yashsingh1/xdaforums huggingface dataset:
[Barnes & Noble Nook Tablet] AdamOutler:
I did some analysis on the board... I found a teardown at iFixit. They speculate the processor is a Package-on-package under the hynix chip.. Blue in this picture: http://guide-images.ifixit.net/igi/BWtQHPQKynJJROds

Unedited picture: http://guide-images.ifixit.net/igi/FoefJvrfi4VnqVv6

I made an overlay for the 4460 which is practically the same chip. The Overlay maps out pin locations.

According to my overlay the boot mode pins should be in the lower left corner of the Hynix chip...

So.. here's another test...

1. boot the device normally

2. install viewmem as mentioned here: http://xdaforums.com/showthread.php?p=20117097#post20117097

2. download SSHDroid

3. Set up SSHDroid to auto-start

4. remove the nook from its case

5. power the raw device on without a screen

6. ground out the center of each of the marked pads here (and others) with a 1Kohm resistor between ground and your test probe.

7. upon each test, run the following via an SSH terminal into the device:

echo "CONTROL_STATUS=`viewmem 0x4A0022C4 |hexdump`"

and check for changes to this value. Currently it is 0x0A. we want 0x00. 0x00 will reverse the boot order and force the processor IROM to ask for a flash.

This way we won't have to brick the device. We can apply UnBrickable Mod to it. For more information on the techinque steps, see this post http://xdaforums.com/showthread.php?t=1338073

Bonus points for the first person other than me to locate UnBrickable Mod.
[Barnes & Noble Nook Tablet] Goferbroke:
About that extended warranty...

You might want to check out Square Trade and compare them to the regular B&N coverage.

My understanding is that Square Trade can be a lot cheaper (with discount codes...see this link); and from some of the discussions on the official B&N site, Square Trade may not be as fussy about covering rooted tabs as B&N seems to be.
[Barnes & Noble Nook Tablet] Entropy512:
Um, yes it does - http://www.ti.com/general/docs/wtbu...lateId=6123&navigationId=12316&contentId=4629

See the line about "Secure Booting".

The documentation for M-Shield is intentionally NOT public - You can say what you want about the validity of security through obscurity, but I can assure you - people DO practice it, including TI.

There is very little public documentation for the OMAP's signed bootloader, but it's clearly there - just look at any Motorola device.

Based on what I've seen before, the chain of trust is:

The hardware verifies x-loader

x-loader verifies u-boot's signature (with hardware assistance)

u-boot verifies the kernel image's signature (with hardware assistance)

See the "Building xloader for EMU" section at http://omappedia.org/wiki/Bootloader_Project - this is some of the only public documentation I've seen about the process for generating a signed image for a locked device.

Hint as to when your documentation is CLEARLY incomplete and large chunks were intentionally left out: References to "HS" devices without the TRM providing any information whatsoever as to what an "HS" device is.

Adam, you really should read pokey9000's work at http://xdaforums.com/showthread.php?t=1349264 - the fact that a signed image on a microSD will boot, but fails if you modify a single byte is a CLEAR sign of a locked bootloader.

pokey9000 established ages ago that the NT will boot off of USB (e.g. talks to an OMAP USB boot tool), but refuses to continue past the initial bootload process if the image isn't signed.
[Barnes & Noble Nook Tablet] 150pilot:
Some links to info about the x-loader:

https://github.com/mrchapp/x-loader/tree/2f2316623ba8ec36485e267903865a08da91265e/cpu/omap4

https://github.com/mrchapp/x-loader/commits/omap4_panda_es2.0/cpu

https://github.com/mrchapp/x-loader

README

#

# (C) Copyright 2004-2006 Texas Instruments

#

# Some cut/paste from U-Boot README

# (C) Copyright 2000 - 2004

# Wolfgang Denk, DENX Software Engineering, wd@denx.de.

#

# See file CREDITS for list of people who contributed to this

# project.

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License as

# published by the Free Software Foundation; either version 2 of

# the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 59 Temple Place, Suite 330, Boston,

# MA 02111-1307 USA

#

Summary:

========

This directory contains the source code for X-Loader, an initial program

loader for Embedded boards based on OMAP processors. X-Loader can be

signed by Texas Instruments IFT and installed to Nand flash to achieve

Nand booting.

Image Format:

=============

X-Loader expects OS boot loader (e.g. U-Boot) in Nand flash using

JFFS2 style ECC.

Prepare Booting Nand Flash:

===========================

After you have built x-load.bin for your board, you need to do the

followings to get it into Nand flash:

1. Use Texas Instruments IFT to sign x-load.bin. This results in a

signed image called x-load.bin.ift.

2. Use Texas Instruments FlashPrep to generate a .out file using

FlashWriterNand and specifying 0 as nand target address.

3. Use Texas instrumnets Code Composer Studio to run the .out file

which flashes x-load.bin.ift to Nand flash.

Next you need to get your OS boot loader to Nand at the address your

X-Loader expects. For the H3 example, you can use U-Boot to flash U-Boot.

You can't use FlashWriterNand because it uses ROM code ECC style.
[Barnes & Noble Nook Tablet] 150pilot:
After some digging...

SDP4430 boot log

linux-omap-list

linux-omap-master
[Barnes & Noble Nook Tablet] AdamOutler:
Its worth mentioning that this board is known as Blaze, not Panda. Things must be compiled as such
[Barnes & Noble Nook Tablet] pokey9000:
As someone who has written documentation for other SoCs with similar security, this is exactly what I've had to do in the past. Security by obscurity is a necessary evil. TI's customers (not you or me) wouldn't trust the security if its operation were publicly documented. You wouldn't want to buy a safe with detailed mechanical drawings available freely, would you?

---------- Post added at 10:25 PM ---------- Previous post was at 10:22 PM ----------

SDP is probably the closest to the NT, but none of those platforms is exactly the same. In the case of omap4boot, the differences are all in the MUX config. You can munge in the MUX configs from x-loader if you so desire. The important part is that the memory config is identical, and that's really the main thing you need working.

---------- Post added at 10:27 PM ---------- Previous post was at 10:25 PM ----------

Protip: CONTROL_STATUS is latched on boot. MUX in the GPIOs on the SYS_BOOT pins for massive damage.
[Barnes & Noble Nook Tablet] jtbnet:
Yes, so really still a don't make it any easier... not truly Secure.... question???

And in a high-end device that equates better... but Nook Tablet is more of a commodity/low-end device...

Thus, more of a 'How much explosive to crack the device without destroying the contents' question???
[Barnes & Noble Nook Tablet] pokey9000:
TI doesn't care what it's used for. If people want to buy only the highest security chips to tile their bathroom, they'll provide that security. If putting a tiny LCD looping Nyancat on top of the chip could score TI a design win for the next Nook, they'd do it.

Barnes and Noble doesn't care about security, they only do it because Netflix makes them for HD certification.

Netflix doesn't care about security, they only do it to ease the paranoid minds of the studios they've signed are paranoid about digital distribution and don't want someone's tablet becoming a way to rip movies.

So nobody really cares but the studios. And the studios know you don't have the hundreds of thousands to millions of dollars it would take to reverse engineer this chip.
[Barnes & Noble Nook Tablet] PG101:
Moderator Warning

Guys, I have just done some thread cleaning, this thread was waaaayyyyyyyyy off topic. Now we are back on discussing ways to un-lock the bootloader. :)

Stay on topic!

Cheers!
[Barnes & Noble Nook Tablet] JohnFranks:
would it be possible that its looking for the image on another USB port? ie: the unpopulated (J801 usb?) connector at the top of the board.

-jfc
[Barnes & Noble Nook Tablet] 150pilot:
Using_EMMC_on_OMAP4_devices
[Barnes & Noble Nook Tablet] Entropy512:
There are definitely two camps in this regard... There are those that truly believe that nothing is properly secure unless it is fully reviewed (see the process that led to the creation of AES - fully open, and as a result, the algorithm is trusted and strong).

The other camp says that obscurity adds another layer of protection - this is especially important when you are designing a piece of hardware that can't be patched after the fact. This is usually bad practice due to lack of peer review (see Sony), but if you have access to the right experts, then the potential negative effects of the lack of peer review are mostly mitigated. Either way, whether one feels it is ideal or not, if you want contracts from certain customers, you play by their rules.

Security by obscurity alone often leads to a bad solution - but obscurity as an added layer of protection can work. All of the signs I see say that TI's solution is a strong (but publically undocumented) one.

I do not wish to go into more detail about this in a public forum.
[Barnes & Noble Nook Tablet] 150pilot:
Has anyone seen this?

Insight into TI's Hardware Security Features
[Barnes & Noble Nook Tablet] 150pilot:
http://www.omappedia.org/wiki/BlazeTablet_L27.10.2-P1_Release_Notes
[Barnes & Noble Nook Tablet] AdamOutler:
OK. I got my Nook Tablet last night. I turned it on, logged in, created a restore SD, factory restored my tablet, tried out the 8 reboot method, and got familiar with it. I sent the Nook over to Josh Groce at Mobiletechvideos.com so he can get us a JTAG solution. Once I have a JTAG restoration of the device, I can really begin hacking things... I'll be quiet for the next few days as I have no new ideas other than trying a dd if=/dev/null on every partition and then using a modified usbdownloader to communicate with the device.

Awesome documentation. This is what I was looking for. Wherever did you find this?

150pilot, keep up the good work. this is awesome. If you're reading all of these, then we need to get Svetius to change your name to Encyclopedia... Are you reading all of these? I can't keep up.
[Barnes & Noble Nook Tablet] Entropy512:
150pilot - thanks for that documentation link. I'm actually VERY surprised that's on TI's site at all - but clearly it seems to be quite cleverly buried at least.

Edit: It appears to be discussing security functions for their dedicated DSP chips - however based on the terminology spread throughout the OMAP4 TRM, I believe M-Shield's security approach is very similar to KeyStone.

I'll be adding notes within your quote in blue, based on my understanding of things from various reports:

kexec basically allows a Linux kernel to be bootloaded from within Linux - so if you can kexec() something that resides in /system, you break the chain of trust. The problem is that the B&N kernel does not have kexec support compiled in - I think some people had success injecting kexec as a module with Moto devices, either that or they got lucky and Moto left kexec enabled (an oversight)

I'm fairly certain that "bootloader unlocks" on Motorola aren't full unlocks - the hardware still verifies the bootloader, but the bootloader is replaced with one that has been signed by Motorola but does not perform any signing checks on anything later in the boot process.
[Barnes & Noble Nook Tablet] AdamOutler:
Recovery is a critical portion of the boot sequence. Luglod bricked his device by rewriting the recovery partition.

Also, the default boot opition is MMC2 (0x0A). It fails over to USB. However, the device will never boot from external sd. the xLoader tries to boot from external SD. MMC2 is the default device.

My first task will be to get the boot to USB>MMC2(0x00). This will open up more potential as there are less layers of security.

[/quote]

CPU START

IROM load

Register checks

ROM program decides where to load xLoader from (including USB and MMC as an option. The device is configured to load from MMC2 Only, and will failover into usb boot if xLoader is missing.)

xLoader is verified, loaded and executed

xLoader performs basic initialization including initialization of the bulk of system RAM

xLoader then locates boot devices (Including USB and MMC as an option)

xLoader then verifies, loads and executes U-Boot

U-Boot performs the heavy lifting of the initialization of the system. This is a very basic operating system. and it pulls its parameters from the BOOT PARAMS to decide what to do, incluidng kernel options

U-Boot then (AT LEAST) verifies recovery (and possibly loads recovery partially)

The kernel is verified from an unknown source, including the initramfs.

The Kernel is loaded and the secure checking is stopped

Kernel loads android and we can modify this image for sure.

[/quote]

What are you talking about with kexec? We can modify the Android system already without any special tools right? Just not the kernel... From my understanding /system/ is not verified.

I havn't looked at a DD'd image yet. Are they any partitions?
[Barnes & Noble Nook Tablet] HMG10:
Information on the types of boot modes

Found this also on TI site. If you go down to chapter 3, it talks about, in some detail, all the types of boot modes. Hopefully it gives more insight:

http://www.ti.com/lit/ug/sprugy5a/sprugy5a.pdf
[Barnes & Noble Nook Tablet] Indirect:
A google search of

AllInurl:"ti.com/" should bring up all the pages on their website as the robots.txt file is empty. Oh how i love knowing about doing research on websites and seeing what directories you arent supposed to be in. :)

Sent by breaking the sound barrier
[Barnes & Noble Nook Tablet] Entropy512:
Wonder if the kernel resides in that partition

Are you sure of that? This is inconsistent with pokey9000's results (see my link on the last page) He was clearly able to get his unit to attempt to boot from USB, but the attempt failed due to the code being unsigned.

His original post was edited to a high level summary, but the original detailed post is in a quote at:

http://xdaforums.com/showpost.php?p=19431260&postcount=27

Correct, /system is not verified, which is how the two methods of bypassing locked bootloaders that have been used on Moto devices are viable

1) If you can't get kexec running, fairly early on in the init process, many initramfs implementations will execute a binary in /system (usually logwrapper)- this gives an opportunity to "break out" of the standard init sequence and coopt it. (replace logwrapper with your own init implementation)

2) kexec lets you boot a new kernel if you have root privileges of a running system and the kernel supports kexec.
[Barnes & Noble Nook Tablet] Loglud:
Im just a little curious how that works out that it means its signed? All it said was

which means nothing about the 2nd stage being signed, it could be that it is enumerating because of SYSBOOT_pins, but the SAR Ram has it bypassing it, meaning that the hole is open for a second for it to push the USB ASIC ID, but not allow it to do anything with the recieved data. Keep in mind that the SAR Ram has 1.5k memory and is allowed to:

and

It may cause it to time out immediately.
[Barnes & Noble Nook Tablet] AdamOutler:
hrm.. maybe it's a long shot, and I don't really know how to FULLY implement it.. I could get a chroot environment running on the device. My only question is how to kill Android and assume control over the devices inside the chroot. In this way, we could have a separate image file and replacing the operating system would be a simple as dropping new binaries into it.
[Barnes & Noble Nook Tablet] Entropy512:
Read in more detail:

1) The TRM indicates that CRC1 is supposed to be 0 on a GP device. It's not 0 - indicating the device is not GP. If it's not GP, it's HS.

2) You missed the "sending 2ndstage to target" line - the CPU went far enough to allow the usbboot to transfer an entire 2ndstage image

Pokey also said elsewhere (I think his edited OP) that if he pulled the signed image from the internal flash and put it onto a MicroSD, it would boot that image (not sure how he was able to tell - looks like it was based on output from u-boot) - http://xdaforums.com/showpost.php?p=19404898&postcount=1

This doesn't allow you to replace the kernel - but I believe you just described second init...
[Barnes & Noble Nook Tablet] rhester72:
Actually, I thought I read a report (perhaps from someone else?) of the exact opposite - that the boot failed and automatically switched back to EMMC.

Rodney
[Barnes & Noble Nook Tablet] Loglud:
Wow thanks Entropy. I see what you mean. I have been reading through the SEC stuff, and it seems like it might not even be able to to JTAG into the ROM for your device Adam. Im curious if we can access the registers, and alter the Security. I will do somemore digging when i'm home, but it seems as though the second init, kexec module, might have to be the way to go.
[Barnes & Noble Nook Tablet] AdamOutler:
Hey. I was talking to supercurio (Voodoo Sound/lagfix). He asked me for a voodoo report last night, but I didn't have the ability to install it. Someone please install this and send the report to supercurio. http://dl.project-voodoo.org/VoodooReport.apk
[Barnes & Noble Nook Tablet] Elmar1801:
Done
[Barnes & Noble Nook Tablet] Entropy512:
Most likely the eFuses can only be burned, not "un-burned" - so most likely you can only convert an HS device to a "BAD" device.

As to JTAG - the flash may still be JTAGable for unbricking, even if the CPU is not JTAGable for debugging.
[Barnes & Noble Nook Tablet] AdamOutler:
Theoretically, we could find some sort of private key that translates to mostly zeros in public key... if we're lucky, we burn our key over the current, popping fuses, and end up making the device only compatible with our special key and no longer compatible with the manufacturers key. This would allow us to sign our own ROMs.

It would be possible to resign stock ROM with our new key as well.

Possible.... would take alot of trial and error for me... we could use a cryptographic expert.

We would have to call it some sort of mod... first one to do it gets full credit... EntropyMod has a nice ring to it ;).

JTAG may or may not be secure. It is possible to lock down the JTAG port as it goes through security.

I'm going to get started on porting AndBuntu as a first step towards running a custom ROM.
[Barnes & Noble Nook Tablet] Indirect:
Efuses were made by ibm to be a quick way to program devices without too much effort.

Sent by breaking the sound barrier
[Barnes & Noble Nook Tablet] AdamOutler:
If anyone has some time and a Linux box, please check out this thread. http://xdaforums.com/showthread.php?p=20346570#post20346570

I'd do it, but I don't have a table to work on. It's out for JTAG location.
[Barnes & Noble Nook Tablet] 150pilot:
Just trying to help out...

I may have found something helpful, not sure. Let me know.

An addendum to the TRM
[Barnes & Noble Nook Tablet] DeanGibson:
Sidebooting without joy ...

I was able to reproduce this, once Pokey9000 corrected a typo:

I copied over a Honeycomb Sdcard image and replaced MLO and u-boot.bin from the factory.zip recovery image. That hung in boot.

I copied over boot.img from the factory.zip recovery image, and renamed it flashing_boot.img. That booted (probably switched to the partitions on mmcblk0).

I created additional partitions (using traditional FDISK) on the SDcard for /rom (FAT32), /bootdata (FAT32), /system (ext2), /cache (ext2), /data (ext2), and /image (FAT32). I then did "cp -a" for each of the above partitions on mmcblk0, to the corresponding new partition on mmcblk1. I didn't really expect the next step to use them, but if it did, I wanted the SDcard to be ready.

I stripped off the ramdisk portion from flashing_boot.img, unpacked the ramdisk image, changed a couple init*.rc files to refer to the partitions on mmcblk1, repacked the ramdisk, and reattached it to flashing_boot.img. That started to boot (eg, "n" logo screen), reset (probably due to the ramdisk signature failure), and then booted normally (entirely from mmcblk0, I believe).

The fact that the results (failures) of #1 and #4 were different, I found very interesting.
[Barnes & Noble Nook Tablet] AdamOutler:
Very good information!

If you can get UART we would have definate information. I have a feeling that the sdcard is booting though.
[Barnes & Noble Nook Tablet] DeanGibson:
How do I do dat?

How do I get UART access, without opening up the device (which I'm unwilling to do at this point)? Is there a USB/software tool that does it?
[Barnes & Noble Nook Tablet] pokey9000:
On the Nook Color, I was able to cook up an x-loader that made a UART come out of the USB connector data pins. The OMAP44XX can do this too, easier actually since USB device D+/D- don't go through the PMIC.

But signed bootloader and all, so you must use the internal one.
[Barnes & Noble Nook Tablet] AdamOutler:
Please post this xLoader.

I spoke to Rebellos from my team and Ludlug from this thread because I do not have the skill myself to do this... Here's a totally plausible idea.

1. load unsigned Blaze Board xLoader into I-RAM

2. wipe DRAM

3. Point pointer at xLoader.

This should bypass all security checks.
[Barnes & Noble Nook Tablet] pokey9000:
Patch and binaries here: http://www.mediafire.com/?rev9h7r27whe171

I forgot that I put this into u-boot instead of x-loader since u-boot overwrites the MUX setup. You could make similar changes to x-loader to see early output, but you'll still have to do the same on u-boot. Either way, this patch won't work at all on OMAP4.
[Barnes & Noble Nook Tablet] AdamOutler:
Awesome. Now we have something to use for diagnostic purposes. We need to get something worked out for Blaze board.

Do we have a working "usbboot" tool? I have a feeling the current one is failing because the board is throwing a code over USB which states "Blaze Board is ready for download" and the current "usbboot" is expecting "Panda Board is ready for download".

Also, we need a "loadmem" and "setpointer" tool to perform a hot reinitialization. If anyone has ideas, please let them be known. The idea here is to load unsigned code from blaze board into IRAM and then execute it.
[Barnes & Noble Nook Tablet] pokey9000:
usbboot expects 0xaabbccdd from aboot regardless of the build target. usbboot just serves to shoehorn aboot and a payload. It doesn't care about the platform outside of the OMAP4 usb boot protocol.
[Barnes & Noble Nook Tablet] diamond_lover:
Why don't just try to port a custom recovery and 2nd init?

NT have a simple hardware (no camera etc), I think we can easily have 100% ICS working with 2.3 kernel.
[Barnes & Noble Nook Tablet] :
I agree and since the Nook Tablet and the Kindle Fire have the same CPU and the Kindle already has ICS on a early build state, it shouldn´t be that hard to port from there. (I know the Kindle only has 512mb Ram and the Nook Tablet 1gb)