What the developer wrote
Authored by ww3512687
fix recovery switch
What changed, and why it matters
This commit adds a one-time reset of a 'recovery mode switch' flag during device startup. The change makes the device clear the recovery-mode marker if it matches an expected magic value and then saves the updated boot settings. Without more context, it looks like a hardening or bug-fix change that prevents a recovery-mode state from persisting unexpectedly across reboots, which could otherwise affect how the device boots or whether it exposes recovery features.
Treat as a low-confidence potential hardening fix. Review the boot parameter structure and recovery-mode flow to confirm the flag cannot be set by untrusted input, cannot be used to bypass normal boot protections, and that SaveBootParam() is safe to call at this early stage. If this addresses a reported issue, request the vendor or reporter to publish an advisory.
Security signals we found
Magic-value comparison on a boot parameter field
One-shot clearing and persistence of a recovery-mode flag at boot
Possible fix for a recovery-mode state persisting across reboots
No explicit bounds or integrity checks beyond the memcmp
Evidence from the diff
In src/device_settings.c, a new 16-byte constant g_recoveryModeFlag (‘recoverymodeflag’) is introduced. During InitBootParam(), after decrypting the boot parameter block, the code now compares g_bootParam.recoveryModeSwitch against g_recoveryModeFlag. If they match, it zeroes out recoveryModeSwitch and persists the boot parameters via SaveBootParam(). This is a startup-time, one-shot clearing of a recovery-mode indicator. The diff does not show what triggers the flag being set, what recovery mode does, or any prior validation/reset logic, so the exact security implication is unclear from the patch alone.
Changed components
src/device_settings.cInitBootParam()Boot parameter / recovery mode switch handlingInspect captured patch +11 / −0
diff --git a/src/device_settings.c b/src/device_settings.c
index bd0bfd3..44d0993 100644
--- a/src/device_settings.c
+++ b/src/device_settings.c
@@ -98,6 +98,13 @@ static const uint8_t g_integrityFlag[16] = {
0x01, 0x09, 0x00, 0x03,
0x01, 0x09, 0x00, 0x03,
};
+
+static const uint8_t g_recoveryModeFlag[16] = {
+ 'r', 'e', 'c', 'o',
+ 'v', 'e', 'r', 'y',
+ 'm', 'o', 'd', 'e',
+ 'f', 'l', 'a', 'g',
+};
void DeviceSettingsInit(void)
{
int32_t ret;
@@ -172,6 +179,10 @@ void InitBootParam(void)
AesDecryptBuffer(&g_bootParam, sizeof(g_bootParam), &bootParam);
PrintArray("bootParam.bootCheckFlag", g_bootParam.bootCheckFlag, sizeof(g_bootParam.bootCheckFlag));
PrintArray("bootParam.recoveryModeSwitch", g_bootParam.recoveryModeSwitch, sizeof(g_bootParam.recoveryModeSwitch));
+ if (memcmp(g_bootParam.recoveryModeSwitch, g_recoveryModeFlag, sizeof(g_bootParam.recoveryModeSwitch)) == 0) {
+ memset(g_bootParam.recoveryModeSwitch, 0, sizeof(g_bootParam.recoveryModeSwitch));
+ SaveBootParam();
+ }
}
#endif
}
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.