Forum TI-Planet.org

parrotgeek1 a écrit:Should I remove this thread?

I don't think so.

It's still very interesting.

Yup, no need to remove this thread, stop working, or delete content on Github

Correct me if I'm wrong, your signature patch let us run DVT Boot2 on production Boot1 ?

I'm not sure this has any application on real hardware, but it's still great : we'll b able to test DVT Boot2/OS much more easily on Firebird !

Could you share the patch then ?

parrotgeek1 a écrit:
critor a écrit:
parrotgeek1 a écrit:Should I remove this thread?

I don't think so.

It's still very interesting.

Can you help me find the nboot patch for boot1?

08 C0 85 E2 44 58 94 E5 03 00 9C E8 14 20 87 E2 01 00 55 E3 03 00 82 E8 10 50 8D E5 01 10 05 E2 01 20 A0 E3 08 30 87 E2 E7 FF FF 3A 00 00 51 E3 07 00 00 0A 08 20 8C E2 03 00 92 E8 02 20 A0 E3 1C E0 87 E2 02 00 55 E1 03 00 8E E8 08 30 83 E2 DD FF FF 3A 82 41 8C E0 03 00 94 E8 01 20 82 E2 82 E1 8C E0 14 40 83 E2 03 00 84 E8 03 00 9E E8 01 20 82 E2 1C E0 83 E2 02 00 55 E1 03 00 8E E8 10 30 83 E2 F2 FF FF 2A CF FF FF EA

does not exist

Which nBoot patch ?
Are you trying to port nBoot for DVT Boot1 3.0.0.0 ?

I suppose it's the code in the nBoot manuf.img file which will have to be fixed...

Where are the signature keys in Boot2 4.0.3.49 and 3.0.0.0DVT ?
I suppose ControlX could just patch them when you'd like to install+run a DVT OS.

parrotgeek1 a écrit:
critor a écrit:Where are the signature keys in Boot2 4.0.3.49 and 3.0.0.0DVT ?
I suppose ControlX could just patch them when you'd like to install+run a DVT OS.

cant find them, sorry

Ok, found several of them.

For 1024-bits RSA keys, search for :

Code: Tout sélectionner: 30 81 89 02 81 81 00 [128 bytes: the key] 02 03 01 00 01

There is one in the CX 3.0.0.0 DVT Boot2 image.

For 2048-bits RSA keys, search for :

Code: Tout sélectionner: 30 82 01 0A 02 82 01 01 00 [256 bytes: the key] 02 03 01 00 01

There are 7-8 of them in all tested CX/CM Boot2 images.
I don't know which one is used for the OS.

parrotgeek1 a écrit:have you found nboot vulnerability fix for boot1 yet? I need it, see above

For Boot1 3.0.0.0 DVT ?
Sorry, I don't know how to patch it.

Ok, CX Boot2 DVT and production have both following 2048-bits keys :
- BA EA ...
- A5 4F ...

CX DVT Boot2 3.0.0.0 is using the BA EA... key to validate TI-Nspire.cer.

CX production Boot2 are using the A5 EF... key to validate TI-Nspire.cer.

CM Boot2 don't have the A5 EF... key, but a D3 C1... key used to validate TI-Nspire.cer.

That's why CX Boot2 4.0.3 with ControlX currently cannot launch CX DVT or CM OSes.

Forum TI-Planet.org

[removed]

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS

Re: Patching 4.4.0.532 CAS to run on Non-CAS