Is it possible to load a custom bootloader onto the safe 5?
I have it unlocked and running my custom FW/kernel but having issues loading a new bootloader.
I built with:
make build_bootloader TREZOR_MODEL=T3T1
and pushed to sdcard with
sudo dd if=build/bootloader/bootloader.bin of=/dev/disk4 bs=512 conv=fsync
but nothing seems to happen.
Is there a step i’m potentially missing or is this not allowed?
you won’t be able to install a bootloader not signed by Trezor Company
I mean technically, you can bundle one into your custom firmware by replacing the file core/embed/models/T3T1/bootloaders/bootloader-T3T1.bin. then your custom bootloader will be installed and you can jump to it manually
(you’d need to either write the jump yourself, or modify code for T2T1 that does a “reset-stack-and-jump-to-bootloader” operation. T3T1 invokes bootloader by going through full reset, which will drop you into boardloader first…)
…but when you unplug and replug next time, the boardloader will detect an invalid (not correctly signed) bootloader and refuse to run, until you use the SD card to reinstall the official one.
Allowing bootloader replacement by custom code would open a pretty serious supply chain side vulnerability: anyone would be able to take your Trezor, replace the bootloader, and then claim that any firmware is legit without triggering the “UNSAFE DO NOT USE” screen.
Of course, this would lose you the ability to authenticate via the Secure Element, because you’d have to unlock bootloader first – but if someone discovered a flaw in that process, then it’s game over.
The bootloader is an important piece of device authenticity chain and will not ever be replaceable by unsigned code.