This is the RAM location where the X-LOADER block is copied into RAM. User droid001 has compared the Droid dump, the Milestone dump and the example CSST HS image, proposing an ISW structure like this one:Ġ200: 00 24 00 00 8c be 00 00 00 00 00 00 00 00 00 00Ġ210: 00 00 00 87 58 2d 4c 4f 41 44 45 52 00 00 00 00 Offset (mbmloader img) Value MeaningĜommentĠx0200Đx00002400 ISW offset1) to X-LOADERĠx0204Đx0000BE8C X-LOADER block length This is the number of bytes to load into RAM, since the whole X-LOADER block is copied. This header is not publicly documented (i.e., not in the TRM) for HS devices like the Milestone and the Droid. Since the NAND flash cannot be used to XIP (eXecute In Place), and since there must be public-key certificates inside the ISW block, there's a header on the ISW (Initial SoftWare) block. (The original site is no longer accessible).
The information below contains specific information from another handset bearing similar hardware features as Nokia N900. X-Loader portion is not only signed but was said to be encrypted in AES 256bit. The first stage is the NOLO-X Loader (which is signed) and NOLO-secondary (which is not signed and is only a binary blob, if you want to edit secondary.bin, see the section NOLO hacking). The booting stage is separated into two parts prior to the booting of the kernel from /dev/mtd3.
Nokia's keys (which was never given to public). OMAP3430 CSST Binary Release - Version 2.5 Most of the information has been scoured from various sources, credit goes to jacekowski for providing insights. The information pertain requires JTAG and knowledge when dealing with serial debugging, etc. For all NOLO related hacks see: here and here.
0 kommentar(er)
