3 ms·
> so you can obviously manipulate the firmware side to ignore the debug fuse stuff. Might not be as trivial as that makes it sound: "Continuing through the bo
by bigiain 5y ago
> so you can obviously manipulate the firmware side to ignore the debug fuse stuff.
Might not be as trivial as that makes it sound:
"Continuing through the boot process we can see that U-Boot loads a kernel, ramdisk and Flattened Device Tree (FDT) from a Flattened uImage Tree (FIT) image that is stored on an embedded MultiMediaCard (eMMC).
We can also see that the integrity (SHA256) and authenticity (RSA 2048) of the kernel, ramdisk and FDT is being checked. While we would have to perform some more tests it appears that a full trusted boot chain (TF-A) is implemented from the early stage ROM bootloader all the way down to the Linux operating system."
- ta988 5y agoThat's great, nothing stops you from using an alternative microcontroler that doesnt check signatures and mimic that one.
- bigiain 5y agoYeah. If you can futz with the hardware, pretty much any security can be circumvented. Desoldering a SOC and replacing it with something similar enough but different in its trusted boot config is somewhat less trivial than "manipulate the firmware" though, at least in my opinion...