BootloadersFreedom » History » Revision 39
Revision 38 (Denis 'GNUtoo' Carikli, 02/24/2020 02:20 AM) → Revision 39/70 (Denis 'GNUtoo' Carikli, 02/24/2020 02:22 AM)
h1. Bootloaders h2. Devices configurations |_. Device and documentation |_. Freedom situation |_. Boot order | | [[NexusSI902xBootloader| Samsung Nexus S (i902x)]] | Proprietary, Signed on the tested devices | ?->USB->?->eMMC->? | | [[I9100Bootloader| Samsung Galaxy S2 (i9100)]] | Proprietary, probably Signed | ? | | [[GalaxyTab2Bootloader| Samsung Galaxy Tab 2]] | Proprietary, signed | ?->USB->?->eMMC->? | | [[OptimusBlackBootloader| LG Optimus black (p970)]] | unsigned, can be replaced with upstream u-boot | eMMC(MMC2)->USB | | Galaxy [[Exynos4Bootrom|Galaxy SIII (I9300) Galaxy SIII 4G (I9305) Galaxy Note II (N7100) Galaxy Note II 4G (N7105) (N7105)]] | * Proprietary, Signed * There is work in progress to understand if we can avoid the signature | ?->eMMC->?->USB->? | | Golden Delicous GTA04 | unsigned, free software | * Aux not pressed during boot: ? * Aux pressed during boot: ?->SD->?->NAND SYS_BOOT0 = 1 SYS_BOOT1 = 1 SYS_BOOT2 = 1 SYS_BOOT3 = 1 SYS_BOOT4 = 1 SYS_BOOT5 = AUX button SYS_BOOT6 = 1 But cannot find Reference manual for the DM370 | h2. System on a chip |_. SOC and documentation |_. Freedom situation | | [[Exynos4Bootrom|Exynos 4]] | * Some or all devices are signed * work in progress to understand if it's possible to bypass the signature | | [[BroadcomVideoCore]] | The SOCs have the ability to check signatures | | [[TegraBootrom]] | * Not all devices are signed * Boot from USB is possible thanks to "fusee_gelee":https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md | | IMX 5 and 6 | * Not all devices are signed * Thanks to "Ref_QBVR2017-0001.txt":https://github.com/f-secure-foundry/usbarmory/blob/master/software/secure_boot/Security_Advisory-Ref_QBVR2017-0001.txt it's possible to bypass signatures anyway, and maybe load code through USB too | h2. Other attempts that involves bypassing the bootrom There have been several security issues in bootrom, which can enable to run fully free software bootloaders, that are under the user control, even on devices that are configured to enforce bootloader signatures. The most interesting security issues is when it enables to just replace the nonfree bootloader by a free bootloader that is controlled by the user. While being able to load a free bootloader through USB is nice, it's not enough per se as it has usability concerns: it's not convenient to need another computer each time you need to power on your smartphone or tablet. It seems that according to a "youtube video":https://www.youtube.com/watch?v=REx_qSTulJM small enough USB dongles exist that implemented fusee_gelee for the Nitendo Switch. On tegras, as the bootrom can also be patched as part of it ends up being in the fuse memory region, it may be possible to patch the bootrom to bypass the code signature and not need such dongles. |_. Affected SOCs |_. Type |_. Link | | Tegra | USB boot | "fusee_gelee":https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md | | IMX 5 and 6 | Normal boot, and maybe USB boot too | "Ref_QBVR2017-0001.txt":https://github.com/f-secure-foundry/usbarmory/blob/master/software/secure_boot/Security_Advisory-Ref_QBVR2017-0001.txt | Other links to cathegorize: * http://www.droid-developers.org : This attempts to run user code on several Motorolla smartphones. It includes analysis of the boot chain: ** "Application_Processor_Boot_ROM":www.droid-developers.org/wiki/Application_Processor_Boot_ROM ** "Booting_chain":http://www.droid-developers.org/wiki/Booting_chain * https://www.theiphonewiki.com/ has a list of "Bootrom security issues":https://www.theiphonewiki.com/wiki/Bootrom for apple devices. * "Ti Nspire":https://hackspire.org ? RSA exponent issues? == See also == * [[Upstream]]