What's new? | Help | Directory | Sign in
Google
qcbqsanalyzer
Analysis of QC BQS mobiles
  
  
  
  
    
Search
for
Updated Jan 18, 2008 by b...@trash-mail.com
BootingSequenceExplained  
Here we figure out what is done whilst booting

Booting Sequence

1. QBL (OTP)
------------

Check of QCSBL header and Config Bits (30 Bit) -> Value hardcoded (Func at FFFF0674)
Load of QCSBL header and Config Bits (Func at FFFF0396)
Check of PBL (SHA1) -> Value hardcoded (Func at FFFF03A0)
Load of PBL (Func at FFFF0260), Entrypoint : 0x0, with given QCSBL Header

2. PBL 
-------
Check of QCSBL (SHA1 + RSA-2048-SHA1 Signature Decryption from QCSBL) (Func at 0xBC)
Load of QCSBL (Func at 0x2FC), Entrypoint : 0x02D4C01C

3. QCSBL
--------
Check of OEMSBL (SHA1 + RSA-2048-SHA1 Signature Decryption from OEMSBL) (Func at 02D4C118)
Init of OEMSBL (Func at 0x2D4C2A0), Entrypoint : 0x02D9C354
Loading of OEMSBL (Func not yet found)
Check of AMSS (SHA1 + RSA-2048-SHA1 Signature Decryption from AMSS)(Func at 02D4C15C)
Loading of AMSS (Func at 0x02D4C060), Entrypoint : 0x0

Sign in to add a comment