Complete technical explanation of the recovery system
Security Recovery Core (SRC) is a hardware-assisted firmware recovery system that operates at the lowest level of your computer system, before the BIOS/UEFI even starts. It provides an automatic safety net that can recover your system from firmware corruption or failed updates.
Key Point: SRC runs independently of your operating system, which means it can protect you even if your OS is completely corrupted or if malware attempts to disable protection.
When you power on your system, the Recovery Core firmware initializes immediately, before any other firmware or BIOS code runs.
SRC reads its configuration from a reserved region in SPI flash memory. It checks if recovery is enabled, if there's a temporary disable period, and reads the last known firmware hash.
The system initializes multiple boot detection methods:
SRC starts a 30-second countdown timer and begins monitoring for boot success signals. If ANY of the detection methods indicates successful boot, the system is considered healthy.
If boot succeeds: SRC performs automatic backup (if needed) and allows normal system operation.
If boot fails: After 30 seconds with no success signal, SRC triggers the recovery process.
No success signal received within 30 seconds. System is considered failed.
SRC initializes USB Mass Storage interface and checks for a valid recovery device. The device must contain a /SECURITY_RECOVERY/ directory.
Reads manifest.json to determine which backup to use (A.bin or B.bin) and verifies board/system ID matches.
Reads the firmware image from USB device (typically 8MB). Attempts A.bin first, then B.bin if A.bin fails verification.
Performs cryptographic signature verification:
signature.sigWrites verified firmware to SPI flash memory at the firmware region (typically offset 0x0, size 8MB).
Reads back the written firmware and compares it with the source to ensure write integrity. If verification fails, the process is aborted.
Triggers system reboot. On next boot, the recovered firmware should boot successfully, and SRC will detect the success signal.
When the system is healthy and booting successfully, SRC performs automatic firmware backups every 10 minutes (configurable).
SRC maintains exactly two backups at all times:
Important: Backups only occur if the USB device is present. If USB is not connected, backups are skipped (system continues normally).
SRC uses a reserved region in SPI flash memory. The typical layout is:
All firmware images must be cryptographically signed. SRC verifies signatures before any recovery operation, preventing unauthorized firmware installation.
SRC runs before the OS, making it immune to malware, OS-level attacks, or software-based disable attempts.
All operations are logged in a tamper-resistant region. Logs cannot be modified without physical access to SPI flash.
SRC can be configured to prevent firmware downgrades, ensuring only newer or same-version firmware can be installed.
SRC operates using a state machine that transitions between different states based on system conditions: