1

I've seen multiple blog posts of people getting around the U-Boot bootdelay 0 environment variable to get to the U-Boot CLI. An example is here. The general process, as I understand it, is:

  1. Desolder/short flash chip so U-Boot cannot access it
  2. Power on device
  3. U-Boot can't find flash chip and drops to CLI

    eth1 up
    eth0, eth1
    Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
    ath_spi_nand_ecc: Couldn't enable internal ECC
    Setting 0x181162c0 to 0x3061a100
    Hit any key to stop autoboot:  0 
    ** Device 0 not available
    ath>
    
  4. Change bootdelay to non-zero value:

    ath> setenv bootdelay 3
    ath> saveenv
    Saving Environment to Flash...
    Protect off 9F040000 ... 9F04FFFF
    Un-Protecting sectors 4..4 in bank 1
    Un-Protected 1 sectors
    Protect off 9F050000 ... 9F05FFFF
    Un-Protecting sectors 5..5 in bank 1
    Un-Protected 1 sectors
    Erasing Flash... 9F050000 ... 9F05FFFF ...Erasing flash... 
    First 0x5 last 0x5 sector size 0x10000 5
    Erased 1 sectors
    Writing to Flash...  9F050005 ... 9F060000 ...write addr: 9f050000
    write addr: 9f040004
    done
    Protecting sectors 5..5 in bank 1
    Protected 1 sectors
    Protecting sectors 4..4 in bank 1
    Protected 1 sectors
    ath>
    
  5. Power off device and reconnect flash chip.

As far as I know, U-Boot and its environment variables reside in flash. If the flash chip is disconnected from the CPU, how is U-Boot even loaded, and how can the bootdelay variable be saved in persistent storage?

  • If you can get the source code to your version of u-boot and compile it, you can change the boot delay and other things... – jc__ May 25 '17 at 15:41
  • I am not asking how this can be done differently. This U-Boot trick is used for reverse engineering purposes (getting access to embedded devices you don't own). I'm asking how is it even possible for this trick to work, as I might be missing something. – c0mpute May 25 '17 at 15:44
  • Oh okay. If you custom compiled u-boot for your device and loaded it into memory, not flash, you would then have a u-boot with the tools you compile in to access the flash (read write) and no physical mod to the flash required. You could then change the environment variables. Reverse engineering 101 run your own binary. – jc__ May 25 '17 at 15:54
  • Hey what about changing the variables in a firmware update, then flash the custom update? This would overwrite the flash... – jc__ May 25 '17 at 15:57
  • Correct me if I'm wrong, but you would need access to the U-Boot CLI to load your own custom compiled U-Boot into memory, which makes the whole custom U-Boot idea useless. EDIT: Again, I'm not looking for different ways of getting access to the U-Boot CLI, I'm just curious about how this trick works, since I've seen it in multiple places. In order to flash a custom update you would need a proper flash image to work with, which is why the U-Boot CLI is needed (in some cases). I know you could just desolder the flash and read it directly, but I'm interested in this method specifically. – c0mpute May 25 '17 at 15:58
0

This is a very specific example. In this specific example what's going on is that U-Boot resides in NOR flash (one chip) and the Linux kernel resides in NAND flash (a second chip). The referenced guide has you remove the NAND chip from the board so that the boot fails, we drop to the U-Boot command line and then you can change and save bootdelay as U-Boot is in this case configured to save environment in the NOR flash as well.

  • That would make sense indeed. How do you know U-Boot is in NOR flash in this case? I will check the device to confirm, and mark your answer as accepted after confirmation. – c0mpute May 26 '17 at 17:32
  • Context clues. Strings like "Un-Protecting sectors" are only for NOR flash. And while it's possible, it's unlikely they put the environment in one place and U-Boot in another. – Tom Rini May 27 '17 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.