I read the source code of hwfly and it looks like the custom bct directly overwrites the bct in emmc. so I think the startup process should look like this.
At the first boot, hwfly detects that the bct in emmc is not custom bct, and then directly replaces it with the custom bct.
When the SOC...