BCT - Revision history

Hexkyz at 20:52, 23 July 2024

2024-07-23T18:52:59Z

Yellows8 at 20:32, 2 July 2024

2024-07-02T18:32:02Z

← Older revision		Revision as of 22:32, 2 July 2024
Line 7:		Line 7:
	The Mariko BCT's data is signed starting at offset 0x420 and encrypted starting at offset 0x480, so the [[Flash_Filesystem#Keyblob\|keyblob]] system is no longer used.		The Mariko BCT's data is signed starting at offset 0x420 and encrypted starting at offset 0x480, so the [[Flash_Filesystem#Keyblob\|keyblob]] system is no longer used.

	During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM ~~at address 0x40000000~~.		During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in [[Memory_layout\|IRAM]].

	= Format =		= Format =

Yellows8 at 18:17, 5 June 2024

2024-06-05T16:17:37Z

← Older revision		Revision as of 20:17, 5 June 2024
Line 5:		Line 5:
	The Erista BCT's data is only signed after offset 0x0510. Therefore, regions like [[#CustomerData\|CustomerData]] can be freely modified without resigning. This is done by [[NS_Services\|NS]] when injecting a new [[Flash_Filesystem#Keyblob\|keyblob]] during a system update, for example.		The Erista BCT's data is only signed after offset 0x0510. Therefore, regions like [[#CustomerData\|CustomerData]] can be freely modified without resigning. This is done by [[NS_Services\|NS]] when injecting a new [[Flash_Filesystem#Keyblob\|keyblob]] during a system update, for example.

	The Mariko BCT's data is signed and encrypted ~~after~~ offset ~~0x0480~~, so the [[Flash_Filesystem#Keyblob\|keyblob]] system is no longer used.		The Mariko BCT's data is signed starting at offset 0x420 and encrypted starting at offset 0x480, so the [[Flash_Filesystem#Keyblob\|keyblob]] system is no longer used.

	During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.		During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.

Liam at 00:57, 18 July 2020

2020-07-17T22:57:03Z

← Older revision		Revision as of 02:57, 18 July 2020
Line 148:		Line 148:
	\| 0x12C		\| 0x12C
	\| [[#BootLoader0\|BootLoader0]]		\| [[#BootLoader0\|BootLoader0]]
	\| Configuration parameters for bootloader 0 (~~normal~~)		\| Configuration parameters for bootloader 0 (main)
	0x2330: Version (variable)		0x2330: Version (variable)
	0x2334: StartBlock (0x00000040)		0x2334: StartBlock (0x00000040 (BootImagePackage), 0x00000100 (BootImagePackageSafe))
	0x2338: StartPage (0x00000000)		0x2338: StartPage (0x00000000)
	0x233C: Length (variable)		0x233C: Length (variable)
	0x2340: LoadAddress (0x40010000)		0x2340: LoadAddress (0x40010000)
	0x2344: EntryPoint (0x40010020 for 1.0.0-3.0.2, 0x40010040 for 4.0.0+)		0x2344: EntryPoint (0x40010020 for 1.0.0-3.0.2, 0x40010040 for 4.0.0+)
	0x2348: Attribute (0x00000000)		0x2348: Attribute (0x00000000 (BootImagePackage), 0x00000001 (BootImagePackageSafe))
	0x234C: CryptoHash (empty)		0x234C: CryptoHash (empty)
	0x235C: RsaPssSig		0x235C: RsaPssSig
Line 162:		Line 162:
	\| 0x12C		\| 0x12C
	\| BootLoader1		\| BootLoader1
	\| Configuration parameters for bootloader 1 (~~safe mode~~)		\| Configuration parameters for bootloader 1 (backup)
	0x245C: Version (variable)		0x245C: Version (variable)
	0x2460: StartBlock (0x00000050)		0x2460: StartBlock (0x00000050 (BootImagePackage), 0x00000110 (BootImagePackageSafe))
	0x2464: StartPage (0x00000000)		0x2464: StartPage (0x00000000)
	0x2468: Length (variable)		0x2468: Length (variable)
	0x246C: LoadAddress (0x40010000)		0x246C: LoadAddress (0x40010000)
	0x2470: EntryPoint (0x40010020 for 1.0.0-3.0.2, 0x40010040 for 4.0.0+)		0x2470: EntryPoint (0x40010020 for 1.0.0-3.0.2, 0x40010040 for 4.0.0+)
	0x2474: Attribute (0x00000000)		0x2474: Attribute (0x00000000 (BootImagePackage), 0x00000001 (BootImagePackageSafe))
	0x2478: CryptoHash (empty)		0x2478: CryptoHash (empty)
	0x2488: RsaPssSig		0x2488: RsaPssSig
Line 340:		Line 340:
	\| 0x10		\| 0x10
	\| BootLoader0		\| BootLoader0
	\| Configuration parameters for bootloader 0 (~~normal~~)		\| Configuration parameters for bootloader 0 (main)
	0x25E0: StartBlock (0x00000040)		0x25E0: StartBlock (0x00000040 (BootImagePackage), 0x00000100 (BootImagePackageSafe))
	0x25E4: StartPage (0x00000000)		0x25E4: StartPage (0x00000000)
	0x25E8: Version (variable)		0x25E8: Version (variable)
Line 349:		Line 349:
	\| 0x10		\| 0x10
	\| BootLoader1		\| BootLoader1
	\| Configuration parameters for bootloader 1 (~~safe mode~~)		\| Configuration parameters for bootloader 1 (backup)
	0x25F0: StartBlock (0x00000050)		0x25F0: StartBlock (0x00000050 (BootImagePackage), 0x00000110 (BootImagePackageSafe))
	0x25F4: StartPage (0x00000000)		0x25F4: StartPage (0x00000000)
	0x25F8: Version (variable)		0x25F8: Version (variable)

Hexkyz: /* Mariko */

2020-05-31T14:55:24Z

Mariko

← Older revision		Revision as of 18:55, 31 May 2020
Line 339:		Line 339:
	\| 0x25E0		\| 0x25E0
	\| 0x10		\| 0x10
	\| ~~[[#~~BootLoader0~~\|BootLoader0]]~~		\| BootLoader0
	\| Configuration parameters for bootloader 0 (normal)		\| Configuration parameters for bootloader 0 (normal)
	0x25E0: StartBlock (0x00000040)		0x25E0: StartBlock (0x00000040)

Hexkyz: /* Mariko */

2020-05-31T14:54:45Z

Mariko

← Older revision		Revision as of 18:54, 31 May 2020
Line 265:		Line 265:
	\| 0x10		\| 0x10
	\| RandomAesBlock		\| RandomAesBlock
	\|		\| Not empty
	\|-		\|-
	\| 0x0490		\| 0x0490

Hexkyz: /* Mariko */

2020-05-31T14:53:56Z

Mariko

← Older revision		Revision as of 18:53, 31 May 2020
Line 242:		Line 242:
	\|-		\|-
	\| 0x0000		\| 0x0000
	\| ~~0x0210~~		\| 0x210
	\| Pcp		\| Pcp
	\| BCT public cryptographic parameters		\| BCT public cryptographic parameters
Line 251:		Line 251:
	\|-		\|-
	\| 0x0210		\| 0x0210
	\| ~~0x0110~~		\| 0x110
	\| Signature		\| Signature
	\| BCT cryptographic signature		\| BCT cryptographic signature
Line 258:		Line 258:
	\|-		\|-
	\| 0x0320		\| 0x0320
	\| ~~0x0160~~		\| 0x160
	\|		\|
	\| Empty		\| Empty

Hexkyz at 16:53, 31 May 2020

2020-05-31T14:53:19Z

@@ Line 5: / Line 5: @@
 The Erista BCT's data is only signed after offset 0x0510. Therefore, regions like [[#CustomerData|CustomerData]] can be freely modified without resigning. This is done by [[NS_Services|NS]] when injecting a new [[Flash_Filesystem#Keyblob|keyblob]] during a system update, for example.
-The Mariko BCT's data is signed and encrypted, so the [[Flash_Filesystem#Keyblob|keyblob]] system is no longer used.
+The Mariko BCT's data is signed and encrypted after offset 0x0480, so the [[Flash_Filesystem#Keyblob|keyblob]] system is no longer used.
 During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.
@@ Line 263: / Line 263: @@
 |-
 |  0x0480
-|  0x2380
+|  0x10
+|
-|  Encrypted BCT data
+|  Empty
 |}

Hexkyz: /* Format */

2020-04-11T16:54:16Z

Format

← Older revision		Revision as of 20:54, 11 April 2020
Line 10:		Line 10:

	= Format =		= Format =
	~~Below are the BCT structure formats used by the Switch.~~

	== Erista ==		== Erista ==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"

Hexkyz at 18:53, 11 April 2020

2020-04-11T16:53:35Z

← Older revision		Revision as of 20:53, 11 April 2020
Line 9:		Line 9:
	During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.		During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.

	= ~~Structure~~ =		= Format =
	Below are the BCT ~~structures~~ used by the Switch.		Below are the BCT structure formats used by the Switch.

	== Erista ==		== Erista ==