Warszawski Hackerspace

User Tools

Site Tools

You are here: start » projects » panohax
Trace: • panohax
projects:panohax

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
projects:panohax [2026/08/13 12:47] – [I/O] q3kprojects:panohax [2026/08/14 09:37] (current) – [Flash Layout] q3k
Line 11: Line 11:
 ==== TX1 ==== ==== TX1 ====
  
-Stock module, probably 4GiB LPDDR4 and 16GB eMMC?+Stock module, 4GiB LPDDR4, 16GB eMMC. Production-fused.
  
 ==== I/O ==== ==== I/O ====
  
 ^ Port ^ Description ^ ^ Port ^ Description ^
-| 2x GbE | PoE in | +| 2x GbE | 1x PoE, in wired to on-board USB3-ethernet adapter, 1x Non-PoE port wired directly to TX1-internal USB3-ethernet adapter | 
-| 2x USB3 | USB A Super Speed |+| 2x USB | USB A 2.0 (OTG, upper) + USB A Super Speed |
 | HDMI Out | Directly from TX1 | | HDMI Out | Directly from TX1 |
 | HDMI In | Through ??? under a metal can. | | HDMI In | Through ??? under a metal can. |
-| DC In | Labeled 54VDC, runs from 31VDC min. | +| DC In | 5.5x2.5(?), Labeled 54VDC, runs from 36VDC min. | 
-| WiFi? Antenna | | +| WiFi? Antenna | Built-in Jetson TX1 2.4 + 5G WIFI + Bluetooth radio | 
-| Button | Capacitive touch + indicator LED |+| Button | Capacitive touch + RGB indicator LED | 
 + 
 +^ Header ^ Description ^ 
 +| SW1102 RECOVERY | Internal RCM button | 
 +| SW1101 RESET | Internal SoC Reset button | 
 +| J901 SERIAL | Pinout: 1.8V, TX, GND, RX. Mind the logic 1.8V levels! 1.8V line dips when ''RESET'' button is pushed down. | 
 +| TP1201 | Unmarked 12V DC rail test point (between AON_P5VO and T1502 transformer), can be used to power up the device directly (bypasses PoE/DC IN circuit), boots from ~11V DC |
  
 ===== Stock Software ===== ===== Stock Software =====
  
-TODO(inf): describe+It's running highly customized Android. 
 + 
 +Serial port exposes password prompt. Unencrypted update bundle from Polycom/HPE reveals default password: ''EyZeBuYTQ'' - this should land a ''user'' shell, from which ''su'' just gets you root access. 
 + 
 +"Devfeatures" (disabled iptables firewall, enabled adb, disabled serial password, enabled telnet I think) can be enabled via ''fw_setenv devfeatures true''. ''fw_printenv'' can be used to check current environment variables. 
 + 
 +Jetson TX1 is SecureBoot/Production-fused. Standard CBoot (first-stage bootloader) is **unlocked** ie. it does not do any signature verification over loaded ''boot'' partition or the operating system altogether. 
 + 
 +==== Flash Layout ==== 
 + 
 +(in bold our current best guess for what the bootchain needs to get to CBOOT. 
 + 
 +^ Number ^ Start ^ Size ^ Name ^ Description ^ 
 +| 1 | 17.4kB | 2097kB | **BPF** | TegraBoot (a.k.a. nvtboot) for BPMP | 
 +| 2 | 2115kB | 262kB | **TBC** | TegraBoot for CPU | 
 +| 3 | 2377kB | 262kB | TBC-B | TegraBoot for CPU, B-partition | 
 +| 4 | 2639kB | 2097kB | **EBT** | CBOOT, loaded by TegraBoot | 
 +| 5 | 4736kB | 2097kB | RBL | CBOOT, B-partition | 
 +| 6 | 6833kB | 2097kB | NCT | Non-volatile vital product data | 
 +| 7 | 8930kB | 6291kB | WB0 | Warm Boot Firmware for device unsuspend | 
 +| 8 | 15.2MB | 2097kB | DFI | all 0x00 | 
 +| 9 | 17.3MB | 4194kB | **RP1** | DTB for CBOOT | 
 +| 10 | 21.5MB | 4194kB | RP2 | 0x24 random bytes, then 0x00 | 
 +| 11 | 25.7MB | 6291kB | **TOS** | Trusted OS/Firmware, loaded by TegraBoot | 
 +| 12 | 32.0MB | 80.9kB | EKS | "Encrypted Key Storage" | 
 +| 13 | 32.1MB | 2097kB | UKS | all 0x00 | 
 +| 14 | 34.2MB | 2097kB | FB | all 0x00 | 
 +| 15 | 36.3MB | 134MB | BMP | Splashscreen partition | 
 +| 16 | 170MB | 26.7MB | SOS | Android Recovery image | 
 +| 17 | 197MB | 4194kB | DTB | DTB for Kernel | 
 +| 18 | 201MB | 26.7MB | LNX | Android Boot image ("boot" fastboot partition) | 
 +| 19 | 228MB | 2147MB | APP | ext4 /system | 
 +| 20 | 2376MB | 2147MB | CAC | ext4 /cache | 
 +| 21 | 4523MB | 805MB | vendor | ext4 /vendor | 
 +| 22 | 5328MB | 2097kB | MSC | all 0x00 | 
 +| 23 | 5331MB | 33.6MB | USP | all 0x00 | 
 +| 24 | 5364MB | 2097kB | MDA | verity metadata partition | 
 +| 25 | 5366MB | 8389kB | RP3 | empty ext4 | 
 +| 26 | 5375MB | 8389kB | RP4 | all 0x00 | 
 +| 27 | 5383MB | 16.8MB | FCT | empty ext4 | 
 +| 28 | 5400MB | 8389kB | UCB | empty ext4, "touchscreen" and "mpu" directories | 
 +| 29 | 5408MB | 2147MB | FAC | ext4 with "factory_restore.zip" update image applied when touch button is pressed on boot | 
 +| 30 | 7556MB | 1074MB | PLC | ext4 with some polycom config stuff | 
 +| 31 | 8629MB | 262kB | CRT | public/private key pair? | 
 +| 32 | 8630MB | 7128MB | UDA | ext4 /data | 
 + 
 +===== Flashing ===== 
 + 
 +==== Fastboot ==== 
 + 
 +Flashing is possible via Fastboot (implemented in cboot) over USB-A 2.0 connector (via cursed USB A-A or USB A-C connector). In order to enter Fastboot you can either: 
 + 
 +  * ''reboot bootloader'' from Android firmware 
 +  * Use customized [[https://code.hackerspace.pl/informatic/fusee-launcher|fusee-launcher]] with ''force_fastboot.bin'' payload: ''./fusee-launcher.py -w -V 0x0955 -P 0x7721 force_fastboot.bin'' 
 + 
 + 
 +**QUIRK:** Fastboot tends to crash/reset whenever HDMI Out is not connected to any display lmao. 
 + 
 +==== RCM/TegraFlash ==== 
 + 
 +Alternative: ''tegraflash.py'' from L4T BSP. 
 + 
 +**NOTE:** Latest L4T tooling doesn't really seem to work very well. Use [[https://developer.nvidia.com/embedded/dlc/tx1-driver-package-r2423|R24.2.3]]. Issue seems to be with ''nvtboot_recovery.bin'': 
 +<code> 
 +$ sha256sum */Linux_for_Tegra/bootloader/nvtboot_recovery.bin  
 +f3a54b2e29857ad627c6ae96352e8d1a2e9b538cca502f3565896c6f6cb51746  l4t24/Linux_for_Tegra/bootloader/nvtboot_recovery.bin # works 
 +3d97c0c37201a5b98fabcc509ac57326bbde8076cee0b5294f969634d4b43a42  l4t28/Linux_for_Tegra/bootloader/nvtboot_recovery.bin # hangs 
 +cd6ec5b3c212fdc44d6d36e043448d2b3484749105005b612fcd043869bd53ac  l4t32/Linux_for_Tegra/bootloader/nvtboot_recovery.bin # crashes with error 4 
 +</code> 
 + 
 +^ Known Error ^ Reason ^ 
 +| <code>[   0.0221 ] Boot Rom communication failed 
 +Error: Return value 3</code> | Device is fused, needs fusee-launcher | 
 +| <code>[   0.0667 ] Cboot is not running on device. 
 +Error: Return value 4</code> | Device crashed, needs a reset (or different ''nvtboot_recovery.bin'') | 
 + 
 +As ''--bl'' use cboot from our device (''mmcblk0p4''). 
 + 
 +<code> 
 +./fusee-launcher.py -w -V 0x0955 -P 0x7721 ipatch_rcm_sample.bin 
 +python3 tegraflash.py --bl mmcblk0p4.img --applet nvtboot_recovery.bin --chip 0x21 --cmd "read DTB dtb-extracted.bin" 
 +</code> 
 + 
 +===== Booting Linux ===== 
 + 
 +Mainline U-Boot (d0615e4a67c commit tested) with ''p2371-2180_defconfig'' can be flashed over ''boot'' (''mmcblk0p18'') partition. 
 + 
 +<code> 
 +CROSS_COMPILE=aarch64-unknown-linux-gnu- make V=1 && \ 
 +mkbootimg --kernel u-boot.bin --pagesize 4096 --base 0x10008000 --output u-boot.aimg && \ 
 +fastboot flash boot u-boot.aimg && \ 
 +fastboot reboot 
 +</code>
  
 +===== References =====
  
 +  * https://yifan.lu/2022/06/17/unbricking-shield-tv-2015-with-a-bootrom-exploit/
 +  * https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3275/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/part_config.html
projects/panohax.1786625235.txt.gz · Last modified: by q3k
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki