[Verizon Galaxy Note 3 Q&A, Help & Troubleshooting] bftb0:
Hi.

My head is spinning.

Q1) Anyone have a decent link that describes (or hypothesizes) the N3 chain of trust boot sequence ordering?

e.g. is it something like: (power up) -> dbi -> sbl1-> -> aboot -> boot -> tz, rpm, init...

tz & rpm seem to be ELF images suggesting they need kernel support - or at least ELF relocation during image loading as they are not pure arm code. (The above sequence is hypothetical, I have no idea how it really works, but I picked that order based on blob size and continuous presence of PKI Certs).

x1kB-
PART NAME SIZE COMMENT

3 sbl1 512 Arm Code. Samsung Certs. Many SPMI comments
4 dbi 32 Arm Code. Samsung Certs.
6 aboot 2048 "bootloader". Arm Code. Samsung Certs
7 rpm 512 ELF image. Samsung Certs. Clock/Power Management
8 tz 512 ELF image. Samsung Certs.

Q2) The device (mmcblk0) MBR and subsequent UFI/GPT primary partition layout match the PIT exactly (as expected), excepting that PIT partitions 70-73 (PGPT, PIT, MD5, SGPT) are not actually explicitly present as partitions the UFI/GPT - but their data is.

And thus my question:

Has anyone figured out what the MD5 sigs contained in the MD5 partition (LBA blocks 0x32 - 0x51) are computed against?

For example, the psuedo-partition "MD5" at blocks 0x32 - 0x51 has (apparently) a number of MD5 sigs in there. I am not sure how they get there, but it brings up question Q3 below

The first of them - the "MBR" md5 (5AC92E1775AED95BFA69B4ED91B95F44) indeed is the md5 hash of the (legacy) MBR of /dev/block/mmcblk0 (first 512 bytes). But I can't figure out the correspondence of the others - the signatures of the full partitions (those not likely to change during normal operation) match neither the full-partition md5 signatures, nor the md5s of the Odin images installed there.

I went and grabbed one of those "Odin" tar files for the MJ7 build (that's what is still on my N3 & I have not used Odin or Kies, nor accepted any OTA since it came from the store, btw); when I dump the same number of bytes (from the corresponding partitions) of the various .img, .bin, and .mbn files from the corresponding partitions on my device, the MD5 sums of those blobs (apnhlos, modem, sbl1, sdi, aboot, rpm, tz, boot, recov) match. This is also to be expected - and a bit of a relief that the blobs are not per-device encrypted (e.g. as the Tegra3 bootloaders are); but strangely, if I dump the full partition lengths (the partitions sizes are greater than their contents), I still can not match the MD5s found on my device (LBA block addresss 0x32-0x51).

FWIW, here are the MD5s from the MJ7 build. You can find the corresponding ones on your device with something like:

dd if=/dev/block/mmcblk0 bs=512 skip=50 count=32 | strings -n 3

(MJ7 device, MJE should be different excepting MBR, GPT)

MBR 5AC92E1775AED95BFA69B4ED91B95F44
GPT 93D5B5ED952432999E1A63FBFBE1CAC2
PIT 0901E2E26B272644E64FBBFA671F1614
NONE 2BF1AABDC459C22BDA8FFFF5089B1443
NONE CAFA19C07B19E1CB633C6FD4DF38F23B
NONE DC3EE00113409E5172842D3A2703C862
NONE 1895185C4B4069E3DE38CDD97BAAD935
NONE 83EBDE825292FC15E5305DD3B39D900C
NONE F9F18407DE277A3330960B8C0C284FE5
NONE E3D03F2C0FCF8000EA45F2DAA3F5F927
CEXT4 B82580F9234207CCC4E575EAD339C7C5
NONE 5B6DBA514E8F7096E242CC419E479C0F
NONE 8C777C6B80565A59348B50F612A20AB8
CEXT4 6568CFE33E298FC376236DF82AEEB43E
CEXT4 FE48E691E236CB981B54C139E259137C
CEXT4 945E351CEE0008B2C8111572A31DCBCD
CEXT4 00630CC10D62CD21BE1263583E901D50
CEXT4 4C9C5F931BC89E2B09A0E0C22E22688E

Q3) Origin of the various Note 3 "Odin tar.md5" files floating around. Were these munged together by a dev, or captured intact directly from a Samsung download (e.g. by intercepting Kies software update payloads)? Specifically, I note that the files "pgpt.img", "md5.img", and "sgpt.img" referenced in [MENTION=3544615]beanstown[/MENTION]s106 's partition/PIT analysis thread are not present in either of these.

ALL_N900VVRUBMI9_N900VVZWMI9_1671014_REV03_user_low_ship_MULTI_CERT.tar.md5

ALL_N900VVRUBMJE_N900VVZWMJE_2106277_REV03_user_low_ship_MULTI_CERT.tar.md5

Whew. Well, if you've read this far you deserve a reward, whether or not you reply. Attached are a zip of the JPEGs stripped out of the MJ7 bootloader. ("aboot.mbn"). Enjoy. (I can't guarantee they don't have trailing junk beyond their ends based on the way I extracted them, but it should be harmless junk if any).