That might actually be a way the FPGA might look for a trigger. Count how many bytes have been read from the emmc after booting up -> is it the size of the BCT? -> perform glitch using the given parameters
Related to this:
https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10062170
As
@doom95 has already said, there are 4 BCT slots. HWFLY-NX overrides the first two, the last two get the original BCTs
The Tegra tries to read the first, if it fails then the second, etc. until it can boot. If all 4 fail it goes into RCM AFAIK.
On a side note, I read a bit of the MMC standard documentation and it looks relatively easy to understand. As I can't find MMC cards on Amazon (only SD cards) and SD cards are basically successors to MMC cards, does anybody know if I can read SD cards in some sort of "MMC mode"?
View attachment 350682
E.g. can I just connect only DAT0 (MMC cards only have one DAT line), Vss2, CLK, Vcc, Vss1, CMD and CAT3 and talk to the SDC with MMC commands?