[Barnes & Noble Nook Tablet] AdamOutler:
Introduction

In order to condence information, I put together a condenced "lessons learned" guide from [DISCUSSION] on the boot loader and The Nook Tablet Hack Pack. This thread will cover Normal Operation, Booting from SDCard and Bootloader Exploits which alter the boot sequence. If you want to come up-to-speed on the Nook Tablet's security, read on, otherwise it is alot of information to take in.

Part I - Data, Partition Structure & Functional blocks

In this section I will outline the Partition Structure and Functional blocks of the Nook Tablet.

Hardware Configuration

Hardware based input registers - Several registers inside the OMAP4430 processor are tied to physical resistors which serve as configuration bits. If you modify the resistor to be high or low, it will change the register in the device. For example, the SYSTEM_STATUS register contains 6 BOOT_MODE bits which are tied to resistors and any change to these resistors will affect the boot mode. IE. Boot from USB, MMC, MMC2 and so on.

E-Fuse and Secure Rom - The OMAP4430 begins its hardware-initiated chain-of-trust with preburnt registers/secure rom AKA E-Fuse. These E-Fuses serve as a static reference for items which we cannot change and would have severe concequences if they were chaged. They serve to identify the processor and firmware configurations in later stages of the boot sequence. By containing the Secure ROM within the processor, the secure boot sequence is effectively "hardware initiated"

Secure Boot

The following block cannot be touched by any known means outside of factory programming.

IROM - Inside the OMAP4430, there is a ROM which we will refer to as IROM. This IROM cannot be modified. The IROM's function is to initialize the System-on-a-chip. This bootloader (in a nutshell) tells the OMAP4430 that it's an OMAP4430 and initializes internal memory. The primary function of the IROM is to load the X-Loader. The IROM will check the consistancy and signature of X-Loader and then execute it.

Secure Blocks

The following blocks should be considered secure as modifying a single bit will cause a failure during consistancy checking. Each of these secure blocks are signed and modification can lead to an inoperative device.

the following are references to the partitions on the internal MMC:

X-Loader - Provides further initialization of the OMAP4430 including the much larger D-RAM. By initializing the D-RAM, the system is able to access a larger block of memory and load larger programs.

X-Loader is referred to by the alias xloader and can be found as a block in the following locations:

/dev/block/mmcblk0p1
/dev/block/platform/mmci-omap-hs.1/by-name/xloader
/dev/block/platform/mmci-omap-hs.1/by-num/p1

Xloader will check the consistancy and signature of U-Boot and then execute it

Das U-Boot - U-Boot is called such because it is a Universal Bootloader. It is designed to handle a wide array of chips and perform various system specific initialization tasks including initializing paripherals such as filesystems. U-Boot is where you will find the display and many other paripherals initialized. By default, U-Boot serves as a recovery as well as a bootloader. It has several options acessible through UART. It can be considered an entire operating system on it's own.

U-Boot is referred to by the alias bootloader and can be found as a block in the following locations:

/dev/block/mmcblk0p2
/dev/block/platform/mmci-omap-hs.1/by-name/bootloader
/dev/block/platform/mmci-omap-hs.1/by-num/p2

U-Boot will load the recovery, then check the consistancy of the recovery partition, then load and check the consistancy of the kernel.

Recovery - This partition functions similar to the boot partition, however it is specifically designed to load up the factory partition and execute a system wipe or factory recovery depending upon its boot arguments provided by U-Boot.

Recovery can be found in the following partitions:

/dev/block/mmcblk0p3
/dev/block/platform/mmci-omap-hs.1/by-name/recovery
/dev/block/platform/mmci-omap-hs.1/by-num/p3

boot - boot is the first block which is not loaded as a program. The BOOT partition consists of a compressed Ram-disk and a kernel. The Kernel and Ramdisk function together in order to bring up the Linux environment. The Kernel handles "drivers" while the Ramdisk handles files. This is an extremely complex block and would require a rather large volume of literature to explain. The Kernel completes the boot sequence by initializing the second processor and loading required drivers into memory. At this point, the device will boot in a non-linear manner where all partitions are used simultaniously.

The Kernel and Ramdisk are aliased as boot and can be found in the following locations:

/dev/block/mmcblk0p4
/dev/block/platform/mmci-omap-hs.1/by-name/boot
/dev/block/platform/mmci-omap-hs.1/by-num/p4

The kernel loads up userdata, media, cache, system, bootdata, and rom. Kernel finishes initialization up by loading the Android UI.

The ramdisk is mounted at /.

Unsecure Blocks

ROM - The ROM partition contains serial numbers, MAC addresses as well as other general configuration information and logs.

The ROM is aliased as rom and can be found in the following locations:

/dev/block/mmcblk0p5
/dev/block/platform/mmci-omap-hs.1/by-name/rom
/dev/block/platform/mmci-omap-hs.1/by-num/p5

this block is mounted at /rom.

bootdata - The bootdata partition contains the boot count and some configuration data which is unknown at this point. bootdata can be found in the following locations:

/dev/block/mmcblk0p6
/dev/block/platform/mmci-omap-hs.1/by-name/bootdata
/dev/block/platform/mmci-omap-hs.1/by-num/p6

this block is mounted at /bootdata

factory - The factory partition contains restoration scripts used by the recovery partition. The factory partition is not mounted automatically unless the device is in factory restore modes. The factory partition can be found in the following locations:

/dev/block/mmcblk0p7
/dev/block/platform/mmci-omap-hs.1/by-name/factory
/dev/block/platform/mmci-omap-hs.1/by-num/p7

system - The system partition contains the Android layer which rides on top of the kernel. The system partition can be found in the following locations:

/dev/block/mmcblk0p8
/dev/block/platform/mmci-omap-hs.1/by-name/system
/dev/block/platform/mmci-omap-hs.1/by-num/p8

The system partition is mounted at /system/

cache - The cache partition is used by Android to provide quick access to optimized loading data. It effectively makes apps work faster by trading filesize for processor use. It would appear that this partition is unused on the Nook Tablet but rather cache is stored in /data/cache. Cache can be found in the following locations:

/dev/block/mmcblk0p9
/dev/block/platform/mmci-omap-hs.1/by-name/cache
/dev/block/platform/mmci-omap-hs.1/by-num/p9

The cache partition is mounted at /cache/

media - This partition is a general purpose user storage area. It is known as the SDCard on most android devices. Media can be found in the following locations:

/dev/block/mmcblk0p10
/dev/block/platform/mmci-omap-hs.1/by-name/media
/dev/block/platform/mmci-omap-hs.1/by-num/p10

The Media partition is mounted at /mnt/media

userdata - This partition is used for application storage. Each new application is stored in /data/app and each application can create its own folder on this partition for use during operation. This partition is aliased as "data" and can be found in the following locations:

/dev/block/mmcblk0p11
/dev/block/platform/mmci-omap-hs.1/by-name/userdata
/dev/block/platform/mmci-omap-hs.1/by-num/p11

The Media partition is mounted at /data