ooohh.. ok. I see.
Well when I used to do R&D with broadcomm based STBs, the way they worked was the main chip actually had its own internal ROM, and an OTP ROM. Small, about 128K. The way it was setup is the broadcomm ROM basically checked the flash memory bootloader section for a valid chip ID and signature before handing control over to the IC, and this key was stored in the OTP, well the public key anyway. The chip ID function and even the signature function was settable via the OTP block. Once programmed, that was it. it was set. no changing it.
This basically insured that only the authorized firmware provider could ever put firmware on it, otherwise the CPU would never boot unsigned code. However there was a flaw that you could drop the multiplier and clock glitch the CPU to screw with that, but thats another topic entirely.
once this check passed, the control was handed over to the flash bootloader and that was responsible for checking and decompressing the firmware, and the rest is gravy. the STBs I worked with usually had the bootloader section of the flash, actually locked. so you couldnt ever re-write that sector of the flash without replacing the IC. yea, it was insane.
Not sure how that one is designed though.
Well when I used to do R&D with broadcomm based STBs, the way they worked was the main chip actually had its own internal ROM, and an OTP ROM. Small, about 128K. The way it was setup is the broadcomm ROM basically checked the flash memory bootloader section for a valid chip ID and signature before handing control over to the IC, and this key was stored in the OTP, well the public key anyway. The chip ID function and even the signature function was settable via the OTP block. Once programmed, that was it. it was set. no changing it.
This basically insured that only the authorized firmware provider could ever put firmware on it, otherwise the CPU would never boot unsigned code. However there was a flaw that you could drop the multiplier and clock glitch the CPU to screw with that, but thats another topic entirely.
once this check passed, the control was handed over to the flash bootloader and that was responsible for checking and decompressing the firmware, and the rest is gravy. the STBs I worked with usually had the bootloader section of the flash, actually locked. so you couldnt ever re-write that sector of the flash without replacing the IC. yea, it was insane.
Not sure how that one is designed though.