Xiaomi Mi4 windows 10 mobile ROM analysis

I did an analysis of the windows 10 mobile ROM that was recently made available for the Xiami Mi4 android phone. I was particularly interested in how the android phone is able to run windows 10 mobile and if it is possible to go back to android if needed. The SBL1 which is secondary boot loader file is not signed and does not have signature or certificate chain.

Xiaomi Mi4 windows 10

Codeword[4]: d1dc4b84
Magic[4]: 3410d773
Image ID[4]: 15000000 (SBL1_IMG)
Reserved 1[4]: ffffffff
Reserved 2[4]: ffffffff
Image source[4]: 50000000
Image destination pointer[4]: 00c000f8 (4160798720)
Image size[4]: f8480400
Code size[4]: f8480400
Signature pointer[4]: f80805f8 (4161079544)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: f80805f8 (4161079544)
Certificate chain size[4]: 00000000 (0)
OEM root certificate selelected[4]: 01000000
OEM number of root certificates[4]: 01000000
Booting image config[4]: ffffffff
Reserved 6[4]: ffffffff
Reserved 7[4]: ffffffff
Reserved 8[4]: ffffffff
Reserved 9[4]: ffffffff

Same goes for UEFI file with ARM binary file with no signature or certificate chain.

Image ID[4]: 05000000 (APPSBL_IMG)
Flash partition version[4]: 03000000
Image source[4]: 00000000
Image destination pointer[4]: 00002000 (2097152)
Image size[4]: 00800d00
Code size[4]: 00800d00
Signature pointer[4]: 00802d00 (2981888)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: 00802d00 (2981888)
Certificate chain size[4]: 00000000 (0)

I found that five partitions are reserved for android, six are nulled and thirteen are written with data.

+—–+———–+———–+——–+—————–+———+——————-+
+  #  | Start LBA | End LBA   | Size   | Name            | In FFU  | Status            |
+—–+———–+———–+——–+—————–+———+——————-+
|    0|       1024|       2047|    1024|SBL1             |   Yes   | Written           |
|    1|       2048|       2559|     512|UEFI_BS_NV       |   Yes   | Nulled            |
|    2|       3072|       3583|     512|UEFI_RT_NV       |   Yes   | Nulled            |
|    3|       4096|       8191|    4096|UEFI             |   Yes   | Written           |
|    4|       8192|      10239|    2048|DDR              |         | Kept from Android |
|    5|      10240|      12287|    2048|SSD              |         | Kept from Android |
|    6|      12288|      14335|    2048|PADDING0         |   Yes   | Nulled            |
|    7|      14336|      30719|   16384|DPP              |   Yes   | Written           |
|    8|      30720|      30783|      64|DBI              |   Yes   | Written           |
|    9|      31744|      32743|    1000|RPM              |   Yes   | Written           |
|   10|      32768|      33767|    1000|TZ               |   Yes   | Written           |
|   11|      33792|      34815|    1024|WINSECAPP        |   Yes   | Written           |
|   12|      34816|      67583|   32768|TZAPPS           |   Yes   | Written           |
|   13|      67584|      68607|    1024|BACKUP_SBL1      |         |                   |
|   14|      68608|      68671|      64|BACKUP_DBI       |         |                   |
|   15|      69632|      73727|    4096|BACKUP_UEFI      |         |                   |
|   16|      73728|      74727|    1000|BACKUP_RPM       |         |                   |
|   17|      74752|      75751|    1000|BACKUP_TZ        |         |                   |
|   18|      75776|      76799|    1024|BACKUP_WINSECAPP |         |                   |
|   19|      76800|     109567|   32768|BACKUP_TZAPPS    |   Yes   | Nulled            |
|   20|     109568|     117759|    8192|MMOS             |   Yes   | Written           |
|   21|     117760|     131071|   13312|PADDING1         |         |                   |
|   22|     131072|     134143|    3072|MODEM_FS1        |         | Kept from Android |
|   23|     134144|     137215|    3072|MODEM_FS2        |   Yes   | Nulled            |
|   24|     137216|     137247|      32|MODEM_FSC        |   Yes   | Nulled            |
|   25|     138240|     154623|   16384|PLAT             |   Yes   | Written           |
|   26|     154624|     220159|   65536|EFIESP           |   Yes   | Written           |
|   27|     220160|     262143|   41984|PADDING2         |         |                   |
|   28|     262144|     265215|    3072|MODEM_FSG        |         | Kept from Android |
|   29|     265216|     491519|  226304|PADDING3         |         |                   |
|   30|     491520|     524287|   32768|PERSIST          |         | Kept from Android |
|   31|     524288|    5537791| 5013504|MainOS           |   Yes   | Written           |
|   32|    5537792|   20967423|15429632|Data             |   Yes   | Written           |
+—–+———–+———–+————————–+———+——————-+