Unlocking the Motorola Bootloader with a TrustZone Exploit
bits-please.blogspot.com
Unlocking the Motorola Bootloader with a TrustZone Exploit
1–10 of 30 posts
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#2Interesting part about QFuses. How are they actually implemented in the hardware?
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#3Interesting part about QFuses. How are they actually implemented in the hardware?
AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#4Oooh sunshine is about to take a hit I guess.
added: wish you could subscribe to users on HN, I missed all your previous goodies
wow you make it all look so easy, but it's not at all
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#5Interesting part about QFuses. How are they actually implemented in the hardware?
AFAIK it's unknown - there's a controller on the SoC which is responsible for reading/writing the fuses, but its firmware is in mask ROM and isn't available. Perhaps it's a real chemical reaction? Maybe it's just emulated in firmware? Your guess is as good as mine.
Could easily be an actual fuse. A array of skinny pieces of metal with a big monster current source to pop them on command.
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#6Interesting part about QFuses. How are they actually implemented in the hardware?
Generically, it would be referred to as "OTP NVM", or one time programmable non-volatile memory.
There are apparently a few different ways to implement that.
A little dry, but the only thing I could find with some comparison of approaches: http://www.kilopass.com/wp-content/uploads/2010/04/compariso...
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#7Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware.
This is the sort of thing Senators are for.
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#8Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware. This is the sort of thing Senators are for.
Personally, I would rather vote with my dollars than ask for more rules.
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#9Oooh sunshine is about to take a hit I guess. added: wish you could subscribe to users on HN, I missed all your previous goodies wow you make it all look so easy, but it's not at all
Thanks! I'm also on twitter in case that helps (@laginimaineb).
As for Sunshine - I'm publishing a new (even broader) zero-to-TZ saga, complete with exploits, but I'm not going to create a product out of it. So ultimately, as long as there are people behind Sunshine who are willing to make it work with relative ease, I'm sure most people won't mind spending a few dollars to unlock their device.
As for the more tech-savvy crowd; I hope they choose to do it themselves with the exploits provided - it is much more fun that way, IMHO.
Re: Unlocking the Motorola Bootloader with a TrustZone Exploit
#10Today I learned that headset manufacturers could simply NOT blow the "engineering" QFuse and their devices would suddenly be FOSS compatible hardware. This is the sort of thing Senators are for.
Note that the engineering fuse is blown on the Nexus 4 and 5, too. This stops you reflashing the lk bootloader, but doesn't stop you chainloading into something more interesting, like https://github.com/grub4android/grub