Motorola Milestone 2 (motorola-milestone2)
Appearance
This device is marked as not booting.
![]() Motorola Milestone 2 with the keyboard slid out | |
Manufacturer | Motorola |
---|---|
Name | Milestone 2 |
Codename | CHANGE_ME |
Model | A953 |
Released | 2010 |
Type | slide-out keyboard handset |
Hardware | |
Chipset | TI OMAP3630 |
CPU | 1.0 GHz Cortex-A8 |
GPU | PowerVR SGX530 |
Display | 480×854 TFT |
Storage | 8 GiB eMMC + µSD |
Memory | 487 MB |
Architecture | armv7 |
Software | |
Original software | Android |
Original version | 2.2 |
postmarketOS | |
Category | testing |
Pre-built images | no |
postmarketOS kernel | none |
Unixbench Whet/Dhry score | 0.0 |
Contributors
- jn
Users owning this device
How to enter flash mode
- Hold the UP key on the keyboard, press the power button
Installation
Using pmbootstrap
Follow Installation/Using pmbootstrap. When asked for the device's vendor/codename, select FIXME as the vendor and FIXME as the codename.
To flash the image to the device:
- Enter flashing mode (see #How to enter flash mode)
- Run
pmbootstrap flasher flash_kernel
to flash the kernel - Run
pmbootstrap flasher flash_rootfs
Details
Partition layout
Device Boot Start End Sectors Size Id Type mmcblk1p1 * 256 511 256 128K 83 Linux mmcblk1p2 1024 2047 1024 512K 83 Linux mmcblk1p3 2048 3071 1024 512K 83 Linux mmcblk1p4 3072 31358975 31355904 15G 5 Extended mmcblk1p5 4096 5119 1024 512K 83 Linux mmcblk1p6 5120 6143 1024 512K 83 Linux mmcblk1p7 6144 14335 8192 4M 83 Linux mmcblk1p8 14336 15359 1024 512K 83 Linux mmcblk1p9 15360 16383 1024 512K 83 Linux mmcblk1p10 16384 18431 2048 1M 83 Linux mmcblk1p11 18432 22527 4096 2M 83 Linux mmcblk1p12 22528 23551 1024 512K 83 Linux mmcblk1p13 23552 24575 1024 512K 83 Linux mmcblk1p14 24576 34815 10240 5M 83 Linux mmcblk1p15 34816 51199 16384 8M 83 Linux mmcblk1p16 51200 67583 16384 8M 83 Linux mmcblk1p17 67584 96255 28672 14M 83 Linux mmcblk1p18 96256 97279 1024 512K 83 Linux mmcblk1p19 97280 98303 1024 512K 83 Linux mmcblk1p20 98304 106495 8192 4M 83 Linux mmcblk1p21 106496 776191 669696 327M 83 Linux mmcblk1p22 776192 777215 1024 512K 83 Linux mmcblk1p23 777216 778239 1024 512K 83 Linux mmcblk1p24 778240 1187839 409600 200M 83 Linux mmcblk1p25 1187840 1712127 524288 256M 83 Linux mmcblk1p26 1712128 31358975 29646848 14.1G 83 Linux
Notable partitions
- p1: First stage bootloader
- p2: Second stage bootloader, handles USB flash mod
- p3: "OMAP34 Bootloader", loads Linux
- p7: ext3 filesystem, /pds
- p15: Android bootimg
- p17: ISO9660 filesystem with some Windows tools
- p21: ext3 filesystem, /system
- p24: ext3 filesystem, /cache
- p26: ext3 filesystem, /data
SBF files
Updates that are installed through USB flashing, are stored in SBF files, called P2K Superfile by their file header. A notable example is vulnerable_recovery_only_RAMDLD90_78.sbf
, which is mentioned in several tutorials for having incorrect signature validation.
There are a few tools to send SBF files to the bootloader:
- sbf_flash - simple commandline client for Linux/MacOS, but no source code
- RSD Lite - Graphical tool for windows; again, no source code
Research questions
- How does the boot flow work?
- How are SBF files structured?
- What is the vulnerability in
vulnerable_recovery_only_RAMDLD90_78.sbf
and how is it exploited?
See also
- Rooting guide
- How to install CyanogenMod
- Wikipedia: Droid 2
- Upstream work for the Milestone/Droid 4 (Tony Lindgren)