[Motorola Droid 4] biktor_gj:
Are you talking about mbm itself or mbmloader?

My phone is stucked on customs, so I still can't look up anything on the phone itself, right now I'm just looking up information I can find on the internet, and don't have any _real life_ information to work with...

For what I can see so far, the boot process for this phone is more or less like this:

CPU RESET
|
|
OMAP Boot IROM
|
Device Boot select (SYSBOOT hardware switch through some resistors near the cpu)
|
Boot from NAND
|
|
MBMLoader (like secboot on qualcomm)
|
Signature Check for MBM.bin (well, and a lot more I guess)
|
MBM (3rd stage loader, like osbl for qualcomm phones)
|
Signature checks everywhere
|
Choose boot partition (boot/recovery)
|
Boot!

Question: MBMLoader has loads of certificates, but is OMAP's boot IROM checking a signature of MBMLoader before booting or just forcing the phone to boot from internal NAND through sys_boot switches?

I've dump a copy of MLO from a Galaxy Nexus and they have a very similar header, and both have certificates bundled in them...

Galaxy Nexus:

00000000 00 40 00 00 a0 59 00 00 00 00 00 00 00 00 00 00 |.@...Y..........|
00000010 00 00 00 00 4d 4c 4f 00 00 00 00 00 00 00 00 00 |....MLO.........|
00000020 00 0c 00 00 18 32 00 00 00 00 00 00 00 00 00 00 |.....2..........|
00000030 00 00 00 00 50 52 49 4d 41 50 50 00 00 00 00 00 |....PRIMAPP.....|
00000040 00 02 00 00 60 09 00 00 00 00 00 00 00 00 00 00 |....`...........|
00000050 00 00 00 00 4b 45 59 53 00 00 00 00 00 00 00 00 |....KEYS........|
00000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200 43 65 72 74 50 4b 5f 00 ff ff ff ff ff ff ff ff |CertPK_.........|
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000230 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 |................|
00000240 00 01 00 00 01 00 01 00 a3 2c 01 a9 74 ef 79 d1 |.........,..t.y.|
00000250 3a 2e 37 8e 72 3a 7d f6 7a 5f 6f 4d 05 a9 e8 35 |:.7.r:}.z_oM...5|
00000260 c0 f7 47 f7 8d 9f bf f7 61 92 ff f4 27 0f 81 27 |..G.....a...'..'|
00000270 5a 73 ce 90 c7 5b f0 6d 76 c0 c9 90 b7 c2 1c d4 |Zs...[.mv.......|
00000280 80 5f 5f 8e 8e 62 ed 83 7e 72 81 09 1f a5 ad 3a |.__..b..~r.....:|

Motorola Droid 4:

00000000 00 40 00 00 dc 6a 00 00 00 00 00 00 00 00 00 00 |.@...j..........|
00000010 00 00 00 00 4d 4c 4f 00 00 00 00 00 00 00 00 00 |....MLO.........|
00000020 00 02 00 00 60 09 00 00 00 00 00 00 00 00 00 00 |....`...........|
00000030 00 00 00 00 4b 45 59 53 00 00 00 00 00 00 00 00 |....KEYS........|
00000040 00 0c 00 00 c8 33 00 00 00 00 00 00 00 00 00 00 |.....3..........|
00000050 00 00 00 00 50 52 49 4d 41 50 50 00 00 00 00 00 |....PRIMAPP.....|
00000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200 43 65 72 74 50 4b 5f 00 00 00 00 00 00 00 00 00 |CertPK_.........|
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000230 00 00 00 00 01 00 00 00 00 00 03 00 01 00 00 00 |................

I guess the real question would be... Could we replace MBMLoader with a compiled X-Loader (of course with all the modifications to let it boot on the xt894 hardware) and would it boot or is HS mode blocking that too?