https://nitter.pussthecat.org/xbootorg/status/1476536996378120193 RISC-V_vs_ARM_BROM.png Associated article (here t_6546.html and text dump using w3m) from: https://whycan.com/t_6546.html SunXi generally use in SoC firmware eGON for booting, it load boot0 then boot1 https://linux-sunxi.org/EGON No need to reverse, all this is well documented here: https://linux-sunxi.org/Allwinner_Nezha#Manual_build Boot0 is in boot0_sdcard_sun20iw1p1.bin See: https://github.com/smaeul/sun20i_d1_spl/blob/mainline/nboot/main/load_image.c * https://github.com/smaeul/sun20i_d1_spl * https://github.com/orangecms/oreboot/ # Rust based boot, bersion without C of Coreboot * https://github.com/xboot/xboot xboot is a multi-SoC boot that can run Lua in a virtualmachine and support GUI and animations (can run on Qemu and x86_64 sandbox too). * https://github.com/smaeul/u-boot/tree/allwinner/tools * https://github.com/orangecms/u-root * https://github.com/carlosedp/riscv-bringup * https://github.com/linux-sunxi/sunxi-tools Varioous linux-sunxi tools for analyze/build/convert https://github.com/xboot/xfel Tiny FEL tools for Allwinner SOC. FEL is a low-level subroutine contained in the BootROM on Allwinner devices. It is used for initial programming and recovery of devices using USB. Xfel_capabilities.png come from this twitt: https://nitter.pussthecat.org/xbootorg/status/1479270188700762113 Documentation: https://xboot.org/xfel/ Tocl: https://github.com/smaeul/u-boot/blob/d1-wip/tools/sunxi_toc1.c ================== d1-kernel.toc1 // contains kernel, and after strings OpenSBI and probably some device tree infos: 00000030: 0000 0000 0000 0000 0000 0000 4d49 453b ............MIE; 00000040: 6f70 656e 7362 6900 0000 0000 0000 0000 opensbi......... ... 000001a0: 0000 0000 0000 0000 0000 0000 4949 453b ............IIE; 000001b0: 6474 6200 0000 0000 0000 0000 0000 0000 dtb............. ... 00000310: 0000 0000 0000 0000 0000 0000 4949 453b ............IIE; 00000320: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 4d49 453b MIE; => opensbi 4949 453b IIE; => dtb arround 0x00013400 OpenSBI + its ASCII Art logo 00013400: 2d2d 2d00 0000 0000 7630 2e39 2d31 3930 ---.....v0.9-190 00013410: 2d67 3230 6466 3537 6300 0000 0000 0000 -g20df57c....... 00013420: 0a4f 7065 6e53 4249 2025 730a 0000 0000 .OpenSBI %s..... 00013430: 2020 205f 5f5f 5f20 2020 2020 2020 2020 ____ 00013440: 2020 2020 2020 2020 2020 205f 5f5f 5f5f _____ 00013450: 205f 5f5f 5f20 5f5f 5f5f 5f0a 2020 2f20 ____ _____. / 00013460: 5f5f 205c 2020 2020 2020 2020 2020 2020 __ \ 00013470: 2020 2020 2020 2f20 5f5f 5f5f 7c20 205f / ____| _ 00013480: 205c 5f20 2020 5f7c 0a20 7c20 7c20 207c \_ _|. | | | 00013490: 207c 5f20 5f5f 2020 205f 5f5f 205f 205f |_ __ ___ _ _ Laters some strings probably from std OpenSBI but wih 00 around (gaisler/shakti/sifive/litex)_uart and uart8250 The same way this 2 strings with 00 around (block alignement or block copied in ram, then data filled dynamicallY?): 00016f80: 7375 6e78 692d 7764 742d 7265 7365 7400 sunxi-wdt-reset. 00016ff0: 7468 6561 645f 7265 7365 7400 0000 0000 thead_reset..... Sunxi-tools contains a tool to automatically extract info from eGON.BT0, could be used as base and improved: https://linux-sunxi.org/Sunxi-tools#sunxi-bootinfo Source of sunxi-bootinfo: https://github.com/linux-sunxi/sunxi-tools/blob/master/bootinfo.c ./sunxi-tools/sunxi-bootinfo licheerv_d1_ub2004_20220104a/boot0_sdcard_sun20iw1p1.bin 4: Magic : eGON.BT0 10: Length : 49152 14: HSize : 48 18: HEAD ver : 3000 1c: FILE ver : 20: BOOT ver : 24: eGON ver : 28: platform : 4.0