Address Mapping

iPod touch (2nd generation) Bootrom

I think this might not be a good idea, because this page will wind up getting huge, but in case anyone thinks differently I'll add these for the hell of it.

functions

• 0x067A - BootromStart
• 0x45BA - InitProcessor
• 0x4778 - SetupMMU
• 0x4734 - MMU_MapAddr
• 0x3A84 - Do_MMU_Mappings
• 0x34FC - EnableInterrupts
• 0x652C - Setup_SPI
• 0x36DC - Setup_IdleTask
• 0x4906 - PrepareNOR
• 0x49BC - nor_spi_read_range
• 0x178C - malloc
• 0x34D8 - DisableInterrupts
• 0x7840 - memset
• 0x7858 - memzero (this looks funny in IDA, kind of, but really it's just optimized as part of memset)
• 0x1954 - free
• 0x4844 - addNORtoBlockDevList
• 0x4804 - default_block_read
• 0x10C8 - blockdev_read_hook(void *BDevStruct, void *OutputBuffer, __int32 InputImageStartAddress, int Offset, __int32 Size)
• 0x1258 - fake_default_block_read
• 0x136E - blockdev_write_hook
• 0x1518 - default_block_write
• 0x151E - default_block_erase
• 0x1090 - get_block_device(const char* deviceName)
• 0x8354 - strcmp
• 0x1AF0 - CreateImageList
• 0x1F68 - DoCreateImageList
• 0x204C - GetImage(u32 imageFourccTag)
• 0x1BF0 - SetupMemzStruct(u32 LoadAddress, u32 FileSize, u32 flags)
• 0x30E8 - InitUSB
• 0x795C - memcpy
• 0x0E84 - USB_Core_Init
• 0x1058 - StopUSB
• 0x328C - GetSystemInfo
• 0x3D94 - Get_Chip_ID
• 0x3DA0 - Get_Chip_Revision
• 0x3D74 - Get_Security_Epoch
• 0x3AE4 - Get_Board_ID
• 0x3DD4 - Get_Unique_Chip_ID
• 0x8286 - snprintf
• 0x7D5C - vfprintf_like_thingy
• 0x82A8 - printf
• 0x8422 - putchar
• 0x2E98 - usb_print
• 0x83CC - strncat
• 0x1C18 - FreeMemzStruct
• 0x67DC - Reboot (via watchdog, so yeah it looks a bit odd)
• 0x0644 - LoadAndJumpToFWImage(struct MemzStruct *pMemzInfo, __int32 LoadAddress, __int32 FileSize)
• 0x3338 - ProperlyJumpToImage(void unkown, u32 address, void unknown)
• 0x4584 - PrepMMUForJump (?)
• 0x1B78 - LoadFirmwareImage
• 0x2144 - doLoadFirmwareImage
• 0x1D04 - VerifyImage
• 0x5EA8 - ComputeSHA1(void *Input_Data, int Data_Size, void *SHA1_Of_Data)
• 0x4150 - AdjustClock
• 0x5E54 - CopyBlockToSHA1Engine
• 0x372E - yield
• 0x2400 - DecryptRSASignature
• 0x0898 - DoCrypto(int CryptOption, void *Input_Buffer, void *Output_Buffer, __int32 Size, int AESMode, void *Key, void *IV) [CryptOption 0x10 == encrypt, 0x11 == decrypt]
• 0x5010 - aes_encrypt
• 0x4DB8 - do_aes_encrypt
• 0x4D38 - send_key_to_aes
• 0x4D88 - send_iv_to_aes
• 0x4F44 - aes_decrypt
• 0x4E80 - do_aes_decrypt
• 0x2668 - parse_certificate_and_signature(void *pCertsData, int sizeOfCerts, void *pImageRsaSha1, int sizeofRsaSha1, void *pComputedImageSha1, int sha1Size, void *pImageBuffer, int imageFullSize)
• 0x356C - CheckIfDiagnosticDevice
• 0x3D64 - Get_Security_Domain
• 0x3D44 - Get_Production_Mode
• 0x1F00 - Find_Data_For_Tag
• 0x346C - Panic
• 0x0634 - WaitForInterrupt
• 0x4618 - UndefinedInstructionVector
• 0x46F0 - UndefinedInstructionHandler
• 0x4628 - SoftwareInterruptVector
• 0x4700 - SoftwareInterruptHandler
• 0x4640 - PrefetchAbortVector
• 0x46B4 - PrefetchAbortHandler
• 0x4664 - DataAbortVector
• 0x46A2 - DataAbortHandler
• 0x467C - AddressExceptionTrapVector
• 0x4680 - InterruptRequestVector
• 0x4710 - InterruptRequestHandler
• 0x4BEC - HandleInterruptRequest
• 0x4690 - FastInterruptRequestVector
• 0x4722 - FastInterruptRequestHandler
• 0x4C40 - HandleFastInterruptRequest

variables

• 0x220240D4 - SHA1 accelerator register table
• 0x22024200 - Block Device List
• 0x220250A0 - Permissions Flags
• 0x220254E0 - Interrupt Table
• 0x2202C000 - Page table