# bootrom Published articles for bootrom. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Unbricking SHIELD TV (2015) with a Bootrom Exploit DevFeed: [Unbricking SHIELD TV (2015) with a Bootrom Exploit]() Original publisher: [Read original article]() Author: yifanlu Published: 2022-06-17T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Raspberry Pi](), [configuration](), [boot](), [Nvidia](), [Linux]() Tags: [boot](), [bootrom](), [configuration](), [embedded](), [exploit](), [linux](), [nvidia](), [raspberry-pi](), [rcm](), [reverse-engineering](), [t210](), [tegra]() ### AI overview The article documents recovering a 2015 NVIDIA SHIELD TV after flashing an outdated device tree blob left it unable to boot. It examines serial-console diagnostics and the Tegra boot ROM's APX emergency recovery mode, including its use of NVIDIA's RCM protocol. ### Source excerpt Last year, a friend gave me his SHIELD TV when he moved. He worked at NVIDIA and got it for free and had used it only a handful of times before it traveled from his closet to my own. I had forgotten about it until I had a need for a Raspberry Pi and discovered that they were all still sold out. Wouldn't the SHIELD TV make a great RPI replacement? It has been out for almost a decade now and surely people have gotten Linux working on it. After following a guide from 2015, I quickly bricked the device trying to flash an outdated DTB file. It turns out that a bad DTB brick was quite common in the community and unfortunately the only proposed solution of "return it to Best Buy" was not an option for me. Even though I have never cared about this device, I was still ashamed at my negligence and felt guilty about creating more e-waste. Thus began my journey to recover the device. ## ESP32-S2 -- Security Features DevFeed: [ESP32-S2 -- Security Features]() Original publisher: [Read original article]() Author: John Lee Published: 2019-12-09T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [Esp32 S2](), [Security](), [ESP32](), [boot](), [Encryption](), [Cryptography](), [SOC](), [Espressif](), [Wi-Fi](), [Hardware]() Tags: [algorithm](), [article](), [blog](), [boot](), [bootloader](), [bootrom](), [code](), [cryptographic](), [cryptography](), [devices](), [encryption](), [esp32](), [esp32-s2](), [espressif](), [firmware](), [flash](), [flash-encryption](), [hardware](), [secure-boot](), [security](), [soc]() ### AI overview This article examines the security features of Espressif's ESP32-S2 Wi-Fi SoC. It describes improvements to Secure Boot and Flash Encryption, including RSA-PSS signature verification in BootROM and faster secure-boot verification enabled by an improved hardware RSA accelerator. ### Source excerpt Espressif recently announced ESP32-S2 -- a new Wi-Fi SoC with additional security features and improvements over some of the ESP32 security features. Given the current state of the security of the connected devices, these are quite meaningful features. This article discusses these changes and what do they mean from security perspective. My colleague wrote about ESP32 security features here. We continue to carry forward Secure Boot and Flash Encryption features. ## Extracting Boot Code from a Prototype PlayStation Vita Development Kit DevFeed: [Extracting Boot Code from a Prototype PlayStation Vita Development Kit]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-08-16T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Code](), [Hacking](), [Hardware](), [boot](), [Embedded Software Dev](), [Kernel]() Tags: [boot](), [bootrom](), [code](), [console](), [develop](), [development-kit](), [experiment](), [firmware](), [glitching](), [hacking](), [hardware](), [history](), [kernel](), [prototype](), [vita]() ### AI overview The author describes attempting to extract boot code from a rare prototype PlayStation Vita development kit, using hardware-hacking techniques and documenting the work as part of preserving the system's historical data. ### Source excerpt A few months ago, a contact reached out to me with an irresistible offer. I would be given the opportunity to experiment with an insanely rare, prototype development kit PlayStation Vita. The only ask from my source is that I somehow dump the boot code. I've spent the last seven years hacking every last bit of the Vita from exploiting the kernel to extracting hardware keys with AES fault injections. In that long journey, I've gotten intimate with every model and revision of the Vita so it seems inevitable that I would find myself with the very first prototype. The DEM-3000L is actually more rare than the DEM-3000H that recently made headlines having been sold for $20,000. Although I cannot confirm this independently, my source claims that the DEM-3000H units were distributed to early game developers while the DEM-3000L was used internally at Sony to develop the system firmware. The history of this particular DEM-3000L was that two of these were originally found side by side at a Chinese landfill. They had extensive water damage (I was told they were "at the bottom of a lake") and was carefully repaired. One of the two (the one with the broken display) eventually made it to me.