Exploitee.rs

Referring to the Logitech Review Hardware page: http://gtvhacker.com/index.php/Logitech ... ware#Usage

It says:

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Has any effort been made toward using a u-boot system, like the Nook devices? It seems like we could maybe build USB sticks with a system image, and then boot from that. This would at least preserve the existing OS letting us try things like Honeycomb before committing fully.

Another benefit to this, it would allow us to be more experimental with hacking the boot and kernel images to gain root.

I've been reading, and may have answered my own question...

I tracked down some really great information about the Android boot process:
http://www.androidenea.com/2009/06/andr ... er-on.html and
http://bootloader.wikidot.com/linuxandroid

So presumably, if the USB stick can replace /sda on boot, then we just need to create a bootloader for a USB stick formated as an EXT2 filesystem.

My initial thought was that we'd use U-Boot, which is the embedded systems bootloader of choice for ARM devices, such as the Nook Color. U-Boot doesn't seem to support the Atom processor, so no luck for us with an Atom CE4150. http://www.mail-archive.com/u-boot@list ... 22736.html

The coreboot listserv had discussion about working with the Atom, but there was no specific discussion about the CE4150 (or family of devices the CE4100). http://search.gmane.org/?query=atom&aut ... x.bios---A

Furthermore, it sounds like we don't even have access to an SDK from Intel. I found this page about Embedded Software Development, and it proved to be useful: http://www.cnx-software.com/2010/11/30/ ... 30-ce4150/

Strange as it may be, maybe we need to try and talk to the D-link Boxee Box devs, as the Boxee apparently ships with the less powerful CE4100 sibling. If someone from that development community has acquired the SDK, that is one step in the right direction for us to port coreboot and start making a bootable USB stick. Maybe we'll have it working by the time the Revue 3 rolls out.

Chinpokomon wrote:I've been reading, and may have answered my own question...

I tracked down some really great information about the Android boot process:
http://www.androidenea.com/2009/06/andr ... er-on.html and
http://bootloader.wikidot.com/linuxandroid

So presumably, if the USB stick can replace /sda on boot, then we just need to create a bootloader for a USB stick formated as an EXT2 filesystem.

My initial thought was that we'd use U-Boot, which is the embedded systems bootloader of choice for ARM devices, such as the Nook Color. U-Boot doesn't seem to support the Atom processor, so no luck for us with an Atom CE4150. http://www.mail-archive.com/u-boot@list ... 22736.html

The coreboot listserv had discussion about working with the Atom, but there was no specific discussion about the CE4150 (or family of devices the CE4100). http://search.gmane.org/?query=atom&aut ... x.bios---A

Furthermore, it sounds like we don't even have access to an SDK from Intel. I found this page about Embedded Software Development, and it proved to be useful: http://www.cnx-software.com/2010/11/30/ ... 30-ce4150/

Strange as it may be, maybe we need to try and talk to the D-link Boxee Box devs, as the Boxee apparently ships with the less powerful CE4100 sibling. If someone from that development community has acquired the SDK, that is one step in the right direction for us to port coreboot and start making a bootable USB stick. Maybe we'll have it working by the time the Revue 3 rolls out.

Sounds promising, a little above my league of programming at this time however. Definitely interested to see where this could go. Great research on your part! +1

I hate to bring a thread to a hault - but:

The Revue does not boot from sda, that is just used for storage (its CHROME:).

The kernel (which is signed), boots from the OTHER onboard flash (the Samsung) which is not hooked up as a USB device, and there is a trusted chain of boot, so you can't even replace the bootloader without it being signed.

Well, I that's disappointing.

What does the validation of the bootloader? Is that a function of the Atom processor? I saw that the CE4150 had some sort of security capabilities built in.

I just picked up my Revue and I'm looking for ways we can get around the locks in place. I'll keep looking.

Chinpokomon wrote:Well, I that's disappointing.

What does the validation of the bootloader? Is that a function of the Atom processor? I saw that the CE4150 had some sort of security capabilities built in.

I just picked up my Revue and I'm looking for was we can get around the locks in place. I'll keep looking.

It seems so, yes - that the SOC (CE4150) does the validation of the bootloader, internally.

the kernel of the "normal" system, is it also signed?

pcgeil wrote:the kernel of the "normal" system, is it also signed?

The update packages are signed, I don't think the kernel normally is. Looking at http://android-dls.com/wiki/index.php?t ... oot_Images, it doesn't look like it is. Is that what you mean by a "normal" system.

I mean, the D-Link Boxee Box HD Media Player is less powerful than the GTV.
Would it be possible to use the kernel and the rootfile system of boxee?
Most of it should be compatible.

I want XBMC to get running on the GTV, maybe even without android!
with 99$ it would be the cheapest xbmc or boxee device.

pcgeil wrote:I mean, the D-Link Boxee Box HD Media Player is less powerful than the GTV.
Would it be possible to use the kernel and the rootfile system of boxee?
Most of it should be compatible.

I want XBMC to get running on the GTV, maybe even without android!
with 99$ it would be the cheapest xbmc or boxee device.

As a SoC device, the architecture may be similar enough for all the drivers to work. It would be an interesting way to test the boot signing... I don't know how easy it'd be to replace though. My guess is it'd have to be done through the UART or a JTAG port.