[removed]

[critor]

Should I remove this thread?

I don't think so.

It's still very interesting.

[Lionel Debroux]

Yup, no need to remove this thread, stop working, or delete content on Github

[parrotgeek1]

.

[parrotgeek1]

.

[critor]

Correct me if I'm wrong, your signature patch let us run DVT Boot2 on production Boot1 ?

I'm not sure this has any application on real hardware, but it's still great : we'll b able to test DVT Boot2/OS much more easily on Firebird !

Could you share the patch then ?

Should I remove this thread?

I don't think so.

It's still very interesting.

Can you help me find the nboot patch for boot1?

08 C0 85 E2 44 58 94 E5 03 00 9C E8 14 20 87 E2 01 00 55 E3 03 00 82 E8 10 50 8D E5 01 10 05 E2 01 20 A0 E3 08 30 87 E2 E7 FF FF 3A 00 00 51 E3 07 00 00 0A 08 20 8C E2 03 00 92 E8 02 20 A0 E3 1C E0 87 E2 02 00 55 E1 03 00 8E E8 08 30 83 E2 DD FF FF 3A 82 41 8C E0 03 00 94 E8 01 20 82 E2 82 E1 8C E0 14 40 83 E2 03 00 84 E8 03 00 9E E8 01 20 82 E2 1C E0 83 E2 02 00 55 E1 03 00 8E E8 10 30 83 E2 F2 FF FF 2A CF FF FF EA

does not exist

Which nBoot patch ?
Are you trying to port nBoot for DVT Boot1 3.0.0.0 ?

I suppose it's the code in the nBoot manuf.img file which will have to be fixed...

[parrotgeek1]

.

[critor]

Where are the signature keys in Boot2 4.0.3.49 and 3.0.0.0DVT ?
I suppose ControlX could just patch them when you'd like to install+run a DVT OS.

[parrotgeek1]

.

[critor]

Where are the signature keys in Boot2 4.0.3.49 and 3.0.0.0DVT ?
I suppose ControlX could just patch them when you'd like to install+run a DVT OS.

cant find them, sorry

Ok, found several of them.

For 1024-bits RSA keys, search for :

Code: Select all

30 81 89 02 81 81 00 [128 bytes: the key] 02 03 01 00 01

There is one in the CX 3.0.0.0 DVT Boot2 image.

For 2048-bits RSA keys, search for :

Code: Select all

30 82 01 0A 02 82 01 01 00 [256 bytes: the key] 02 03 01 00 01

There are 7-8 of them in all tested CX/CM Boot2 images.
I don't know which one is used for the OS.

have you found nboot vulnerability fix for boot1 yet? I need it, see above

For Boot1 3.0.0.0 DVT ?
Sorry, I don't know how to patch it.

[critor]

Ok, CX Boot2 DVT and production have both following 2048-bits keys :
- BA EA ...
- A5 4F ...

CX DVT Boot2 3.0.0.0 is using the BA EA... key to validate TI-Nspire.cer.

CX production Boot2 are using the A5 EF... key to validate TI-Nspire.cer.

CM Boot2 don't have the A5 EF... key, but a D3 C1... key used to validate TI-Nspire.cer.

That's why CX Boot2 4.0.3 with ControlX currently cannot launch CX DVT or CM OSes.