[Barnes & Noble Nook Tablet] AdamOutler:
Part III - Bootloader Unlocking Exploits

This section covers bootloader unlocks

Bauwks Bootloader unlock

Original post found here: http://xdaforums.com/showpost.php?p=21151522&postcount=274

function: This flashing_boot.bin will load an unsecure U-Boot bootloader into ram which passes security checks and is executed by the Secure U-Boot. The Unsecure U-Boot will then look for a "boot.img" on the sdcard and execute it without security checks. Thereby eliminating security and "unlocking" the bootloader.

UART NOP Based Security Bypass

See here for the original thread: http://xdaforums.com/showthread.php?t=1425044

See here for setting up UART http://xdaforums.com/showthread.php?t=1423009

U-Boot prompt method

This method expects that you are using a stock MLO and a stock U-Boot on an SDCard. At the U-Boot prompt type the following to load a unsecure kernel named "new.flashing_boot.img" without security:

mmcinit 0; fatload mmc 0:1 0x81000000 new.flashing_boot.img;
mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000;booti 0x81000000;

Automated "UnBrickable ModCHIP"

This method can be automated using an ATTiny4313. The ATTiny4313 costs $3 so this is an inexpensive hardware-based bootloader unlock. The following code can be compiled using Arduino IDE with ArduinoTiny Libraries set for ATTiny4313 microcontroller.

/*
Barnes and Nobel Nook Tablet UnBrickable Modchip
Copyright 2011 Adam Outler - hkvc
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-Adam Outler adamoutler, gmail.com
*/

boolean Position[3]={true,true,true};//Place holders for operation
int inByte; //current byte
String Message=""; //current string of bytes
//begin sketch

void setup() {
Serial.begin(115200); //Initialize UART and set baud for serial
Serial.println("I are your god now");
}
void loop() {
if (Serial.available()) {
inByte = Serial.read();
if ( inByte == 10 ){
Message="";
}
else {
Message=Message +(char)inByte; //dump char into string
if (Message == "OMAP44XX SDP # "){
if ( Position[1]){
Serial.println("O hai Nook Im in ur memory");
Serial.println("mmcinit 0; fatload mmc 0:1 0x81000000 new.flashing_boot.img;");
Serial.println("Mai kernel is ur kernel");
Position[1]=(!Position[1]);
return;

} else if ( Position[2]){
Serial.println("Ur Security is my target");
Serial.println("mw.l 80e84794 e1a00000; mw.l 80e847fc e1a00000; mw.l 80e84808 e1a00000; mw.l 80e847a0 e1a00000;");
Serial.println("Ur Security is neutralized");
Position[2]=(!Position[2]);
return;
}
else if ( Position[3]){
Serial.println("boot mai kernel now");
Serial.print("booti 0x81000000");
Serial.println("k thx bai");
Position[3]=(!Position[3]);
lockup;
}
}
}
}
if (millis()>=60000){
lockup;
}
}
void lockup(){
while(true){
delay(50000);//program cannot end, only sleep
}
}

The ATTiny4313 is connected to the device in the following way:

Pin2>Uart TX

Pin3>UART RX

Pin10> Ground

Pin20>1.8v.

function: This hardware exploit sends commands into memory which null the security checks and allow the device to boot a file called "new.flashing_boot.img" without any security checks.

Conclusion

Using this information and other resources on Linux/Android hacking, you should have all the tools required to make your own custom Android ROM. It is my goal to help enable development on this device. We now have total control over the Nook Tablet.

Please let me know if there's anything I should add.D