hardware
- Android test-keys: system UID with AOSP's public platform key
Android ROMs signed with AOSP test-keys accept any APK signed with the public platform key as system UID 1000: the conversion, signing and catch.
- FiiO X1 NAND: 44 KB of high-entropy data, identified
43,535 bytes at the start of the FiiO X1's boot resource partition looked encrypted. XOR, zlib and LZMA all failed; the firmware image named the file.
- HTC Desire Z: three black screens and a brightness of 30
Debloating CyanogenMod 7 on an HTC Desire Z, the screen went black three times in 22 minutes. One was a saved brightness of 30; two never got a cause.
- FiiO X1 NAND map: fonts, plaintext and a stranger's music
Mapping a raw FiiO X1 NAND dump: the firmware found in one search, no PN scrambling, 25 MB of fonts that pass for code, and an old owner's music.
- Debloating Android 2.3 on the HTC Desire Z: use pm disable
51 CyanogenMod 7 system APKs came off an HTC Desire Z and only one was load-bearing. pm disable was the better tool, and I had already used it.
- FiiO X1 NAND dump: 128 MB over USB, one block at a time
A bare-metal SD dumper for the FiiO X1 that never ran, and the hwstub shell loop that copied all 128 MB of its NAND flash overnight with zero read errors.
- HTC Desire Z bought for parts: S-OFF, SuperCID and 4202 mV
A 2010 HTC Desire Z bought for parts came back S-OFF, SuperCID, ENG HBOOT and CyanogenMod 7, its battery at 4202 mV: the start of a pocket mesh node.
- FiiO X1 factory.x1: unsigned code execution from the SD card
The FiiO X1's X-Boot loader jumps into any factory.x1 on the SD card on its recovery path: XOR-scrambled with a public prime key, never signed.
- FiiO X1 IPL decompiled: 8 KB of JZ4760B DDR init code
Decompiling the FiiO X1's 8 KB IPL in Ghidra: warm resume, a UART log nobody reads, 64-step DQS calibration and the real DDR timings.
- FiiO X1 NAND dump: hwstub, fee1:dead and a 64-bit compiler
Dumping the FiiO X1's IPL from NAND after every ingenic-boot route failed: Rockbox hwstub cross-built for the JZ4760B, shimmed for Lua 5.4.