888
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − + − Package1 is distributed as a plaintext initial bootloader and a secondary encrypted blob. Execution starts at the plaintext bootloader which will set up hardware, generate keys and decrypt the next stage.+ − + Line 493:
Line 493: − + − +
fix names
Present in the firmware package titles (0100000000000819, 010000000000081A, 010000000000081B and 010000000000081C) and installed into eMMC storage's [[Flash_Filesystem#Boot_Partitions|boot partitions 0 and 1]], "package1" contains the first Switch bootloader to run under the NVIDIA boot processor (an ARM7TDMI called "BPMP", "BPMP-Lite", "AVP" or "COP").
Present in the firmware package titles (0100000000000819, 010000000000081A, 010000000000081B and 010000000000081C) and installed into eMMC storage's [[Flash_Filesystem#Boot_Partitions|boot partitions 0 and 1]], "package1" contains the first Switch bootloader ("Package1ldr") to run under the NVIDIA boot processor (an ARM7TDMI called "BPMP", "BPMP-Lite", "AVP" or "COP"), as well as the actual encrypted package1 ("PK11") blob containing the second Switch Bootloader and TrustZone code.
The boot ROM validates, copies to IRAM and executes this package by parsing it's information block from the [[BCT|BCT]].
The boot ROM validates, copies to IRAM and executes this package by parsing it's information block from the [[BCT|BCT]].
= Format =
= Format =
This package is distributed as a plaintext initial bootloader (package1ldr) and a secondary encrypted blob ("PK11"). Execution starts at plaintext package1ldr which will set up hardware, generate keys and decrypt the next stage.
== Bootloader ==
== Package1ldr ==
The code for this stage is stored in plaintext inside the package. By looking into the BCT's bootloader0_info (normal) or bootloader1_info (safe mode), the boot ROM starts executing this stage at address 0x40010020 in IRAM.
The code for this stage is stored in plaintext inside the package. By looking into the BCT's bootloader0_info (normal) or bootloader1_info (safe mode), the boot ROM starts executing this stage at address 0x40010020 in IRAM.
</syntaxhighlight>
</syntaxhighlight>
== PK11 Blob ==
== Package1 (PK11) ==
This blob is stored encrypted inside the package and is decrypted by the initial bootloader.
This blob is stored encrypted inside the package and is decrypted by package1ldr.
=== Encryption ===
=== Encryption ===