Project

General

Profile

Actions

FindDevicesWithUnsignedBootloaedrs

Several smartphones and tablets that have an OMAP System On a Chip (SOC) are configured by hardware to try to load the bootloader from USB before loading it from the internal storage.

So far this includes at least the following deviecs:
  • Galaxy Nexus (GT-I9250)
  • Galaxy Tab 2 (GT-P3100, GT-P3110, GT-P5100, GT-P5110)
  • Galaxy SII (GT-I9100G)

As it might apply to other devices too, we could try to use that to find out if some devices we don't know about yet have the ability to run unsigned bootloaders.

How to check with command line utilities

To get the bootrom to try to boot on USB, you need to do the following:
  • Connect the USB cable to the device but make sure it's not connected on the computer.
  • Power off the device
  • Connect the USB cable

If we do that, we get the following in the kernel log of your laptop:

usb 1-1: new high-speed USB device number 24 using ehci-pci
usb 1-1: unable to get BOS descriptor or descriptor too short
usb 1-1: New USB device found, idVendor=0451, idProduct=d00f, bcdDevice= 0.00
usb 1-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
usb 1-1: Product: OMAP4430
usb 1-1: Manufacturer: Texas Instruments

Note that your kernel might need to be compiled with CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
to print that. In Parabola CONFIG_USB_ANNOUNCE_NEW_DEVICES=y is enabled.

We can also try to get a bit more infos with omap-usb-boot:

$ sudo omap-usb-boot -v -w boot invalidbootmedia
Finding and opening USB device
Found and opened omap4 USB device: OMAP4430
ASIC device id: 4430, HS device
Booting from device invalidbootmedia...
Booting device invalidbootmedia not found
Booting from device failed

Here we know the device is signed because it's a "HS device".
If it was not signed it would print "GP device" instead.

Updated by Denis 'GNUtoo' Carikli over 2 years ago · 3 revisions

Also available in: PDF HTML TXT