BlackBerry PlayBook (blackberry-playbook)
 | |
| Manufacturer | Research In Motion (Quanta) |
|---|---|
| Name | Blackberry PlayBook |
| Codename | blackberry-playbook |
| Released | 2011 |
| Hardware | |
| Chipset | TI OMAP 4430 |
| CPU | Dual-core Cortex-A9 |
| GPU | PowerVR SGX540 |
| Display | 1024x600 |
| Storage | 16 / 32 / 64 GiB |
| Memory | 1 GiB |
| Architecture | armv7 |
| Software | |
| Original software | BlackBerry Tablet OS |
| Original version | 2.1.0.1917 |
| postmarketOS | |
| Category | testing |
| Pre-built images | no |
This device is marked as not booting.
Research
The Blackberry PlayBook can't be unlocked through any official methods.
There has been some research into the security of the chipset:
- http://droid-dev.mobi/wiki/Booting_chain
- https://processors.wiki.ti.com/index.php/OMAP4_Debug_and_Trace_Tools
- Bootrom dumps, dead links: https://forums.crackberry.com/blackberry-playbook-os-f228/playbook-bootrom-mlo-bootloader-830909/
- Security overview from NCC Group: https://www.nccgroup.com/uk/our-research/blackberry-playbook-security-part-one/
Blackberry implemented a package-on-package configuration for the OMAP4430 and DRAM. JTAG might give more interesting information, some research was done in 2013 by QuackQuack147: https://unlockplaybook.wordpress.com/2013/08/07/progress-irc-chat/ The JTAG pins are probably buried beneath the BGA package.
Link to bootrom of the OMAP 4430 on the Motorola Milestone 3: http://droid-dev.mobi/wiki/File:Omap_4430.bin.gz
Porting kexecboot-droid4 might be interesting if there are partitions that are not verified by the bootloader: https://github.com/tmlind/droid4-kexecboot/blob/master/PARTITIONS