yashsingh1/xdaforums huggingface dataset:
[Barnes & Noble Nook Tablet] hkvc:
PARTIAL SUCCESS BYPASSING SEC CHECK using NOP

Hi

By BYPASSING both the Kernel and Ramdisk checks using NOPs, I am able to run the kernel (not modified, but repackaged, so bypassed Kernel sec check) and modified ramdisk.

However either

a) I seem to have done something wrong OR

b) Secure boot chain is doing something internally before passing control to uboot during kernel sec check, which is different between a successful call and a bad call.

Because the kernel crashes after control passes to it, almost immidiately.

NOTE: Have to try with only ramdisk change ...

The UART Dump of my run is given below.

OMAP44XX SDP # booti 0x81000000

[ERROR] [SEC_ENTRY] Call to Secure HAL failed!

kernel @ 80088000 (2689312)

[ERROR] [SEC_ENTRY] Call to Secure HAL failed!

ramdisk @ 81080000 (513429)

Initrd start : 81080000 , Initrd end : 810fd475Acclaim Board.

Starting kernel ...

undefined instruction

pc : [<800886e4>] lr : [<80e930c0>]

sp : 80e3fac4 ip : 00028f05 fp : 80eabe44

r10: 810fd475 r9 : 80eb1fb8 r8 : 80e3ffdc

r7 : 80088000 r6 : 00000000 r5 : 80e3ffb4 r4 : 80eb1fb8

r3 : 00000000 r2 : 80000100 r1 : 00000e18 r0 : 00000000

Flags: nZCv IRQs off FIQs on Mode SVC_32

Resetting CPU ...

NOTE: This requires UART access to NookTab.

UPDATE 1: I found one mistake in that the unpack tool was always using a fixed size 2048 for page size rather than 4096 in the BN recovery.img, I fixed it and repackaged the new set of files and now even thou success eludes me, I find that this time it didn't give a SEC ERROR for my modified ramdisk !?!?!? But it was slower with the checks this time.

OMAP44XX SDP # booti 0x81000000

kernel @ 80088000 (2687264)

[ERROR] [SEC_ENTRY] Call to Secure HAL failed!

ramdisk @ 81080000 (513416)

Initrd start : 81080000 , Initrd end : 810fd468Acclaim Board.

Starting kernel ...
[Barnes & Noble Nook Tablet] CelticWebSolutions:
That all looks very good and sounds extremely promising :)

So in the realms of being able to boot modified roms where does this put us?
[Barnes & Noble Nook Tablet] hkvc:
Uses of this method and its merits/demerits or needs/no needs

Hi Celtic/All,

*** The only places I see a meaningful use for this is mentioned towards the end, otherwise, I am working on this mainly for the fun of exploration. In most other cases where one thinks one needs this, I can tell you It can be achieved with out this, except for some exotic things which don't affect majority of users ***

My thoughts on ROMs with different complexities

------------------------------------------------------------------------

If a modified ROM is not using (doesn't need) custom Kernel or custom Ramdisk, then my 2ndihkvc or any other working 2nd-init method is the simple and straight forward way of doing a custom rom.

If it however requires a custom Ramdisk, then this NOP based BYPASS method will allow one to achieve the same. However I don't see any need for anyone to use a custom ramdisk. If someone is using a custom ramdisk, It can be 98% modified to use the generic 2nd-init method and in case of NookTab my simple 2ndihkvc method (As documented in my other thread, the default 2nd-init logic fails on NookTab as it uses ONE too many PTRACE calls).

If it requires a custom Kernel then with bit more work on this I don't see why a Custom kernel cann't be booted.

However if you ask me, we don't gain much with a custom kernel or ramdisk, which cann't be achieved using root access and or module loading support in default kernel, and inturn REMEMBER that both of these can be done on NookTab today (i.e 1. Root access and 2. Module loading).

Also NOTE that this requires UART access.

*** ONE PLACE WHERE THIS CAN HELP *** is, with BN 1.4.1 firmware, which has blocked the current rooting method If I am not wrong (Unless someone has found a way to break it recently, which I have missed). For 1.4.1, with this, we can boot into a specific custom recovery image and modify the /system partition, such that we put su and SuperUser back into it under /system/bin (with proper chmod settings) and /system/app, so that we can gain Root access again, on rebooting into the NookTAB normally after this change.

*** Another place *** is when the device is very old and the new kernel can bring in some feature missing badly in a very old device. Again in many of these cases, if one puts sufficient effort the feature may be back portable and or injectable into a older kernel using the module route.

REMEMBER IN LINUX - KERNEL MODULE IS SAME AS KERNEL as far as PRIVILAGES are concerned, as it stands TODAY, all LIMITS IF ANY are ARTIFICIAL.

HOPE THAT HELPS :-)
[Barnes & Noble Nook Tablet] LiuAnshan:
I love reading these threads even though I don't fully understand everything going on in the code parts.

I'm interested in custom kernels because as far as I know there's no way to get ICS running on the Tab without one.

Nexus S 4G 4.0.3
[Barnes & Noble Nook Tablet] rbellis:
I honestly dont know much about creating custom ROM's but I have been wondering why every thinks that we have to have the bootloader unlocked before we can get any type of custom ROM. I have a Moto X2. The bootloader is not and never will be unlocked but I am running a really sweet custom ROM on it. I know from other android phones that a ROM is possible with a locked bootloader.

My point is...I am glad to see someone working around this and taking the next step. I was wondering if DEV's have almost given up on the NT. Thank you for your work!
[Barnes & Noble Nook Tablet] DeanGibson:
Rooting 1.4.1

See my method at http://xdaforums.com/showthread.php?t=1413734 (since Dec 27)

Note that my method starts with either a rooted or (preferably) unrooted copy of 1.4.0, roots it if necessary, modifies it slightly, updates to 1.4.1, and then regains root. Requires ADB/USB access.
[Barnes & Noble Nook Tablet] hkvc:
POTENTIAL SUCCESS with CUSTOM KERNEL (INDIRECT METHOD)

Hi All,

In SHORT for impatient

---------------------------------

OMAP44XX SDP # mmcinit 0; fatload mmc 0:1 0x81000000 new.hdr.img;

OMAP44XX SDP # md.l 80e84794 1; md.l 80e847fc 1; mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; md.l 80e84794 1; md.l 80e847fc 1

OMAP44XX SDP # md.l 80e84808 1; md.l 80e847a0 1; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000; md.l 80e84808 1; md.l 80e847a0 1

OMAP44XX SDP # booti 0x81000000

(c) HKVC, GPL ;-)

The sufficient minimal Details

-------------------------------------

I have verified that NOT CALLING SEC_ENTRY calls, with in uboot, related to kernel and ramdisk check keeps things smooth. That should mean the FLOOD GATES are POTENTIALLY OPEN for CUSTOM KERNELs with UART ACCESS.

This requires few additional NOPs compared to what I had originally specified (My original set of NOPs had some issue with Kernel booting, which I have to debug later, however this work around seems to resolve it - I don't want to delve more into this than what I have already specified here, unless Secure Bootloader people get any ideas ;-).

UART Boot Dump/log

-------------------------

OMAP44XX SDP # mmcinit 0; fatload mmc 0:1 0x81000000 new.hdr.img;

3207168 bytes read

OMAP44XX SDP # md.l 80e84794 1; md.l 80e847fc 1; mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; md.l 80e84794 1; md.l 80e847fc 1

80e84794: eb0030f1 .0..

80e847fc: eb0030d7 .0..

80e84794: e1a00000 ....

80e847fc: e1a00000 ....

OMAP44XX SDP # md.l 80e84808 1; md.l 80e847a0 1; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000; md.l 80e84808 1; md.l 80e847a0 1

80e84808: 1a00000a ....

80e847a0: 1a000004 ....

80e84808: e1a00000 ....

80e847a0: e1a00000 ....

OMAP44XX SDP # booti 0x81000000

kernel @ 80088000 (2682952)

ramdisk @ 81080000 (513707)

Initrd start : 81080000 , Initrd end : 810fd58bAcclaim Board.

Starting kernel ...

Linux version 2.6.35.7 (build@dhabuildimage17) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011

CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f

CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache

Machine: OMAP4430 ACCLAIM

Memory policy: ECC disabled, Data cache writealloc

On node 0 totalpages: 245760
[Barnes & Noble Nook Tablet] LexS007:
And if the merge bootloader of the nook color and from nook tablet, compare it and try to create one substitution?
[Barnes & Noble Nook Tablet] hkvc:
Hi DeanGibson,

Thanks for your efforts on that. It should help people who get bumped into 1.41 by BN.

HOWEVER Do note that if the uSD based MLO and u-boot.bin gets loaded first before the ones in eMMC by the internal boot rom of the Omap (Should be the case based on what Pokey had mentioned sometime back, I haven't cross checked myself yet, as I have been busy with these stuff which I am looking into). Then what ever (except for one cavet - which I wont mention here) BN may do in a future update, with the UART based u-boot method which I have mentioned in this thread, one will always be able to get root access to the device.
[Barnes & Noble Nook Tablet] tonyp22:
OMG hkvc, between you, DG, and AO how can the NT win? :)

You guys are monsters! (in a good way)
[Barnes & Noble Nook Tablet] camapghe:
Ok, little explaining before questioning is I'm not a tech guy. But from the all post of hkvc in this thread, the understanding that we can access more space in 16GB internal storage and custom ROM/kernel is on the way is correct?
[Barnes & Noble Nook Tablet] cfoesch:
This requires repartitioning the drive, which we are not at this time confident, that it will not brick your nook by doing so. (This double negative actually is making a positive: Repartitioning might brick your nook.)

This hardware modification has nothing to do with accessing more of the space as that is entirely a software remedy. We're just not confident about how hard the Nook looks at the primary partition table.
[Barnes & Noble Nook Tablet] hkvc:
SUCCESS SUCCESS SUCCESS with CUSTOM Kernel+ CUSTOM Ramdisk, UART NOP BYPASS

Hi All,

As I had mentioned yesterday/today early morning, By bypassing the SEC_ENTRY check I was able to run stock kernel with out any problem. And as I had mentioned then even thou it is a indirect way of verifying possibility of custom kernels, it should still open the flood gate for custom kernels (with UART access for NoW ;-).

Now I have actually verified by RUNNING a CUSTOM Kernel which I compiled along with a CUSTOM Ramdisk (with adb enabled - look at last few lines), which you can know from

a) the kernel version line while booting, which contains the machine used for compiling (Obviously I have redacted part of my name ;-),

b) as well as the size of the kernel and ramdisk images which is different from the stock img files, because this contains both a custom kernel as well as custom ramdisk from me.

SO IT IS SUCCESS with CUSTOM KERNELS+ CUSTOM RAMDISKS, using the uboot commands which I had mentioned in my older post.

UART DUMP including UBoot commands

--------------------------------------------------

OMAP44XX SDP # mmcinit 0; fatload mmc 0:1 0x81000000 new.kr.img;

4157440 bytes read

OMAP44XX SDP # md.l 80e84794 1; md.l 80e847fc 1; mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; md.l 80e84794 1; md.l 80e847fc 1

80e84794: eb0030f1 .0..

80e847fc: eb0030d7 .0..

80e84794: e1a00000 ....

80e847fc: e1a00000 ....

OMAP44XX SDP # md.l 80e84808 1; md.l 80e847a0 1; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000; md.l 80e84808 1; md.l 80e847a0 1

80e84808: 1a00000a ....

80e847a0: 1a000004 ....

80e84808: e1a00000 ....

80e847a0: e1a00000 ....

OMAP44XX SDP # booti 0x81000000

kernel @ 80088000 (2693828)

ramdisk @ 81080000 (1455055)

Initrd start : 81080000 , Initrd end : 811e32afAcclaim Board.

Starting kernel ...

Linux version 2.6.35.7 (hREDACkvc@HCU1) (gcc version 4.5.4 (Ubuntu/Linaro 4.5.3-9ubuntu1) ) #1 SMP PREEMPT Wed Jan 4 02:43:18 IST 2012

CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f

CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache

Machine: OMAP4430 ACCLAIM

Memory policy: ECC disabled, Data cache writealloc

On node 0 totalpages: 245760

..... Chopped ...............

omapfb omapfb: Unknown ioctl 0x40044620

init: Unable to open persistent property directory /data/property errno: 2

enabling adb

adb_open

android_usb gadget: high speed config #1: android

SO ALL OF YOU out there ITHCING to experiment with Custom Kernels and What not, Go ahead and enjoy the freedom to do so on NOOK TABLET (with UART access for NoW ;-)
[Barnes & Noble Nook Tablet] hkvc:
My Android Img file manipulation scripts including few older ones by others.

Hi,

I am attaching the simple C program and the scripts which I use for extracting BN Android Imgs consisting of

a) Dumping the individual sections of Android img

b) Allow seperating the header from the actual Kernel or Ramdisk

c) Allow concatenating (This is kind of dummy, but required to take care of u-boot logic of loading) the old header with new Kernel or Ramdisk

d) Pass proper arguments to recreate the Android IMG file.

Also I have attached some of the other open source tools which I started with originally, but due to few things here and there and also to get maximum flexibility I moved to my own set of scripts and program.
[Barnes & Noble Nook Tablet] hkvc:
recovery img with simple ramdisk with ADB and Root shell on Adb and console

Hi,

Attached is a recovery.img file with the standard Kernel from NookTab and a modified Ramdisk which has support for

a) ADB shell

b) Root shell access (Both ADB and Console)

c) Console is enabled in UART.

Note that the sh on the ramdisk is renamed busybox with a symbolic link called busybox pointing to this sh.

go into /system/bin and run

busybox --install /system/bin

So that you have the standard commands available on the recovery shell.

Also remember to run

export PATH=/system/bin:$PATH
[Barnes & Noble Nook Tablet] Myque:
I am following this thread, Congrats on your findings and thanks for your time you spent on it.
[Barnes & Noble Nook Tablet] lavero.burgos:
O.K. mehhh :D so now that its all SUCCESS SUCCESS SUCCESS what would be the next step to put all that success on normal users NT? :D:D:D if its possible :D:D:D.

Thanks for all the work you have put in, you rock!
[Barnes & Noble Nook Tablet] hkvc:
Hi,

Wrt The Flaw in security chain, I haven't taken a call on it yet, as to whether I will release something which uses it.

However I have started on another thing called linboothkvc, which basically is to achieve something similar/equivalent to kexec, even if kexec is not enabled in kernel. If it works out, which I believe it will from a technical standpoint (unless for any incompetence in my implementation) then even a normal user should be able to get a new kernel or .... to execute on their NookTab with out requiring UART access or the use of the secure chain flaw.

NOTE: My belief in Kernel module approach to achieve anything required (except for things in the secure world within omap, haven't looked at that much, because it is not required for what we want to do, ie even a new custom kernel easily) is 100%. If it fails, it will be only for my incompetence in implementing it properly.
[Barnes & Noble Nook Tablet] macrossmerrell:
hkvc, I think I'm falling in love with you :eek:

Merrell
[Barnes & Noble Nook Tablet] conundrum768:
Sorry, I called shotgun.
[Barnes & Noble Nook Tablet] CelticWebSolutions:
Sounds promising. While using uart is achievable its not practical.

We look forward to your results :)
[Barnes & Noble Nook Tablet] themow:
i just read this whole thread and understand none of it. I do have a tablet and want a rom for it though. Keep up the good work guys
[Barnes & Noble Nook Tablet] macrossmerrell:
DAMNIT all! :p
[Barnes & Noble Nook Tablet] AdamOutler:
hkvc, now we need to work out the partitioning structure for SDCard. Apparently it's not able to mount certain things. I've worked out the following:

Partition 1 FAT32/BOOT/LBA: MLO, u-boot.bin, kernel

Partition 2 EXT2,3,4: Unknown contents

All other partitions are unknown. It is possible that all partitons are to be loaded from Partition1.

Edit: found this in nook color. this looks very similar

/dev/block/mmcblk1p1 : boot (fat32)
/dev/block/mmcblk1p2 : system (ext2)
/dev/block/mmcblk1p3 : data (ext3)
/dev/block/mmcblk1p4 : sdcard (fat32)

Must try this. grab a dd copy of all partitions, mount it to a linux computer. then copy to the sdcard. I'm betting that will do it.
[Barnes & Noble Nook Tablet] cfoesch:
Which SDCard? You mean a new partition structure for an external SDCard? Or the flash memory that comes default with the Nook Tablet?

If you're talking about the later, it's a GPT partition table, and I posted the details here.

--- Edit ---

I think I'm being an idiot... of course you have that partition map already... >_<
[Barnes & Noble Nook Tablet] hkvc:
Explanation of Omap / NookTablet partition mechanisms.

Hi AdamOutler,

WRT Boot Flow

-------------------------

Note that there is a default init ramdisk in the recovery.img or the boot.img (whether default or a custom one which you create). Inturn by default

a) the Linux kernel mounts this initial ramdisk as the rootfs.

b) Inturn the init program in this initial ramdisk runs the commands in the init.rc and the init.omap4430.rc files

c.1) contains some commands to setup the partitions as well as set ENV Variable for which will be the SDCard/External storage (Unless I am mixing this with my beagleboard files/experiments - Been few days now and working on other things, so these things go out my FIFO ...).

c.2) HOWEVER MORE IMPORTANT the init.omap4430.rc file inturn contains the mount commands which determine what partitions get mounted as what.

So by editing the contents of the initial ramdisk you can decide what partitions to treat as what. NOTE: This is the same thing which I do with my released 2ndihkvc package to treat sdcard partitions as /system and /data instead of emmc ones.

Hope that helps/clarifies or I am missing what your requirement is. If this issue of yours relates to your post on the other thread with init not being found, check out my response on that thread, in short it is most likely because of using the old 2K header than a new header with proper size for new modified custom ramdisk.

WRT what the partitions should contain

--------------------------------------------------

Because of the way the boot chain works in Omap4 and inturn the way it is used in NookTablet.

XLoader (MLO), u-boot.bin and the Android.img files or the uImage and ramdisk files should be in the first partition (rather a VFAT partition with boot flag set - unless it has changed between Omap3 to Omap4). In turn whether it is the Android's img file or the uImage and ramdisk depend on what commands you pass to your u-boot.

NOTE: the bootrom code can work with raw partitions but that is a different story.

The remaining partitions depend on how you configure in the init.rc/init.omap4430.rc files in the ramdisk.

Next the 2nd and subsequent partitions should be a Ext3 or Ext4 partitions with the contents of the Android AOSP distribution i.e its userdata and system partitions.

Technically even the root/ramdisk contents of a Android AOSP distribution can be merged into the 2nd partition mentioned above along with userdata and system partitions (i.e a single ext3/4 2nd partition for the linux kernel - containing everything i.e ramdisk+system+userdata contents), provided the u-boot and kernel command lines are updated appropriately. However keeping the ramdisk seperate and already in the first partition keeps things simple and more flexible and powerful.

In Short:

1st VFAT Partition is for Bootloader chaing

2nd (+ additional if required) EXT3/4 Partition(s) is for Linux kernel.
[Barnes & Noble Nook Tablet] AdamOutler:
Well, I've tried using this on a compiled kernel from the provided sources and it didn't work... I thought I'd report here on this..

I built a uboot (for the uImage tools), then compiled the kernel, and I used the uImage to make a new.flashing_boot.bin... here's the result.

MAX17042_STATUS (00h) is 0x0002
STATUS = 0x0002 -- clearing POR
MAX17042_STATUS (00h) is 0x0000
Max17042 init is done
SOC 54%, booting.
Board revision PVT
Booting from sd
Autobooting in 0 seconds, press <SPACE> to stop...

** Unable to read "flashing_boot.img" from mmc 0:1 **
booti: bad boot image magic
OMAP44XX SDP # mmcinit 0; fatload mmc 0:1 0x81000000 new.flashing_boot.img;
mmc read: Invalid size

2682712 bytes read
OMAP44XX SDP # md.l 80e84794 1; md.l 80e847fc 1; mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; md.l 80e84794 1; md.l 80e847fc 1;
80e84794: eb0030f1 .0..
80e847fc: eb0030d7 .0..
80e84794: e1a00000 ....
80e847fc: e1a00000 ....
OMAP44XX SDP # md.l 80e84808 1; md.l 80e847a0 1; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000; md.l 80e84808 1; md.l 80e847a0 1;
80e84808: 1a00000a ....
80e847a0: 1a000004 ....
80e84808: e1a00000 ....
80e847a0: e1a00000 ....
OMAP44XX SDP # booti 0x81000000
booti: bad boot image magic
OMAP44XX SDP #
[Barnes & Noble Nook Tablet] cgdash:
That is great news!
[Barnes & Noble Nook Tablet] Elmar1801:
This is great. I haven't decided about UART. If there is development i will go for it.
[Barnes & Noble Nook Tablet] AdamOutler:
This is definately development only.
[Barnes & Noble Nook Tablet] chrmhoffmann:
Hi,

cool. I imagine the MLO and u-boot.bin are not needed?

Chris
[Barnes & Noble Nook Tablet] AdamOutler:
They are totally needed to boot from sdcard
[Barnes & Noble Nook Tablet] hkvc:
Hi AdamOutler,

Dont want to break your heart, have you by any chance posted the dump of a different run, if not, this uart dump shows that this is the Standard BN kernel. Notice the kernel build system details and build time at the begining of the kernel uart messages. That is how you can validate whether you are running your kernel or a different one. Also the kernel image size will also give some amount of indication.

However as I have already verified running of custom kernel, there is no issue with running custom kernel.

Please have a look at my c program has well as the shell scripts which I had posted few days back on this thread. And see what is wrong in your steps with creating the img file, compared to how my script does it.

The bad magic error is basically telling that there is something wrong in the way you are recreating or cating or what ever you (dd) are doing wrt the img file.

If you are only changing the kernel, then from my tools you have to run the following with approriate arguments in this order.

a) hkvc-androidimg-dump.c (rather the compiled version) and pass the original img file

b) hkvc-BN-extract-kernel.sh --- pass the kernel-dump file created by (a) above.

c) Bring you new kernel into your working directory

d) hkvc-BN-repack-kernel.sh (call with new kernel (from (c) above) and the kernelBNHeader (with ext .hdr) created by step (b) above).

e) hkvc-BN-mkbootimg.sh --- pass the ??????.withhdr file created by (d) along with original-ramdisk-dump (from step a) and new img file name.

The other two tools are required only if ramdisk is being edited/updated.

hkvc-BN-extract-ramdisk.sh

hkvc-BN-repack-ramdisk.sh

Hope this helps.
[Barnes & Noble Nook Tablet] SilverRampart:
Nop based

Which devices could this be ported to? What would the requiements be? I understand you need at least UART and specific bootloaders.
[Android Q&A, Help & Troubleshooting] E15i:
I need some roms for a couple of brown devices, and dont have access to Emma, and only flash tool can flash them, but I dont have access to roms, I can pay $$, if someone just supply me the files, I will decrypt them after, and flash with flash tool.
[Android Q&A, Help & Troubleshooting] E15i:
Ps, I dont need brown roms, they do work with red roms with no problem, if anybody know a fee service that do support brown devices, reply me.
[Android Q&A, Help & Troubleshooting] AndroHero:
Did you try wontanserver?
[Android Q&A, Help & Troubleshooting] E15i:
I did, also I have 10 credits on Davinci, but they not work with BROWN devices :(, can you help maybe? all I ask is only the ROM files, not username & password, as I will use "flash tool" and convert the files to SIN and then to FTF.