What is a goldcard and how does it work?

Question

I know how to create a Goldcard, but I'm curious as to what it actually is and how it works. I've done some Googling but can't find any information about the details.

To create a Goldcard one needs the CID, which from what I can gather is an SD identifier for the card. The CID is then reversed and entered into a site which generates a Goldcard image. The image is copied to bytes 0x000 to 0x170 of the device.

• Does the CID change when the card is formatted?
• If I plug an SD card into my computer, will I get the same CID as when it's in the phone?
• Is the Goldcard image a boot sector?
• How does it fit in with the FAT32 filesystem on the card?
• How is the Goldcard image generated?
• Could I generate one myself, or modify an existing image for a different CID?
• What does the Goldcard do when the phone boots? Does the phone boot off the card?
• How does this bypass the restrictions to allow other firmware to be flashed?

Answer 1

To partially answer my own question, the CID is a unique identifier assigned to the SD card at manufacture time. It is stored in a special register which is accessed using the SEND_CID command. From page 93 of Part 1 Physical Layer Simplified Specification:

The Card IDentification (CID) register is 128 bits wide. It contains the card identification information used during the card identification phase. Every individual Read/Write (RW) card shall have a unique identification number.

The CID therefore does not change when the card is formatted, and will be reported the same regardless of which device the card is plugged into.

The card does have an MBR partition table, and the Goldcard image is inserted into the code area of the MBR (between 0x000 and 0x1b7). There is therefore no direct interaction with the FAT32 filesystem. The first 128 bytes of the image are null however, and so it doesn't seem to actually be executable.