Jump to content

Motorola Milestone 2 (motorola-milestone2)

From postmarketOS Wiki
This device is marked as not booting.
Motorola Milestone 2
Motorola Milestone 2 with the keyboard slid out
Motorola Milestone 2 with the keyboard slid out
Manufacturer Motorola
Name Milestone 2
Codename CHANGE_ME
Model A953
Released 2010
Type slide-out keyboard handset
Hardware
Chipset TI OMAP3630
CPU 1.0 GHz Cortex-A8
GPU PowerVR SGX530
Display 480×854 TFT
Storage 8 GiB eMMC + µSD
Memory 487 MB
Architecture armv7
Software
Original software Android
Original version 2.2
postmarketOS
Category testing
Pre-built images no
postmarketOS kernel none
Unixbench Whet/Dhry score 0.0


Contributors

  • jn

Users owning this device

How to enter flash mode

  • Hold the UP key on the keyboard, press the power button


Installation

Using pmbootstrap

Follow Installation/Using pmbootstrap. When asked for the device's vendor/codename, select FIXME as the vendor and FIXME as the codename.

To flash the image to the device:

  • Enter flashing mode (see #How to enter flash mode)
  • Run pmbootstrap flasher flash_kernel to flash the kernel
  • Run pmbootstrap flasher flash_rootfs


Details

Partition layout

Device     Boot   Start      End  Sectors  Size Id Type
mmcblk1p1  *        256      511      256  128K 83 Linux
mmcblk1p2          1024     2047     1024  512K 83 Linux
mmcblk1p3          2048     3071     1024  512K 83 Linux
mmcblk1p4          3072 31358975 31355904   15G  5 Extended
mmcblk1p5          4096     5119     1024  512K 83 Linux
mmcblk1p6          5120     6143     1024  512K 83 Linux
mmcblk1p7          6144    14335     8192    4M 83 Linux
mmcblk1p8         14336    15359     1024  512K 83 Linux
mmcblk1p9         15360    16383     1024  512K 83 Linux
mmcblk1p10        16384    18431     2048    1M 83 Linux
mmcblk1p11        18432    22527     4096    2M 83 Linux
mmcblk1p12        22528    23551     1024  512K 83 Linux
mmcblk1p13        23552    24575     1024  512K 83 Linux
mmcblk1p14        24576    34815    10240    5M 83 Linux
mmcblk1p15        34816    51199    16384    8M 83 Linux
mmcblk1p16        51200    67583    16384    8M 83 Linux
mmcblk1p17        67584    96255    28672   14M 83 Linux
mmcblk1p18        96256    97279     1024  512K 83 Linux
mmcblk1p19        97280    98303     1024  512K 83 Linux
mmcblk1p20        98304   106495     8192    4M 83 Linux
mmcblk1p21       106496   776191   669696  327M 83 Linux
mmcblk1p22       776192   777215     1024  512K 83 Linux
mmcblk1p23       777216   778239     1024  512K 83 Linux
mmcblk1p24       778240  1187839   409600  200M 83 Linux
mmcblk1p25      1187840  1712127   524288  256M 83 Linux
mmcblk1p26      1712128 31358975 29646848 14.1G 83 Linux

Notable partitions

  • p1: First stage bootloader
  • p2: Second stage bootloader, handles USB flash mod
  • p3: "OMAP34 Bootloader", loads Linux
  • p7: ext3 filesystem, /pds
  • p15: Android bootimg
  • p17: ISO9660 filesystem with some Windows tools
  • p21: ext3 filesystem, /system
  • p24: ext3 filesystem, /cache
  • p26: ext3 filesystem, /data

SBF files

Updates that are installed through USB flashing, are stored in SBF files, called P2K Superfile by their file header. A notable example is vulnerable_recovery_only_RAMDLD90_78.sbf, which is mentioned in several tutorials for having incorrect signature validation.

There are a few tools to send SBF files to the bootloader:

  • sbf_flash - simple commandline client for Linux/MacOS, but no source code
  • RSD Lite - Graphical tool for windows; again, no source code


Research questions

  • How does the boot flow work?
  • How are SBF files structured?
  • What is the vulnerability in vulnerable_recovery_only_RAMDLD90_78.sbf and how is it exploited?


See also