Author Topic: Take full control with Boot1 1.1.9999  (Read 6663 times)

0 Members and 1 Guest are viewing this topic.

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Take full control with Boot1 1.1.9999
« on: January 13, 2013, 07:54:30 am »
The TI-Nspire starts in 3 steps:
  • Boot1
  • Boot2
  • OS
In this security model, each software component ensures the integrity of the next one.

Since last year, it became possible to reprogram the boot1 on prototypes TI-Nspire ClickPad from Q1 2007, permanently transforming these into production models accepting the latest OS released on TI website.
Indeed, these prototypes were using an external read-write Flash-NOR chip.

But this is not limited to prototypes! ;)
We already knew that the TI-Nspire TouchPad had their Flash NOR chip moved into the ASIC chip. So so far, that chip is out of our reach.
We noticed in a previous news that TI-Nspire ClickPad Hardware Revision C and later had their Flash NOR chip incorporated into the ASIC chip too.


We do not know about hardware revisions B, but the very first production TI-Nspire released in 2007 and their hardware revision A have a motherboard similar to the prototypes with the same external Flash NOR chip! ;D

The only problem is that their Flash NOR chip is physically set to read-only through a difference in the pinout:

But a tiny hardware modification was enough to make that chip rewriteable, as presented in a previous news for non-CAS TI-Nspire:

After a first successful test of a Boot1 reflashing in a previous news, I'm honored to present you today the lastest achievment of the TI community, Boot1 1.1.9999! ;D


This is a patch for the Boot1 1.1.8916 coming with all production TI-Nspire ClickPad and TouchPad, which will allow you to install and run:
  • production Boot2
  • development Boot2
  • modified Boot2
  • production Diagnostics
  • development diagnostis
  • modified diagnostics
Meaning that is does accept modified images which don't pass the RSA signature check!  :crazy:

For example, here is a TI-Nspire with Boot1 1.1.9999, running on a 1.4.1571 Boot2 whose version string has been patched to 1.4.9999:



The possibilities are simply huge!

On the one hand, this is a feat far greater than in a nLaunch previous news.

Ndless was taking control of your TI-Nspire inside the OS 3.1.

nLaunch was allready one step above as it was taking control of your TI-Nspire inside the Boot2 1.4, meaning that you could do everything with the OS.

And now, we're taking full control of the hardware inside the Boot1 1.1.8916, meaning that we can do everything with the Boot2 and Diagnostics software, and by extension with the OS.


Everything is now possible, just be inspired and imagine:
  • using development Diagnostics softares which much more interesting options ;D
  • have our own diagnostics software or maintenance menu with much more options ;D
  • using U-Boot to start Linux directly without having to go through the OS 3.1 and Ndless ;D
  • having a boot menu to choose the OS to launch within a multi-boot ;D
  • using a modified Boot2 that does not check the signatures of the OS to launch, the mode ID or CAS / non-CAS type
  • programming and running all this in the Diags area which, unlike the Boot2 area, is not checked/reprogrammed after installing a new OS ;D
  • ...
As a bonus for you, here is the historical video of the live first flashing of Boot1 1.1.9999! ;)
[ Invalid YouTube link ]



Source & downloads:
http://tiplanet.org/forum/viewtopic.php?t=11102&lang=en
« Last Edit: January 13, 2013, 07:54:57 am by critor »
TI-Planet co-admin.

Offline TIfanx1999

  • ಠ_ಠ ( ͡° ͜ʖ ͡°)
  • CoT Emeritus
  • LV13 Extreme Addict (Next: 9001)
  • *
  • Posts: 6173
  • Rating: +191/-9
    • View Profile
Re: Take full control with Boot1 1.1.9999
« Reply #1 on: January 13, 2013, 07:59:14 am »
Great work as usual! :)

Offline ElementCoder

  • LV7 Elite (Next: 700)
  • *******
  • Posts: 611
  • Rating: +42/-2
    • View Profile
Re: Take full control with Boot1 1.1.9999
« Reply #2 on: January 13, 2013, 10:50:48 am »
What can I say but to agree with Art_of_camelot :) I keep thinking at each news 'ok, this is our last victory' but you guys keep going :) The possibility of cold launching linux and/or multiboot souds great! :D

Some people need a high five in the face... with a chair.
~EC

Offline Juju

  • Incredibly sexy mare
  • Coder Of Tomorrow
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 5730
  • Rating: +500/-19
  • Weird programmer
    • View Profile
    • juju2143's shed
Re: Take full control with Boot1 1.1.9999
« Reply #3 on: January 13, 2013, 11:39:45 am »
Great work indeed! I would totally love seeing the Linux bootloader installed as Boot2.

Remember the day the walrus started to fly...

I finally cleared my sig after 4 years you're happy now?
THEGAME
This signature is ridiculously large you've been warned.

The cute mare that used to be in my avatar is Yuki Kagayaki, you can follow her on Facebook and Tumblr.

Offline excale

  • LV4 Regular (Next: 200)
  • ****
  • Posts: 103
  • Rating: +19/-1
    • View Profile
Re: Take full control with Boot1 1.1.9999
« Reply #4 on: January 13, 2013, 11:43:59 am »
You can already have linux bootloader as your OS with nLaunch :).

Offline Sorunome

  • Fox Fox Fox Fox Fox Fox Fox!
  • Support Staff
  • LV13 Extreme Addict (Next: 9001)
  • *************
  • Posts: 7920
  • Rating: +374/-13
  • Derpy Hooves
    • View Profile
    • My website! (You might lose the game)
Re: Take full control with Boot1 1.1.9999
« Reply #5 on: January 13, 2013, 03:15:27 pm »
Awesome as usual!
But with these new cool flashing I got a question: If somebody else wants to flash it, does he/she still need to mod the hardware with that switch?

THE GAME
Also, check out my website
If OmnomIRC is screwed up, blame me!
Click here to give me an internet!

Offline Lionel Debroux

  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2135
  • Rating: +290/-45
    • View Profile
    • TI-Chess Team
Re: Take full control with Boot1 1.1.9999
« Reply #6 on: January 13, 2013, 03:17:30 pm »
Quote
If somebody else wants to flash it, does he/she still need to mod the hardware with that switch?
Yes, it's still needed.
Member of the TI-Chess Team.
Co-maintainer of GCC4TI (GCC4TI online documentation), TILP and TIEmu.
Co-admin of TI-Planet.

Offline TheNlightenedOne

  • LV6 Super Member (Next: 500)
  • ******
  • Posts: 427
  • Rating: +16/-1
    • View Profile
Re: Take full control with Boot1 1.1.9999
« Reply #7 on: January 25, 2013, 09:22:52 pm »
That's a great development for the TI-Nspire. :D I'm excited to see what people end up doing with the ability to flash arbitrary boot1s.
Also, how did you get the ASIC scan?
"Eris" (Ndless 3.1)
"Keto" (Ndless 3.1)
"Luna" (AMS 3.10, HW4)
"Aurora" (2.55MP)

Offline critor

  • Editor
  • LV11 Super Veteran (Next: 3000)
  • ***********
  • Posts: 2079
  • Rating: +439/-13
    • View Profile
    • TI-Planet
Re: Take full control with Boot1 1.1.9999
« Reply #8 on: January 26, 2013, 03:41:24 am »
Hi,

I've made a news with all available scans from the first TI-Nspire ClickPad ASIC (initial hardware + hardware revision A).
http://tiplanet.org/forum/viewtopic.php?t=10486

All scans (raw) come from microblog.routed.net:
http://microblog.routed.net/2008/08/15/ic-friday-tis-nspire/

But unfortunately, the site is not updated anymore. It could have been useful to get ClickPad revision C-J, TouchPad and CX ASIC scans and look for the internal NOR chip...
TI-Planet co-admin.