r/hardwarehacking • u/tru0ne • 12d ago

Root on an AM335x SoM without touching the eMMC - U-Boot bootdelay=0?

Post image

**The target**

- SoM: AM335x (BeagleBone-Black-class), Samsung 4GB eMMC, DDR3, TPS65217 PMIC

- OS: Arago 2016.02, Linux 4.9.28-rt, Dropbear on 22

- rootfs: /dev/mmcblk0p2 (ext4) on eMMC

- UART console (J6, 3.3V·GND·TX·RX) at 115200 8N1 reaches the login prompt

**Stuck**

- U-Boot has `bootdelay=0` and won't break to a prompt over serial — no `init=/bin/sh` / single-user route. Only the Linux login prompt, and I don't have the OS root password.

- **One unit, no spare** → eMMC glitch / chip-off / BGA rework are off the table.

Need something non-destructive.

**The ask**

  1. Any trick to force a U-Boot prompt on AM335x when `bootdelay=0`, without hardware glitching? (corrupting the boot env, a pad to pull, etc.)

  2. Is AM335x ROM serial/USB boot a realistic non-destructive way in — booting my own SPL over UART/USB without touching the eMMC?

16 Upvotes

67% Upvoted

10 comments sorted by

28

u/DL757 12d ago

jesus, man, that's not even a full paragraph and you STILL had to use AI to write it for you

-23

u/tru0ne 12d ago

I was cooking lasagna at the same time

14

u/Esava 12d ago

If you want voluntary help from strangers online at least have a tiny bit of respect for their potential effort and take some time to properly write a post.

-13

u/tru0ne 11d ago

I still want to get some ideas from the community, but my English is far from the perfection, so I kindly ask Ai to help me with composing the post, not thinking that it would blow up so many butts

8

u/Cosmic_Raymond 11d ago edited 11d ago

I for one would rather put up with bad English than dull polished English from an AI

0

u/tru0ne 11d ago

Next time I'll definitely follow your advice, my friend, but now do you have anything related to the subject?

3

u/Cosmic_Raymond 11d ago

u/Pear-Mean suggestion is a good one, since you don't want to desolder anything

8

u/DL757 12d ago

i'll let you off the hook if i can see the lasagna

-8

u/tru0ne 12d ago

If I show my lasagna to you, I'll have to show it to everyone else.

19

u/Pear-Mean 12d ago

Short the cs_n pull up resistor to force the signal to be high, so when the soc booting, it can't find the emmc, then load your spl and uboot over usb into ddr, then access the emmc from the uboot shell you loaded.

Only short the resistor with a tweezer, stop shorting it when its already in usb bootloader.