| Commit message (Expand) | Author | Age |
|---|
| * | Record PSP security investigation artifacts and probesHEADmain | user | 2026-10-09 |
| * | GCP->ASD 0x403: ASD-internal chain PROVEN end-to-end in emulator (real handlers) | user | 2026-10-08 |
| * | GCP->ASD lead: aliasing resolved for our build (index 90) + HW service-2 reac... | user | 2026-10-08 |
| * | eval: GCP->ASD op_403 confused-deputy -> SVC 0x7C privileged physical write (... | user | 2026-10-08 |
| * | hw: no deterministic crypto-output placement - SVC 0xB5 client check (sub_197... | user | 2026-10-08 |
| * | sim: confirm GCP crypto ROP message is correct; localize 0xFFFF000F to SVC 0x... | user | 2026-10-08 |
| * | crypto output oracle: ABANDON - confused-deputy output-buffer validation is r... | user | 2026-10-08 |
| * | crypto output read-back: principle OK (create handle), but RNG 'identical out... | user | 2026-10-08 |
| * | re-evaluate GCP attack surface (post-retraction): capability-capped SYS_DRV r... | user | 2026-10-08 |
| * | overview: correct the retracted SYS_DRV-hijack claim -> GCP self-corruption +... | user | 2026-10-08 |
| * | RETRACTION: the SYS_DRV control-flow hijack was GCP self-corruption of our ow... | user | 2026-10-08 |
| * | overview: full GCP-invocable syscall/op surface by context + constraints | user | 2026-10-08 |
| * | op 0x3a pointer-relay NOT viable (metadata not code pointers); close crypto-w... | user | 2026-10-08 |
| * | path-1 attempt via op 0x36 ctx-copy confirms the controlled-value barrier | user | 2026-10-08 |
| * | controlled-value analysis: chosen PC gated by confused-deputy marshaling (PC-... | user | 2026-10-08 |
| * | CONFIRMED reproducible SYS_DRV PC=written-data; return word at 0x410040-0x410080 | user | 2026-10-08 |
| * | BREAKTHROUGH: big-wipe reveals SYS_DRV control-flow hijack (PC = written data) | user | 2026-10-08 |
| * | (a) map in-window SYS_DRV mapping: benign ~48KB scratch/bounce region, not li... | user | 2026-10-08 |
| * | attribution nailed: fault is the RNG STRB (0xe04f4c) in SYS_DRV context; conf... | user | 2026-10-08 |
| * | LEAD: crypto buffer-write is a confused-deputy write into SYS_DRV address space | user | 2026-10-08 |
| * | push further: full crypto op (TEE_GenerateRandom 0x35) EXECUTES but pointer-b... | user | 2026-10-08 |
| * | crypto ROP harness: multi-op (two-svc) validated on silicon + usage/status doc | user | 2026-10-08 |
| * | CORRECTION: crypto buffer confinement is the type-5 svc-0xf2 window [0x400000... | user | 2026-10-08 |
| * | memory-safety spot-audit of the GCP-reachable crypto surface: bounded, no ove... | user | 2026-10-08 |
| * | AUDIT: no device-bound key reachable via the GCP svc-0xf2 SYS_DRV crypto surface | user | 2026-10-08 |
| * | CORRECTION: crypto ops 0x43-0x48 are the TEE Property API, NOT a keyladder/de... | user | 2026-10-08 |
| * | overview: GCP-reachable crypto surface (svc 0xf2 svc1 crypto dispatcher, ~50 ... | user | 2026-10-08 |
| * | CORRECTION: retract the 0x105d-bypass thesis -- it is an internal helper, not... | user | 2026-10-08 |
| * | HW gap #2: spirom_xfer executes from GCP but slot reservation fails (0xffff00... | user | 2026-10-08 |
| * | mechanism: overlap check reads engine slot regs (SMN 0x49007a00), not the pro... | user | 2026-10-08 |
| * | HW CONFIRM: 0x105d (spirom_xfer) is reachable from GCP on stock .54 (gap #1 c... | user | 2026-10-08 |
| * | DIFF: .54 TMR fix is scoped to 0x1006 SETUP_TMR; spirom_xfer/0x105d path is b... | user | 2026-10-08 |
| * | name the flagged handlers functionally; 0x105d = spirom_xfer is a CONFIRMED p... | user | 2026-10-08 |
| * | audit the reachable register/map/protect handlers: all bounded, no arbitrary ... | user | 2026-10-08 |
| * | compile the named overview of all 164 GCP-reachable SYS_DRV opcodes | user | 2026-10-08 |
| * | count the free opcodes: ~164 reachable from GCP (9 crypto 0x1-0x9 + 155 high ... | user | 2026-10-08 |
| * | [HW] round-2 sweep: OTP-read (0x6001), MMIO-write (0x6002), reg-access (0x70x... | user | 2026-10-08 |
| * | [HW] measured svc 0xf2 SYS_DRV reachability: ALL ACL ranges rejected, only fr... | user | 2026-10-08 |
| * | accurate picture: the only useful triggerable SVC is 0xf2; audit of 0xf0-0xf5... | user | 2026-10-08 |
| * | [HW] CORRECTION: version is right (.54 confirmed), but the opcode ACL rejects... | user | 2026-10-08 |
| * | [HW] svc 0xf2 issued from GCP ROP via stack migration; ASD survive-check passes | user | 2026-10-08 |
| * | step 5b: stack-migration solves the svc 0xf2 SP/msg-window gate in one memcpy... | user | 2026-10-08 |
| * | hardware prep: analysis finds the svc 0xf2 gate rejects a command-buffer SP; ... | user | 2026-10-08 |
| * | step 4: PC CONTROL in SYS_DRV demonstrated in emulator (chosen fault PC 0x00b... | user | 2026-10-08 |
| * | step 3: the SYS_DRV overflow is a CONTROLLED overwrite (bounded, non-crashing... | user | 2026-10-08 |
| * | step 2 DEMONSTRATED in emulator: opcode 0x3103 reaches sub_E0F364 and overflo... | user | 2026-10-08 |
| * | step 1 done: resolve the SYS_DRV overflow opcodes (0x3102 read / 0x3103 write... | user | 2026-10-08 |
| * | crypto service (service 1) == SYS_DRV: the known overflow #9 is reachable fro... | user | 2026-10-08 |
| * | ASD audit pass 2: 0x800/forwarded group + tail workers uniformly validated --... | user | 2026-10-08 |
| * | ASD audit pass 1: first-level 0x180 handlers validate (ptr,len) but only cap ... | user | 2026-10-08 |
