Address Mapping

iPod touch (2nd generation) Bootrom

I think this might not be a good idea, because this page will wind up getting huge, but in case anyone thinks differently I'll add these for the hell of it.

functions

0x067A - BootromStart
0x45BA - InitProcessor
0x4778 - SetupMMU
0x4734 - MMU_MapAddr
0x3A84 - Do_MMU_Mappings
0x34FC - EnableInterrupts
0x652C - Setup_SPI
0x36DC - Setup_IdleTask
0x4906 - PrepareNOR
0x49BC - nor_spi_read_range
0x178C - malloc
0x34D8 - DisableInterrupts
0x7840 - memset
0x7858 - memzero (this looks funny in IDA, kind of, but really it's just optimized as part of memset)
0x1954 - free
0x4844 - addNORtoBlockDevList
0x4804 - default_block_read
0x10C8 - blockdev_read_hook(void *BDevStruct, void *OutputBuffer, __int32 InputImageStartAddress, int Offset, __int32 Size)
0x1258 - fake_default_block_read
0x136E - blockdev_write_hook
0x1518 - default_block_write
0x151E - default_block_erase
0x1090 - get_block_device(const char* deviceName)
0x8354 - strcmp
0x1AF0 - CreateImageList
0x1F68 - DoCreateImageList
0x204C - GetImage(u32 imageFourccTag)
0x1BF0 - SetupMemzStruct(u32 LoadAddress, u32 FileSize, u32 flags)
0x30E8 - InitUSB
0x795C - memcpy
0x0E84 - USB_Core_Init
0x1058 - StopUSB
0x328C - GetSystemInfo
0x3D94 - Get_Chip_ID
0x3DA0 - Get_Chip_Revision
0x3D74 - Get_Security_Epoch
0x3AE4 - Get_Board_ID
0x3DD4 - Get_Unique_Chip_ID
0x8286 - snprintf
0x7D5C - vfprintf_like_thingy
0x82A8 - printf
0x8422 - putchar
0x2E98 - usb_print
0x83CC - strncat
0x1C18 - FreeMemzStruct
0x67DC - Reboot (via watchdog, so yeah it looks a bit odd)
0x0644 - LoadAndJumpToFWImage(struct MemzStruct *pMemzInfo, __int32 LoadAddress, __int32 FileSize)
0x3338 - ProperlyJumpToImage(void unkown, u32 address, void unknown)
0x4584 - PrepMMUForJump (?)
0x1B78 - LoadFirmwareImage
0x2144 - doLoadFirmwareImage
0x1D04 - VerifyImage
0x5EA8 - ComputeSHA1(void *Input_Data, int Data_Size, void *SHA1_Of_Data)
0x4150 - AdjustClock
0x5E54 - CopyBlockToSHA1Engine
0x372E - yield
0x2400 - DecryptRSASignature
0x0898 - DoCrypto(int CryptOption, void *Input_Buffer, void *Output_Buffer, __int32 Size, int AESMode, void *Key, void *IV) [CryptOption 0x10 == encrypt, 0x11 == decrypt]
0x5010 - aes_encrypt
0x4DB8 - do_aes_encrypt
0x4D38 - send_key_to_aes
0x4D88 - send_iv_to_aes
0x4F44 - aes_decrypt
0x4E80 - do_aes_decrypt
0x2668 - parse_certificate_and_signature(void *pCertsData, int sizeOfCerts, void *pImageRsaSha1, int sizeofRsaSha1, void *pComputedImageSha1, int sha1Size, void *pImageBuffer, int imageFullSize)
0x356C - CheckIfDiagnosticDevice
0x3D64 - Get_Security_Domain
0x3D44 - Get_Production_Mode
0x1F00 - Find_Data_For_Tag
0x346C - Panic
0x0634 - WaitForInterrupt
0x4618 - UndefinedInstructionVector
0x46F0 - UndefinedInstructionHandler
0x4628 - SoftwareInterruptVector
0x4700 - SoftwareInterruptHandler
0x4640 - PrefetchAbortVector
0x46B4 - PrefetchAbortHandler
0x4664 - DataAbortVector
0x46A2 - DataAbortHandler
0x467C - AddressExceptionTrapVector
0x4680 - InterruptRequestVector
0x4710 - InterruptRequestHandler
0x4BEC - HandleInterruptRequest
0x4690 - FastInterruptRequestVector
0x4722 - FastInterruptRequestHandler
0x4C40 - HandleFastInterruptRequest

variables

0x220240D4 - SHA1 accelerator register table
0x22024200 - Block Device List
0x220250A0 - Permissions Flags
0x220254E0 - Interrupt Table
0x2202C000 - Page table