« previous next »
Pages: [1]   Go Down

Author Topic: Let's hack Nspire Boot1  (Read 10084 times)

0 Members and 2 Guests are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Let's hack Nspire Boot1
« on: January 02, 2011, 09:54:39 am »
Here are the "programs" used when booting a Nspire:

  • boot 1
  • boot 2
  • OS

Boot1 is checking boot2 signature, then launching it.
Boot2 is checking OS signature, then launching it.

Up to now, we were believing that boot2 could be updated by a software, but not boot1.


Then, if we ever managed to factor the OS key, TI just would have to use a different signing key for new OSes. This would force you to update your boot2 to a new version that would launch the new OSes signed with the new key, but not the old OSes signed with the old key.

Then, we just had to factor the boot2 key.
If boot1 couldn't be updated by a software, only new TI-Nspire could get a new boot1 using a new key and refusing to load boot2 signed with the old key.


The TI-Nspire diagnostic software 1.3 can update the NAND ROM code (boot2, diagnostic software, test program, OS). Here are the related messages:
Code: [Select]
The NandFlash has more than 20 bad blocks, please change it!!
Nand Flash Test
UpdatedNandFlash(528B)
NAND
Copy Nand  Data To SD Card
SDCard Update NandFlash Code
Search  Nand
Erasing the Nand
Copy Nand.bin to NandFlash
Search  Nand.Chk
Copy Nand.bin to RAM
Copy RAM to NandFlash
Verify SDCard Update NandFlash Code
NandIDFlashFailed
Nandflash Check
Please enter nandflash address
Nandflash Address
Please input nandflash address again
ST Micro NAND128R3A
ST Micro NAND128W3A
ST Micro NAND128R4A
ST Micro NAND128W4A
ST Micro NAND256R3A
ST Micro NAND256W3A
ST Micro NAND256R4A
ST Micro NAND256W4A
ST Micro NAND512R3A
ST Micro NAND512W3A
ST Micro NAND512R4A
ST Micro NAND512W4A
ST Micro NAND01GR3A
ST Micro NAND01GW3A
ST Micro NAND01GR4A
ST Micro NAND01GW4A
NAND_BI_RSN_READ
NAND_BI_RSN_ERASE
NAND_BI_RSN_WRITE
NAND_BI_RSN_ECC
NAND_BI_RSN_TEST
Nand Flash Test


But... it also seems the TI-Nspire diagnostic software 1.3 can update NOR ROM code (boot1), by looking for a "Nor.raw" file on the external SD card.
Code: [Select]
NOR
Verify SDCard Update NorFlash Code
Search  Nor.raw
Comparing  Nor.raw with Norflash
SDCard Update NorFlash Code
Search  Nor.Chk
Copy Nor.raw to RAM
Erasing the Norflash
Copy RAM to Norflash
NorFlash
NorFlash Test
NorFlash_ID

Then, as boot1 can be updated by a software, TI could make a new TI-Nspire OS which would update boot1 to a new version using a different key and boot2 to a new version signed with the new key. We wouldn't be able to load boot2 signed with the old key any more.


But... If I am right, boot1 is not signed.
Then, it means we would just have to disable the boot2 signature checking in boot1 in order to load a modified boot2 and then a modified OS...

Of course, TI could then release OSes that would update boot1 again (and maybe won't want to run with the hacked boot1) but we would just have to disable that security by modifying the new OSes before installing them.


Did I make a mistake somewhere?

Does anybody have the courage to try something like that on Goplat's emulator ? (for now...)
I can give the diagnostic software 1.3 dump, in order to look for the flashing code.
Logged
TI-Planet co-admin.

Offline bsl

  • LV4 Regular (Next: 200)
  • ****
  • Posts: 157
  • Rating: +14/-0
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #1 on: January 02, 2011, 10:17:07 am »
Here is the source for dumping boot1 for Ndless 1.1
It works !!!!!
Logged

Offline Goplat

  • LV5 Advanced (Next: 300)
  • *****
  • Posts: 289
  • Rating: +82/-0
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #2 on: January 02, 2011, 02:24:12 pm »
The big problem with modifying BOOT1: If anything goes wrong, your calculator is completely bricked unless you can somehow remove the BOOT1 flash chip, build a device to re-flash it, and put it back in. Maybe critor could pull this off but I certainly can't :(

Note that on the newer hardware models, the BOOT1 flash chip is not present. Their BOOT1 is most likely built in to the big ASIC as just a read-only ROM rather than Flash.
Logged
Numquam te deseram; numquam te deficiam; numquam circa curram et te desolabo
Numquam te plorare faciam; numquam valedicam; numquam mendacium dicam et te vulnerabo

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #3 on: January 02, 2011, 03:03:29 pm »
Like Goplat said, you want to be VERY confident in your code before you try anything, otherwise...  O.O
« Last Edit: January 02, 2011, 03:03:39 pm by Qwerty.55 »
Logged
∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Let's hack Nspire Boot1
« Reply #4 on: January 02, 2011, 03:38:55 pm »
But for the moment, we don't have any code.
I've said in the 1st post not to try writing on a real calculator for now.

A faulty boot1 or even a faulty boot2 will make your Nspire completly unusable.


Goplat -> It doesn't prove anything, but the TI-Nspire Diagnostic Software 2.00.1183 (the one included in TouchPad Nspire with the new hardware) still contains the NOR flashing/updating strings. The chip has been merged with the ASIC, but seems to be still writeable...
Logged
TI-Planet co-admin.

Offline fb39ca4

  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1749
  • Rating: +60/-3
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #5 on: January 02, 2011, 03:50:31 pm »
Will this be able to be tested on the emulator?
Logged

Offline JosJuice

  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1344
  • Rating: +66/-14
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #6 on: January 02, 2011, 03:50:54 pm »
Quote from: critor on January 02, 2011, 03:38:55 pm
Goplat -> It doesn't prove anything, but the TI-Nspire Diagnostic Software 2.00.1183 (the one included in TouchPad Nspire with the new hardware) still contains the NOR flashing/updating strings. The chip has been merged with the ASIC, but seems to be still writeable...
IIRC, the diagnostic software contains a lot of useless stuff such as the SD card test. That NOR flashing exists does not necessarily mean that it's possible. (Correct me if I'm wrong - I'm not really an Nspire guy.)
Logged

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55943
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Let's hack Nspire Boot1
« Reply #7 on: January 04, 2011, 12:06:20 am »
I hope that stuff is testable on an emulator too, else debugging will cost a lot of calcs x.x

It would be great is we succeeded in hacking that stuff, though.
« Last Edit: January 04, 2011, 12:06:43 am by DJ Omnimaga »
Logged

Offline fb39ca4

  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1749
  • Rating: +60/-3
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #8 on: January 04, 2011, 06:44:52 am »
At least we'll have lots of paperweights :P
Logged

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Let's hack Nspire Boot1
« Reply #9 on: January 04, 2011, 07:51:25 am »
Quote from: JosJuice on January 02, 2011, 03:50:54 pm
Quote from: critor on January 02, 2011, 03:38:55 pm
Goplat -> It doesn't prove anything, but the TI-Nspire Diagnostic Software 2.00.1183 (the one included in TouchPad Nspire with the new hardware) still contains the NOR flashing/updating strings. The chip has been merged with the ASIC, but seems to be still writeable...
IIRC, the diagnostic software contains a lot of useless stuff such as the SD card test. That NOR flashing exists does not necessarily mean that it's possible. (Correct me if I'm wrong - I'm not really an Nspire guy.)

The SD card test is not useless.
It just doesn't work with you, because you don't have the Nspire SD card reader connected to the dock.

But factories and service centers have it, in order to flash NOR (boot1) and NAND (boot2 + diagnostic + OS).
Remember that diagnostic is run at boot1 level, and that USB support is only available at boot2 level.
Logged
TI-Planet co-admin.

Offline DJ Omnimaga

  • Clacualters are teh gr33t
  • CoT Emeritus
  • LV15 Omnimagician (Next: --)
  • *
  • Posts: 55943
  • Rating: +3154/-232
  • CodeWalrus founder & retired Omnimaga founder
    • View Profile
    • Dream of Omnimaga Music
Re: Let's hack Nspire Boot1
« Reply #10 on: January 04, 2011, 04:01:04 pm »
Hmm I see now, I wondered if it was because they planned to release SD card reading support in the future or something, but it seems to become more clear that it's for their own personal use now...
Logged

Offline willrandship

  • Omnimagus of the Multi-Base.
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2953
  • Rating: +98/-13
  • Insert sugar to begin programming subroutine.
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #11 on: January 10, 2011, 06:12:45 pm »
So, the SD host is connected to the base plugs? Sweet!

Who here besides me thinks that bottom dock is too useful to be ignored? After all the uses are discovered (Aren't there still a few pins left?) I'm thinking I should make a dock for it. Strange, hackspire doesn't have anything on the SD card slot except the memory map.

Also, since the emulator asks for a boot1 file, I think we could test a modified boot1 before trying it on a calculator.
« Last Edit: January 10, 2011, 06:15:08 pm by willrandship »
Logged

Offline fb39ca4

  • LV10 31337 u53r (Next: 2000)
  • **********
  • Posts: 1749
  • Rating: +60/-3
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #12 on: January 10, 2011, 06:18:05 pm »
Ninja'd
A dock would be sweet! Battery charging, Ed reader and serial port are all on there and who knows what else?
Logged

Offline AngelFish

  • Is this my custom title?
  • Administrator
  • LV12 Extreme Poster (Next: 5000)
  • ************
  • Posts: 3242
  • Rating: +270/-27
  • I'm a Fishbot
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #13 on: January 10, 2011, 06:18:18 pm »
Quote from: critor on January 04, 2011, 07:51:25 am

The SD card test is not useless.
It just doesn't work with you, because you don't have the Nspire SD card reader connected to the dock.

But factories and service centers have it, in order to flash NOR (boot1) and NAND (boot2 + diagnostic + OS).
Remember that diagnostic is run at boot1 level, and that USB support is only available at boot2 level.

Couldn't an emulator be made for the dock? The data the calculator is expecting from the other device should be possible to discern from a disassembly of the OS, even if that would be very difficult.
Logged
∂²Ψ    -(2m(V(x)-E)Ψ
---  = -------------
∂x²        ℏ²Ψ

Offline willrandship

  • Omnimagus of the Multi-Base.
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2953
  • Rating: +98/-13
  • Insert sugar to begin programming subroutine.
    • View Profile
Re: Let's hack Nspire Boot1
« Reply #14 on: January 10, 2011, 06:23:41 pm »
OS, and Boot2 disassembly is very easy, it's just only semi-legal. Let's call it a "grey area"

Does anybody know what type of connector the nspire's dock would be called? I'm thinking card edge, but I need something single sided as well.
« Last Edit: January 10, 2011, 06:25:23 pm by willrandship »
Logged
Pages: [1]   Go Up
« previous next »