bootneuter作者关于baseband损坏无法修复的解释
根据本人个人理解翻译的，不对的地方轻点拍俺...
MuscleNerd
iPhone DevTeam
Join Date: Aug 2007
Location: Always sunny Los Angeles, California
Posts: 316
Rep Power: 21
--------------------------------------------------------------------------------
If sping reports "unexpected result 0xc1" that's a bad sign
It basically means that although the low-level bootrom noticed you knocking and accepted the serial payload, it refused to run it because it thinks the bootloader has started.
But if the bootloader was still active you'd see more characters after the 0xc1, so that means the bootloader has passed control to the baseband and the baseband has spun out of
control.
The boot sequence is bootrom->bootloader<->baseband. The bootrom sanity checks the bootloader before running it, the bootloader sanity checks the baseband before running it. The
sanity check is pretty weak though. If the bootloader passes CPU control to the baseband and the baseband is corrupted and throws an invalid instruction or data alignment
exception (for example) early in the boot process, the exception vectors are not set up yet and you'll end up in tight loop using dummy handlers.
In other words, your S-Gold is doing bootrom->bootloader->baseband->tight loop. The tight loop is preventing the bootloader from servicing interactive bootloader requests done
by bbupdater, bootneuter, and the rest.
In theory, if your baseband is empty at the right locations above a0040000, you may still be able to do the A17 hardware hack, which will trick the bootrom into thinking the
bootloader is empty and so it would execute your serial payloads.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
如果用sping这个程序检测的结果是"unexpected result 0xc1"，这是一个非常糟糕的情况
它基本表明尽管底层的bootrom注意到你的请求并接受了软件包，但它拒绝运行，因为它认为bootloader在运行中。但是如果bootloader如果还处于运行状态，你应该在0xc1后面看到更多的信息，因此这意味着bootloader已经把控制权交给了baseband，而baseband失控了。
(iphone)启动的顺序是：bootrom->bootloader<->baseband。bootrom在运行bootloader之前会对它进行完整性检测，bootloader在运行baseband之前会对它进行完整性检测。可是这个完整性检测是非常弱的。如果在启动初期，bootloader把CPU控制权交给baseband，而baseband已经损坏，并发出无效的指令或异常数据队列，这些异常向量一直无法建立，而你将困在一个假操作的死循环中。
换句话说，你的S-gold（iphone里负责通讯模块的cpu）一直在做 bootrom->bootloader->baseband->死循环。这个死循环（占用cpu）阻止了bootloader与 bbupdater、bootneuter等软件的交流。
理论上，如果你的baseband在a0040000这个位置是空白的话，你还是有可能用A17硬件破解法通过欺骗bootrom，让它认为bootloader是空的，来执行一些刷机软件包
特别注释：3.9的bl由于有漏洞，可以用软件欺骗bootloader对baseband的完整性检测，避免进入死循环，从而实现重刷损坏的baseband
4.6的bl没有这个漏洞了，但在baseband完整的情况，可以通过bootneuter对BL进行修改，去掉这个完整性检测，然后再刷新baseband
当在原生的4.6BL情况下，一旦baseband损坏，现阶段可能就是一个灾难了，只有尝试用A17的的硬件破解法修复了
[ 本帖最后由 bluesprince 于 2008-4-9 10:08 编辑 ]
运行中]
