6,264
edits
Changes
→Boot9 image data memory layout
* 0xffffe060(end addr of the above key-area) size 0x230-bytes: This is the initial DTCM image @ 0xFFF00000, see below.
* 0xffffe060(end addr of the above key-area) size 0x230-bytes: This is the initial DTCM image @ 0xFFF00000, see below.
* 0xffffe290(DTCM_image_end) - {boot9 image end}: All-zero.
* 0xffffe290(DTCM_image_end) - {boot9 image end}: All-zero.
Layout of the 0x2f80-byte key-area at 0xffffb0e0:
* 0xffffb0e0 size 0x2600-bytes: This is the RSA key-data, see below.
* 0xffffd6e0(end-addr of the above area) size 0x40-bytes: This is the keydata used for crypting the entire OTP with keyslot 0x3f, used by main(). The first 0x20-bytes is for retail, the remaining 0x20-bytes starting at 0xffffd700 is for devunit. Chunk+0(retail=0xffffd6e0 devunit=0xffffd700) is the normalkey, chunk+0x10(retail=0xffffd6f0 devunit=0xffffd710) is the AES-IV.
* ...
* 0xffffd760: size 0x100-bytes: First 0x80-bytes is for retail, the remaining 0x80-bytes at 0xffffd7e0 is for devunit. This 0x80-byte block is copied to 0x07ffcd00 by a Boot9 function, however that code actually does the copy in two 0x40-bytes chunks.
* 0xffffd860(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for retail.
* 0xffffdc60(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for devunit. This is very last chunk of data in the boot9 data-section key-area: end addr for this area is 0xffffe060.
Layout of the 0x2600-byte RSA key-data at 0xffffb0e0:
First 0x1300-bytes is for retail, the remaining 0x1300-bytes starting at 0xffffc3e0 is for devunit.
* ...
== Boot9 DTCM layout ==
== Boot9 DTCM layout ==