Changes

== Stage 2 ==

== Stage 2 ==

This stage is decrypted by Stage 1 using an hardware secret (HOVI == Horizon VI?).

This stage is decrypted by Stage 1 using a key generated by encrypting a seed with an hardware secret (see [[TSEC#keygen|keygen]]).

The hardware secret is, presumably, a 16 bytes key located at offset 0x26 inside the KFUSE array.

== Key data ==

== Key data ==