anarsoul's blog

Here's rx1950 nand flash layout: 0x0000 - 0x1000 - First stage bootloader 0x1000 - 0x4000 - Some data, i.e. wifi mac is here 0x4000 - 0x44000 - Second stage bootloader. This block starts with 0x1000 byte header, 0x44000 - 0x-------- - WinCE image. This block starts with 0x400-byte partition table (???) followed by 0x1000 byte header (almost same as bootloader, but different addresses) Bootloader header looks like this: 0xfe 0x03 0x00 0xea ; some magic bytes? 0x00 * 0x3c ; 0x3c zeros 0x45 0x43 0x45 0x43 ; "ECEC" - more magic bytes? 0x8c0b5dcc ; stored in little endian format, virtual address in ram where image ends 0x00035dcc ; stored in little endian format, image size 0x00 * 0xfb4 ; 0xfb4 zeros So, bootloader will be loaded at 0x8c0b5dcc - 0x00035dcc = 0x8c080000 (virtual address) WinCE header looks almost the same, except address is 0x8014e388 and size is 0x0014e388, so WinCE image will be loaded at 0x80000000 (virtual) WinCE partition table is not looking interesting t...