[Galaxy S III General] scholbert:
... just an update

Hi,

it's been a while now that i found some time to fiddle around with one of my i9305 mainboards.

In the meantime there'd been some nice conversation via PM with Rebellos as well.

u-boot on Galaxy S3

Find the sources here:

https://github.com/Rebell/exynos4_uboot

So i finally gave it a try, jumped on his work and compiled a version of u-boot for Galaxy S3 devices.

As a prerequisite you'll have to block eMMC and to make it short...

It just works!!!

Attached you'll find a log from external sdcard boot.

Maybe i'll do some tweaks in the near future, e.g. remove the annoying "pmic_s5m8767_init" messages,

as there is no such device on our S3.

s-boot for Tizen on Galaxy S3

On the Tizen Wiki (https://wiki.tizen.org/wiki/Flash_Tizen_2.2.1_Image_to_Reference_Device)

there's a link to a tar with image files (Tizen_RD-PQ_System_20131107_1.tar), which contains a s-boot file.

Unfortunately the signature of BL1 inside the s-boot image seems not fit the mass production units.

In other words no boot message here at all... at least while trying to boot from sdcard.

mass production sboot on external SD-card

On the other hand the mass production units sboot images are ready to boot from sdcard as well.

Find the second log attached below.

The error messages are normal, because i blocked eMMC all the time, to prevent bricking during my experiments.

security key validation

As you'll see in the logs i dumped the region at 0x10100000 for the security key values.

Here's a snippet of the secure boot function header in the u-boot sources:

#define	MAX_EFUSE_DATA_LEN	16

typedef struct
{
unsigned char	rsa_n[128];	/* RSA Modulus N */
unsigned char	rsa_e[4];	/* RSA Public Exponent E */
} RawRSAPublicKey;

typedef struct
{
RawRSAPublicKey	rsaPubKey;	/* RSA PublicKey */
unsigned char	signedData[20];	/* HMAC Value of RSA PublicKey */
} PubKeyInfo;

/* Secure Boot Context */
typedef struct
{
RawRSAPublicKey	stage2PubKey;	/* Stage2 RSA Public Key */
unsigned char	code_SignedData[128];	/* RSA Signature Value */
PubKeyInfo	pubKeyInfo;	/* Stage1 RSA PublicKey and it's HMAC value */
unsigned char	func_ptr_BaseAddr[48];	/* Function pointer of iROM's secure boot function */
unsigned char	test_eFuse[MAX_EFUSE_DATA_LEN];
unsigned char	reservedData[36];
} SecureBoot_CTX;

If i assume S3 still uses V1.1 security with 1024Bit RSA (BL1.bin is 8192Byte) the efuse key would be 128Bit, which results in 4 registers with 32Bit length.

Exported to a hex dat file this is 16Byte of Hex data.

Dump at 0x10100000 gives:

10100000: 0d19a391 2a0502af 1576987a 212121bc .......*z.v..!!!

We'll have to re-arrange the bytes for little endian order:

91a3190d af02052a 7a987615 bc212121

... use a hex-editor and put these into a file named: eFuseData.dat

Next i took codesigner_v21 and tried to validate stock BL1 files if they match.

codesigner_v21 -v1.1 <BL1.bin> <eFuseData.dat> -VERIFY

Unfortunately no succes yet... signature verification always failed.

This is a mistery, because the position of the key should be correct and i used valid bootloader files as well.

Anyway this had been only a proof of concept if we got the right tool and the right efuse values.

TBC

Cheers,

scholbert