yashsingh1/xdaforums huggingface dataset:
[Barnes & Noble Nook Tablet] DeanGibson:
I wasn't clear

I wasn't clear. I tried two cases:

1. When I placed an unaltered MLO, u-boot.bin, and flashable_boot.img on the SDcard. In that case booting used the MLO, u-boot.bin, kernel, and ramdisk from the SDcard. Only problem was, the init.rc and init-omap.rc (exact name escapes me) file from the ramdisk, mount partitions on the internal memory, so while the kernel (and prior elements) booted from the SD card (and I'm sure logged that they booted from the SDcard), when init ran, the remaining partitions were mounted on the internal memory.

2. When I altered the ramdisk (and replaced it within flashing_boot.img), that case started to boot, aborted, and then started over booting the MLO, u-boot.bin, kernel, and ramdisk from the internal memory.

I used the second case to prove to myself that I couldn't modify the ramdisk and even get the SDcard kernel to load.

I used the first case to seen that an unaltered MLO, u-boot.bin, kernel, and ramdisk on the SDcard do indeed boot from the SDcard, as you note. The question is, what happens after the kernel has completed initialization and passes control to init.

I may have missed it, but I saw nothing in your UART output that indicated that init was processing your acclaim_update.zip, and not going to the internal memory partitions. I have no doubt that your kernel booted from the SDcard.

Now, if you have found (or find later) a way for a custom script to get control without accessing the internal memory, I know more than a few people that would be very, very interested. In particular, repartitioning of the internal memory would make a lot of people very happy.
[Barnes & Noble Nook Tablet] AdamOutler:
I've been searching the source code heavily for answers and I'm absolutely sure the u-boot source is using "omap4430sdp" for configurations. I found this when searching for "flashing_boot".. the .img file

adam@Adam-Desktop:~/Desktop/NookTab/SOURCE-Nook_tablet_1-4-1$ grep -r "flashing_boot" ./
grep: warning: ./android/alsa-lib/include/alsa: recursive directory loop
./u-boot/board/omap4430sdp/mmc.c:	setenv ("bootcmd", "setenv setbootargs setenv bootargs ${sdbootargs}; run setbootargs; mmcinit 0; fatload mmc 0:1 0x81000000 flashing_boot.img; booti 0x81000000");

I searched a bit more into it and this looks like "if the device boots from sdcard, use these bootcommands".. these are very easy to understand

case BOOT_SD:
setenv ("bootcmd", "setenv setbootargs setenv bootargs ${sdbootargs}; run setbootargs; mmcinit 0; fatload mmc 0:1 0x81000000 flashing_boot.img; booti 0x81000000");
setenv ("altbootcmd", "run bootcmd"); // for sd boot altbootcmd is the same as bootcmd
break;

It would be very helpful if someone could take a gander at some of the source and figure out what is required to make the device use acclaim_update.zip... I can boot MLO, uboot.bin, and a kernel with the name "flashing_boot.img"... however it would appear that it stops there and won't continue. I think there must be a way to get acclaim_update on there.

For some reason flashing_boot.img is working, and it will load android only, the recovery.img is not working and it will boot to the "return to manufacturer" screen, the same as "adb reboot recovery"
[Barnes & Noble Nook Tablet] hkvc:
Potentially working Alternate Userspace in uSD using 2ndihkvc

Hi All,

I have updated my 2ndihkvc package a bit more and now you can boot into a ALTERNATE Android user space in uSD (NOTE: Userspace only and not kernel - locked bootloader doesn't allow alternate kernel).

For this you require to copy your required android /system and /data partitions into a MicroSD card in its 2nd and 3rd partitions which should be ext4 (specified in the init.omap4430.rc file in 2ndihkvc directory).

NOTE: Best way of getting a working /system and /data partitions is to ==> After rooting your Nook and removing all unwanted Apps/Junk, make a copy of the /system partition from eMMC to uSD. Same for /data/partition. Then you can copy what ever additional applications you want in this uSD based Android /system/app or /data/app partition. Thus you can have different sets of Android user space in different uSD cards.

Follow the instructions in INSTALL file for experimenting this on your rooted NookTab. BUT REMEMBER IT IS STILL EXPERIMENTAL. ALSO as a SAFETY FEATURE, as of now it will boot into this ALTERNATE MODE (in uSD) only when the current HOUR is specified in the start2ndihkvc.sh file appropriately. Otherwise it tries to boot into the your normal Andorid system in eMMC. This should hopefull CATCH any mistake, BUT THIS IS NOT GUARENTEED AND THIS IS A DANGEROUS THING TO EXPERIMENT, UNLESS YOU KNOW WHAT YOU ARE DOING.

NOTE: One time it did reboot from my alternate android system, I haven't debugged this yet, as it has not occured after it (Well I have tried only once more) so cann't say one way or the other yet. But definitely, there are some corner cases.

NOTE: If something gets messed up or if something is different or even if there is some corner case in my code, which I haven't handled yet, it may MESS UP your NOOK TAB so EXPERIMENT WITH THIS only if you know how to recover on your own, provided the NOOKTAB is recoverable (90% should be, but NO GAURENTEE).

Now the BRAVE HEARTS can experiment and Enjoy a alternate Andorid system in uSD card.

NOTE: With this one should be able to boot into any Custom ROM after suitable updation of the scripts in my zip file, as well as by copying their /system and /data/ partitions into uSD 2nd and 3rd partitions. AS long AS that Custom ROM doesn't have any specific kernel requirements.
[Barnes & Noble Nook Tablet] hkvc:
Hi Adamoutler,

Because it is a secure bootloader chain, less likely that we can use a alternate kernel etc with the NookTabs normal boot sequence, doesn't matter whether it picks up the image from eMMC or uSD.

HOWEVER because you have UART access, and because they have forgotten to disable uboot prompt, the best option to BREAK the SECURE CHAIN will be to copy a ALTERNATE uboot (for OMAP development board which is near to NOOK TAB) which doesn't do any secure boot check and then we should be able to boot what ever kernel we want.

NOTE: Also have you tried unziping the factory.zip file into a newly formated uSD card and see if it fully boots into it and restore the NookTab to factory state, which is good enough if the factory.zip is from 1.40 because then one can always use zergRush to gain root access back and continue to experiment or what ever.
[Barnes & Noble Nook Tablet] AdamOutler:
My focus is a restoration option. We can't really be free to do anything unless we know how to undo it.

unrelated, funny line of code:

*update_image_location = 0xDEADBEEF;

*snicker*
[Barnes & Noble Nook Tablet] hkvc:
Hi Adamoutler,

May be I am missing something here. If unziping the factory.zip into a uSD card and booting into it will restore the factory state of NookTab (I haven't cross checked it, but logically seems like it will work, unless they have put check in factory.zip boot chain which specifically depends on eMMC having valid things in it), isn't it a proper restoration???

Or you mean something else with restoration ???
[Barnes & Noble Nook Tablet] AdamOutler:
It does not work yet. It *****es about the data partition and kicks out of recovery. I'm still working on it.
[Barnes & Noble Nook Tablet] AdamOutler:
Here's a good tidbit of information:

I thought I had done something before I went to sleep, turns out I just left it on. I'm theorizing the device won't boot unless it meets VFSOC.. A "Sleeping death" occurs when the device becomes low on power. I theorize that this is because when the device is in standby, it does not check its fuel gauge for shutdown and allows itself to go below the limit of turn-on.

Here's the values which control power-on

fullcap0=0x2067 VFSOC=0x08f0 remcap=0x02e5

fullcap0=battery full capacity

VFSOC= Voltage for? System On a Chip- the value required for the device to operate

remcap= remaining capacity

My device battery is way low.. I'm charging on normal USB so it's trickling up at a rate of about 0x0010 per 2 minutes. At this rate, the device will be ready to use in aproximately 1.5 hours... And until then i'm sure nothing will show on the screen.

This may or may not apply to using the Barnes and Nobel cable. I do not have one available though.

So, if you ever come across a situation where the device won't turn on even after being plugged in, leave it plugged in for a few hours. It could have a case of the "sleeping death".

Also, I'm able to verify that the device... even when totally powered off will charge on a standard USB cable.
[Barnes & Noble Nook Tablet] hkvc:
Hi AdamOutler,

Thanks for the clarification. So even if we unzip the factory.zip into a uSD card, it is still checking the /data partition for some things/files if I get you correctly.

To be on safe side is the reason why I created my scripts and inturn updated the partition entries in init.omap4430.rc with in 2ndihkvc such that it mounts the /system and /data partition from uSD rather than eMMC, so if they are purely working in user space, less likely that they will mess up the eMMC.
[Barnes & Noble Nook Tablet] sungod88:
So I read through this thread and I don't want to sound like a tard but I am completley confused. I see that you go to the recovery, So I am assuming that whats happening is you are trying to have the ability to flash a new rom?

Also why have people been saying catch up with the nook tablet? I don't understand that. I'm sorry for my confusion but I have no experience with android programing.
[Barnes & Noble Nook Tablet] AdamOutler:
We can flash parts of the ROM all day long. If we flash other parts, the device will die completely. we need to figure out how to totally boot the device from SDCard and recover it before we go screwing with the stock partitions.

What device needs to catch up with the nook tablet? We're playing catch up here. We have no way to run Ice Cream Sandwich until we can get a custom Linux3.0+ kernel operational.
[Barnes & Noble Nook Tablet] 150pilot:
Or could it be "State of Charge"?
[Barnes & Noble Nook Tablet] AdamOutler:
Sure. But why would a charging state require several bits of information? SOC is an acronym used in several places in the boot sequence.
[Barnes & Noble Nook Tablet] sungod88:
Sorry that was meant to mean What is the nook catching up to. I saw the kindle fire but I dont see why I thought personally the Nook is a lot better.

I wish I could help with the development but I really would just screw it up. This is a awesome step though. I bow to your dev-fu.
[Barnes & Noble Nook Tablet] AdamOutler:
I'm sorry. We've washed away your post with recovery, battery and other questions. You should start a new thread in the development section about your init.
[Barnes & Noble Nook Tablet] rjin9673:
He has one in General, but maybe the Mod can move it to Development.
[Barnes & Noble Nook Tablet] AdamOutler:
I changed a byte("battery type" to "batTery type" in the u-boot.bin and received this

Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
[ERROR] [SEC_ENTRY] Call to Secure HAL failed!
Could not read bootloader!
X-Loader hangs

I changed it back and the device booted fine. This at least means modification date has no impact on the secure checks.

I tried the same thing with a random byte at the end of the u-boot.bin. There is no chance of modification to the u-boot.bin. It would require a signature, or an open-ended xLoader.

I'll be testing the recovery and kernel next
[Barnes & Noble Nook Tablet] CelticWebSolutions:
This is getting quite exciting now :) With the time you lot are putting in it looks like the custom rom idea which was pretty much out of the question not so long ago is actually becoming a very real possibility now :)

Keep up the good work!
[Barnes & Noble Nook Tablet] AdamOutler:
It would appear the kernel and recovery partition and encrypted. I can't find a single string within them. Changing a single byte of recovery results in this:

3203072 bytes read
kernel @ 80088000 (2682952)
[ERROR] [SEC_ENTRY] Call to Secure HAL failed!
Ramdisk image has been corrupted , cannot boot

Although there is a block at the top..

ANDROID!H�(##�#��e#####�######�###�############################androidboot.console=ttyO0 console=ttyO0,115200n8 mem=448M@0x80000000 mem=512M@0xA0000000 init=/init rootwait vram=32M,82000000 omapfb.vram=0:5M@82000000#####

I changed vram=32M to vram=31M

It would appear that we are free to change this. the init parameter seems interesting :D

Maybe I can convince it to boot to recovery properly with this knowledge in-hand...
[Barnes & Noble Nook Tablet] 150pilot:
Was researching this and found some interesting info.

Not sure if any of this helps or not but thought it might be with a look.

A small portion from above link:
[Barnes & Noble Nook Tablet] Entropy512:
Requires at least 7 bits to handle 0-100.

State of Charge doesn't mean "charging vs not charging" - it means "battery percentage"

Looks like the NT might have the same fuel gauge chip (MAX17042) that the Galaxy S II has. SOC may be polled during the boot sequence in order to force low power mode (power-off charging) or shut down the device if battery is too low.
[Barnes & Noble Nook Tablet] hkvc:
Hi AdamOutler,

The boot and recovery partitions are the standard android img format, which contains a 2K header at the beginning which among other things contains the kernel cmd line also, if I remember correctly and inturn there is the kernel (which is compressed ) as well as a gzip cpio ramdisk (again compressed) so that is the reason why you are not able to get strings from this other than the 1st 2K.

Also if you remember the install-recovery.sh file, it checks the first 2k of this to verify if it is changed or not. However based on what you mentioned, it would appear if we change the content of the 2K header or atleast some parts of it, it is not validated other than during apply-patch, which updates the eMMC partitions.

You can use the split_bootimg.pl or unpack-bootimg.pl (one of them works but the other fails for these, have forgotten which one) to extract the contents of the android img files.
[Barnes & Noble Nook Tablet] AdamOutler:
Ah.. ok... I had assumed it was encrypted, but it's simply packed... Alright.

Maybe you can help me with this puzzle.. I found exactly what needs to happen in order to get this thing to do what I want it to. In Nook Source /u-boot/board/omap4430sdp/mmc.c there is a block..

static const struct bootloader_message romrestore_bcb = {
.command = "boot-recovery",
.status = "",
.recovery = "recovery\n--update_package=/factory/romrestore.zip\n--restore=rom\n",
};

I need this to be executed. The problem is I'm out of my league.. I don't know C very well and I have never dealt with u-boot.. only Samsung SBL. where is this message delivered? I need to figure out how to trigger this action.
[Barnes & Noble Nook Tablet] j_dev:
Downloading the source now, I'll let you know if I find anything.

---------- Post added at 01:31 PM ---------- Previous post was at 01:25 PM ----------

AdamOutler,

Just a heads up, the updated link you posted in dev for the 1.4.1 source code was the old link (for 1.4) - the new link has a file name of nook_tablet_1-4-1.tar.gz

I would post there, but unfortunately noobs such as myself cannot post in dev :(

---------- Post added at 02:11 PM ---------- Previous post was at 01:31 PM ----------

So upon investigation, the "romrestore" command is run under 3 circumstances.

1) Not running u-boot from SD AND reading the bootcount fails

2) Not running u-boot from SD AND writing the bootcount fails

3) Not running u-boot from SD AND reading the serial number fails. Here is the command that runs:

run_command("mmcinit 1; fatload mmc 1:4 0x81000000 devconf/DeviceId 31", 0)

However I might have stumbled upon something else! I'll post back after I follow this rabbit hole a little deeper.

---------- Post added at 02:50 PM ---------- Previous post was at 02:11 PM ----------

It looks like if the following three conditions are met, the Nook Tablet tries to read a file named BCB.

1) u-boot is not running from SD

2) mmc_init does not fail (probably just a basic initialization routine to make sure there is a valid mmc)

3) load_serial_num does not fail (ie there is a valid serial number)

Then it attempts to read the BCB file using the following command:

run_command("mmcinit 1; fatload mmc 1:5 0x81000000 BCB 2048", 0);

If the BCB file doesn't exist or the BCB file isn't empty, it boots into recovery. In the case where it doesn't exist, my guess is it runs some default recovery command. Otherwise it will run the command stored in the BCB file (very interesting!).

Hope this helps!

---------- Post added at 02:56 PM ---------- Previous post was at 02:50 PM ----------

One more post from me...

The BCB file is written with the following function:

static void write_bcb(const struct bootloader_message * const bcb)
{
sprintf(buf, "mmcinit 1; fatsave mmc 1:5 0x%08x BCB", bcb);
run_command(buf, 0);
}
[Barnes & Noble Nook Tablet] sungod88:
Damn i wish I knew how to help you guys are making alot of progress more hands would make it smoother and less stressful on you guys lol
[Barnes & Noble Nook Tablet] DeanGibson:
Splitting off the ramdisk from the kernel

To split off the kernel and ramdisk.img from flashing_boot.img (B&N 1.4.0):

dd bs=1 if=flashing_boot.img count=2691360 of=zImage
dd bs=1 if=flashing_boot.img skip=2691360 of=ramdisk.img

To unpack ramdisk.img:

mkdir temp
pushd temp
gunzip -c ../ramdisk.img | cpio -i

To repack a new ramdisk.img and reattach it to the kernel:

find . | cpio -o -H newc | gzip > ../newramdisk.img
cat ../zImage ../newramdisk.img >newflashing_boot.img

I used Pokey9000's information and "hexdump" for finding the correct size (2691360).

Edit: I screwed up!!! The last command above I've now edited to be correct.
[Barnes & Noble Nook Tablet] hkvc:
Controling recovery with UBoot uart access

Hi AdamOutler,

By going thro the UBoot source code ==>

To run a specific recovery session with a specified valid recovery zip file. Create the required bootloader_message in the BCB file in /bootdata partition and then run

UBOOT PROMPT> "mmcinit 1; booti mmc1 recovery"

This will load the recovery.img from the /recovery partition of emmc and it inturn will potentially read from the BCB file and execute the recovery program with valid zip file for recovery.

NOTE: If you want to control whether recovery.img is picked from emmc or SD card or memory you can manipulate the arguments to booti.

To booti if you pass

mmc0, then it will use uSD to read the partition specified (In this case you will most likely have to specify the partition number directly rather than partition names or you may have to have EFI partition table in uSD (Haven't dug deep yet on this))

mmc1, then it will use eMMC to read the partition specified by name.

Addr, then it will expect the recovery.img to be already copied into specified memory offset

Note that in all these cases it will do the passive security check (I say passive, because I feel, if we bypass the result check of this security check (As specified in my other post on BYPASSING) it will still work, rather than lock the ARM processor, this is my feel, someone with uart access validate this feeling). And inturn if a valid image is found, it will load the kernel and ramdisk into memory and boot the kernel. Note that this will still expect a valid update zip file because it is running the the BN recovery image in ramdisk which is validated unless BYPASSING is used.

HOWEVER if one BYPASSES the security check by NOPing them, then one should be able to run any kernel and any ramdisk. However this is currently possible only with access to UBoot thro UART.

HOWEVER: If one DOES NOT want to BYPASS the SECURITY check, then ONE possibility to CHECK is, if one specifies a file in /system/bin/ say /system/bin/myrecovery instead of recovery in either the command or the recovery field of the bootloader_message in BCB, whether it will run it. Less likely, but capturing for completeness. Even this will be possible only thro UART access, because in most cases uboot will overwrite BCB unless we take control and directly trigger the recovery booting.

So using BYPASSING of Security check thro NOPing of the condition checks will be the simplest and most flexible thing to do, if one is going the route of UART access.
[Barnes & Noble Nook Tablet] hkvc:
AWaiting feedback from people with UART access on my simple BYPASS logic

Hi Adamoutler/All,

If anyone has UART access, I would request you to try the simple BYPASS logic which i have mentioned in a earlier post today, which can be done directly from uboot prompt itself, and say if it worked or not, that will give indication has to what we are up against now and in future, if any.

Also this would mean that there is no need to get a new Uboot/bootloader compiled (like what I had mentioned initially) and then loading that into memory using BN uboot.

For maximum success, first try a changed RAMDisk rather than Changed Kernel. If Changed Ramdisk works then try Changed Kernel (THere is one more thing in Code, which I am not sure if it will impact a modified kernel or not yet, only way is to experiment).
[Barnes & Noble Nook Tablet] j_dev:
Nice work hkvc, I'm really excited to see where that heads. And just to clarify, the "simple BYPASS logic" you are referencing is your NOP logic right?

And as far a UART access is concerned, I'm fairly certain just AdamOutler has it for the time being.
[Barnes & Noble Nook Tablet] hkvc:
Yes J_dev, by "simple BYPASS logic I mean my NOP logic.

Initially I had mentioned a relatively complex logic of using a replacement uboot, then I thought thro further and realised this even simpler logic.
[Barnes & Noble Nook Tablet] AdamOutler:
I wrote a guide here http://xdaforums.com/showthread.php?t=1423009 this will allow anyone to set up UART

You are going over my head here. I don't understand U-Boot commands.

Please specify the test setup and commands which you would like me to test. I'll work on extracting the kernel, making changes and recompressing it.

If I understand correctly, I think this method which you are suggesting will require a hardware mod-chip.. Which won't be impossible, and I believe we can make it happen for around $5 shipped. It would require 4 points of soldering, power, ground RX, TX with a AT-Mini microcontroller. Code can be made as follows:

upon startup, give 120000 mS window of total operation for the mod chip. Check TX line for input, send output, then exit loop and put microcontroller into sleep mode.

pseduo:

void setup() {
Serial.begin(115200);
}

void loop() {
// read port 0 and save to CONDITION variable.
if (CONDITIONS ARE MET) {
Serial.print(Send commands);
sleep(300);
Serial.print(Send more commands);
Serial.stop
Sleep()
}

}
[Barnes & Noble Nook Tablet] j_dev:
Adam,

Thanks for the link, I had planned on doing that as soon as I get a NT :) I am sans-tablet right now.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
I assume all this talk of opening up the NT soldering chips etc is just so you cab get information out to allow you to create a completely software solutions for the rest of us?
[Barnes & Noble Nook Tablet] AdamOutler:
This did not work.. I followed the directions, then before repacking the kernel, I used "gedit ./default.prop" I changed the default.prop file..

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=0
ro.allow.mock.location=1
ro.debuggable=1
persist.service.adb.enable=1

then I repacked the kernel.

When repacked, I booted and got the following:

Booting from sd
Autobooting in 0 seconds, press <SPACE> to stop...

2850080 bytes read
booti: bad boot image magic
OMAP44XX SDP #

note, it did not secure fail. It just had a bad image.