I know more about computers than I do phones so I need some educating. What does the boot loader do that keeps you from going back to an earlier OS? Why can't it just be formatted like your HD on your PC and start from fresh? Maybe you need to explain the function of the boot loader. Thanks.
![Photo](http://www.droidrzr.com/uploads/profile/photo-thumb-87879.jpg?_r=1402112912)
How does the boot loader keep you from going back?.
#1
Posted 08 June 2014 - 05:02 AM
#2
Posted 08 June 2014 - 05:24 AM
VZW Samsung Galaxy S7 Stock and unrooted running Marshmallow 46A, 32gb Nexus 7 unlocked
#3
Posted 08 June 2014 - 05:41 AM
I don't really NEED to explain anything. Now I get you're asking to be educated and I appreciate that, but, the tone of how you posted it is really off putting and sounds almost as if I owe you an explanation. Not to mention this information is out there, if only you actually searched for it instead of demanding to be spoon fed.
Start there. Once you've understood that, continue reading.
Modern phones have a trusted zone partition. This partition is a security layer that sits between the kernel and the physical hardware. That means any time the kernel wants to do something with the hardware, it has to go through the trusted zone. The trusted zone on the HD and M at one point had a security hole which allowed a rooted phone to execute the code in the trusted zone that unlocks the device without needing a security token. That hole, as we all know, was closed thus preventing unlocks from taking place.
What you asked about is how phones disallow downgrading. The bootloader plays a very small part in that. When a phone boots up, there's an "aboot" partition that loads first. It determines if the device should boot in secure or unsecure mode. How it determines that varies from device to device. On the HD and M, it's checking to see if a particular eFuse is blown...the one that the trusted zone blows when the unlock function is called. If the device is determined to be unlocked, then the security chain is skipped and you're allowed to flash almost anything to your device. Almost. We'll get to the limitations in a minute. If the device is locked, it boots up with the secure chain. Bootloader disallows flashing and loading of unsigned code. This is what prevents you from flashing a custom recovery on a locked device. In both cases, the trusted zone is active, however. There are lots of reasons for this, but, the biggest is to prevent someone from flashing unsigned radios.
So the trusted zone is always enabled, even on unlocked devices. This means that even on an unlocked phone, you can't downgrade the trusted zone partition. Once it's updated, it stays updated. Next up is the aboot and gpt partitions. The gpt is the partition table which determines the location of all the partitions. This was recently changed on the kitkat builds, for example. Aboot has a part to play on some phones in determining what can and can't be flashed. Same with GPT. They contain a "security version" for all the partitions. I've been able to determine that for locked HD/M's, it works like this:
GPT or aboot is updated, security table is increased for each partition. After that point, no partition with a lower security version can be flashed else you soft brick the phone and end up in AP Fastboot mode with a security error. My research has shown that something else also happens which is disturbing to me, to be honest. Let's say you skip flashing aboot, gpt, and tz and only flash the partitions themselves. In theory you should be able to downgrade on a locked device. I had someone test this theory. It doesn't work as expected. The reason is that the partitions contain the security version. Once you flash, let's say, boot from a higher version, it will never let you flash a lower version boot partition. Again, this is controlled via the secure boot chain, so there's no circumventing it. You're not going to "trick it". You're not going to unlock it. You're not going to "crack the signature so you can sign your own code". Or any other crazy idea you may think you have for getting around it. They're using 128 bit encryption for their signatures. GLWT.
That, in a nutshell, is a long detailed answer to your question. Short answer....because the security prevents it.
- Thach, hectorlumbago, matjmonk and 9 others like this
Non potest esse nisi unus
#4
Posted 08 June 2014 - 06:26 AM
Sent from my Droid MAXX
- SamuriHL and johnthehillbilly like this
#5
Posted 08 June 2014 - 07:05 AM
Sent from my S-Offed One M8
- Thach and johnthehillbilly like this
Sig by livinginkaos
Samsung S8+ / Pixel XL 128gb / iPhone 7+ 256gb / iPad Pro 12.9" / Samsung Chromrbook Plus / Pixel C / Nexus 6p 128gb / Nexus 6 / Nexus 6 on Fi / Nexus 9 / Moto 360^2 / Nvidia Shield TV Pro / Nvidia Shield Tablet / HTC EVODesign on FreedomPop / Chromecast / Surface Pro 3 i7 / Samsung Tab Pro 12.2 / Lenovo Win8 Tab / Eee Slate / '13 Nexus 7
#6
Posted 10 June 2014 - 04:00 PM
- Thach likes this
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users