Yesterday I had a brief look at the bootrom binary and the Archos aimage file. I noticed the sections denoted with the strings "CYV1" and "CYV2" in the header of the aimage file and found those same two strings in the bootrom just before the highly interesting string "aimage not v2 type". Interesting enough, the space behind "CYV1" is empty in the aimage while behind "CYV2" there are 96 bytes of what seems to be a hash or checksum. I guess, all of this was already known.
When I looked at the disassembled code of the bootrom, I found an interesting portion of code with some EOR-shift-operations inside a loop around address 0x2400 (don´t remember exactly) that reads some data bytewise and shifts it bitwise into a register that gets exored with the content of some other register shifted by one. EOR-shift-operations are often used in checksum algorithms. When I have time, I will try and find out whether this portion of code could have anything to do with the check of the aimage on boot.
