This boot process is universal to all PROXmobil3 units as best as I can surmise.

1. U-Boot starts up and loads the kernel from the rootFS microSD card.
2. systemd attempts to mount the initFS by searching for any partitions named init. If it cannot find any volumes after 10 seconds, it shuts down. 3. The kernel calls to /sbin/init, which later calls /init/tools/initexec.sh startup. If the startup argument is not passed, the script tells you the only valid argument is startup, then exits.
4a. /init/tools/initexec.sh sets up a bunch of aliases and environment variables.
4b. initexec.sh ensures necessary directories are created, then checks and sets the device's distribution channel.
4c. It calls a function do_startup, which checks if there is software to run, and if not, installs it via a function install_archive. This function misspells “archive” to “archvie” in an echo log.
4d. It checks if /init/tmp/reboot.flg exists, and if so, reboots the device.
4e. It calls every script located in /init/autorun/, launching /efad/pgm/NxProx (the CapMetro software), then echoes “Startup completed”.software).

It is trivially easy to hijack this init sequence by modifying initexec.sh or just inserting a script into /init/autorun.