Part of the iPhone Dev Team Archive
Geo's hardware trick convinces the bootrom that the bootloader is empty. Here is the bootrom code that's being tricked by the A17 pullup.
004004B0 ; if values at these locations are all FFFFFFFF: A0000030,A000A5A0,A0015C58,A0017370
004004B0 ; return 0
004004B0 ; else if value at A0000030 is complement of value at A0000034
004004B0 ; return 1
004004B0 ; else
004004B0 ; return -1
004004B0 ;
004004B0
004004B0 checkblank
004004B0 STMFD SP!, {R3-R5,LR}
004004B4 MOV R0, #0
004004B8 BL setup_nor
004004B8
004004BC LDR R0, =0xA0000030
004004C0 BL readnor
004004C0
004004C4 MOV R4, R0
004004C8 CMN R4, #1
004004CC BNE loc_400520
004004CC
004004D0 LDR R0, =0xA000A5A0
004004D4 BL readnor
004004D4
004004D8 CMN R0, #1
004004DC BEQ loc_4004E8
004004DC
004004E0 MVN R0, #0 ; return -1
004004E0
004004E4
004004E4 locret_4004E4
004004E4 LDMFD SP!, {R3-R5,PC}
004004E4
004004E8 ; ---------------------------------------------------------------------------
004004E8
004004E8 loc_4004E8 ; CODE XREF: checkblank+2Cj
004004E8 LDR R0, =0xA0015C58
004004EC BL readnor
004004EC
004004F0 CMN R0, #1
004004F4 BEQ loc_400500
004004F4
004004F8 MOVL R0, 0xFFFFFFFF ; return -1
004004FC B locret_4004E4
004004FC
00400500 ; ---------------------------------------------------------------------------
00400500
00400500 loc_400500 ; CODE XREF: checkblank+44j
00400500 LDR R0, =0xA0017370
00400504 BL readnor
00400504
00400508 CMN R0, #1
0040050C BEQ return0
0040050C
00400510 MOVL R0, 0xFFFFFFFF ; return -1
00400514 B locret_4004E4
00400514
00400518 ; ---------------------------------------------------------------------------
00400518
00400518 return0 ; CODE XREF: checkblank+5Cj
00400518 MOV R0, #0
0040051C B locret_4004E4
0040051C
00400520 ; ---------------------------------------------------------------------------
00400520
00400520 loc_400520 ; CODE XREF: checkblank+1Cj
00400520 LDR R0, =0xA0000034
00400524 BL readnor
00400524
00400528 MOV R5, R0
0040052C if (*(0xA0000030)&0x3)
0040052C return -1
0040052C TST R4, #3
00400530 BNE loc_400540 ; return -1
00400530
00400534 MVN R0, R5
00400538 if (*(0xA0000030) == ~(0xA0000034))
00400538 return 1
00400538
00400538 CMP R4, R0
0040053C BEQ return1
0040053C
00400540
00400540 loc_400540 ; CODE XREF: checkblank+80j
00400540 MOVL R0, 0xFFFFFFFF ; return -1
00400544 B locret_4004E4
00400544
00400548 ; ---------------------------------------------------------------------------
00400548
00400548 return1 ; CODE XREF: checkblank+8Cj
00400548 MOV R0, #1
0040054C B locret_4004E4
0040054C
0040054C ; End of function checkblank