Boot chain map — SM-F956B, F956BXXS4DZI1 (bit 4)

Source: official BL tar (BL_F956BXXS4DZI1_…_MULTI_CERT.tar.md5, 33 members), plus live partition dumps taken with temp root. Static classification by segment entropy + printable-string scan. All binaries stripped (no symbols).

Encrypted at rest

Member	Size	Notes
`abl.elf.lz4`	2.4 MB	ELF headers plain, loadable segments ciphertext (entropy ≈ 8.0, zero real strings). This is why static abl RE from tars doesn't work on this generation.
`imagefv.elf.lz4`	8.4 MB	Same profile — the main UEFI firmware volume (apps live here).

Plaintext (fully RE-able)

Member	Size	Highlights
`uefi.elf.lz4`	3.1 MB	UEFI DXE firmware. `LoadImage:`, embedded platform config (`uefiplatLA.cfg` — see `uefi-config.md`), "UEFI Aux FV decompression" path, `Sec.efi`.
`uefi_sec.mbn.lz4`	197 KB	The UEFI secure app (`uefisecapp`). Var-name table `PK/KEK/SetupMode/SecureBoot/db/dbx`, full secboot lib (`secboot_hashUpdate/Final`, `validate_pkcs7_and_get_public_key`, `pbl_secx509_parse_pub_key`), `TzSetVariable`/`TzGetVariable`/`TzVariablePolicyCheck`/`AuthenticateVariable`/`DeleteVariableEx`, `SecureBootEnable`, `VariablePolicyIsPrivAuthVarProtectionDisabled`, `kek_keys`, key label `SM-F956B_EUR_XX_QKEY1`.
`xbl_s.melf.lz4`	669 KB	Qualcomm XBL-secure. Source paths (`…/services/antirollback/src/AntiRollbackMgr.cpp`), `ARBConfig:arbFuseMapOem`, `Secure Boot:`, AES S-box present.
`xbl_config.elf.lz4`	80 KB	XBL config (DTB-ish), `OEMInfo`, `VUEFI_FD` entries.
`tz.mbn.lz4`	4.1 MB	TrustZone OS + apps. "Device is OEM unlocked", "Secure boot is disabled/enabled", `oem_decryption_service_enabled`, `/secboot/deferred_oem`, `sec_deferred_oem_roots_of_trust`, AES S-box.
`tz_kg.mbn.lz4`	1.5 MB	KG trustlet. `KG_unlock`, `KG unlock`, `KGBL_read_fuse`/`KGBL_write_fuse`, `HWIO_QFPROM_RAW_OEM_SPARE_1_ROW1_LSB_ADDR` (KG state = QFPROM fuse row + RPMB), `KG_TA : KG unlock` / `verify complete token`.
`tz_iccc.mbn.lz4`	90 KB	Device-status trustlet. `CICCCGetDeviceStatus`, "Warranty Bit", "Secure Boot", `is_updates_lock_enabled`.
`vaultkeeper.mbn.lz4`	1.1 MB	VaultKeeper. Warranty-bit fuse reads, `oem_sw_fuse` checks, `device_info` RPMB provisioning.
`engmode.mbn.lz4`	1.4 MB	Engineering mode app. `em_clear_rpmb`, `em_crypto_aes_256_gcm_decrypt`, "EngineeringMode20 AES256 Key Label, MSTG".
`keymint.mbn.lz4`	425 KB	`is_unlocked`, `UNLOCKED_DEVICE_REQUIRED`, RPMB/rollback-protected key storage.
`bksecapp.mbn.lz4`	70 KB	Boot-key security app (warranty-related).
`hypvm.mbn.lz4`	1.4 MB	Hypervisor. `gpt: Failed to revert write!`, `qhee_hyp_assign_rollback` SMC paths.
`devcfg.mbn.lz4`	390 KB	`verified boot` strings.
`XblRamdump.elf.lz4`	1.8 MB	XBL ramdump handler; AES S-box; `devinfo` reference.

Device partition layout (interesting subset)

uefi, uefisecapp, uefivarstore, tz_kg, tziccc, vk, em, bksecapp, steady, devinfo, frp, param, bota, xbl, xbl_config, abl, imagefv, persistent, storsec, catefv, toolsfv, testparti, qweslicstore, secdata… No efisp/esp partition (unlike the SM8850 GBL reference design).

Live dump observations

devinfo (4 KB): magic SAMANDR-BOOT!, single flag byte 0x01 at 0x90.
frp (512 KB): all zeros — FRP inactive (matches the PDB service analysis).
uefivarstore (512 KB): XBL config vars only (incl. oem_image_encryption_key1, oem_image_encryption_key1_sel). UEFI auth vars (PK/KEK/db/SetupMode) are NOT here — they're TZ-stored (TzSet/GetVariable).
steady (4 MB): nearly empty on this device.
toolsfv / catefv / testparti: empty on retail (all zeros) — raw writable partitions.
uefi (5 MB): the UEFI DXE image as flashed.

Crypto observations

AES S-box found in tz.mbn and XblRamdump.elf only. The TAs and UEFI components use hardware crypto (HW keyslots / CE engine) — no software S-box in uefi.elf, uefi_sec, vaultkeeper, tz_kg, engmode.
abl.elf/imagefv.elf ciphertext profile = uniform-random; decryption key source is an open question (candidates: SM-F956B_EUR_XX_QKEY1 label via keymaster/TZ, oem_image_encryption_key1 varstore value, fuse-derived).