Project

General

Profile

GTI9100GBootloaderFreedom » History » Version 23

Denis 'GNUtoo' Carikli, 03/25/2020 04:49 AM

1 1 Denis 'GNUtoo' Carikli
h1. I9100GBootloader
2
3 9 Denis 'GNUtoo' Carikli
{{toc}}
4 3 Denis 'GNUtoo' Carikli
5 23 Denis 'GNUtoo' Carikli
h2. Findings, TODO and status
6
7
* The I9100G of hpagseddy is unsigned but the omap-usb-tool says the soc is in HS mode.
8
* If I recall well, the string was verified by hpagseddy, so MLO was flashed and ran
9
* MLO was flashed through heimdall frmo Android 4.x bootloader's odin mode
10
* GNUtoo laptop works fine with heimdall with Android 2.3.6 bootloader while GNUtoo desktop doesn't
11
** The device can easily be stuck in "PC screen mode" with the Android 2.3.6 bootloader, so beware if your computer doesn't manage to talk to heimdall in that mode
12
** It might be related to USB timings or to the unfinished coreboot port for the F2A85M-PRO or the fact that I don't use nonfree firmware/fpga binary for the USB3 on the F2A85M-PRO so the machine is stuck on USB2 with USB3 hardware and I've no idea if that has some impacts or not. My laptop is a Thinkpad X200 with USB2.
13
14
We need to solve this OMAP HS mystery:
15
* I've looked at u-boot, barebox, linux, crucible and I didn't find any driver or code for fuses for any OMAP SOC.
16
* GNUtoo is in Paris where we're confined in our homes due to COVID-19 and I can't afford to brick my GT-I9100G
17
* It might be due to the fuses having been programmed with the hash of a key / certificate but not being in enforcing mode.
18
* The website for breaking motorolla restricted boot is only about OMAP3 devices but it contains infos on the structure of signed MLO
19
* I've tried loading hpagseddy's MLO from USB with omap-usb-tool and I cound't validate that the code ran:
20
** I tried playing with the WDT (easy) => no difference
21
** I tried printing something to the UART in a for(;;) loop => no difference
22
* I've not managed yet to extract *and* re-send the stock MLO through USB as I don't know how to parse signatures yet (I need to look at the wiki for breaking motorolla restricted boot). Once I can parse that stuff, I will know the exact size of the signature
23
* I've not checked the sram size limit nor the load address of MLO in case of USB boot or boot from eMMC.
24
* I've not managed to get any difference by booting from mmc1
25
* I've not dumped yet the usual register for booting configuration like SYS_BOOT
26
27 11 Denis 'GNUtoo' Carikli
h2. How to check if you have a signed bootloader
28 3 Denis 'GNUtoo' Carikli
29 11 Denis 'GNUtoo' Carikli
h3. How to check from the bootloader interface to install the recovery.
30 7 Denis 'GNUtoo' Carikli
31 8 Denis 'GNUtoo' Carikli
To do that you need to get into the ODIN MODE that is typically used to install the Replicant recovery:
32 1 Denis 'GNUtoo' Carikli
33 7 Denis 'GNUtoo' Carikli
# Start the device by holding the following key combination: *Volume down, Select, Power*,
34
# Hold the key combination until the device shows a *Warning* message.
35
# Confirm that you want to download a custom OS using volume up
36
# Make sure the device is in *Downloading* mode
37
38
When this is done, it should show some text:
39
<pre>
40
ODIN MODE
41
PRODUCT NAME: GT-I9100G_CHN_CHN
42
</pre>
43
44 10 Denis 'GNUtoo' Carikli
Here CHN_CHN probably refers to the Chinese version. And it looks like that version has a signed bootloader: According to "a thread on the XDA developers forum":https://forum.xda-developers.com/galaxy-s2/development/guide-repair-totally-sleep-dead-boot-t1701471 "Means that you own a chinese bootloader locked I9100G. You can't flash any other bootloader than the chinese one."
45 1 Denis 'GNUtoo' Carikli
46 12 Denis 'GNUtoo' Carikli
h3. How to check with command line utilities
47 5 Denis 'GNUtoo' Carikli
48 1 Denis 'GNUtoo' Carikli
To get the bootrom to try to boot on USB, you need to do the following:
49
* Connect the USB cable to the device but make sure it's not connected on the computer.
50
* Power off the device
51
* Connect the USB cable
52
53
If we do that, we get the following in the kernel log of your laptop:
54
<pre>
55
usb 1-1: new high-speed USB device number 24 using ehci-pci
56
usb 1-1: unable to get BOS descriptor or descriptor too short
57
usb 1-1: New USB device found, idVendor=0451, idProduct=d00f, bcdDevice= 0.00
58
usb 1-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
59
usb 1-1: Product: OMAP4430
60
usb 1-1: Manufacturer: Texas Instruments
61
</pre>
62
63 22 Denis 'GNUtoo' Carikli
Note that your kernel might need to be compiled with CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
64
to print that. In Parabola CONFIG_USB_ANNOUNCE_NEW_DEVICES=y is enabled.
65
66 1 Denis 'GNUtoo' Carikli
We can also try to get a bit more infos with omap-usb-boot:
67
<pre>
68
$ sudo omap-usb-boot -v -w boot invalidbootmedia
69
Finding and opening USB device
70
Found and opened omap4 USB device: OMAP4430
71
ASIC device id: 4430, HS device
72
Booting from device invalidbootmedia...
73
Booting device invalidbootmedia not found
74
Booting from device failed
75
</pre>
76
77
Here we know the device is signed because it's a "HS device".
78
If it was not signed it would print "GP device" instead.
79 9 Denis 'GNUtoo' Carikli
80 11 Denis 'GNUtoo' Carikli
h3. Using the Android version or other devices properties?
81 9 Denis 'GNUtoo' Carikli
82 15 Denis 'GNUtoo' Carikli
"hpagseddy/i9100g_xloader":https://github.com/hpagseddy/i9100g_xloader is based on "ths-backup/i9100g_xloader":https://github.com/ths-backup/i9100g_xloader which has an ics (Icecream Sandwitch, an Android version) branch only. According to hpagseddy, that branch is also used for Android Jelly brean.
83 9 Denis 'GNUtoo' Carikli
84
It's still unclear if there is some correlation between Android version and signed bootloaders.
85
86
The device that was given to [[People#Denis-GNUtoo-Carikli|GNUtoo]] that has a signed bootloader also has the following characteristics:
87
88
*Software state*: Running the stock OS, unmodified
89
*Android version*: Android 2.3.6
90
*Baseband version*: IG9100GZCLC2
91
*Build number*: GINGERBREAD.ZCLC2
92
*Kernel version*: 2.6.35.7 se.infra@SEI-30#2
93
94 18 Denis 'GNUtoo' Carikli
According to "a thread on XDA":https://forum.xda-developers.com/galaxy-s2/development/bootloader-t1754158 there is a corelation between the @Baseband version@ and the geographic zone that is targeted. And as we can see above, the @Build number@ seem to be related to the @Baseband version@ as well. While the list of baseband versions is incomplete, we can still use it to avoid the Chinese version (CHN_CHN) which has a signed bootloader. 
95 17 Denis 'GNUtoo' Carikli
96
At this point it's also still unclear if any of the other characteristics above correlate to signed or unsigned bootloaders.
97 2 Denis 'GNUtoo' Carikli
98 20 Denis 'GNUtoo' Carikli
As the binaries are under the GPLv2 or later, It would also be a good idea to collect all of them, match them with the device characteristics like the @Build@ number and @Baseband version@, and verify if they are signed or not with some free software tool.
99 19 Denis 'GNUtoo' Carikli
100 21 Denis 'GNUtoo' Carikli
We could even publish the unsigned versions. As for the signed versions, if they cannot run on devices that don't enforce bootloader signatures, it would probably not be a good idea to publish them as the binaries wouldn't respect the 4 freedoms, but we can still check with the FSF if they have good ideas on that point.
101
102 2 Denis 'GNUtoo' Carikli
h2. Source code
103
104
* https://github.com/hpagseddy/i9100g_xloader This got rebuilt and flashed, and it worked on the device it was tested on.
105
* https://blog.the-leviathan.ch/?p=408
106
107 1 Denis 'GNUtoo' Carikli
h2. TODO
108
109 16 Denis 'GNUtoo' Carikli
* Document the various firmware version mentioned here: https://www.sammobile.com/samsung/galaxy-s2/firmware/#GT-I9100G
110 1 Denis 'GNUtoo' Carikli
* Understand how to get unsigned versions (Android version, serial number, etc)
111 13 Denis 'GNUtoo' Carikli
* Get a device with an unsigned bootloader and u-boot and ask samsung for source code
112 14 Denis 'GNUtoo' Carikli
* Check the boot order on unsigned devices (is it possible to boot from USB easily?)
113 6 Denis 'GNUtoo' Carikli
* Try to boot the xloader nevertheless, as the device could be in some "verify but not enforce mode" for signatures