[HTC Desire 526] BigCountry907:
Partition #3 sbl1

Ok this is an interesting one.

The Secondary Boot Loader. Lets Take a look.

This is a partition that we would really like to COOK.

It's time to take a look at some deep stuff. Lets Evaluate the boot process.

It will be very good to understand this. Please look here :cyclops:

https://translate.google.com/transl...et/fybon/article/details/18185441&prev=search

https://translate.google.com/transl...et/fybon/article/details/37565227&prev=search

Our ability to change this partition depends on.

Has the vendor signed the file

Is the file only using Qualcomm Test Keys

What is the status of the Q-Fuses on our device.

This is all important. If we have S-off we might be able to use unsigned files. :victory:

If you are S-on and the files are signed by the vendor you can only use files signed by the vendor.

If we can run boot loaders signed with our own keys then we can have full access to do anything we want with the device.

All this Really Really makes me want to blow a fuse. Quite literally. :p

But for now we must save that for later.

Ok lets check and see if and how the file is singed.

We will compare the sbl1-8909-1.img in the RUU with the sbl1.mbn in the Template Rom. (Longcheer Rom)

This is in the hex editor comparing 2 sbl1.mbn files that are both signed with test keys.

This is in the hex editor comparing the RUU sbl1.img and the Template Rom sbl1.img.

IT IS EASY TO SEE THAT HTC HAS SIGNED THE SBL1.IMG

poop that kinda stinks. :crying:

There is a way around this but we are not ready to get into that yet.

So this kinda makes our process a little simpler right now.

Now we know we have to use the files included in the ruu.

There is possibility that we could pull these from a RUU for a different HTC device but that wouldn't gain us much.

Lets go set our Generator for these partitions..

Our partition info for each of the partitions.

SBL1

RPM

TZ

ABOOT

RADIO

HOSD

BOOT

RECOVERY

ALL OF THOSE PARTITIONS WILL REQUIRE SIGNED FILES ( FOR NOW ANYWAY )

GENERATOR SETTINGS

sbl1 = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ?????

Lets figure out our filenames for these images. After all the qc flash tools might only recognize certain file names. :confused:

The best place to get this information would be from Factory partition.xml & our Template Rom partition.xml.

Lets open up these in a text editor and take a look.

You can find the Test Rom file Here.

~/Desktop/526-Completed/Example-Rom/LLD0005_0113031301_T07C0618_userdebug/Maincode/partition.xml

:laugh:

FACTORY XML

Both of those are very close to the same.

The filenames for the partitions we are looking at are the same.

We are going to use those filenames.

FINAL DATA FOR THESE PARTITIONS IN THE GENERATOR

sbl1 = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( sbl1.mbn )

rpm = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( rpm.mbn )

tz = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( tz.mbn )

aboot = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( emmc_appsboot.mbn )

radio = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( NON-HLOS.bin )

hosd = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( hosd.img )

boot = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( boot.img )

recovery = Readonly flag is ( False ) Boot Flag is ( False ) Filename is ( recovery.img )

Go edit the generator.

We may need to look at how to pack the NON-HLOS.bin and the emmc_appsboot.mbn.

I have not confirmed that the .img files in the RUU are in the correct format. :eek:

Well that adds a lot more green to our generator. We still have a lot to do. :cowboy: