Record PSP security investigation artifacts and probesHEADmain

1 files changed, 60 insertions, 0 deletions

diff --git a/fw/scan_service_registrations.py b/fw/scan_service_registrations.py
new file mode 100644
index 0000000..1aeaeb1
--- /dev/null
+++ b/fw/scan_service_registrations.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""List SVC #0x74 candidates and driver-ID property TLVs in signed ELFs.
+
+The SVC scan is limited to halfword-aligned executable ELF segments but is
+NOT a CFG disassembly: Thumb-2 second halfwords and data can collide. Validate
+every hit in disassembly before attributing service slots. Property TLVs are
+matched by the exact short header (length/type/name length/value length).
+"""
+from __future__ import annotations
+
+import argparse
+import struct
+from pathlib import Path
+
+SVC74 = b'\x74\xdf'
+DRIVER_PROP = b'amd.dr.driverID\0'
+DRIVER_HEADER = bytes((4 + len(DRIVER_PROP) + 4, 1, len(DRIVER_PROP), 4))
+
+
+def load_spans(path: Path):
+    image = path.read_bytes()
+    if len(image) < 52 or image[:5] != b'\x7fELF\x01' or image[5] != 1:
+        return []
+    phoff = struct.unpack_from('<I', image, 28)[0]
+    entsize, count = struct.unpack_from('<HH', image, 42)
+    spans = []
+    for i in range(count):
+        pos = phoff + entsize * i
+        if pos + 32 > len(image):
+            break
+        kind, offset, va, _, filesz, _, flags, _ = struct.unpack_from('<8I', image, pos)
+        if kind != 1 or not flags & 1 or offset + filesz > len(image):
+            continue
+        spans.append((va, offset, image[offset:offset + filesz]))
+    return spans
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument('paths', type=Path, nargs='+', help='ELF files or trees')
+    args = ap.parse_args()
+    paths = sorted({f for p in args.paths for f in ([p] if p.is_file() else p.rglob('*.elf'))})
+    for path in paths:
+        image = path.read_bytes()
+        for va, file_off, data in load_spans(path):
+            for i in range((-va) & 1, len(data) - 1, 2):
+                if data[i:i+2] == SVC74:
+                    print(f'{path}\tsvc74-candidate va=0x{va+i:x}\tfile_off=0x{file_off+i:x}')
+        pos = image.find(DRIVER_PROP)
+        while pos >= 0:
+            end = pos + len(DRIVER_PROP)
+            if image[pos-4:pos] == DRIVER_HEADER and end + 4 <= len(image):
+                value = struct.unpack_from('<I', image, end)[0]
+                print(f'{path}\tdriver-id={value}\tfile_off=0x{pos:x}')
+            pos = image.find(DRIVER_PROP, pos + 1)
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())