diff --git a/documentation/source/BootROM_8890/boot_chain.rst b/documentation/source/BootROM_8890/boot_chain.rst
index 4dbced1..88103f3 100644
--- a/documentation/source/BootROM_8890/boot_chain.rst
+++ b/documentation/source/BootROM_8890/boot_chain.rst
@@ -3,7 +3,7 @@
 Booting
 =======
 
-After exploitation the goal is to fully boot the device.
+After exploitation the goal is to fully boot the device. 
 
 Current boot chain:
 
@@ -19,9 +19,63 @@ As done by Frederic, the bootrom can be dumped using his provided scripts, and c
     ./exynos-usbdl e payloads/Exynos8890_dump_bootrom.bin dumped_sboot.bin
     scripts/split-sboot-8890.sh dumped_sboot.bin
 
+This results in the following files:
+
+.. list-table:: bootrom stages
+	:header-rows: 1
+
+	* - File
+	  - Strings output
+	  - Likely boot stage?
+	* - sboot.bin.1.bin
+	  - Exynos BL1
+	  - BL1
+	* - sboot.bin.2.bin
+	  - BL31 %s
+	  - BL31
+	* - sboot.bin.3.bin
+	  - Unsure. Contains strings like: TOP_DIV_ACLK_MFC_600 and APOLLO_DIV_APOLLO_RUN_MONITOR
+	  - BL2?
+	* - sboot.bin.4.bin
+	  - Contains more textual information, and references to post BL2 boot, and android information
+	  - Kernel boot/BL33?
+
 debugger
 ========
-Some other information about the debugger and it's current state.
+After the initial loading of the debugger, the state reported is:
+
+.. code:: bash
+    
+    root | DEBUG | 
+                X0 : 0x0 | X1 : 0xffffffff | X2 : 0x20215d8 | X3 : 0x2021894 | X4 : 0x4 | X5 : 0x0 | X6 : 0x0 |
+                X7 : 0x136c0008 | X8 : 0x2069000 | X9 : 0x0 | X10 : 0x2070000 | X11 : 0x0 | X12 : 0x0 | X13 : 0x0 |
+                X14 : 0xf | X15 : 0x206d000 | X16 : 0x9 | X17 : 0x0 | X18 : 0x1 | X19 : 0x2000 | X20 : 0x2069000 |
+                X21 : 0x0 | X22 : 0x0 | X23 : 0x0 | X24 : 0x0 | X25 : 0x0 | X26 : 0x0 | X27 : 0x1 |
+                X28 : 0x0 | X29 : 0x2020f00 | LR/X30 : 0x20219b8 | SP/X31 : 0x2020ef0
+
+With the original bl1
+
+.. code:: bash
+
+  root | DEBUG | 
+            X0 : 0x0 | X1 : 0x1 | X2 : 0x20215d8 | X3 : 0x2021894 | X4 : 0x4 | X5 : 0x0 | X6 : 0x0 |
+            X7 : 0x136c0008 | X8 : 0x2069000 | X9 : 0x0 | X10 : 0x2070000 | X11 : 0x0 | X12 : 0x0 | X13 : 0x0 |
+            X14 : 0xf | X15 : 0x20c4000 | X16 : 0x9 | X17 : 0x0 | X18 : 0x1 | X19 : 0x2000 | X20 : 0x2069000 |
+            X21 : 0x0 | X22 : 0x0 | X23 : 0x0 | X24 : 0x0 | X25 : 0x0 | X26 : 0x0 | X27 : 0x1 |
+            X28 : 0x0 | X29 : 0x2020f00 | LR/X30 : 0x20c0000 | SP/X31 : 0x2020ef0
+
+
+
+With a modified bl1
+
+.. code:: bash
+
+  root | DEBUG | 
+            X0 : 0x0 | X1 : 0x1 | X2 : 0x20215d8 | X3 : 0x2021894 | X4 : 0x4 | X5 : 0x0 | X6 : 0x0 |
+            X7 : 0x136c0008 | X8 : 0x2069000 | X9 : 0x0 | X10 : 0x2070000 | X11 : 0x0 | X12 : 0x0 | X13 : 0x0 |
+            X14 : 0xf | X15 : 0x20c4000 | X16 : 0x9 | X17 : 0x0 | X18 : 0x1 | X19 : 0x2000 | X20 : 0x2069000 |
+            X21 : 0x0 | X22 : 0x0 | X23 : 0x0 | X24 : 0x0 | X25 : 0x0 | X26 : 0x0 | X27 : 0x1 |
+            X28 : 0x0 | X29 : 0x2020f00 | LR/X30 : 0x20c0000 | SP/X31 : 0x2020ef0
 
 bl1
 ===
@@ -90,6 +144,13 @@ Replacing this function with our debugger makes us jump back:
 
 However this does not fully run bl1, so we will have to dig a bit deeper to see the puropose and when to jump back to the debugger.
 
+Authentication of BL1 seems to be done at ``0x0012848``. With return value '0' expected when this function is executed, to execute other functions.
+
+.. figure:: images/bl1_auth_references.png
+   :align: center
+
+   BL1 authentication. 
+
 purpose
 -------
 bl1 interacts with several pheriperals, from the DTB these are: