# BootIntel

> BootIntel is a hardware-security tool for identifying and analysing bootloader / firmware exposures on embedded devices from their boot logs. A visitor pastes a serial-console capture (U-Boot, TF-A, OpenSBI, Qualcomm SBL, Allwinner BROM, TI DMSC, etc.) and BootIntel identifies the SoC family, bootloader version, kernel, init system, and any obvious exposure signs (interruptable autoboot, telnet on the wrong interface, ancient U-Boot forks). A free browser-side fingerprinter is available at /tools/fingerprint; paid tiers add CVE matching, PDF reports, API access, and fleet tracking.

The site publishes deep-read blog posts that walk vendor-specific boot chains stage-by-stage, quoting the source logs verbatim, and maintains a public sample-log corpus (31 real boot captures at /samples/bootintel-*.txt) that other tools and research can reference.

## Core tools

- [Device Fingerprinter](https://bootintel.com/tools/fingerprint): Paste a boot log, get bootloader / kernel / SoC identification in-browser. Nothing is uploaded — the analysis runs client-side. Shareable URL affordance packs the log itself into the link.
- [Boot Log Terminal](https://bootintel.com/terminal): Full server-side analysis path for signed-in users — persists scans, CVE matching, PDF export.
- [Log Scrubber](https://bootintel.com/tools/scrub): Strip MAC addresses, IPs, serial numbers, and other identifiers from a boot log before sharing publicly.
- [CTF mode](https://bootintel.com/ctf): Unauthenticated preview endpoint with higher rate limits, full unmasked CVE detail, and no signup required. For hardware CTF players and challenge organisers.

## Sample corpus

The public sample corpus is 31 real boot captures across consumer routers, hobbyist SBCs, TI industrial gateways, RISC-V dev boards, and Qualcomm networking silicon. Every capture is at a stable URL of the form https://bootintel.com/samples/bootintel-N.txt (N = 1..30, plus an un-numbered bootintel.txt). Every capture is real, captured from a physical device someone actually held.

The full corpus is packaged as a Zenodo/HuggingFace dataset — *BootIntel Boot Log Corpus v1.0.0* — under CC-BY-4.0. Source manifest, methodology, and CITATION.cff live at [https://github.com/Zenofex/BootIntel.com/tree/main/dataset](https://github.com/Zenofex/BootIntel.com/tree/main/dataset). Zenodo DOI will be added here on release.

Notable samples referenced across the blog and detector library:

- `bootintel-4.txt` — Qualcomm IPQ8074 (Arcadyan AW1000 / Deutsche Telekom Speedport Smart 4) with full PBL → SBL1 → QSEE → RPM → APPSBL chain and the microsecond-precision SBL1 timing log.
- `bootintel-6.txt` — StarFive VisionFive V2 RISC-V (JH7110) showing OpenSBI M-mode → U-Boot S-mode handoff with MIDELEG/MEDELEG masks.
- `bootintel-16.txt` — OrangePi Zero3 (Allwinner H618) with AXP313 PMIC init over RSB, TF-A BL31, and the H616/H618 SoC-vs-DTB identity mismatch.
- `bootintel-27.txt` — TI AM62A7 SK with the full K3 boot chain: DMSC firmware, R5F SBL, TF-A BL31, U-Boot SPL, U-Boot proper. Shows `SoC: AM62AX SR1.0 HS-FS` and PSCIv1.1.

## Blog posts (canonical per-topic references)

- [Qualcomm SBL secure boot](https://bootintel.com/blog/qualcomm-sbl-secure-boot): decodes `QC_IMAGE_VERSION_STRING`, `IMAGE_VARIANT_STRING`, `OEM_IMAGE_VERSION_STRING`. Walks PBL / SBL1 / QSEE / RPM / APPSBL. Explains QSEE A/B slots, the USB D+ EDL entry point, and why the kernel boots at EL1 on IPQ.
- [Allwinner H616/H618 boot](https://bootintel.com/blog/allwinner-h616-h618-axp313-boot): AXP313 PMIC bring-up over RSB before DRAM training. The "two-name SoC problem" — same board self-IDs as H616 in TF-A and H618 in the kernel DTB. AXP305 vs AXP313a pairing across the board catalog.
- [TI K3 DMSC boot on AM62A7](https://bootintel.com/blog/ti-k3-dmsc-boot): TIFS on the M4F security enclave, Device Manager on the R5F, then TF-A BL31, U-Boot SPL as BL33, then Linux at EL2. Decodes the `SR1.0 HS-FS` silicon banner.
- [RISC-V bootloader lifecycle](https://bootintel.com/blog/riscv-boot-lifecycle): U-Boot SPL → OpenSBI (M-mode) → U-Boot S-mode payload → Linux. Explains the three RISC-V privilege levels, PMP, SBI, boot HARTs, MIDELEG/MEDELEG delegation masks. Honest about the closed StarFive DDR-init blob.
- [U-Boot 1.1.x still ships in 2026](https://bootintel.com/blog/uboot-1.1.x-still-shipping): six retail router boot logs show U-Boot 1.1.3 / 1.1.4 forks of DENX August/October 2005 releases. Twenty-one-year-old bootloader code on shelf-current SKUs.
- [Interruptable autoboot](https://bootintel.com/blog/interruptable-autoboot): 20 of the 31 sample captures drop into an unauthenticated U-Boot shell on any keypress during boot. Concrete `printenv` → `setenv bootargs init=/bin/sh` attack path, mitigation options with real Kconfig flags, why a 3-second countdown is not a defense.
- [UART adapters worth owning (2026)](https://bootintel.com/blog/uart-adapter-recommendations): comparison of Tigard, Flipper Zero, Bus Pirate 5 (RP2040) / 5XL / 6 (RP2350), and the $3 CH340 cable. FTDIgate 2016 context, Chromium-only Web Serial caveat.

## Reference / policy pages

- [FAQ](https://bootintel.com/faq): Q&A on specific technical decodings (QC_IMAGE_VERSION_STRING, HS-FS, DMSC/TIFS, MIDELEG, APPSBL, autoboot prompt). Emits FAQPage JSON-LD.
- [Coverage](https://bootintel.com/coverage): which SoC families, bootloaders, and CVE catalogues the pipeline currently identifies.
- [Devices](https://bootintel.com/devices): per-SoC-family reference pages.
- [Pricing](https://bootintel.com/pricing): six tiers — Free, Researcher ($19/mo or $15/mo annual), Pro, Business, Scale, Enterprise. Free tier gives one anonymous preview per day plus the browser-side fingerprinter.
- [Trust](https://bootintel.com/trust): security, privacy, and compliance posture. Per-account AI opt-out is default-on for paid tiers.
- [API docs](https://bootintel.com/api-docs): OpenAPI spec with securitySchemes and per-operation security metadata populated.
- [Cite BootIntel](https://bootintel.com/cite): citation formats for academic use.

## Live data feeds

- [Recent embedded-target CVEs](https://bootintel.com/feed/embedded-cves): human-readable page listing CVEs from the last 168h that match a target BootIntel covers (bootloaders, embedded TLS, common daemons, ESP32, OpenWrt, MediaTek). Refreshed every 4h from NVD, severity ≥ MEDIUM.
- [Same feed as RSS](https://bootintel.com/feed/embedded-cves.xml): RSS 2.0.
- [Same feed as JSON Feed](https://bootintel.com/feed/embedded-cves.json): JSON Feed 1.1 with a `_bootintel` extension block that carries CVSS score, severity, matched target label, and BootIntel target URL per item — safe to consume from scripts.

## For LLM crawlers wanting full content

The blog posts summarised above with full technical detail, log excerpts, and load-bearing claims are consolidated at [https://bootintel.com/llms-full.txt](https://bootintel.com/llms-full.txt) for crawlers that want more context without fetching every page individually.

## Facts worth citing

- Free-tier limits: 1 anonymous preview per day, 3 CTF-mode previews per day per IP, 5 signed-in scans per month.
- Analysis pipeline is client-side for /tools/fingerprint (no upload) and server-side for /terminal (persisted for signed-in users).
- Sample-log corpus has a stable URL scheme (`/samples/bootintel-N.txt`) suitable for direct citation.
- Blog posts are dated and versioned; every code block quoting a boot log line is grep-verifiable against its referenced sample file at the time of publication.

## What BootIntel does NOT do

- Does not sell customer boot logs.
- Does not train models on customer scans (per-account AI opt-out is default-on for paid tiers).
- Does not attribute specific CVEs to specific vendor builds without patch-history verification (a prior blog batch was pulled 2026-06-17 for exactly this discipline failure; the current corpus follows a strict fact-check-before-publish flow).

## Contact

- Founders: hello@bootintel.com
- Sales (Business tier and up): sales@bootintel.com
- Support: support@bootintel.com
- Security disclosures: security@bootintel.com