婆罗门
精华
|
战斗力 鹅
|
回帖 0
注册时间 2007-12-24
|
I now have proof that the Nook Tablet is efuse locked and bootloaders signed. We can only boot signed bootloaders, ,kernels, and ramdisks from microSD.
我已经证明NT采用efuse技术并且锁住了Bootloader引导程序。我们只能启动认证过的引导程序，系统内核以及SD卡上的闪存盘。
Don't buy this if you expect any real development to happen on it. The only possible way is through kexec, and that's a lot of trouble to go through considering all the other tablet options.
如果你期望NT有实质性的发展变化的话，请不要买它，你会失望的！唯一的可能是通过kexec技术，但是那将伴随着非常多的麻烦，还不如去选择其他的平板。
For what it's worth, the u-boot in the recently posted update image from the Kindle Fire does not appear to have the signed header that the one on the NT has.
不管怎样，u-boot最近贴出来的KF的升级图片中好像没有出现类似NT上的认证头文件。
Things I learned in the process:
在破解NT的过程中学到的东西（下面就不弄了，大家自己看看吧！）
-USB boot is enabled, as is SD boot
-I can boot from a microSD if I format it the same as for Nook Color (modified CHS, fat on p1) and copy the MLO, u-boot, and boot.img renamed to factory-boot.img
-There is a serial port inside that will let you at the u-boot console and a shell after the OS boots
-x-loader is signed. A known-good x-loader on microsd will not even execute, and the next item in the boot list checked (emmc)
-u-boot is signed. I know this because a known-good u-boot from Pandaboard that should be close enough to boot causes x-loader to take the code path where the secure ROM call with a pointer to the image returns nonzero
-kernel and ramdisk are signed individually in the boot.img. I can modify a byte in the boot.img on the microsd that's in the middle of the kernel or the ramdisk section and u-boot will fail the same exact call that x-loader uses to validate u-boot, but this time emitting a message complaining that the image is corrupt
-Comparing the first part of u-boot grabbed from the NC, NT, and the KF, shows that the signature that's at address 0 of the KF and NC versions is seen about 300 bytes into the NT version, with some unknown junk above. I assume that's the signature, and that the call to the secure ROM returns the image pointer (which is passed by reference, a good clue) plus the size of the header.
NT似乎彻底坑爹了
KF淘宝已有国内现货，心动 |
|
楼主: bears
沪公网安备 31010702007642号 )
发表于 2011-11-19 11:48
没看懂, 这个意思不是像楼上某位说的插上SD卡就换系统吗?
root之后能解除限制了么, 等圣诞再弄个来玩玩好了
搜索返回键如果一直显示在屏幕下方,很窄一个黑条
搞好啦...用着很顺畅