[LG Optimus L9 P760, P765, P768, P769] shutt1e:
hello folks, seem not quite easy, i got big headache to load the bootloader into ida, looks like omap processors use different addesses, while the good old msm7x30 was reading the bootloader at location 0 the omap don't. To get the bootloader show in ida i have had to load it twice at two memory locations, first one is at 0x9d000000 and the second at 0x9e000000. dunno really if this approach is correct but using this trick i can see all the text stings correctly extracted by ida.

Bootloader code on E730 was much more straightforward, this one use some tricks that make (at least for me) impossible to guess what is the next instruction to execute.

If i guessed the labels correctly, the most interesting part of the bootloader is this one

RAM:9D0133FC boot_main ; CODE XREF: RAM:9D01393Cp

RAM:9D0133FC

RAM:9D0133FC var_978 = -0x978

RAM:9D0133FC var_180 = -0x180

RAM:9D0133FC var_174 = -0x174

RAM:9D0133FC var_EC = -0xEC

RAM:9D0133FC

RAM:9D0133FC STMFD SP!, {R4-R6,LR}

RAM:9D013400 MOV R3, 0x9CFFFFFF

RAM:9D013404 SUB SP, SP, #0x970

RAM:9D013408 MOV R5, R0

RAM:9D01340C LDR R4, [R3,#-0x357]

RAM:9D013410 BL sub_9D014958

RAM:9D013414 CMP R0, #1

RAM:9D013418 BNE MmcInitFail_bootimg

RAM:9D01341C MOV R0, asc_9D03096C ; "======================================="...

RAM:9D013424 BL Print_on_screen

RAM:9D013428 MOV R0, asc_9D03096C ; "======================================="...

RAM:9D013430 BL Print_on_screen

RAM:9D013434 MOV R0, aFotaProcessLk ; " FOTA process LK\n"

RAM:9D01343C BL Print_on_screen

RAM:9D013440 MOV R0, asc_9D03096C ; "======================================="...

RAM:9D013448 BL Print_on_screen

RAM:9D01344C MOV R0, asc_9D03096C ; "======================================="...

RAM:9D013454 BL Print_on_screen

RAM:9D013458 MOV R1, #0x9C8

RAM:9D01345C MOV R0, R4

RAM:9D013460 MOVT R1, #0x9D03

RAM:9D013464 BL sub_9D0175D4

RAM:9D013468 SUBS R3, R0, #0

RAM:9D01346C BEQ NoFotaPart

RAM:9D013470 MOV R1, #0x9F4

RAM:9D013474 MOV R0, R4

RAM:9D013478 MOVT R1, #0x9D03

RAM:9D01347C LDR R6, [R3,#0x10]

RAM:9D013480 BL sub_9D0175D4

RAM:9D013484 CMP R0, #0

RAM:9D013488 BEQ NoFotaUboot

RAM:9D01348C LDR LR, [R0,#0x14]

RAM:9D013490 MOV R12, unk_9D126788

RAM:9D013498 ADD R3, SP, #0x980+var_180

RAM:9D01349C ADD R0, R3, #8

RAM:9D0134A0 ADD R6, R6, LR,LSR#9

RAM:9D0134A4 STR R6, [R12]

RAM:9D0134A8 BL mmcReadErrLoadFOTAUSD

RAM:9D0134AC LDR R2, [SP,#0x980+var_174]

RAM:9D0134B0 MOV R1, 0xF0F85EFE

RAM:9D0134B8 ADD R0, R2, R1

RAM:9D0134BC CMP R0, #2

RAM:9D0134C0 BHI boot_linux_emmc

RAM:9D0134C4 LDR R0, [SP,#0x980+var_EC]

RAM:9D0134C8 CMP R0, #0x1A

RAM:9D0134CC BEQ boot_linux_emmc

RAM:9D0134D0 MOV R0, asc_9D03096C ; "======================================="...

RAM:9D0134D8 BL Print_on_screen

RAM:9D0134DC MOV R0, aGotoRecoveryForF ; " Goto recovery for FOTA up"...

RAM:9D0134E4 BL Print_on_screen

RAM:9D0134E8 MOV R0, asc_9D03096C ; "======================================="...

RAM:9D0134F0 BL Print_on_screen

RAM:9D0134F4 MOV R0, unk_9D02E694

RAM:9D0134FC BL Print_on_screen

RAM:9D013500 MOV R1, #0xA50

RAM:9D013504 MOV R0, R4

RAM:9D013508 MOVT R1, #0x9D03

RAM:9D01350C BL sub_9D0175D4

RAM:9D013510 CMP R0, #0

RAM:9D013514 BEQ NoKernPart

RAM:9D013518 LDR R6, [R0,#0x10]

RAM:9D01351C MOV R0, aToRecoveryLu ; " to recovery [%lu]!\n"

RAM:9D013524 MOV R1, R6

RAM:9D013528 BL Print_on_screen

RAM:9D01352C

RAM:9D01352C Secure_Boot ; CODE XREF: boot_main+3F0j

RAM:9D01352C MOV R4, #0x678C

RAM:9D013530 MOV R0, R5

RAM:9D013534 MOVT R4, #0x9D12

RAM:9D013538 MOV R1, R6

RAM:9D01353C MOV R2, R4

RAM:9D013540 MOV R3, #0x200

RAM:9D013544 BL read_block_from_mmc

RAM:9D013548 CMP R0, #1

RAM:9D01354C BNE FailToLoadBootHdr

RAM:9D013550 MOV R1, #0xB10

RAM:9D013554 MOV R0, R4

RAM:9D013558 MOVT R1, #0x9D03

RAM:9D01355C MOV R2, #8

RAM:9D013560 BL chk_magic

RAM:9D013564 CMP R0, #0

RAM:9D013568 BNE Bad_magic

RAM:9D01356C LDR R12, [R4,#0x24]

RAM:9D013570 MOV R0, R5

RAM:9D013574 LDR R2, [R4,#0xC]

RAM:9D013578 LDR R3, [R4,#8]

RAM:9D01357C ADD R6, R6, R12,LSR#9

RAM:9D013580 MOV R1, R6

RAM:9D013584 BL read_block_from_mmc

RAM:9D013588 CMP R0, #1

RAM:9D01358C BNE FailToLoadKernel

RAM:9D013590 LDR R1, [R4,#0x24]

RAM:9D013594 MOV R0, R5

RAM:9D013598 LDR LR, [R4,#8]

RAM:9D01359C LDR R2, [R4,#0x14]

RAM:9D0135A0 RSB R12, R1, #0

RAM:9D0135A4 LDR R3, [R4,#0x10]

RAM:9D0135A8 ADD R1, R1, LR

RAM:9D0135AC SUB R1, R1, #1

RAM:9D0135B0 AND LR, R1, R12

RAM:9D0135B4 ADD R6, R6, LR,LSR#9

RAM:9D0135B8 MOV R1, R6

RAM:9D0135BC BL read_block_from_mmc

RAM:9D0135C0 CMP R0, #1

RAM:9D0135C4 BNE FailToLoadRamDSK

RAM:9D0135C8 BL sub_9D0076C0

RAM:9D0135CC MOV R1, R0

RAM:9D0135D0 MOV R0, BeforeSecureBoot ; "before secure booting - current time: %"...

RAM:9D0135D8 BL Print_on_screen

RAM:9D0135DC BL sub_9D017D8C

RAM:9D0135E0 MOV R0, SecureBootStart ; "Secure boot started\n"

RAM:9D0135E8 BL sub_9D015E84

RAM:9D0135EC MOV R0, asc_9D02FC70 ; "---------------------------------------"...

RAM:9D0135F4 BL Print_on_screen

RAM:9D0135F8 MOV R0, InfoLge_security ; "INFO: LGE_SECURITY boot is started~!!!\n"...

RAM:9D013600 BL Print_on_screen

RAM:9D013604 LDR R1, [R4,#0x24]

RAM:9D013608 MOV R0, R5

RAM:9D01360C LDR LR, [R4,#0x10]

RAM:9D013610 ADD R2, SP, #0x980+var_978

RAM:9D013614 MOV R3, #0x800

RAM:9D013618 RSB R12, R1, #0

RAM:9D01361C ADD R1, R1, LR

RAM:9D013620 SUB LR, R1, #1

RAM:9D013624 AND R1, LR, R12

RAM:9D013628 ADD R1, R6, R1,LSR#9

RAM:9D01362C BL read_block_from_mmc

RAM:9D013630 CMP R0, #1

RAM:9D013634 BEQ bootImgSignature

RAM:9D013638 MOV R0, #0xC14

RAM:9D01363C MOV R5, #0x4E1F

RAM:9D013640 MOVT R0, #0x9D03

RAM:9D013644 BL Print_on_screen

RAM:9D013648 MOV R0, CannotReadCertImg ; "CANNOT READ CERTIFICATION IMAGE\n "

RAM:9D013650 BL Print_on_screen

RAM:9D013654 MOV R0, #2

RAM:9D013658 BL sub_9D00F4E0

RAM:9D01365C MOV R12, #0xE29C

RAM:9D013660 MOV R0, #0xA600

RAM:9D013664 MOVT R12, #0x9D12

RAM:9D013668 MOVT R0, #0x9D0C

RAM:9D01366C LDRH R2, [R12]

RAM:9D013670 MOV R1, #0x87000000

RAM:9D013674 LDRH R3, [R12,#2]

RAM:9D013678 MUL R2, R2, R3

RAM:9D01367C BL sub_9D001994

RAM:9D013680 MOV R0, #2

RAM:9D013684 BL sub_9D00F53C

RAM:9D013688

RAM:9D013688 loc_9D013688 ; CODE XREF: boot_main+2A8j

RAM:9D013688 SUB R5, R5, #1

RAM:9D01368C MOV R0, #0x3E8

RAM:9D013690 BL sub_9D00760C

RAM:9D013694 SUB R5, R5, #1

RAM:9D013698 MOV R0, #0x3E8

RAM:9D01369C BL sub_9D00760C

RAM:9D0136A0 CMN R5, #1

RAM:9D0136A4 BNE loc_9D013688

RAM:9D0136A8 MOV R0, #7

RAM:9D0136AC BL sub_9D0058BC

RAM:9D0136B0

RAM:9D0136B0 bootImgSignature ; CODE XREF: boot_main+238j

RAM:9D0136B0 LDR R0, [R4,#0xC]

RAM:9D0136B4 ADD R12, SP, #0x980+var_978

RAM:9D0136B8 LDR R1, [R4,#8]

RAM:9D0136BC MOV LR, #0x400

RAM:9D0136C0 LDR R2, [R4,#0x14]

RAM:9D0136C4 LDR R3, [R4,#0x10]

RAM:9D0136C8 STMEA SP, {R12,LR}

RAM:9D0136CC BL sub_9D017DBC

RAM:9D0136D0 CMP R0, #0

RAM:9D0136D4 BNE NoBootImgSign

RAM:9D0136D8

RAM:9D0136D8 secure_boot_end ; CODE XREF: boot_main+494j

RAM:9D0136D8 BL sub_9D0076C0

RAM:9D0136DC MOV R1, R0

RAM:9D0136E0 MOV R0, AfterSecureBoot ; "after secure booting - current time: %l"...

RAM:9D0136E8 BL Print_on_screen

RAM:9D0136EC MOV R0, SecureBootEnd ; "Secure boot End\n"

RAM:9D0136F4 BL sub_9D015E84

RAM:9D0136F8 MOV R0, #0xCDC

RAM:9D0136FC LDR R1, [R4,#0xC]

RAM:9D013700 LDR R2, [R4,#8]

RAM:9D013704 MOVT R0, #0x9D03

RAM:9D013708 BL Print_on_screen

RAM:9D01370C MOV R0, #0xCF4

RAM:9D013710 LDR R2, [R4,#0x10]

RAM:9D013714 LDR R1, [R4,#0x14]

RAM:9D013718 MOVT R0, #0x9D03

RAM:9D01371C BL Print_on_screen

RAM:9D013720 LDR R1, [R4,#8]

RAM:9D013724 LDR R0, [R4,#0xC]

RAM:9D013728 BL sub_9D013D14

RAM:9D01372C MOV R0, aKernelIsNotChang ; "Kernel is not changed. Starting kernel."...

RAM:9D013734 BL Print_on_screen

RAM:9D013738 MOV R0, unk_9D12678C

RAM:9D013740 BL starting_kernel

RAM:9D013744 MOV R0, aBootKernelFailed ; "boot kernel failed!\n"

RAM:9D01374C BL Print_on_screen

RAM:9D013750 MOV R0, #0

so, apparently, the code in bold, make the code jump if the img signature is missing or tampered. Nopping the BNE make it to skip the check at all, seem so easy but.....

altering a bootloader is a risky thing. if there is somewhere an integrity check or if the patch is wrong, it could lead on an hard bricked device. i have hard bricked mine once and i was lucky to revive it, i know how to reflash a dead E730, but i know nothing about an L9.

i will include on this post the ida .idb file, so maybe someone else skilled on arm asm can read it and suggest another/better way.

I can patch the bootloader easily but i want you know what the tester (i can't test because i don't have the device) is risking.