AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/fw/diffs/hdcp?h=main 2026-10-01T19:26:44Z 2026-10-01T19:26:44Z user user@clank 2026-10-01T19:26:44Z urn:sha1:98c2a5384d08dc835e83bea5220b671de6dd0a1b fw/ta_diff_all.py writes every meaningful same-branch consecutive-build diff to fw/diffs/, one file per pair plus an INDEX.md. Two correctness rules are baked in, both learned by getting them wrong first. The third version field is a BRANCH, not a sequence -- ASD ships 33.0.0.x through 33.0.28.x in parallel -- so only same-branch pairs are emitted; comparing across them made asd_dispatch oscillate 842/1306/1352 bytes, which is branch identity misread as change over time. And the four noise sources measured earlier are normalised away: tier annotations, address-derived tokens, long hex literals, local renumbering. Each file leads with the size table from the index sidecars, which is the signal no decompiler instability can fake: same function, different byte size means the code changed. Body hunks follow, grouped per function, with local declarations dropped. INDEX.md opens with four findings rather than making the reader hunt: the HDCP 23.0.0.52 -> .57 timing side-channel fix in the HDCP 2.x locality check, where L' verification moved from early-exit memcmp_be to constant-time ct_memcmp; GCP's ASIC allowlist in cmdFE08 growing from 14 to 28 entries across nine builds with 0xe backfilled out of order; the teardown sequence added to GCP's three session-lifecycle handlers at 22.0.0.62; and a warning not to read ASD's dispatch case lists as change, since the 48 labels that appear and vanish are Hex-Rays alternating between a switch and the range check rpc_id - 384 <= 0x40. The index marks `resized` as the trustworthy column and `new`/`gone` as leads, because a function named in one build and not another shows up there without any firmware change behind it.