Boot Process
From t-hack.com - Hack X300T / X301T
m (→BooterCE on Harddisk) |
(added boot process diagram) |
||
| Line 1: | Line 1: | ||
| + | [[Image:Boot.png|thumb|Box Boot Process Diagram|300px]] | ||
=== CPU internal === | === CPU internal === | ||
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process. | The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process. | ||
| − | It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU. | + | It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU. |
=== Bootloader in Flash === | === Bootloader in Flash === | ||
| Line 13: | Line 14: | ||
This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de | This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de | ||
| − | The content of this file is not important for the boot itself. | + | The content of this file is not important for the boot itself. (On the BT-Vision version the file contains some Certificate information. Maybe this is part of the trust chain - will the box accept any CA cert, i.e. if this is the start of the chain, or is there a cert that verifies this one that is already in flash? I do not recognise the format, but the strings make this look like a BT Vision CA cert signed by the BT root CA.) |
Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered. | Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered. | ||
| − | For | + | === Disaster-Recovery === |
| + | For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP. (On the BT-Vision version the file sync contains the dns name of the server to download dra from, and a some Certificate information). | ||
dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started. | dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started. | ||
