IOS/Loader
< IOS
Loader
Each time the IOSU starts, the ELF loader is the first portion of code that runs in order to make preparations for the actual IOSU binary. During the console's initial boot, boot1 is responsible for fetching the "fw.img" file from NAND, verifying, decrypting and launching it (cold boot). However, IOS-MCP also has to do this when handling a system restart (warm boot) for which it follows a similar path but, ultimately, uses the LaunchOS system call in order to disable memory protections and jump to the IOSU's ELF loader code.
The loader does the following:
- Clears it's own stack;
- Sets 0x20 in HW_SRNPROT register, if not set already;
- Fetches e_phnum from the IOSU's ELF header;
- Loops through the IOSU's ELF program header structs;
- For each program marked with PT_LOAD, copies it's code into the target physical memory;
- Wipes the IOSU's ELF binary from MEM1;
- Wipes itself from MEM1 (excluding the then running subroutine);
- Jumps to 0xFFFF0000 (IOSU kernel boot).