webOS Nation Forums >  webOS Discussion >  webOS Tips, Info & Resources > Parsing the NVRAM
Parsing the NVRAM
Like Tree1Likes
  • 1 Post By GMMan

Thread Tools Display Modes
Old 02/15/2013, 10:28 PM   #1 (permalink)
GMMan's Avatar
Posts: 2,136
For ye olde hackers only!

The NVRAM is the section of flash memory in webOS that holds your bootloader graphics, tokens, and environment variables. That means the HP boot logo you see, charging indicators before the device boots, and all of your MAC addresses, serial number, SKU, calibration data, etc. are stored in this partition. For one reason or another, you may need to edit the NVRAM (only when something is extremely broken), or may want to create a copy for backup. Here are some information on the NVRAM.

Note: if you don't know what any of this stands for, don't try to mess with the partition before you do. Doing so could brick your device!

The NVRAM can be dumped from /dev/mmcblk0p12 on a TouchPad. I do not have any other webOS devices, so I don't know where they're stored on those other devices. The NVRAM is 4MiB in length. Their contents are like this:

Multiple graphics for bootloader
Blank space
Tokens backup

The byte order of the NVRAM is little-endian. Here are descriptions for the above:

Gives a layout of the contents of the NVRAM. It is represented like this:
struct TocHeaderEntry
    char tagType[4] = "NVRM";
    unsigned version;
    unsigned length;
    unsigned crc32;
    char name[16]; // Zeros

struct TocEntry
    char tagType[4] = "TOC1";
    unsigned offset;
    unsigned length;
    unsigned flags;
    char name[16];

struct Toc
    TocHeaderEntry header;
    TocEntry entries[];
In flags (guessed):
1 - Region (does not take space, but marks space)
2 - Backup

TOC header version is always 1. TOC size is always 4096 bytes. CRC is calculated with the CRC field set to 0. CRC is calculated for the entire TOC, which includes the header. The TOC header does not have a name, but each entry does.

Entries, by name, are currently in this order:

"envelope" is a notable entry, as it carries the flag 1 and does not take up any space. It indicates the actual offset and length of data, excluding the TOC. "tokens-backup" has flag 2 set, and is always stored a few pages off from the end of the NVRAM, specifically, ending 2048 bytes from the end of the NVRAM. Each data section is 4096 byte aligned. Each data section is rounded up to the nearest 16KiB.

The envelope is not data in and of itself, but it represents all the data in the NVRAM. It is defined in the TOC.

Environment Variables
Environment variables are added to the kernel command prompt and/or used by the bootloader. They are stored as a list of null terminated strings, forming key-value pairs. This section is 16KiB in length.

Tokens entries are stored one next to another, 4-byte aligned.
struct TokenEntry
    char tagType[4] = "TOKN";
    unsigned version;
    unsigned dataLen;
    unsigned flags;
    unsigned crc32;
    char name[16];
    char data[dataLen];
1 - Unknown; probably data type indicator, such that set means text, unset means binary
2 - Is OEM defined (defined out of the factory)

Version is always 1. CRC is calculated beginning with tagType up until then end of the data as specified by dataLen. crc32 field is 0 during calculation. Flag 2 is set for tokens such as WIFIoADDR, PalmSN, and ACCELCAL, while unset for tokens such as installer. This section is 10240 bytes long. The backup tokens section contains identical data.

Graphics files
They are in RLE compressed 24BPP Targa format. Rounding and alignment rules apply. These files can be found in webOS Doctor archives. Corrupting them will not brick the device, but you will see funny colorful moire patterns.
Contact: @GMMan_BZFlag (me on Twitter)
webOS Releases: Change your App Catalog country: TouchPad/PC | TouchPad/webOS Resources | Search suggestion patch for browser | Cycling Email Notifications | Don't Doctor! Make a good support request. | How to post logs | webOS Charge Monitor
GMMan is offline   Reply With Quote
Liked by Remy X likes this.
Thanked by NuttyBunny, Remy X


Thread Tools
Display Modes


Content Relevant URLs by vBSEO 3.6.0