I am a bit confused about the BROM address location:
In this page, it it said the following:
" eGON.BRM The BROM bootloader has been extracted from the chip and can be found in hno's repository.. The magic signature is "eGON.BRM". The BROM seems to start at 0x4000. If the BROM has identified boot0 in NAND loads and executes it. "
And, in the [] page, it is said the following:
" A10/A20 After power-up, the A10/A20 boots from an integrated, non-replaceable 32 KiB ROM chip (Boot ROM or BROM). This could be considered the primary program-loader. The SoC starts to fetch instructions from address 0xffff0000 which is where the BROM is located at. The BROM split up into two parts: The first part (at 0xffff0000) is the FEL mode and the second is the eGON.BRM (located at 0xffff4000). "