const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/FIRMWARE" date="2026-08-05" title="The boot chain is the map" lede="ROM → bootloader → kernel → rootfs → the vendor daemon. If you cannot name those hops on this image, you do not know what you unpacked."/>
<P>A firmware tree with 4,000 files is not a map. A map is: what runs first, what it loads, what it verifies, and which process still talks to the network after init. We write that before we open httpd in Ghidra.</P>
<Callout>This is inventory of an offline image, or of a lab device named in the letter. It is not a guide to glitching production units.</Callout>
<H2>The hops</H2>
<H3>ROM / SPL</H3>
<P>Often not in the upgrade file. The SoC boots a mask ROM, then a small SPL from flash. If the customer only sent “the app partition,” say so. You cannot audit a boot ROM you were not given.</P>
<H3>Bootloader (U-Boot and cousins)</H3>
<P>Environment, bootcmd, whether it accepts a netboot, whether it checks a signature before <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>bootm</span>. Default U-Boot env in the image is a finding when it still has a vendor password or an extra boot path the product UI never mentions.</P>
<H3>Kernel + dtb</H3>
<P>Tells you the board the vendor actually built, not the SKU name on the box. UART pins in the dtb are how we know a lab console exists — see the UART note. Kernel version plus config fragments beat guessing CVE soup.</P>
<H3>Rootfs and init</H3>
<P><span style={{fontFamily:'var(--font-mono)',fontSize:13}}>/etc/inittab</span>, systemd units, procd, a vendor <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>rcS</span>. PID 1 is not the product. The product is whatever that script execs and leaves listening.</P>
<H2>What we write</H2>
<Code lang="boot.txt">{`given:    gateway-fw.bin  (hashed)
missing:  mask ROM (not in image) — stated
bootloader: u-boot, bootcmd=..., extra netboot path
kernel:   5.10.x, dtb shows uart0
rootfs:   squashfs, /etc/init.d/vendor-httpd
listens:  :80, :22 dropbear, :9000 vendor`}</Code>
<Ul items={[
'What was in the image vs what we never saw (ROM, OTP, companion MCU).',
'What is verified at each hop — or not.',
'Which process we will actually reverse, and why that one.'
]}/>
<P>If the updater can skip the bootloader check, that is an update-path finding, not a boot-chain mystery. Keep the two notes separate. Do not mix them in one paragraph of the report.</P>
<Related items={[
['post-fw-formats.html','What kind of blob is this firmware'],
['post-firmware.html','Unpacking firmware']
]}/>
</>;
}
window.Article=Article;
mountPost();