The S3 area (0x30000000) contains another iboot copy, different from the nand flash (1.00z37 vs 1.00a40). This may be an initial bootstrap program which loads the nand version.
The load address of the nand iboot is found as a string in this version.
This iboot copy also has TFTP support. Maybe it can be used as a last-resort recovery mechanism somehow.
The top of the S3 area is also used as stack.
The Netgear NAS forum
2 posts • Page 1 of 1