Les infos de Goplat sur les factory images reportées ici, quand on aura le courage de documenter proprement tout ça sur le wiki :

At startup, BOOT2 checks the NAND flash at page 0x1000 to look for a pre-loaded factory image. The format is a 32-byte header followed by the .tnc/.tno file contents:

Offset 00-13: String "***PRELOAD_IMAGE***"
Offset 14-17: 55 F0 01 55
Offset 18-1B: (unknown)
Offset 1C-1F: Size of image (in big-endian)

If boot2 finds this header, the user is prompted to press 'I' on the keypad (this is what the function at 11800534 checks for). After that, the image is copied to RAM before creating the filesystem (The filesystem also starts at page 0x1000, so it cannot co-exist with a factory image), and is installed the same as if it had been received from the serial port.

There is also code at 11925F38 to look for ***PRELOAD_BOOT2*** and ***PRELOAD_DIAGS*** images, and if found, move them to pages 0x20-0xA7F and 0xB00-0xFFF respectively. However, this function does not appear to be used at all, so it's probably something from boot1 that got included in boot2 by accident.