Record PSP security investigation artifacts and probesHEADmain

1 files changed, 35 insertions, 0 deletions

diff --git a/psp_emu/harness/probe_sysdrv_102f_fixed_map.py b/psp_emu/harness/probe_sysdrv_102f_fixed_map.py
new file mode 100644
index 0000000..5be2dac
--- /dev/null
+++ b/psp_emu/harness/probe_sysdrv_102f_fixed_map.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Signed .54 0x102F fixed 128KiB mapping-copy path; no real source map.
+"""
+from pathlib import Path
+import sys
+from unicorn import UC_HOOK_CODE
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]))
+from pspemu import sysdrv_env
+SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'
+
+def main():
+    sd=sysdrv_env.make()
+    assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes()
+    r,f,_=sysdrv_env.run_init(sd)
+    assert r==0 and not f and sysdrv_env.init_flag(sd)==1
+    req,cfg,out=sd.alloc(0x100),sd.alloc(0x400),sd.alloc(0x20010)
+    sd.write(cfg,bytes(0x400))
+    counts={x:0 for x in (0xE06314,0xE06328,0xE06338)}
+    for ea in counts:
+        sd.uc.hook_add(UC_HOOK_CODE,lambda uc,pc,size,data:counts.__setitem__(pc,counts[pc]+1),begin=ea,end=ea+1)
+    def run(size):
+        sd.write(req,bytes(0x100));sd.write(out,b'\xA5'*0x20010)
+        for i,v in ((0,0x102F),(1,2),(2,out),(3,size),
+                    (sysdrv_env.REQ_CONFIG_DWORD,cfg)):
+            sd.wr32(req+4*i,v)
+        rv=sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000)
+        assert not sd.faults
+        return rv,sd.read(out,0x20010)
+    short,untouched=run(0x1FFFF)
+    assert short==0xFFFF0010 and untouched==b'\xA5'*0x20010 and not any(counts.values())
+    full,still=run(0x20000)
+    assert counts[0xE06314]==1 and counts[0xE06328]==counts[0xE06338]==32,(counts,full)
+    assert full==0 and still[:0x20000]!=b'\xA5'*0x20000 and still[0x20000:]==b'\xA5'*16
+    print(f'signed 0x102F: short gate={short:#x}, modeled fixed-map completion={full:#x}, page_copies=32; output bytes redacted')
+if __name__=='__main__':main()