Decode · Qualcomm

QC_IMAGE_VERSION_STRING decoded (BOOT.BF.3.3.1-00163)

S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163

The QC_IMAGE_VERSION_STRING is the identifier the Qualcomm Secondary Boot Loader (SBL1) emits at the top of every UART boot log. It uniquely identifies which SBL image is running on the chip.

The format is <image-kind>.<branch>.<major>.<minor>.<patch>-<build>:

  • BOOT: the image kind (secondary bootloader; other kinds include APPSBL, DEVCFG, RPM).
  • BF: Qualcomm-internal boot-firmware branch code. BF is used for IPQ (networking) boot firmware; LA is Linux/Android; other codes exist for wearable, IoT, and modem branches. The full mapping is not published by Qualcomm.
  • 3.3.1: semantic version within that branch.
  • 00163: build number.

The string is emitted by SBL1 itself, and SBL1's signature is RSA-verified by the immutable ROM stage (PBL) against a certificate chain whose root-key SHA is fused into the chip at manufacture. So the version string is signed content: an attacker cannot forge it without also holding the OEM's SBL signing key.

The accompanying IMAGE_VARIANT_STRING (e.g. HAACANAZA) is an 8-character per-SKU variant identifier whose internal field layout Qualcomm has not published. OEM_IMAGE_VERSION_STRING=CRM means the image came off Qualcomm's Chipset Release Manager (their internal CI pipeline).

References

Full walkthrough: /blog/qualcomm-sbl-secure-boot

Source log: /samples/bootintel-4.txt

More decoders: /decode · /faq

Have a boot log with something you can't decode? Paste it into the free fingerprinter. It identifies bootloader / kernel / SoC / autoboot exposure client-side, nothing uploaded.