AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/fw/libnames.json?h=main 2026-09-29T12:09:05Z 2026-09-29T12:09:05Z user user@clank 2026-09-29T12:09:05Z urn:sha1:19a523d9a07e3966815b5b0f13dbd88d9499b319 These TAs share one PSP TEE runtime, so the same helper appears byte-identical in several of them. fw/ta_libmatch.py dumps IDA's function list per TA, hashes each function's bytes, and clusters across TAs: 628 functions, 457 distinct bodies, 55 clusters shared by two or more TAs covering 225 instances. Naming a cluster once and propagating by exact content match is much better leverage than renaming anonymous functions individually. The clustering reproduces known answers before being trusted for unknown ones: the 148-byte cluster shared by eight TAs is exactly the entry trampoline already named from the header parse, and the 2- and 4-byte clusters are the return stubs already named as the close-session and destroy entry points. Naming discipline kept deliberately tight. Only six clusters got semantic names, the ones whose disassembly proves them: a word-block zero fill present in ten TAs, a bytewise zero fill with alignment fixup in six, the two return stubs, the trampoline and a tail-jump thunk. The other 49 are tagged lib_<hash>_<size>, which records that they are shared runtime rather than TA-specific logic without inventing semantics; several look like a stream or vtable family but probably is not a name. Coverage rises from 38 to 61 percent. The remainder is TA-specific internal logic and is stated as unnamed.