-
Hello readers!
greetings!
i am seeing too many posts regarding bootrom and many speculations and misinformation. this post will clear those. so please dont FUD and create confusion and no fear mongering please.
bootloader is locked using 2 techniques, one is HS or high security, its a register in the OMAP4430, registers are like memory or cache stored in the cpu which does a hash or value check and then goes about loading it and the secondard boot loader which is called chain loader. this is called as bootrom and unlike apple products there is/are no separate IC's (integrated circuits) for this purpose its stored in the 48 KB nonvolatile memory called SRAM which is what we call as bootrom.
the IPL or initial primary loader is signed using rsa keys, we dont know the passphrase of the keys and we know one thing its 3072 bit or more, and the IPL is 48 KB in size and its stored in a special register called sram which is inside the CPU.
so the bootloader function is like this, (pheudo diagram)
power on -> cpu check the hash -> starts IPL -> IPL contains the drivers or modules for emmc viz 16/32/64 gb -> it chainloads to second stage bootloader, thus it has only 2 drivers or modules, one for CPU and one for the primary storage device, here emmc.
now bootrom executes -> second stage loader which is called as chain loader -> now the chain loader executed all other hardware drivers or modules as we call it in *nix or linux and this activates all other devices -> then it does a signature check on the OS or OS binary firmware -> if it fails it doesnt proceed -> if it does? you get to wait for minutes till it boots and you get the final welcome screen.
thats about it. and this is the same for all HS chipsets. HS is an arm technology and vendors like TI and qualcomm and MTK are allowed to write their own register changes. which is not disclosed to public but to OEM and ODM. So the high security is generic and its generic to all HS register chipsets on many arm devices, else its a GP or general purpose CPU.
having said that HS also has one speciality, it can be bypassed by applying a resistor value and then it can be jtagged or icepicked (2 wire jtag). w/o the resistor it cant wipe the memory stored in the sram.
QNX has already released the source code and the device is based on panda board, albeit with some modification to the board it did its initial design. and they released the source code way back in 2012. its my fault that i been lazy and i been ignoring the device, else this work would have kicked off in 2012 itself. beat me up for being lazy and showing this much negligence. i am sorry. else this would have done ages ago.
now one request please read this thread before you spread rumors about bootload and security and et al, and it turns into a menace and the menace goes spirally out of control.
can some moderator make this sticky. and people need to read it first. and lastly. if you find grammar mistake and or spelling or want to re-edit this entire script? please drop me a pm with the final edited script. i dont have time to edit this post. thanks for reading this post and wasting your time.
http://forums.crackberry.com/playboo...ml#post8756059
thanks to ANTIRIM! we got a 100% confirmation bootrom is only 16 KiB or its only 16 KiloBytes!
thats it period no more confusion. and most likely RIM uses its own in-house signing technology/tool which helps it store the compression and the signature together. DONE DEAL SEALED RESEARCH. Credits goes to ANTIRIM!
Final information related to bootrom.
Bootrom is hash checked via sha1 signature that to first generation and not second generation. and its possible to do a hash collition and even gen 2 can be done by hash collition. credit goes to scrid2000, and his post pastebin.com/yHLjy2eE, thank you scrid2000
regards!
thanks!
-paul
p.s. sorry antirim. terribly sorry!
p.s. mshield details and its technical work flow is now known. read here. http://forums.crackberry.com/playboo...ml#post8790247Last edited by quackquack147; 07-09-13 at 09:21 AM.
06-29-13 05:57 AM
Read this post first! before jumping into conclusion wrt bootrom!
Similar Threads
-
Please sign this playbook petition.......
By Lionellmax in forum BlackBerry PlayBookReplies: 21Last Post: 07-02-13, 08:09 PM -
wot this icon indicates?
By code39 in forum BlackBerry Torch SeriesReplies: 1Last Post: 06-29-13, 03:21 AM