Record PSP security investigation artifacts and probesHEADmain

1 files changed, 28 insertions, 0 deletions

diff --git a/psp_emu/harness/probe_sysdrv_101d_nested_gate.py b/psp_emu/harness/probe_sysdrv_101d_nested_gate.py
new file mode 100644
index 0000000..03d881b
--- /dev/null
+++ b/psp_emu/harness/probe_sysdrv_101d_nested_gate.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Signed .54 0x101D: determine if default per-caller crypto gate reaches +52 read.
+No crypto/session state is planted or modified on hardware.
+"""
+from pathlib import Path
+import sys
+from unicorn import UC_HOOK_CODE
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]))
+from pspemu import sysdrv_env
+SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'
+
+def main():
+    sd=sysdrv_env.make()
+    assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes()
+    r,f,_=sysdrv_env.run_init(sd)
+    assert r==0 and not f and sysdrv_env.init_flag(sd)==1
+    req,cfg,inp,out=[sd.alloc(n) for n in (0x100,0x400,0x80,0x40)]
+    sd.write(cfg,bytes(0x400));sd.write(inp,bytes(0x80));sd.write(out,bytes(0x40))
+    reads=[]
+    sd.uc.hook_add(UC_HOOK_CODE,lambda uc,ea,size,data:reads.append(ea),begin=0xE1F6EA,end=0xE1F6EB)
+    sd.write(req,bytes(0x100))
+    for i,v in ((0,0x101D),(1,2),(2,inp),(3,4),(4,out),(5,4),
+                (sysdrv_env.REQ_CONFIG_DWORD,cfg)):
+        sd.wr32(req+4*i,v)
+    rv=sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000)
+    assert not reads and not sd.faults,(rv,reads)
+    print(f'signed 0x101D default emulator: gate_status={rv:#x}, nested+52_read_reached=False; conditional signed path remains untested')
+if __name__=='__main__':main()