Replicant

Thanks for the post!

I should mention that https://forkwhiletrue.me/ has replaced all or some of s-boot with u-boot mainline on the i9300.

He posted 'U-Boot 2018.03-i9300-00017-gae73efb436-dirty (Apr 27 2018 - 16:12:54 +1000)' in the Replicant IRC and said he likely will do a blog post about this once he gets it fully working.

Exciting stuff! Can't wait for the blog post.

J

Enjoy: https://blog.forkwhiletrue.me/posts/u-boot-on-galaxy-s3/ https://blog.forkwhiletrue.me/pages/midas-mainline/

Simon recently posted an update, sounds really promising:

https://blog.forkwhiletrue.me/posts/an-almost-fully-libre-galaxy-s3/

Thanks for posting that Daniel! Super exciting! I wonder what this means, "It's also worth mentioning that LineageOS/Replicant will boot under u-boot with a kernel compiled without CONFIG_ARM_TRUSTZONE set, but the display will not work (probably because u-boot does not initialise the display)."

I asked Simon on IRC, "Do you think that u-boot can initialize the display if someone works on it, or do you think it is more likely that we won't be able to get LineageOS/Replicant to work with u-boot on the i9300?". I'll post his response here.

This is great stuff!

@Kurtis Hanna: Any news regarding the display issue?

And if I understand this correctly - if we were able to boot using u-boot, we could finally disable the Heimdall security hole? Or is heimdall mode independent from the boot loader?

I just added this issue on the tracker related to u-boot: https://redmine.replicant.us/issues/1906

I don't think that forkbomb is updating his website to reflect the recent work on this, so here is a link to the newer commits that he pushed on github: https://github.com/fourkbomb/u-boot/commits/midas-2019.04

Oh cool, thanks for sharing - didn't see that! As far as I can see from the commits the usb network console seems to work already? No mentioning of the screen, though. Any brave souls here who want to try it out?

I really don't know the answer to the screen question, but I think that maybe it works with the mainlined kernel, but doesn't work with the older modified Samsung kernel that Replicant 6.0 uses. If someone else could chime in and provide a better understanding of the situation that'd be great.

Here's another Exynos S-boot exploit that might be able to be ported to the devices that we support: https://wikileaks.org/ciav7p1/cms/files/cadmium.pdf
It was released by Wikileaks in their Vault 7 publications.

I don't know if this is a separate exploit from the Cadmium one, but has been blogged about recently (link to blog in the Readme):

https://github.com/frederic/exynos-usbdl

It gets the Exynos BootROM to boot unsigned bootloader images. First step involves a hardware mod, but the author says software can be used (without going into detail). It is confirmed to work on Exynos 8890 & 8895 SoCs. Hopefully it is present in Exynos4. The code has to be delivered over USB - but maybe the SD card could be used instead if the exploit is modified? I don't know. If it works on Exynos4, and if SD card can be used, (a long shot, perhaps?) this would be a way of getting mainline u-boot (and therefore mainline linux) to work on Replicant-supported Exynos devices, wouldn't it? No proprietary BL1 needed...

EDIT - software method now detailed in the readme.

Details of another interesting exploit:

https://blog.quarkslab.com/a-deep-dive-into-samsungs-trustzone-part-3.html