This boot process is universal to all PROXmobil3 units as best as I can surmise.

1. U-Boot starts up and loads the kernel from the rootFS microSD card.
2. The kernel loads systemd from /usr/lib/systemd/systemd. 3. systemd attempts to mount the initFS by searching for any partitions named init. If it cannot find any volumes after 90 seconds, it shuts down. 4. The kernel calls to /sbin/init, which later calls /init/tools/initexec.sh startup. If the startup argument is not passed, the script tells you the only valid argument is startup, then exits.
5a. /init/tools/initexec.sh sets up a bunch of aliases and environment variables.
5b. initexec.sh ensures necessary directories are created, then checks and sets the device's distribution channel.
5c. It calls a function do_startup, which checks if there is software to run, and if not, installs it via a function install_archive. This function misspells “archive” to “archvie” in an echo log.
5d. It checks if /init/tmp/reboot.flg exists, and if so, reboots the device.
5e. It calls every script located in /init/autorun/, launching /efad/pgm/NxProx (the CapMetro software), then echoes “Startup completed”.software).

It is trivially easy to hijack this init sequence by modifying initexec.sh or just inserting a script into /init/autorun.