[lsTwinkle]

How does playbook boot? I think it boots the same way android boots. Enea Android Blog: The Android boot process from power on

Of course, there last 3 stages on playbook are different from android's.

So, if its right, bootloader is stored in writable memory and, potentially, we can modify it.

I'd like to read thinkings by people more skilled than me.


PS Can anyone share archive with full filesystem of BB tablet OS?

[xsacha]

1. Bootrom (read-only, impossible to write to)
2. Bootrom boots signed (ONLY RIM SIGNATURE) bootloader.
3. Bootloader runs hashed (INSTALL HASH) firmware scripts (/scripts/startup.sh) from signed (ONLY RIM SIGNATURE) firmware.
4. Scripts initialise background services, as root.
5. Scripts initialise navigator and launcher, as root.
6. User-space apps run above this (they have no root privileges)

[joannesbenedek]

so there no app at all that runs as a root??? Is that why u cant root pb os 7111 and above?

[xsacha]

so there no app at all that runs as a root??? Is that why u cant root pb os 7111 and above?

Only the web server and a handful of background services (which are rock solid). Yeah. Before 7111, it was more like Android with a few root apps.

[lsTwinkle]

1. Bootrom (read-only, impossible to write to)
2. Bootrom boots signed (ONLY RIM SIGNATURE) bootloader.
3. Bootloader runs hashed (INSTALL HASH) firmware scripts (/scripts/startup.sh) from signed (ONLY RIM SIGNATURE) firmware.
4. Scripts initialise background services, as root.
5. Scripts initialise navigator and launcher, as root.
6. User-space apps run above this (they have no root privileges)

What does contain bootrom? How does it check sign?
Do you have full OS image?

[xsacha]

Bootrom contains boot code.
It checks sign by comparing to public (same as every other sign).
The code is actually the same as on the Blackberry handsets.
The salt is "Retreating is advancing backwards" or something like that if you want to see the area of 'interest'.

Heaps of people have full OS image. The / is 512MB. You want?

[lsTwinkle]

Bootrom contains boot code.
Heaps of people have full OS image. The / is 512MB. You want?

I do, thanks

[GreyGhostRos]

I do, thanks

Playbook elite seems to have all the images..

Welcome To Playbook Elite

[xsacha]

I do, thanks

Do you know a site I can upload it to? It's quite large.

[lsTwinkle]

Playbook elite seems to have all the images..

Welcome To Playbook Elite

i saw it, and downloaded it, but i cant open qcfm.image.com.qnx.coreos.qcfm.os.factory_sfi.358. 186652.signed in qcfm.image.com.qnx.coreos.qcfm.os.factory_sfi.358. 186652.signed.bar.

Do you know a site I can upload it to? It's quite large.

try dropbox (2gb limit) or gmail(and send me by email) or use torrents

[joannesbenedek]

Only the web server and a handful of background services (which are rock solid). Yeah. Before 7111, it was more like Android with a few root apps.

Can't you use this web server somehow to root???

[SifJar]

Can't you use this web server somehow to root???

Only if the web server is exploitable in some way, and I am assuming it is not or they would have done it. Or at the very least, not easily exploitable.

[xsacha]

i saw it, and downloaded it, but i cant open qcfm.image.com.qnx.coreos.qcfm.os.factory_sfi.358. 186652.signed in qcfm.image.com.qnx.coreos.qcfm.os.factory_sfi.358. 186652.signed.bar.

Oh you just want a dump of the files? I thought you meant a live FS.
Just use 'dumpifs' on it to get a dump of the files.

Only if the web server is exploitable in some way, and I am assuming it is not or they would have done it. Or at the very least, not easily exploitable.

It sort of has a reputation as being the most secure web server. Not only that, but the only access to it is via 6 commands.
http://www.acme.com/software/micro_httpd/

[lsTwinkle]

Oh you just want a dump of the files? I thought you meant a live FS.
Just use 'dumpifs' on it to get a dump of the files.

No no no. I meant a live FS, actually. I was searching the ways for looking deeper in neutrino on playbook.

But thanks for that method.

Also i looked at emulator FS. But it is pretty different from playbook's system.

PS Under livefs I mean all the files installed a real system.

[xsacha]

No no no. I meant a live FS, actually. I was searching the ways for looking deeper in neutrino on playbook.

But thanks for that method.

Also i looked at emulator FS. But it is pretty different from playbook's system.

PS Under livefs I mean all the files installed a real system.

Just log in to your Playbook as devuser and do `ls -al /`.

And you can get a dump of all the files as suggested before.

[lsTwinkle]

Just log in to your Playbook as devuser and do `ls -al /`.

And you can get a dump of all the files as suggested before.

How can i dump it?

[SifJar]

You can't without root I don't think

[xsacha]

You can't without root I don't think

Yes, as I've explained two times on this thread already, just use `dumpifs` on the coreOS.
If you are too lazy to do this or something, you can just read the raw files in a hex dump.

[Dfube]

I had a quick question that might be a bit farfetched but ill ask anyways. I am being bugged to update to 2.0.1.358 and it made me wonder if we could intercept the update and somehow push an old os.

I'm new to the playbook scene so I've been trying to catchup on all the crazy blocks rim likes to put up.

Cheers
Dfube

[xsacha]

The update just loads the OS on there. You are free to load 7111 or older OS on there too.
They just won't boot.

So yeah, you can intercept and load an old OS. But you can directly load an old OS too. No difference.

[Yankee495]

Yes, as I've explained two times on this thread already, just use `dumpifs` on the coreOS.
If you are too lazy to do this or something, you can just read the raw files in a hex dump.

How do you do this? USB, and what command prompt?

Excuse me, but just getting into the PB and checking it out.

[xsacha]

Nothing fancy. Just open the core os file that RIM hosts on their website.