yashsingh1/xdaforums huggingface dataset:
[Windows RT Development and Hacking] coherixmatts:
[MENTION=10768985]CrackTheSurface[/MENTION] All my testing recently was on the Surface 2. I took the shell.efi from previous link and renamed it to boot.efi, which allowed it to load. Trying to run shell.efi from Grub didn't work for me.

As far as building grub2.04, here's basically what I did:

0. Download grub-2.04.tar.gz from https: (slash slash) git.savannah.gnu.org/cgit/grub.git

1. Uncompress the download. Open terminal and cd into grub-2.04 directory

2. ./bootstrap

3. ./configure --with-platform=efi --target=arm-linux-gnueabihf

4. make

5. cd <grub2_compiled_source_dir>/grub-core

6. ../grub-mkimage -O arm-efi -d . -o grub.efi -p / part_gpt part_msdos ntfs ntfscomp hfsplus fat ext2 normal chain boot configfile linux gfxterm videoinfo efi_gop all_video video video_fb loadenv help reboot raid6rec raid5rec mdraid1x mdraid09 lvm diskfilter zfsinfo zfscrypt gcry_rijndael gcry_sha1 zfs true test sleep search search_fs_uuid search_fs_file search_label png password_pbkdf2 gcry_sha512 pbkdf2 part_apple minicmd memdisk lsacpi lssal lsefisystab lsefimmap lsefi disk keystatus jpeg iso9660 halt gfxterm_background gfxmenu trig bitmap_scale video_colors bitmap font fshelp efifwsetup echo terminal gettext efinet net priority_queue datetime bufio cat btrfs gzio lzopio crypto acpi extcmd mmap

7. it's very fast, but the compiled grub.efi should now be in the <grub-core> directory

NOTE: The Grub2.04 built from these instructions currently only boots correctly on Surface 2 or QEMU, it does not output video yet on the Surface RT1. I'm working on fixing this.

Build of this was done on an Ubuntu 14.04 LTS x64 system. There are some dependencies that will need to install, but it basically tells you what to apt-get.

Once on the USB stick, i renamed grub.efi to boot.efi. My account doesn't allow me to attach the binary.
[Windows RT Development and Hacking] CrackTheSurface:
[MENTION=10365003]alexenferman[/MENTION] as far as i know bypassing secureboot is only possible on Windows 8.0.

In Windows 8.1 they blacklisted the securebootBypassBinarys, so downgrading is unavoidable to boot other things than Binary signed by Microsoft (?WoA/IoT should work without jailbreak?)

[MENTION=10784299]coherixmatts[/MENTION] thx i will try as soon as possible. I set up Manjaro a long time ago and configured the CrossCompileToolchain.

My main problem back than was that I didn't know that I only had to replace BOOT.efi.

I will try compiling Grub as soon as possible.

Android is only a colorful touchy surface which is based on Linux, so at very first we must get Linux running.

The SoC(System on Chip) Tegra3 has Linux kernel mainline support so driver support shouldn't be that much of a problem (I am an optimist :fingers-crossed:). Display output should also be possible as far as i know it uses Display Serial Interface (DSI) and is directly connected to the SoC.

The attachable keyboard is connected via i2c HID, which has also Linux kernel suppport. HDMI should also be supported out of box by the kernel. Touchscreen, WiFi, Audio, Bluetooth are the main problem points.

But now must start getting the kernel to run with an command line interface (CLI).

And installing the nvidia graphics drivers and multimedia codecs
[Windows RT Development and Hacking] Pioneer4x4:
Hey, every year or so I look to see if any progress is made, thanks for keeping the dream alive. I just love the hardware, and would like to make it usable again. Now I use it as a RDP device to a "real" windows machine, and it is great for that when on vacation.

Let me know if there is anything I can do for testing, I do have the bitlocker key for it as well. And I could get into cmd from boot recovery and mount volumes...
[Windows RT Development and Hacking] ShapeShifter499:
Is there a reason why we couldn't get Grub to boot something off a USB or SD card?
[Windows RT Development and Hacking] coherixmatts:
As far as I know, there is no restriction that prevents Grub from booting something from storage. It can already read the file system for both the internal and external drives.

You can load kernel, devicetree, and initrd without error on Grub2.02 from ROL.

Just that after you issue the 'boot' command, nothing appears to happen (maybe it is failing silently in the background).
[Windows RT Development and Hacking] JukeBox344:
As a lot of people here I've been lurking on the surface RT threads for quite some time, hoping to get some more functionality out of the abandoned device. Since then I've gained knowledge to actually add to the conversation here. I'm a developer in daytime with a background in micro-electronics. Got an RT 1 and 2 here but i only can (and have) screwed open the 1.

Currently I have the supplied grub booting here from USB. I tried booting from the build in SD slot but that isn't showing up, maybe i missed something but that seems to be not possible.

Finding the debug port is the first matter at hand. I'll look and probe around with a scope to see if i see any of the wanted data blocks. To consolidate the information gathered here we should definitely find a central place to dump this, something like a media-wiki would be simple enough and to the point.

On a funny side-note, I initially made a recovery USB from the surface 2 and tried to boot the 1 with. It actually worked and displayed the language selection. Sadly the touchscreen and keyboard where unresponsive. This could indicate the display section isn't that different after all
[Windows RT Development and Hacking] coherixmatts:
I'm focusing now on getting this to work for Surface 2, since it is the more 'standardized' of the two ARM32 Surface models. To that end, I started testing using QEMU instead of the physical device. There is a good write-up here on setting up UEFI for Cortex-A15 processor type in QEMU: designprincipia.com/virtualize-uefi-on-arm-using-qemu/

This has been helpful to me, as I was able to quickly test changes to the BCD file. Changing the BCD file allowed me to replace test.efi with bootshim.efi from here: github.com/imbushuo/boot-shim/releases

Instead of loading EFI files like test.efi, this alternative loads ELF files. That isn't necessarily so exciting, but this BootShim also unloads elements of the original SecureBoot restricted UEFI. They are using this on Lumia devices (particularly the 950XL) to load a modified version of UEFI. After that, it seems they can boot most anything.

P.S. This ancient thread from 2013 describes some of the challenges we face ahead: xdaforums.com/showthread.php?t=2211825
[Windows RT Development and Hacking] JukeBox344:
Thanks for all the information about the software side of the present serial bus. Having the baud makes it easier, and seeing the value present in the BCD is even more reassuring.

I have the hardware for level conversion of the serial port so reading shouldn't be a problem, uncovering the J14 connector is a different matter however as i've not attemted this before.

Luckley the surface i got only cost me 20€ and some rubbing alcohol for the charging port so i'm happy to attempt this. Is the J14 connector present on the Surface 2 as well ?

JTAG could actually be used to read raw data from rom and ram, its direct access into the registers of the IC (if I'm correct).

To focus all our efforts i'm going to set up a mediawiki that we can consolidate on, especially seeing how hard it is to get some of these old files. If anyone wants access, send me a PM.
[Windows RT Development and Hacking] CrackTheSurface:
Discord Server invite

Hi guys,

I created a discord server. join: https://discord.gg/tAxvvVC

I thinks discord is a good platfrom to exchange knowledge, because we can have different channels for different topics like uefi, grub, linux, hardware, etc.

It works with Windows, Linux, macOs, Android, iOS and Browsers

It's free to use so everybody should have access to it.

I will continue to post updates and files here, but i dont want to fill this thread with too much false assumptions and corrupt binarys :)
[Windows RT Development and Hacking] Cesium-234:
The invite expired can you update it?
[Windows RT Development and Hacking] Erick2142:
I made the mistake of buying a used RT tablet thinking it would be easy to get linux running on it.... smh Microsoft...

[MENTION=10768985]CrackTheSurface[/MENTION] Did you make any progress on that J14 connector? Also, did you try plugging an external screen on the mini hdmi port?
[Windows RT Development and Hacking] saianjan:
Surface RT APX Mode

I sent the tablet into APX mode and used Nvflash tool, and ended up with the error shown below:

Can someone confirm whether they are getting the same uid and error.

I have found this driver working for Surface RT:https://developer.toradex.com/knowledge-base/txx-recovery-mode#colibri-t30

Nvflash v2.6:https://docs.toradex.com/103464-nvflash-recovery-toolset.zip

NvFlash tool for getting uid:https://web.archive.org/web/20160318173203if_/http://www.androidroot.mobi/download/nvflash-tools-win32.zip

Thank you.
[Windows RT Development and Hacking] fxsheep:
Unfortunately, APX mode requires recovery blobs signed by OEM per device, on secure devices, to be useful. So if you hardbricked your tablet, there's no going back.

There are exploits available, though, e.g. the Nintendo Switch jailbreak, but mainly PoCs.You need to dive into ARM assembly and hardwares in order to code one working on the Surface RT.
[Windows RT Development and Hacking] saianjan:
Thank you for your reply!

But,

Can you please explain what do mean by:

"You need to dive into ARM assembly and hardwares in order to code one working on the Surface RT."
[Windows RT Development and Hacking] fxsheep:
In theory these devices are meant to be secure, but the Tegra series has been proved to have vulnerabilities/security holes in the SoC's BootROM, which is the read-only memory storing the code responsible for the APX mode and platform startup.There are proof-of-concept codes available in public to make use of it to exploit the BootROM, and boot whatever you want, with full control of the hardware.The problem is that there isn't a version ready for SurfaceRT. So you'll need to have enough skills, look into the exploit codes and the SRT's bootchain, and finally write your own exploit for the (specific model, firmware version) Surface RT.
[Windows RT Development and Hacking] Hrishabh2005:
Hi

Devolopers have managed to install windows 10 on the surface rt. Is it possible to install Linux or Chrome OS using this method? Links to thread https://xdaforums.com/windows-8-rt/rt-general/tutorial-install-windows-10-arm32-t4052035/page10

https://xdaforums.com/windows-8-rt/rt-development/windows-10-arm-surface-rt-t3830124/page15

Thanks
[Windows RT Development and Hacking] fxsheep:
With secure boot disabled, it's now possible to install whichever arm32 OS in theory. What makes it lack of reality is that there isn't a kernel ready for this device.

Speaking of Linux, Tegra 3/4 is mostly supported by mainline. However, the hardware of Surface RT is more customized than usual. UEFI booting makes it worse.
[Windows RT Development and Hacking] coherixmatts:
The modified RT boot sequence still utilizes Microsoft's bootarm.efi, once this is loaded the UEFI environment is too contaminated to load a stock linux build.

If you could replace bootarm.efi entirely, then it would be much more manageable to get Linux going (since Tegra3/4 are supported in the mainline kernel). The problem is that bootarm.efi MUST be production signed by the Microsoft private key or booting fails.

The unlock we have currently does not change this behaviour, but it instead allows us modify BCD to allow loading shims from the Windows Boot Manager. That is why you can load a minimally functioning version of Grub or other ARM32 versions of Windows.

That isn't a complete blocker to bringing up Linux, but the problem is that we have no debug ports for UART. Without a functioning display driver or UART port, you would be doing everything blind. I think that's why nobody managed to do this so far.
[Windows RT Development and Hacking] fxsheep:
bootarm.efi is not actually quite a big problem since the unlock allows an arbitary Windows Boot Manager Application to run. The situation is similar to Lumia 950 XL, whose stock UEFI firmware is 32bit. People managed to run a 64bit UEFI and the real windows on arm / mainline Linux on it, just starting from a boot shim.

What really stucks is that these 32bit UEFI firmwares (including the Surface and Lumia) usually lives at very low memory space, while arm32 Linux requires to be run at low memory space too. This causes overlap when Linux kernel is booted under UEFI, e.g. using GRUB. Therefore UEFI will be overwritten by Linux, which relies on UEFI runtime services. This confliction makes it impossible to boot Linux under stock UEFI. (Usually this causes an immediate reboot, or just stucks.)

The only way to bypass this problem seems to be kicking the stock UEFI out(which is what those Lumia guys do), as Linux loading location isn't quite changeable. By kicking out stock UEFI from memory you can then load an alternative bootloader like u-boot or even nvaboot (Android bootloader used by Nvidia on tegras) if you managed to get the source. Or just cleanly load Linux kernel, which is more inconvenient.
[Windows RT Development and Hacking] moklev:
Linux Kernel 5.9 add Tegra support

Linux Kernel 5.9 add Tegra support for Acer Iconia Tab A500 (Tegra 250 AP20H) and Nexus 7 (Tegra 3 T30L, the same SOC of Surface RT). Now Tegra support is mainlined...
[Windows RT Development and Hacking] CrackTheSurface:
Some Progress

This week we found this great repo https://github.com/imbushuo/boot-shim-tegra-3/.

He figured out how to utilize the screen of sRT in boot environment.

boot-shim-tegra-3/src/EFIApp.c

// Take the last handle as ConOut, don't know how I know this.
// It is painful...and it is 5am now
Status = gBS->HandleProtocol(
pOutputHandles[NumOutputProtocolHandles - 1],
&gEfiSimpleTextOutProtocolGuid,
(VOID**)&pScreenEfiOutputProtocol
);

// Hack: force use the screen output for ConOut
if (!EFI_ERROR(Status))
{
gST->ConOut = pScreenEfiOutputProtocol;
gST->ConsoleOutHandle = pOutputHandles[NumOutputProtocolHandles - 1];
// TODO: Maybe set ConOut device later...?
pScreenEfiOutputProtocol->OutputString(pScreenEfiOutputProtocol, L"At this moment you should have seen something on the screen...\n");
}

I compiled it using VisualStudio2019. Renamed "BootShim.efi" to "BootShim.exe" than signed it and renamed it to "test.efi". Signed it with this signtool.

You want to test it?

YOU NEED A WORKING JAILBREAK

get GRUB.zip from here.

Extract GRUB.zip to an empty FAT32 usb drive. Replace "test.efi" with the new "test.efi".

Now you just need to boot from USB. (also described here)

We would be happy if you would join our Discord Server​
[Windows RT Development and Hacking] Qiangong2:
This still doesn't allow for booting linux or bsd, just using grub
[Windows RT Development and Hacking] coherixmatts:
Hi again [MENTION=10768985]CrackTheSurface[/MENTION], a little progress: I released a new version of Grub2.04 that works properly on Surface RT/Surface 2/QEMU-SYSTEM-ARM with UEFI. You can download over here: https://github.com/coherixmatts/grub-2.04

This Grub 2.04 EFI file isn't that exciting right now, because it still can't boot linux with the existing goldenkey/ROL unlock. It may prove useful in the future because it is a bit more capable than the existing Grub 2.02.
[Windows RT Development and Hacking] marios096:
Is there a way to install the latest 5.9-mainline kernel on top of the grub and install linux?
[Windows RT Development and Hacking] coherixmatts:
With the current SecureBoot bypass, nobody has successfully booted the linux kernel and demonstrated it publicly. The issue is memory address related.

If we can find a way to fully disable SecureBoot, then the memory address issues disappear, but it is not yet possible to do this.
[Windows RT Development and Hacking] marios096:
So the only way to boot to linux is to someone find a way to fully disable SecureBoot but with the current SecureBoot disable we can install Windows 10 arm?
[Windows RT Development and Hacking] coherixmatts:
You can install Windows 10 build 15035 only, as this is the only ARM32 build Microsoft has allowed into the wild. The other Win10ARM builds are for AARCH64, so we can't use those. Win10 IOT is also a possibility, but it is extremely limited.

As for linux, one of the individuals who created the original goldenkey unlock said years ago that he was able to get a very hacky linux kernel to boot, but he would not release it publicly. So it could be done if there was someone skilled enough. I've tried but it's beyond my ability.

If SecureBoot was fully disabled, we would get Linux on it.
[Windows RT Development and Hacking] 7rst1:
Hello. Recently wiped and went back to Windows 8 RT, and the rest of the process went great. Are we waiting for a proper deactivation of Safe Boot? Is there anything we common nerds can help with?
[Windows RT Development and Hacking] shanghailoz:
We have linux booting now via uboot, and fusee gelee payload.

Only over serial for now, but are working on dtb's

Still bleeding edge, but progress is fast

See https://openrt.gitbook.io/open-surfacert/ and join the discord for more info. (link on the gitbooks link)
[Windows RT Development and Hacking] alexenferman:
Awesome work!
[Windows RT Development and Hacking] CrackTheSurface:
Progress, Progress, Progress!

It's nearly a month since my last post.

Alot of great stuff happend since then.

You can find all the documentation in our GitBook

TL;DR

We found a way to use Fusee Gelee on SurfaceRT.

Using a custom payload which spams UART-A port we were able to find UART-A-TX

Knowing where UART-A port is located we started building "Das U-Boot". it acts as a firmware and bootloader for linux.

We got the UART console of UBoot working very quickly. Now was the time to find UART-A-RX so we could talk to UBoot.

One educated guess later we found RX next to TX. Now we can talk to UBoot. Nice.

Time to build a Linux kernel. We went with simple tegra_defconfig and modified .config a little bit.

Now we needed to configure a devicetree (devicetree is a hardware description used by ARM SoCs).

With only the basics like UART-A/memory/aliases/chosen nodes we were able to see the kernel boot and complain about a missing root filesystem.

Time to build a root filesystem. We used BuildRoot and configured it for ARM.

We put the rootFS and the kernel on a 2GB micro SD Card. booted it from UBoot and were greeted via UART-A by a command prompt.

Thanks to [MENTION=2414931]shanghailoz[/MENTION], [MENTION=2605071]pgwipeout[/MENTION], [MENTION=7092012]imbushuo[/MENTION], [MENTION=10790381]JukeBox344[/MENTION], [MENTION=10784299]coherixmatts[/MENTION], [MENTION=10365003]alexenferman[/MENTION] and everybody else who participated in Surface RT development sofar.

[IMG="Linux on SurfaceRT via UART-A"]https://i.imgur.com/TWNGaaB.png[/IMG]

If you are still interested please continue reading here!

As always feel free to join our Discord Server if you can help or just want to see the daily progress​
[Windows RT Development and Hacking] Qiangong2:
I only skimmed the gitbook, but it looks like this exploit doesn't support the Surface 2? Only the Surface RT?
[Windows RT Development and Hacking] iwantpies:
The exploit does support the Surface 2, it just hasn't been fully ported with the Surface 2 addresses.

The precompiled exploit binaries and fusee python is currently written for Tegra3.
[Windows RT Development and Hacking] Tomcio-Paluch:
install Linux on m.surfce rt/rt2

Hello.

This is my first time writing here on the forum. Some time ago I bought a surface rt with a 64bit disk, I am relieved to accommodate Linux Mint xfce, I can see that there is a problem with these tablets. I did not realize it. I wanted to use this M. Sourface rt tablet for designing, controlling Linux Mint xfce drives with functions, for modbuss programs, sensor and control boards with rasberry and Arduino. I thought it would be good and I would use ten tablet instead of raspberry pi. I have had a tablet for several months. I can see that it is solidly made and you can see that it would suit the project.

You can see that there is a potential of this tablet instead of raspberry pi, for example for interesting projects running under linux.

I have a question for you programmers, and I can see the work going on on your part to start Linux.

My question:

1. What will be able to run Linux distributions on these tablets? You can see that this would be from the Ubuntu / debian families (like mint, Arach or other distributions).

2. Will the gpio mode offered by surface rt / rt2 work well with the USB output?

Thank you very much for your answer. Congratulations on your hard work and enthusiasm on these tablets.

PS. Sorry for the spelling, I used the translator to translate to English.
[Windows RT Development and Hacking] CrackTheSurface:
Its been a while since my last post but work is still in progress.

What happend in the meantime?

We were able to enable a few feature on SurfaceRT Linux:

Boot from UHS-I SD Cards

HDMI displays are working with EDID support

Volume keys, PowerButton, WindowsButton state can be read

We dumped the SPI Bootflash and generated a new signed firmware image just to find out that the Flash is OTP (one time programmable) and we can't override the OG firmware (chip replacement is difficult) :(

We decompiled ACPI tables especially SSDT0000.bin which contains the device specific hardware description which helped a lot to get the above-named feature to work

Built-in screen works. PWM brightness control also works

View attachment 5191839

we can use any rootFS which is created for ARM32 like RaspiOS:

View attachment 5192119

further information can be found on our GitBookPage

Open Surface RT Home | Open Surface RT

Get the most out of your Surface RT and other Windows RT devices. Install Linux or Windows 10 on ARM32.

openrt.gitbook.io

A way was found to permanently disable SecureBoot on Surface RT/2 which makes booting Win10oA32 much easier.

GitHub - NekomimiRouter/yahallo: Tegra 3 and Tegra 4 TrustZone UEFI variable services handler exploit and Secure Boot unlock tool

Tegra 3 and Tegra 4 TrustZone UEFI variable services handler exploit and Secure Boot unlock tool - NekomimiRouter/yahallo

github.com

@frylockk19 has started porting useful Libraries and Otter Browser for Win10oA32/WinRT8.1. Otter Browser works fine. But at the moment its JIT-less and doesn't support multimedia sites.

special thanks to everybody who contributed to Linux, WinRT, Win10oA development in the past months :)

If you want to get involved too:

Join the Open RT Discord Server!

Windows RT device modding and giving them a second chance, with Linux or Android | 2861 members

discord.gg
[Windows RT Development and Hacking] keepah:
That's really awesome work.
[Windows RT Development and Hacking] lord_melchett:
Given the Lumia 2520 is Snapdragon I assume there is no hope in achiving a similar result on that device? Great work!