[garaetjjte]

My guess is that the chip doesn't have enough RAM to store firmware image, verify it, and only then write it to flash. So instead it needs to write it on the fly as it receives data in chunks of 0x400 byte pages. It starts by erasing first page, but instead of immediately writing it instead keeps buffer for that page for later. Then it transfers remaining pages normally, and at the end only when signature is correctly verified it goes back to write the first page.

[raphman]

That would also be my assumption.

However, it seems the firmware was written as 0x800 byte pages:

https://cdn.cs50.net/2014/fall/lectures/1/w/src1w/iUnlock.c

[fabiensanglard]

Thank you guys for your explanation.

From what I understand on this thread, the header of the firmware is 0x400 long. A page can be up to 0x800:

``` int size_to_write = Size > 0x800 ? 0x800 : Size; ```

So it would appear the firmware has a header of 0x400 which is buffered during upload but discarded if the firmware fails the checksum at the end of the upload.