Switch 2: BCT - Revision history

Hexkyz at 03:47, 30 September 2025

2025-09-30T01:47:27Z

Hexkyz at 03:44, 29 September 2025

2025-09-29T01:44:22Z

← Older revision		Revision as of 05:44, 29 September 2025
Line 57:		Line 57:
	\| 0x0		\| 0x0
	\| 0x10		\| 0x10
	\| Salt1~~. Random~~ 16 bytes.		\| Salt1 (random 16 bytes)
	\|-		\|-
	\| 0x10		\| 0x10
Line 101:		Line 101:
	\| 0x10B		\| 0x10B
	\| 0x1		\| 0x1
	\| RevokePk~~. Bit0~~: RevokeH0, ~~Bit1~~: RevokeH1		\| RevokePk (bit0: RevokeH0, bit1: RevokeH1)
	\|-		\|-
	\| 0x10C		\| 0x10C
Line 113:		Line 113:
	\| 0x790		\| 0x790
	\| 0x10		\| 0x10
	\| Salt2~~. Random~~ 16 bytes.		\| Salt2 (random 16 bytes)
	\|-		\|-
	\| 0x7A0		\| 0x7A0

Hexkyz: /* NvBctPtInfo */

2025-09-29T01:38:06Z

NvBctPtInfo

← Older revision		Revision as of 05:38, 29 September 2025
Line 229:		Line 229:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| ~~Mb1BctStartBlock~~		\| Mb1BctStartPage
	\|-		\|-
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| ~~Mb1BctStartPage~~		\| Mb1BctStartBlock
	\|-		\|-
	\| 0x8		\| 0x8
Line 245:		Line 245:
	\| 0x10		\| 0x10
	\| 0x4		\| 0x4
	\| ~~Mb1StartBlock~~		\| PscBlStartPage
	\|-		\|-
	\| 0x14		\| 0x14
	\| 0x4		\| 0x4
	\| ~~Mb1StartPage~~		\| PscBlStartBlock
	\|-		\|-
	\| 0x18		\| 0x18
	\| 0x4		\| 0x4
	\| ~~Mb1Version~~		\| PscBlVersion
	\|-		\|-
	\| 0x1C		\| 0x1C
	\| 0x4		\| 0x4
	\| ~~Mb1Random~~		\| PscBlRandom
	\|-		\|-
	\| 0x20		\| 0x20
	\| 0x4		\| 0x4
	\| ~~PscBlStartBlock~~		\| Mb1StartPage
	\|-		\|-
	\| 0x24		\| 0x24
	\| 0x4		\| 0x4
	\| ~~PscBlStartPage~~		\| Mb1StartBlock
	\|-		\|-
	\| 0x28		\| 0x28
	\| 0x4		\| 0x4
	\| ~~PscBlVersion~~		\| Mb1Version
	\|-		\|-
	\| 0x2C		\| 0x2C
	\| 0x4		\| 0x4
	\| ~~PscBlRandom~~		\| Mb1Random
	\|}		\|}

Hexkyz at 03:17, 29 September 2025

2025-09-29T01:17:58Z

← Older revision		Revision as of 05:17, 29 September 2025
Line 85:		Line 85:
	\| 0x48		\| 0x48
	\| 0xC0 (0x30 * 4)		\| 0xC0 (0x30 * 4)
	\| [[#~~BlInfo~~\|~~BlInfo~~]]		\| [[#NvBctPtInfo\|PtInfo]][4]
	\|-		\|-
	\| 0x108		\| 0x108
Line 220:		Line 220:
	\|}		\|}

	==== ~~BlInfo~~ ====		==== NvBctPtInfo ====
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	\|-		\|-
Line 229:		Line 229:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| ~~StartBlock0~~		\| Mb1BctStartBlock
	\|-		\|-
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| ~~StartPage0~~		\| Mb1BctStartPage
	\|-		\|-
	\| 0x8		\| 0x8
	\| 0x4		\| 0x4
	\| ~~Version0~~		\| Mb1BctVersion
	\|-		\|-
	\| 0xC		\| 0xC
	\| 0x4		\| 0x4
	\| ~~Random0~~		\| Mb1BctRandom
	\|-		\|-
	\| 0x10		\| 0x10
	\| 0x4		\| 0x4
	\| ~~StartBlock1~~		\| Mb1StartBlock
	\|-		\|-
	\| 0x14		\| 0x14
	\| 0x4		\| 0x4
	\| ~~StartPage1~~		\| Mb1StartPage
	\|-		\|-
	\| 0x18		\| 0x18
	\| 0x4		\| 0x4
	\| ~~Version1~~		\| Mb1Version
	\|-		\|-
	\| 0x1C		\| 0x1C
	\| 0x4		\| 0x4
	\| ~~Random1~~		\| Mb1Random
	\|-		\|-
	\| 0x20		\| 0x20
	\| 0x4		\| 0x4
	\| ~~StartBlock2~~		\| PscBlStartBlock
	\|-		\|-
	\| 0x24		\| 0x24
	\| 0x4		\| 0x4
	\| ~~StartPage2~~		\| PscBlStartPage
	\|-		\|-
	\| 0x28		\| 0x28
	\| 0x4		\| 0x4
	\| ~~Version2~~		\| PscBlVersion
	\|-		\|-
	\| 0x2C		\| 0x2C
	\| 0x4		\| 0x4
	\| ~~Random2~~		\| PscBlRandom
	\|}		\|}

Ootulp: Created page with "BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters. The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's LUN0 and LUN1. = Structure = == BRBCT == {| class="wikitable" border="1" |- ! Offset ! Size ! Description |- | 0x0 | 0x4 | Magic ("BCT..."

2025-08-07T01:02:21Z

Created page with "BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters. The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's LUN0 and LUN1. = Structure = == BRBCT == {| class="wikitable" border="1" |- ! Offset ! Size ! Description |- | 0x0 | 0x4 | Magic ("BCT..."

New page

BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters.

The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's [[Switch 2: Flash_Filesystem#LUN0|LUN0]] and [[Switch 2: Flash_Filesystem#LUN1|LUN1]].

= Structure =
== BRBCT ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic ("BCTB")
|-
| 0x4
| 0x40
| BctHash (SHA-512 hash over data from 0x44 to 0x2000)
|-
| 0x44
| 0x180
| PublicParams
|-
| 0x1C4
| 0x40
| CryptoHash (SHA-512 hash over data from 0x1200 to 0x2000)
|-
| 0x204
| 0xB10
| CryptoSignature (XMSS-SHA2_20_256 signature)
|-
| 0xD14
| 0x400
| CustomerInfo
|-
| 0x1114
| 0xEC
|
|-
| 0x1200
| 0xE00
| SignedSect
|}

=== SignedSect ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| style="background: orange" | AAD Section Begin
| style="background: orange" |
| style="background: orange" |
|-
| 0x0
| 0x10
| Salt1. Random 16 bytes.
|-
| 0x10
| 0x4
| Magic ("BCTB")
|-
| 0x14
| 0x14
| KdfLabel
|-
| 0x28
| 0x4
| Zeroes
|-
| 0x2C
| 0x0C
| AesGcmIv
|-
| style="background: orange" | AAD Section End
| style="background: orange" |
| style="background: orange" |
|-
| 0x38
| 0x10
| AesGcmTag
|-
| 0x48
| 0xC0 (0x30 * 4)
| [[#BlInfo|BlInfo]]
|-
| 0x108
| 0x1
| VerMajor
|-
| 0x109
| 0x1
| VerMinor
|-
| 0x10A
| 0x1
| RatchetLevel
|-
| 0x10B
| 0x1
| RevokePk. Bit0: RevokeH0, Bit1: RevokeH1
|-
| 0x10C
| 0x400
| CustomerInfo
|-
| 0x50C
| 0x284
|
|-
| 0x790
| 0x10
| Salt2. Random 16 bytes.
|-
| 0x7A0
| 0x10
| Ecid
|-
| 0x7B0
| 0x8
| BrBctBinding
|-
| 0x7B8
| 0x8
| SbkKdfLabel
|-
| 0x7C0
| 0x8
| UnknownKdfLabel0
|-
| 0x7C8
| 0x8
| UnknownKdfLabel1
|-
| 0x7D0
| 0x8
| FsiKdfLabel
|-
| 0x7D8
| 0x4
| NonGpioSelectBootChain
|-
| 0x7DC
| 0x4
| BootLoadersUsed
|-
| 0x7E0
| 0x4
| SecureDebugControlNoneEcid
|-
| 0x7E4
| 0x4
| SecureDebugControlEcid
|-
| 0x7E8
| 0x4
| PreprodDevSign
|-
| 0x7EC
| 0x4
| SecProvisioningKeynumSecure
|-
| 0x7F0
| 0x4
| [[#BfBlBits|BfBlBits]]
|-
| 0x7F4
| 0x20
| TzTestKey
|-
| 0x814
| 0x20
| FskpTestKey
|-
| 0x834
| 0x20
| PkaTestKey
|-
| 0x854
| 0x24
|
|-
| 0x878
| 0x01
| FskpKeyAesType
|-
| 0x879
| 0x01
| FskpKeyHmacType
|-
| 0x87A
| 0x01
| PkaTestKeyType
|-
| 0x87B
| 0x20
| SecProvisionDerivationString1
|-
| 0x89B
| 0x20
| SecProvisionDerivationString2
|-
| 0x8BB
| 0x1
|
|-
| 0x8BC
| 0x4
| SoftSkuOverwrite
|-
| 0x8C0
| 0x4FC
|
|-
| 0xDBC
| 0x44
| Digest
|}

==== BlInfo ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| StartBlock0
|-
| 0x4
| 0x4
| StartPage0
|-
| 0x8
| 0x4
| Version0
|-
| 0xC
| 0x4
| Random0
|-
| 0x10
| 0x4
| StartBlock1
|-
| 0x14
| 0x4
| StartPage1
|-
| 0x18
| 0x4
| Version1
|-
| 0x1C
| 0x4
| Random1
|-
| 0x20
| 0x4
| StartBlock2
|-
| 0x24
| 0x4
| StartPage2
|-
| 0x28
| 0x4
| Version2
|-
| 0x2C
| 0x4
| Random2
|}

==== BfBlBits ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| GpioSelectBootChain
|-
| 1
| Mb1DebugProduction
|-
| 2
| Sc7RfDebugProduction
|-
| 3
| PscBlDebugProduction
|-
| 4
| PscRfDebugProduction
|-
| 5
| PscFwDebugProduction
|-
| 6
| BpmpDebugProduction
|-
| 7
| BpmpIstDebugProduction
|-
| 8
| MceDebugProduction
|-
| 9
| IstCcplexDebugProduction
|-
| 10
| IstFwDebugProduction
|-
| 11
| RtcRailViolationDetect
|-
| 12
| CustNvCcplexDfdEn
|-
| 13
| DebugWithTestKeys
|-
| 14
| DebugWithTestKeysDuringPscDebug
|-
| 15
| DisableBootromClockBoost
|-
| 16
| DisablePscromClkBoost
|-
| 17
| EnableScpmReset
|-
| 18
| SkipOemAuthDiagBoot
|-
| 19
| DiagBoot
|-
| 20
| BpmpDiagBoot
|-
| 21
| L0Ist
|-
| 22
| L1Ist
|-
| 23-31
|
|}