This boot process is universal to all PROXmobil3 units as best as I can surmise.

1. U-Boot starts up and loads the kernel.
2. The kernel mounts the rootFS microSD card from /dev/sda1 to /, and the initFS from /dev/sdb1 to /init
3. The kernel calls to /sbin/init, which later calls /init/tools/initexec.sh startup. If the startup argument is not passed, the script tells you the only valid argument is startup, then exits.
4a. /init/tools/initexec.sh sets up a bunch of aliases and environment variables.
4b. initexec.sh ensures necessary directories are created, then checks and sets the device's distribution channel.
4c. It calls a function do_startup, which checks if there is software to run, and if not, installs it via a function install_archive. This function misspells “archive” to “archvie” in an echo log.
4d. It checks if /init/tmp/reboot.flg exists, and if so, reboots the device.
4e. It calls every script located in /init/autorun/, launching /efad/pgm/NxProx (the CapMetro software), then echoes “Startup completed”.software).

It is trivially easy to hijack this init sequence by modifying initexec.sh or just inserting a script into /init/autorun.