13

I know that doing a fastboot oem unlock will both unlock the bootloader and wipe the data on the device. Unfortunately, while this allows me to install a non-stock ROM like Cyanogenmod, my understanding is that it also allows anyone w/ physical access to the device to flash or boot a different (potentially malicious) kernel among other things.

Is it possible to then do a fastboot oem lock and still be able to load the non-stock ROM? If this is possible, what sort of warnings might appear, if any, during the boot process? And finally, would doing another fastboot oem unlock still wipe the data?

I understand that also flashing a recovery like CWM OR TWRP would allow flashing malicious images even ifthe bootloader is locked. Please assume that only the default recovery would be used.

Additionally, is doing something like this to secure a non-stock ROM posdible on any non-nexus devices?

Improve this question
1
  • Very valid and nice question! I'm waiting for a way to fix this in fact big security problem for Nexus phones if you run custom software. I have described my way in an answer below, but it's very tedious to update it after that procedure has been done and there are accessibility/maintenance problems if the main software gets stuck in a boot-loop (etc.).
    – ce4
    Jun 15, 2013 at 21:37

1 Answer 1

Reset to default
8

Yes. Locking the bootloader is possible after you have installed a custom firmware.

A locked bootloader will not allow you to ad-hoc boot custom binaries (using fastboot boot boot.img and will not allow you to directly write to the flash chips. An unlocked bootloader however does offer you this and newly available commands are:

  • fastboot flash partition image
  • fastboot boot kernel-image

So, if it's locked you will only be able to either boot the normal or the recovery system which themselves need to enforce the chain of trust and ensure security. Current custom recovery images won't enforce any security, so you will have to install a safe stock recovery after you have installed your custom firmware.

Regarding the stock recovery, this will not allow you to install any upcoming custom builds, only stock firmware (that's digitally signed by Google) will install.

So, to have a working chain of trust with no holes in it, you will need to first unlock the bootloader, then install a custom recovery, install a custom firmware (etc.), then re-install the stock recovery (extract it from Google's stock image), then re-lock the bootloader.

The procedure to upgrade to newer firmware builds will be a bit tricky at the moment:

I think there exist user-land tools to unlock the bootloader from a regular (rooted) custom firmware (like CyanogenMod) without the penalty of a full wipe. This way you can unlock the bootloader without a wipe, then (temporarily) boot a custom recovery (via fastboot boot cwm-recovery.img), do an adb sideload update.zip and finally relock the bootloader using fastboot oem lock again.

One note: I think I have read somewhere that the Nexus 4 doesn't to a full wipe with subsequent unlocks after it has been unlocked/relocked once. I'm not sure about this, you will need to test this once.

Improve this answer
2
  • Here's the userland Boot unlocker for Nexus devices. Needed to unlock from userland (without a wipe) and upgrade the custom firmware. Don't forget to relock afterwards!
    – ce4
    Jun 18, 2013 at 8:14
  • You can use your own custom signing keys with a relocked bootloader.
    – mirh
    Sep 14, 2019 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .