Nintendo Switch Brew

BCT: Difference between revisions

← Older editNewer edit →
No edit summary
Line 5: Line 5:
The Erista BCT's data is only signed after offset 0x0510. Therefore, regions like [[#CustomerData|CustomerData]] can be freely modified without resigning. This is done by [[NS_Services|NS]] when injecting a new [[Flash_Filesystem#Keyblob|keyblob]] during a system update, for example.
The Erista BCT's data is only signed after offset 0x0510. Therefore, regions like [[#CustomerData|CustomerData]] can be freely modified without resigning. This is done by [[NS_Services|NS]] when injecting a new [[Flash_Filesystem#Keyblob|keyblob]] during a system update, for example.


The Mariko BCT's data is signed and encrypted, so the [[Flash_Filesystem#Keyblob|keyblob]] system is no longer used.
The Mariko BCT's data is signed and encrypted after offset 0x0480, so the [[Flash_Filesystem#Keyblob|keyblob]] system is no longer used.


During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.
During boot, the boot ROM parses the appropriate BCT from eMMC storage and stores a copy of it in IRAM at address 0x40000000.
Line 263: Line 263:
|-
|-
|  0x0480
|  0x0480
|  0x2380
|  0x10
|  RandomAesBlock
| 
|-
|  0x0490
|  0x10
|  UniqueChipId
|  Always empty
|-
|  0x04A0
|  0x04
|  BootDataVersion
|  Set to 0x00210001 (BOOTDATA_VERSION_T210)
|-
|  0x04A4
|  0x04
|  BlockSizeLog2
|  Always 0x0E
|-
|  0x04A8
|  0x04
|  PageSizeLog2
|  Always 0x09
|-
|  0x04AC
|  0x04
|  PartitionSize
|  Always 0x01000000
|-
|  0x04B0
|  0x04
|  NumParamSets
|  Number of device parameter sets (always 0x01)
|-
|  0x04B4
|  0x04
|  DevType
|  Device type (0x04 == Sdmmc)
|-
|  0x04B8
|  0x40
|  DevParams
|  Device parameters
|-
|  0x04F8
|  0x04
|  NumSdramSets
|  Number of SDRAM parameter sets (always set to 0, but parameters are used despite this)
|-
|  0x04FC
|  0x838
|  SdramParams0
|  Default values filled in
|-
|  0x0D34
|  0x838
|  SdramParams1
|  Default values filled in
|-
|  0x156C
|  0x838
|  SdramParams2
|  Default values filled in
|-
|  0x1DA4
|  0x838
|  SdramParams3
|  Default values filled in
|-
|  0x25DC
|  0x04
|  BootLoadersUsed
|  Number of bootloaders installed (always 0x02, maximum is 0x04)
|-
|  0x25E0
|  0x10
|  [[#BootLoader0|BootLoader0]]
|  Configuration parameters for bootloader 0 (normal)
0x25E0: StartBlock (0x00000040)
0x25E4: StartPage (0x00000000)
0x25E8: Version (variable)
0x25EC: Reserved
|-
|  0x25F0
|  0x10
|  BootLoader1
|  Configuration parameters for bootloader 1 (safe mode)
0x25F0: StartBlock (0x00000050)
0x25F4: StartPage (0x00000000)
0x25F8: Version (variable)
0x25FC: Reserved
|-
|  0x2600
|  0x10
|  BootLoader2
|  Reserved space for bootloader 2 (unused)
|-
|  0x2610
|  0x10
|  BootLoader3
|  Reserved space for bootloader 3 (unused)
|-
|  0x2620
|  0x5C
|   
|   
|  Encrypted BCT data
|  Empty
|-
|  0x267C
|  0x184
|  Reserved
|  Always starts with 0x80000000 (NVBOOT padding pattern)
|}
|}
Retrieved from "https://switchbrew.org/wiki/BCT"