I am seeing a growing discussion on the need for more Linux phones in the market given Google’s problematic behaviour w.r.t the changes that will be introduced to that OS.
One very good point that some community member raised was that Android itself wasn’t the problem but the locking of the bootloader in the phone. If the bootloader could be unlocked, then it significantly lowers the bar for the end user to install their OS of choice.
I have dabbled with flashing OSs in old smartphones (GrapheneOS, Post market and Lineage). I commend the developers because I could do that without truly having to “understand the code” at the lower levels. But I assume that was possible because the boot loader could be unlocked somehow*. It seems that isn’t the case with many/most phone fro. Samsung / Xiomi, etc.
Are their bootloaders truly unlockable? Is it simply impossible to unlock and relock bootloaders?
- I know that with lineage, the bootloader couldn’t be relocked and that was touted as a security flaw. If someone could explain why this lock/unlock is so complex, I’d appreciate it.
Different ways:
Sometimes it’s a cryptographic key thing, if the bootloader doesn’t see an image signed with a trusted key it won’t boot.
Sometimes it’s a flag set in storage that is secure and not writable. Bootloader checks the flag, if it’s set then it enforces signature verification.
Sometimes it’s a hardware thing. Newer chips can come with programmable fuses that can be set to pop. This literally severs an electrical connection within the soc or cpu or whatever and then that is the flag. The nintendo switch’s tegra used this to prevent downgrading; if you upgraded legitimately you’d “burn fuses” and then would be locked on that firmware permanently. downgrading could potentially brick the system. (Maybe someone’s figured out a way around this now, I haven’t fucked with switch stuff since tears of the kingdom came out).
There’s other ways too.
Defeating these methods is generally quite difficult. Sometimes you get lucky and a glaring bootloader exploit is found early on (fusee gelee for the switch) or one that applies to many generations of hardware (checkm8, unpatchable bootrom exploit for iphone 4s-iphone x) but at the same time companies have learned to harden their shit as much as possible and throw money at people who do find these exploits. Even nintendo, who has been notoriously laughably bad at this kind of thing seems to have come much harder at the switch 2. The only thing released to date is a minor userland exploit and even if something more substantial is released they’ll just brick your console for finding/running it