Exynos4Bootrom » History » Revision 12

Revision 11 (Denis 'GNUtoo' Carikli, 11/04/2019 02:33 PM) → Revision 12/25 (Denis 'GNUtoo' Carikli, 11/04/2019 04:15 PM)

h1. Exynos4 Bootrom 


 h2. Background information 

 The Replicant project wants to support devices with free software bootloaders, but most/all the smartphones and tablets supported by Replicant do check the signature of the first stage bootloader. 

 A presentation on the situation of some of the devices supported by Replicant was made at the Replicant contributors meeting in July 2019. The "presentation slides": and "video": are available. 

 h2. Exynos 4 signature check 

 The Exynos4 bootrom has a strange way to check the signatures: 
 * The first stage bootloader is encrypted 
 * The signature check is not very clear[1] 
 * The header that holds the key has a "func_ptr_BaseAddr" field[1]. 

 h2. Tests to attempt 

 * Test with qemu[2] if func_ptr_BaseAddr is somehow used by the bootrom, when verifying the BL1. 
 * Try to understand better the scheme used to check the signature. 
 * Try to see if the fuses can still be written (zeroed) and see whether it's computationally feasible to compute the private key for a zeroed fuses hash. 
 * Try to understand why encryption is used. 
 * Try to see if "Cadmium":, released in Wikileak's Vault 7 documents, can be ported to devices we support 
 * See if we can reach full code execution within s-boot using "this technique": 

 h2. Test setup 

 Either qemu[2] or a development board with JTAG can be used to do the test. 

 Testing with qemu[2] is probably way more easy. 



 h1. HOWTO 

 h2. Loading a bootloader from SD 

 When booting Parabola with a Replicant 9 kernel on a Galaxy SIII (i9300), it is possible to erase the bootloader to make the device boot from the microSD instead. 

 This could be used to do some testing, for instance to see if the BL1 signature can somehow be bypassed, however as no free software bootloaders do exist yet (u-boot relies on nonfree and non-redistributable software), this is not very useful yet. 

 If you really want to erase the bootloader (your device will be broken and will never boot anymore), you could run the following: 

 # echo 0 > /sys/class/block/mmcblk2boot0/force_ro 
 # ddrescue -f /dev/zero /dev/mmcblk2boot0 
 GNU ddrescue 1.24 
 Press Ctrl-C to interrupt 
      ipos:      4194 kB, non-trimmed:          0 B,    current rate:     4194 kB/s 
      opos:      4194 kB, non-scraped:          0 B,    average rate:     4194 kB/s 
 non-tried:      9223 PB,    bad-sector:          0 B,      error rate:         0 B/s 
   rescued:      4194 kB,     bad areas:          0,          run time:            0s 
 pct rescued:      0.00%, read errors:          0,    remaining time:           n/a 
                               time since last successful read:           n/a 
 Copying non-tried blocks... Pass 1 (forwards) 
 ddrescue: Write error: No space left on device 

 And then verify that it's erased: 
 # hexdump -C /dev/mmcblk2boot0 
 00000000    00 00 00 00 00 00 00 00    00 00 00 00 00 00 00 00    |................| 


 Also verify that the following partitions are also erased: 
 * mmcblk2boot1 
 * BOTA0 
 * BOTA1 

 I'm not sure what BOTA0 and BOTA1 are but they were already blank in my case. 

 h2. Recovering from a bad u-boot 

 Note that I didn't manage yet to go from u-boot to s-boot. 

 * A supported device (i9300 or i9305) 
 * A programable PSU or another human that can help you 
 * A serial cable 
 * Very thin/precise multimeter probes that you connect together 

 * Prepare a microSD with u-boot 
 * Disassemble the device and connect the device to a programable PSU. The PSU has to be off 
 ** VCC is available on the battery connector 
 ** GND is available at many places 
 * Make sure that the PSU will go to the right voltage when set to on 
 * script the PSU power on, for instance wait 10 seconds before power on 
 * short the resistor with the multimeter probes 
 You then should have u-boot running which can boot Parabola, so you can then easily recover. 

 Note that to run Parabola you need to make sure that you use an MBR and no gpt as u-boot is to be put at the second 512B block.