Project

General

Profile

OMAPBootrom » History » Version 7

Denis 'GNUtoo' Carikli, 03/27/2020 01:30 AM

1 1 Denis 'GNUtoo' Carikli
h1. OMAPBootrom
2
3 6 Denis 'GNUtoo' Carikli
h2. Documentation
4
5 2 Denis 'GNUtoo' Carikli
The "droiddevelopers website":http://droiddevelopers.org has some information on trying to use bugs run free software on several Motorola devices.
6
7
| Device | SOC |
8
| "Motorola Milestone":https://en.wikipedia.org/wiki/Motorola_Milestone | OMAP 3430 |
9 3 Denis 'GNUtoo' Carikli
| "Motorola Milestone 2":https://en.wikipedia.org/wiki/Motorola_Milestone_2| OMAP 3630 |
10 1 Denis 'GNUtoo' Carikli
| "Motorola Defy (MB525)":https://en.wikipedia.org/wiki/Motorola_Defy | OMAP3630? |
11 6 Denis 'GNUtoo' Carikli
| Motorola Defy+ (MB526) | OMAP3 (which one?) |
12
13
That website has many information:
14
* It has documentation on the structure of signed MLOs
15 2 Denis 'GNUtoo' Carikli
16 7 Denis 'GNUtoo' Carikli
TODO:
17
* Read droiddevelopers more to understand restricted boot better.
18
* Also the OMAP wiki might have some information on OMAP restricted boot.
19
* Also look if there is substancial information in the Technical Reference Manual (TRM) about fuses but that's unlikely.
20
21 5 Denis 'GNUtoo' Carikli
h2. Code
22 1 Denis 'GNUtoo' Carikli
23 7 Denis 'GNUtoo' Carikli
* As march 2020, there are no fuses driver or code for any OMAP in either u-boot, Barebox, Linux, or crucible.
24 1 Denis 'GNUtoo' Carikli
* U-boot documentation mention TI tools that have to be obtained after signing an NDA
25 7 Denis 'GNUtoo' Carikli
* TODO: check if chipsec has infos on OMAP fuses
26 5 Denis 'GNUtoo' Carikli
27
h2. Possible attacks
28
29
* Even if it's unlikely, once we understand the OMAP restricted boot better, we could check if some devices are signed but not in enforcing mode.
30 4 Denis 'GNUtoo' Carikli
31 1 Denis 'GNUtoo' Carikli
h2. Links
32
33
* http://www.droid-developers.org : This attempts to run user code on several Motorolla smartphones. It includes analysis of the boot chain:
34
** "Application_Processor_Boot_ROM":http://www.droid-developers.org/wiki/Application_Processor_Boot_ROM
35
** "Booting_chain":http://www.droid-developers.org/wiki/Booting_chain