aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* type ASD's two internal structures, where its unreadability is concentrateduser2026-10-01
* record all sixteen components in the struct audit, graded by how their size i...user2026-10-01
* type the host request for the remaining components: every module now has oneuser2026-10-01
* type POWERPLAY's host request, and disprove a shared TA request headeruser2026-10-01
* type HDCP's host request, and make the deref locator survive applied prototypesuser2026-10-01
* type ASD's RPC request, the largest module's dispatcheruser2026-10-01
* anchor prototypes to command ids, and derive the OC and WSPE request structuresuser2026-10-01
* derive the XGMI request structure by hand and propagate it where it actually ...user2026-10-01
* harvest struct-field evidence, with a control that caught my own bad controls...user2026-10-01
* apply the prototypes, types and comments the pass had been droppinguser2026-10-01
* extend the decompilation to ASD and the three handover-symbol typesuser2026-10-01
* name TA command handlers from the dispatcher, and extend the run to all twelv...user2026-10-01
* build a symbolicated, diffable decompilation of every GCP builduser2026-10-01
* record the verified closing state and the hand-over orderuser2026-09-30
* index this session's findings, which existed but were unindexeduser2026-09-30
* bring the audit's leading summary up to date with the later findingsuser2026-09-30
* close the last avenue the rollback opened: no extra applications loaduser2026-09-30
* mechanically check the audit log's own references for dangling artifactsuser2026-09-30
* re-verify the session's load-bearing claims and record a process caveatuser2026-09-30
* write up the rollback finding for disclosureuser2026-09-30
* fuzz the rolled-back firmware: both older versions are equally cleanuser2026-09-30
* confirm whole-set rollback with the processor's own version registeruser2026-09-30
* close the rollback lead: the payload requirement does not shrink in an older ...user2026-09-30
* record the lead connecting the rollback gap to the confirmed underflowuser2026-09-30
* finding: the bootloader accepts an older signed system driver, with no versio...user2026-09-30
* record the anti-rollback question as blocked rather than running a confounded...user2026-09-30
* close the runtime bootloader question: component loads are refused after bootuser2026-09-30
* finding: the processor's bootloader command interface is still live after bootuser2026-09-30
* record the interrupt-ring-set probe as vacuous rather than as a passing checkuser2026-09-30
* enumerate the ring control command space: all ids inertuser2026-09-30
* finding: the ring base is accepted misaligned and then wedges on first submituser2026-09-30
* close the ring index: bounded, and handled gracefullyuser2026-09-30
* close the last ring-frame field and publish the complete field mapuser2026-09-30
* characterise the vmid fault and rule out two explanations by measurementuser2026-09-30
* record the frame-sweep passes and add the seventh triggeruser2026-09-30
* finding: the ring frame's vmid byte is host-controlled, propagated into the p...user2026-09-30
* record the ring-frame passes in the audit log and add the sixth trigger to th...user2026-09-30
* finding: the ring frame's fence address is not range-checked, unlike the comm...user2026-09-30
* hundred-and-seventeenth pass: image and command-buffer aliasing is handleduser2026-09-30
* hundred-and-sixteenth pass: loader class confusion is correctly handleduser2026-09-30
* hundred-and-fifteenth pass: sweep the driver-class load path across all corpu...user2026-09-30
* hundred-and-fourteenth pass: close the last acknowledged weak spot in coverageuser2026-09-30
* index the hardware probes so they are discoverable and usableuser2026-09-30
* hundred-and-thirteenth pass: multi-session stateful fuzz with slot recyclinguser2026-09-30
* hundred-and-twelfth pass: stateful sequence fuzz closes the weakest axisuser2026-09-30
* hundred-and-eleventh pass: multi-field mutations across the full windowuser2026-09-30
* hundred-and-tenth pass: full-resolution sweep of the entire shared bufferuser2026-09-30
* hundred-and-ninth pass: full-resolution sweep of the load command structureuser2026-09-30
* hundred-and-eighth pass: characterise the one validated field in the invoke s...user2026-09-30
* hundred-and-seventh pass: close the invoke-structure gap properlyuser2026-09-30
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-07 00:48:10 +0000 — sl0p fork