Boot Chain
boot/boot.bin
Load Address: 0x40200000
This does some minimal hardware initialization, then loads the "real" bootloader and executes it. The "real" bootloader is tacked onto the end of boot.bin as a gzip. The offset of the "real" bootloader is different for every version. Table below will give you the right offset (If your version is not listed, then search with "hexdump -C boot-castle.bin | less" for the byte sequence "1f 8b" (the gzip format identifier)).
| Version | Offset |
| unknown | 0x19D0 (thanks roxfan) |
| 1.3.1 (O2) | 0x19f0 |
hexdump -C webosdoctorp100ewwsprint-1.0.3/webOS/boot-castle.bin | grep '1f 8b' 000019d0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 7c 54 d5 |.............|T.| hexdump -C webosdoctorp100ewwbellmo-1.1.0/webOS/boot-castle.bin | grep '1f 8b' 000019d0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 7c 54 d5 |.............|T.| hexdump -C webosdoctorp100eww-wr-1.1.3/webOS/boot-castle.bin | grep '1f 8b' 000019d0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 7c 54 d5 |.............|T.| hexdump -C webosdoctorp100ewwsprint-1.2.1/webOS/boot-castle.bin | grep '1f 8b' 000019d0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 7c 54 d5 |.............|T.| hexdump -C webosdoctorp100ewwbellmo-1.2.1/webOS/boot-castle.bin | grep '1f 8b' 000019d0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 7c 54 d5 |.............|T.| hexdump -C webosdoctorp100ewwsprint-1.3.1/webOS/boot-castle.bin | grep '1f 8b' 000019f0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 78 54 d5 |.............xT.| hexdump -C webosdoctorp100ueu-wr-1.3.1/webOS/boot-castle.bin | grep '1f 8b' 000019f0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 78 54 d5 |.............xT.| hexdump -C webosdoctorp100ewwbellmo-1.3.1/webOS/boot-castle.bin | grep '1f 8b' 000019f0 1f 8b 08 00 00 00 00 00 02 03 c4 fd 0b 78 54 d5 |.............xT.|
"real" bootloader (bootie)
Load Address: 0x82000000
This looks a _lot_ like iBoot from the iPhoneOS devices, but others say that this is based off u-boot, so I will assume that is true and that iBoot is also based off of it. It even seems to have some of the u-boot commands, such as "printenv", "run", "setenv", "getenv", etc. I am currently looking into how to communicate with it as you can with iBoot.