(07-18-2019 01:53 AM)Claudio L. Wrote: (07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote: Well, just about the only thing in common between G1 and G2 is that they look identical externally. They have completely different hardware, firmware, OS, recovery, booting mechanism and so on. Also, unlike the G1 we can't just hitch a ride on HP's firmware because a chain of trust is enforced (however, a root of trust is not enforced, so booting non-HP firmware is possible through the SoC's recovery, it does require opening the calculator up but hardware mods aren't necessary, I guess Zephray never tried to apply 3.3v on TP907 during reset).
Are you sure you can't replace the firmware? I don't know the specifics of this particular chip but in general even when enforcing secure boot only the lowest level bootloader needs to be signed (usually called BL1 or similar). Once the internal boot ROM verified that signature, control is transferred and it's entirely up to that code what can be loaded, and most other security features are just sitting there waiting to be enabled by that same signed code, if it doesn't do it then we are good. Typically that BL1 loads another 2nd stage bootloader like uboot, but that one only needs to be signed if whoever wrote BL1 requires it. Unless HP specifically required their firmware to be signed it shouldn't be. Perhaps there's some kind of checksum used to check integrity, but I don't think any signature would be required.
I think I remember a comment from Tim stating it wasn't locked but they had all the means ready to do so if somebody messed with the exam mode.
(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote: I've had SoC's recovery and JTAG running since last December, but I just couldn't get the gosh darn DDR controller to work. That's the main breakthrough of Zephray (alongside reverse-engineering most of the hardware on the way) which allows running U-Boot and Linux on the calculator. I'm must say I'm thoroughly impressed by how quickly Zephray achieved such results in less than a week. Then again, reverse-engineering hardware is really not my cup of tea, it's cool seeing in action someone who actually knows what they're doing at this stuff.
The fact you got JTAG running shows they didn't try to activate the security features, since Freescale includes secured JTAG as well. These newer CPUs are much harder to bring up than the older generations so don't feel bad, I agree his progress was incredibly fast, a very talented individual.
They said they will take steps "if somebody messed with the exam mode"?
Come on,according to their firmware ,I think they are too simple to block out others cracking their products.
They programed firmware badly ,which made it impossible to even use the storage space completely.
LMAO.
Search
Member List
Calendar
Help
