hardware.sg2k.firmware
Declared in BadgeOS/modules/sg2k/firmware.nix.
hardware.sg2k.firmware.encryptedBoot
Additionally AES-encrypt the images in the active fip (implies secureBoot), for a badge fused to SCS=02.
Type: boolean
Default:
false
Declared by:
hardware.sg2k.firmware.fipPath
Absolute path, on the badge’s FAT boot partition, that a deploy writes the active polyglot fip to.
The default is the file the BootROM itself loads, which is what an ordinary badge wants: every deploy refreshes the firmware in place.
Set it to a different file on a sophgone exploit target. There /boot/fip.bin holds the grafted fip.
Type: string
Default:
"/boot/fip.bin"
Example:
"/boot/sophg.1"
Declared by:
hardware.sg2k.firmware.secureBoot
Install the TPM-signed polyglot as the active fip, for a badge whose SCS fuses
are burned (its mask ROM verifies the RSA chain, and an unsigned fip halts at
E:verify root (-14)). Also drops the unsigned /boot/fip-<core>.bin recovery
blob, which cannot boot there. The signing needs the autopen daemon socket at
build time.
Type: boolean
Default:
config.hardware.sg2k.secureBoot
Declared by: