more than the price of the card is getting ripped off. Since the contents are open source you must provide your source code to anyone who requests it at the price of transport media. If you're selling sdcards and you aren't a developer, your source is the content of the sdcard in the first place..

You should ask yourself is it worth it? Can I come up with something more productive than copy and pasting onto an sdcard? Just about anyone can do that. The service is worth $1
[Barnes & Noble Nook Tablet] atomicpookavirus:
:eek:

:cool:

:confused:

:p

Seriously no intention of doing that myself. Just trying to clarify a common misconception that anything gpl HAS to be free like beer. It can be free like beer or can be expensive like beer. That is part of the underlying philospohy.

/edit/

Adam summed it it up very nicely!
[Barnes & Noble Nook Tablet] nookabee:
Wow! I'm really impressed by you guys for cracking this! Great work!
[Barnes & Noble Nook Tablet] Maggot226:
Unfortunately no? Someone should update the OP with what has happened in layman's terms, because i just got my hopes way up, lol.
[Barnes & Noble Nook Tablet] downsay:
What it looks like to me is yes it is cracked, but we need to give the devs time to develop. Im guessing most devs interested in making roms and getting into full mod mode on the nook tablet don't even have as much running as nemith currently does.

Probably a few weeks until that point is reached.

I could certainly be wrong, but that would be my guess.
[Barnes & Noble Nook Tablet] cfoesch:
WTF Adam? Are you confused?

Honestly, you may be a really awesome hardware guy, but seriously, you do not seem to understand the law or the GPL...
[Barnes & Noble Nook Tablet] atomicpookavirus:
The GPL does stop you from selling code for profit because noone will buy it. It does not FORBID you from selling code for profit.
[Barnes & Noble Nook Tablet] nookabee:
I bet quite a lot of people are willing to pay for it packaged neatly, not wanting to "mess around" themselves. Most of us here will not hesitate to go ahead and install ourselves, but many more will be happy to part with a few bucks and just pop a SD card in their NT...
[Barnes & Noble Nook Tablet] AdamOutler:
That's a compiled binary. Code must be available upon request.
[Barnes & Noble Nook Tablet] WnG88:
I'd still be all for the devs here figuring out how to get the money out of the the reward site even if the site ends up selling the sd card for profit. If people want to pay for a card that does it all for you its up to them. I think it'd be the same as someone asking me to reinstall their OS on their computer for them and me charging them some amount. A lot of folks may not be comfortable making the bootable sdcard or who knows what other reason. But at least this way the devs can get some money for the work that has been done and share it amongst themselves for all the effort that has been put into cracking this thing.

I'll not get off topic anymore. Sorry mods.