./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7130
./utils/nvflash_v1.13.87205 --getbct --bct ./bct/surface_rt_bct.BIN --configfile ./utils/flash.cfg
Send a payload which patches a security fuse temporarily (until next power off).
Uses original nvflash to read the BCT from Device.
BootConfigTable for the Surface
This defines SDRAM configuration, as well as bootloader location.
Described here (with compiler / decompiler)