GTI9100GBootloaderFreedom » History » Version 26
Denis 'GNUtoo' Carikli, 03/25/2020 04:57 AM
1 | 1 | Denis 'GNUtoo' Carikli | h1. I9100GBootloader |
---|---|---|---|
2 | |||
3 | 9 | Denis 'GNUtoo' Carikli | {{toc}} |
4 | 3 | Denis 'GNUtoo' Carikli | |
5 | 23 | Denis 'GNUtoo' Carikli | h2. Findings, TODO and status |
6 | |||
7 | * The I9100G of hpagseddy is unsigned but the omap-usb-tool says the soc is in HS mode. |
||
8 | * If I recall well, the string was verified by hpagseddy, so MLO was flashed and ran |
||
9 | * MLO was flashed through heimdall frmo Android 4.x bootloader's odin mode |
||
10 | * GNUtoo laptop works fine with heimdall with Android 2.3.6 bootloader while GNUtoo desktop doesn't |
||
11 | ** The device can easily be stuck in "PC screen mode" with the Android 2.3.6 bootloader, so beware if your computer doesn't manage to talk to heimdall in that mode |
||
12 | ** It might be related to USB timings or to the unfinished coreboot port for the F2A85M-PRO or the fact that I don't use nonfree firmware/fpga binary for the USB3 on the F2A85M-PRO so the machine is stuck on USB2 with USB3 hardware and I've no idea if that has some impacts or not. My laptop is a Thinkpad X200 with USB2. |
||
13 | |||
14 | We need to solve this OMAP HS mystery: |
||
15 | * I've looked at u-boot, barebox, linux, crucible and I didn't find any driver or code for fuses for any OMAP SOC. |
||
16 | * GNUtoo is in Paris where we're confined in our homes due to COVID-19 and I can't afford to brick my GT-I9100G |
||
17 | * It might be due to the fuses having been programmed with the hash of a key / certificate but not being in enforcing mode. |
||
18 | * The website for breaking motorolla restricted boot is only about OMAP3 devices but it contains infos on the structure of signed MLO |
||
19 | * I've tried loading hpagseddy's MLO from USB with omap-usb-tool and I cound't validate that the code ran: |
||
20 | ** I tried playing with the WDT (easy) => no difference |
||
21 | ** I tried printing something to the UART in a for(;;) loop => no difference |
||
22 | 24 | Denis 'GNUtoo' Carikli | * I've extracted the MLO but I'm unsure of its size and when I sent it through USB to the bootrom it failed. It might be because of the sram size limit but anyway as I don't know how to parse signatures yet (I need to look at the wiki for breaking motorolla restricted boot) I'm unsure of the exact binary size to send. Once I can parse that stuff, I will know the exact size of the signed area and so of the binary. |
23 | 23 | Denis 'GNUtoo' Carikli | * I've not managed to get any difference by booting from mmc1 |
24 | 1 | Denis 'GNUtoo' Carikli | * I've not dumped yet the usual register for booting configuration like SYS_BOOT |
25 | 25 | Denis 'GNUtoo' Carikli | |
26 | TODO while reading the TRM: |
||
27 | * check the device's OMAP4 the sram size limit |
||
28 | * check the load address / memory mapping of MLO in case of USB boot or boot from eMMC. |
||
29 | * Check mmc1 booting constraint (card size, look if < 4GiB works) |
||
30 | * Read about SYS_BOOT and booting, though fuse infos is most probably missing |
||
31 | |||
32 | 26 | Denis 'GNUtoo' Carikli | If infos about fuses are ever found: |
33 | * Ideally write drivers and upstream them in Linux, u-boot, Barebox and crucible |
||
34 | 23 | Denis 'GNUtoo' Carikli | |
35 | 11 | Denis 'GNUtoo' Carikli | h2. How to check if you have a signed bootloader |
36 | 3 | Denis 'GNUtoo' Carikli | |
37 | 11 | Denis 'GNUtoo' Carikli | h3. How to check from the bootloader interface to install the recovery. |
38 | 7 | Denis 'GNUtoo' Carikli | |
39 | 8 | Denis 'GNUtoo' Carikli | To do that you need to get into the ODIN MODE that is typically used to install the Replicant recovery: |
40 | 1 | Denis 'GNUtoo' Carikli | |
41 | 7 | Denis 'GNUtoo' Carikli | # Start the device by holding the following key combination: *Volume down, Select, Power*, |
42 | # Hold the key combination until the device shows a *Warning* message. |
||
43 | # Confirm that you want to download a custom OS using volume up |
||
44 | # Make sure the device is in *Downloading* mode |
||
45 | |||
46 | When this is done, it should show some text: |
||
47 | <pre> |
||
48 | ODIN MODE |
||
49 | PRODUCT NAME: GT-I9100G_CHN_CHN |
||
50 | </pre> |
||
51 | |||
52 | 10 | Denis 'GNUtoo' Carikli | Here CHN_CHN probably refers to the Chinese version. And it looks like that version has a signed bootloader: According to "a thread on the XDA developers forum":https://forum.xda-developers.com/galaxy-s2/development/guide-repair-totally-sleep-dead-boot-t1701471 "Means that you own a chinese bootloader locked I9100G. You can't flash any other bootloader than the chinese one." |
53 | 1 | Denis 'GNUtoo' Carikli | |
54 | 12 | Denis 'GNUtoo' Carikli | h3. How to check with command line utilities |
55 | 5 | Denis 'GNUtoo' Carikli | |
56 | 1 | Denis 'GNUtoo' Carikli | To get the bootrom to try to boot on USB, you need to do the following: |
57 | * Connect the USB cable to the device but make sure it's not connected on the computer. |
||
58 | * Power off the device |
||
59 | * Connect the USB cable |
||
60 | |||
61 | If we do that, we get the following in the kernel log of your laptop: |
||
62 | <pre> |
||
63 | usb 1-1: new high-speed USB device number 24 using ehci-pci |
||
64 | usb 1-1: unable to get BOS descriptor or descriptor too short |
||
65 | usb 1-1: New USB device found, idVendor=0451, idProduct=d00f, bcdDevice= 0.00 |
||
66 | usb 1-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0 |
||
67 | usb 1-1: Product: OMAP4430 |
||
68 | usb 1-1: Manufacturer: Texas Instruments |
||
69 | </pre> |
||
70 | |||
71 | 22 | Denis 'GNUtoo' Carikli | Note that your kernel might need to be compiled with CONFIG_USB_ANNOUNCE_NEW_DEVICES=y |
72 | to print that. In Parabola CONFIG_USB_ANNOUNCE_NEW_DEVICES=y is enabled. |
||
73 | |||
74 | 1 | Denis 'GNUtoo' Carikli | We can also try to get a bit more infos with omap-usb-boot: |
75 | <pre> |
||
76 | $ sudo omap-usb-boot -v -w boot invalidbootmedia |
||
77 | Finding and opening USB device |
||
78 | Found and opened omap4 USB device: OMAP4430 |
||
79 | ASIC device id: 4430, HS device |
||
80 | Booting from device invalidbootmedia... |
||
81 | Booting device invalidbootmedia not found |
||
82 | Booting from device failed |
||
83 | </pre> |
||
84 | |||
85 | Here we know the device is signed because it's a "HS device". |
||
86 | If it was not signed it would print "GP device" instead. |
||
87 | 9 | Denis 'GNUtoo' Carikli | |
88 | 11 | Denis 'GNUtoo' Carikli | h3. Using the Android version or other devices properties? |
89 | 9 | Denis 'GNUtoo' Carikli | |
90 | 15 | Denis 'GNUtoo' Carikli | "hpagseddy/i9100g_xloader":https://github.com/hpagseddy/i9100g_xloader is based on "ths-backup/i9100g_xloader":https://github.com/ths-backup/i9100g_xloader which has an ics (Icecream Sandwitch, an Android version) branch only. According to hpagseddy, that branch is also used for Android Jelly brean. |
91 | 9 | Denis 'GNUtoo' Carikli | |
92 | It's still unclear if there is some correlation between Android version and signed bootloaders. |
||
93 | |||
94 | The device that was given to [[People#Denis-GNUtoo-Carikli|GNUtoo]] that has a signed bootloader also has the following characteristics: |
||
95 | |||
96 | *Software state*: Running the stock OS, unmodified |
||
97 | *Android version*: Android 2.3.6 |
||
98 | *Baseband version*: IG9100GZCLC2 |
||
99 | *Build number*: GINGERBREAD.ZCLC2 |
||
100 | *Kernel version*: 2.6.35.7 se.infra@SEI-30#2 |
||
101 | |||
102 | 18 | Denis 'GNUtoo' Carikli | According to "a thread on XDA":https://forum.xda-developers.com/galaxy-s2/development/bootloader-t1754158 there is a corelation between the @Baseband version@ and the geographic zone that is targeted. And as we can see above, the @Build number@ seem to be related to the @Baseband version@ as well. While the list of baseband versions is incomplete, we can still use it to avoid the Chinese version (CHN_CHN) which has a signed bootloader. |
103 | 17 | Denis 'GNUtoo' Carikli | |
104 | At this point it's also still unclear if any of the other characteristics above correlate to signed or unsigned bootloaders. |
||
105 | 2 | Denis 'GNUtoo' Carikli | |
106 | 20 | Denis 'GNUtoo' Carikli | As the binaries are under the GPLv2 or later, It would also be a good idea to collect all of them, match them with the device characteristics like the @Build@ number and @Baseband version@, and verify if they are signed or not with some free software tool. |
107 | 19 | Denis 'GNUtoo' Carikli | |
108 | 21 | Denis 'GNUtoo' Carikli | We could even publish the unsigned versions. As for the signed versions, if they cannot run on devices that don't enforce bootloader signatures, it would probably not be a good idea to publish them as the binaries wouldn't respect the 4 freedoms, but we can still check with the FSF if they have good ideas on that point. |
109 | |||
110 | 2 | Denis 'GNUtoo' Carikli | h2. Source code |
111 | |||
112 | * https://github.com/hpagseddy/i9100g_xloader This got rebuilt and flashed, and it worked on the device it was tested on. |
||
113 | * https://blog.the-leviathan.ch/?p=408 |
||
114 | |||
115 | 1 | Denis 'GNUtoo' Carikli | h2. TODO |
116 | |||
117 | 16 | Denis 'GNUtoo' Carikli | * Document the various firmware version mentioned here: https://www.sammobile.com/samsung/galaxy-s2/firmware/#GT-I9100G |
118 | 1 | Denis 'GNUtoo' Carikli | * Understand how to get unsigned versions (Android version, serial number, etc) |
119 | 13 | Denis 'GNUtoo' Carikli | * Get a device with an unsigned bootloader and u-boot and ask samsung for source code |
120 | 14 | Denis 'GNUtoo' Carikli | * Check the boot order on unsigned devices (is it possible to boot from USB easily?) |
121 | 6 | Denis 'GNUtoo' Carikli | * Try to boot the xloader nevertheless, as the device could be in some "verify but not enforce mode" for signatures |