it is possible to boot the kernel with qemu if the header is deleted i also tried to boot the cefdk-logitech_ka3.bin included inside 439c26f6af05.mp-signed-ota_update-b39389.zip but that doesn't work out of the box (deleted the first 0x480 bytes) as far as I see. Inside ...

... 10 bytes are zero in my dump, it looks somehow if everything is shifted 10 bytes in the dump. don't know why ... 2. 0x00c00000-0x00e00000 "cefdk-config" Holds Box SN, repeats (like MBR) 0x00bffff6 - 0x00c01ff5 is 0x00 (important 10 bytes shift) then everything is 0xff till 0x00c06ff5 ...

... and more specifically the install script, about midway into the install there are the following lines: assert(package_extract_file(logitech_ka5.cefdk, /tmp/cefdk5.img, package_extract_file("recovery.img", "/tmp/recovery.img")); It appears to me that this step is extracting ...

... and more specifically the install script, about midway into the install there are the following lines: assert(package_extract_file(logitech_ka5.cefdk, /tmp/cefdk5.img, package_extract_file("recovery.img", "/tmp/recovery.img")); It appears to me that this step is extracting ...