BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters.
The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's LUN0 and LUN1.
Structure
BRBCT
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Magic ("BCTB")
|
| 0x4
|
0x40
|
DigestHash (SHA-512 hash over data from 0x44 to 0x2000)
|
| 0x44
|
0x180
|
PublicParams
|
| 0x1C4
|
0x40
|
CryptoHash (SHA-512 hash over data from 0x1200 to 0x2000)
|
| 0x204
|
0xB10
|
CryptoSignature (XMSS-SHA2_20_256 signature)
|
| 0xD14
|
0x400
|
CustomerInfo
|
| 0x1114
|
0xEC
|
|
| Signed Section Begin
|
|
|
| AAD Section Begin
|
|
|
| 0x1200
|
0x10
|
Salt1
|
| 0x1210
|
0x4
|
Magic ("BCTB")
|
| 0x1214
|
0x4
|
BctEds
|
| 0x1218
|
0x10
|
|
| 0x1228
|
0x4
|
|
| 0x122C
|
0xC
|
Iv
|
| AAD Section End
|
|
|
| 0x1238
|
0x10
|
Tag
|
| 0x1248
|
0xC0 (0x30 * 4)
|
PtInfo[4]
|
| 0x1308
|
0x4
|
Version
|
| 0x130C
|
0x400
|
CustomerInfoSigned
|
| 0x170C
|
0x284
|
|
| Encrypted Section Begin
|
|
|
| 0x1990
|
0x10
|
Salt2
|
| 0x19A0
|
0x10
|
Ecid
|
| 0x19B0
|
0x8
|
BlDerStr
|
| 0x19B8
|
0x8
|
FwDerStr
|
| 0x19C0
|
0x8
|
TzDerStr
|
| 0x19C8
|
0x8
|
GpDerStr
|
| 0x19D0
|
0x8
|
FsiDerStr
|
| 0x19D8
|
0x4
|
NonGpioSelectBootChain
|
| 0x19DC
|
0x4
|
BootLoadersUsed
|
| 0x19E0
|
0x4
|
SecureDebugControlNoneEcid
|
| 0x19E4
|
0x4
|
SecureDebugControlEcid
|
| 0x19E8
|
0x4
|
PreprodDevSign
|
| 0x19EC
|
0x4
|
SecProvisioningKeynumSecure
|
| 0x19F0
|
0x4
|
BfBlBits
|
| 0x19F4
|
0x20
|
TzTestKey
|
| 0x1A14
|
0x20
|
FskpTestKey
|
| 0x1A34
|
0x20
|
PkaTestKey
|
| 0x1A54
|
0x24
|
|
| 0x1A78
|
0x01
|
FskpKeyAesType
|
| 0x1A79
|
0x01
|
FskpKeyHmacType
|
| 0x1A7A
|
0x01
|
PkaTestKeyType
|
| 0x1A7B
|
0x20
|
SecProvisionDerivationString1
|
| 0x1A9B
|
0x20
|
SecProvisionDerivationString2
|
| 0x1ABB
|
0x1
|
|
| 0x1ABC
|
0x4
|
SoftSkuOverwrite
|
| 0x1AC0
|
0x40
|
BrBctHash (SHA-512 hash over data from 0x170C to 0x1AC0)
|
| 0x1B00
|
0x500
|
|
| Encrypted Section End
|
|
|
| Signed Section End
|
|
|
NvBctPtInfo
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Mb1BctStartPage
|
| 0x4
|
0x4
|
Mb1BctStartBlock
|
| 0x8
|
0x4
|
Mb1BctVersion
|
| 0xC
|
0x4
|
Mb1BctRandom
|
| 0x10
|
0x4
|
PscBlStartPage
|
| 0x14
|
0x4
|
PscBlStartBlock
|
| 0x18
|
0x4
|
PscBlVersion
|
| 0x1C
|
0x4
|
PscBlRandom
|
| 0x20
|
0x4
|
Mb1StartPage
|
| 0x24
|
0x4
|
Mb1StartBlock
|
| 0x28
|
0x4
|
Mb1Version
|
| 0x2C
|
0x4
|
Mb1Random
|
Version
| Offset
|
Size
|
Description
|
| 0x0
|
0x1
|
VerMajor
|
| 0x1
|
0x1
|
VerMinor
|
| 0x2
|
0x1
|
RatchetLevel
|
| 0x3
|
0x1
|
RevokePk
|
RevokePk
| Bits
|
Description
|
| 0
|
RevokeH0
|
| 1
|
RevokeH1
|
BfBlBits
| Bits
|
Description
|
| 0
|
GpioSelectBootChain
|
| 1
|
Mb1DebugProduction
|
| 2
|
Sc7RfDebugProduction
|
| 3
|
PscBlDebugProduction
|
| 4
|
PscRfDebugProduction
|
| 5
|
PscFwDebugProduction
|
| 6
|
BpmpDebugProduction
|
| 7
|
BpmpIstDebugProduction
|
| 8
|
MceDebugProduction
|
| 9
|
IstCcplexDebugProduction
|
| 10
|
IstFwDebugProduction
|
| 11
|
RtcRailViolationDetect
|
| 12
|
CustNvCcplexDfdEn
|
| 13
|
DebugWithTestKeys
|
| 14
|
DebugWithTestKeysDuringPscDebug
|
| 15
|
DisableBootromClockBoost
|
| 16
|
DisablePscromClkBoost
|
| 17
|
EnableScpmReset
|
| 18
|
SkipOemAuthDiagBoot
|
| 19
|
DiagBoot
|
| 20
|
BpmpDiagBoot
|
| 21
|
L0Ist
|
| 22
|
L1Ist
|
| 23-31
|
|