| Commit message (Expand) | Author | Age |
|---|
| * | Record PSP security investigation artifacts and probesHEADmain | user | 2026-10-09 |
| * | GCP->ASD 0x403: ASD-internal chain PROVEN end-to-end in emulator (real handlers) | user | 2026-10-08 |
| * | sim: confirm GCP crypto ROP message is correct; localize 0xFFFF000F to SVC 0x... | user | 2026-10-08 |
| * | step 4: PC CONTROL in SYS_DRV demonstrated in emulator (chosen fault PC 0x00b... | user | 2026-10-08 |
| * | step 3: the SYS_DRV overflow is a CONTROLLED overwrite (bounded, non-crashing... | user | 2026-10-08 |
| * | step 2 DEMONSTRATED in emulator: opcode 0x3103 reaches sub_E0F364 and overflo... | user | 2026-10-08 |
| * | [HW] saved-LR shot is a negative across [0x41bf90,0x41bfd8): stack is hit, no... | user | 2026-10-07 |
| * | LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed... | user | 2026-10-07 |
| * | fifty-fifth pass: compose the chain through the real dispatcher in emulation | user | 2026-09-30 |
| * | fifty-fourth pass: step two executed, all three steps now run in emulation | user | 2026-09-30 |
| * | fifty-third pass: fix the harness by instrumentation and execute step one | user | 2026-09-30 |
| * | fifty-second pass: emulating step one is inconclusive and is labelled as such | user | 2026-09-30 |
| * | fifty-first pass: reproduce the corruption step in emulation | user | 2026-09-30 |
| * | emulator fuzz harness: TAs really do load; first fault refuted on silicon | user | 2026-09-29 |
| * | sixth pass: build emulator fuzz harness for the twelve TAs; result deliberate... | user | 2026-09-29 |
| * | TSU disclosure: investigate the verify gate, and propagate the caveat | user | 2026-09-28 |
| * | Add a verified TA-space reader; confirm a malicious sink cannot open ASD 0x308 | user | 2026-09-25 |
| * | END TO END: modelled display data steers real PSP firmware in the emulator | user | 2026-09-25 |
| * | Stage 2 achieved: host ring drives HDCP into a display RPC serviced by real ASD | user | 2026-09-25 |
| * | Clear the display-surface blocker: ASD registers when the platform-id byte is... | user | 2026-09-25 |
| * | full_system's TA invoke was never broken: it was my cmd_buf_len | user | 2026-09-25 |
| * | End-to-end: a sink-reported byte alone decides whether the HDCP overflow runs | user | 2026-09-25 |
| * | Model a malicious display sink: gate B's value passes through verbatim | user | 2026-09-25 |
| * | Execute strategy step 1: CCP fault statuses were unmodelled; fix by modelling | user | 2026-09-24 |
| * | Strategy shift: structural controls (pspemu/oracle.py), then CCP as an oracle | user | 2026-09-24 |
| * | Fix two broken controls; the Route C window really is untouched on exercised ... | user | 2026-09-24 |
| * | Add routec_window_watch harness; its own control voids its first result | user | 2026-09-24 |
| * | Adopt verified CCP semantics from the leaked AMD SP tree | user | 2026-09-24 |
| * | Retract the "flat ring oracle": the readback address was wrong, not the path | user | 2026-09-24 |
| * | Fuzz the pre-auth IFWI parser: two OOB sites, both bounded to 16 bytes | user | 2026-09-24 |
| * | Demonstrate the TSU 4.1c chain end to end in the emulator, and find a gating ... | user | 2026-09-24 |
| * | Demonstrate the pre-auth IFWI wrapping bug executing in the emulator | user | 2026-09-24 |
| * | Fix RAS-in-full_system plumbing; catch a three-address-space aliasing trap | user | 2026-09-23 |
| * | Drive RAS over the ring inside full_system: state confirmed good, plumbing left | user | 2026-09-23 |
| * | P3 resolved: 0x000d's capacity IS populated -- the bridge was the problem | user | 2026-09-23 |
| * | P3: identify the writer of SYS_DRV 0xE575B8 | user | 2026-09-23 |
| * | Drive RAS on real silicon: the 0xE575B8 blocker is missing state, confirmed | user | 2026-09-23 |
| * | Measure ASD's four unmodelled SVCs from a real boot instead of fabricating them | user | 2026-09-23 |
| * | Cover ASD on the card's build: resolve its dispatcher and validate_ptr | user | 2026-09-23 |
| * | Add the card's own TAs and show HDCP/DTM findings reproduce on them | user | 2026-09-23 |
| * | Validate against real silicon: RAS matches the card, HDCP/DTM/ASD do not | user | 2026-09-23 |
| * | State where each gate model is applied, so check_range is not mistaken for live | user | 2026-09-23 |
| * | Model sOS's SVC permission gate: SVCs no longer succeed unconditionally | user | 2026-09-23 |
| * | Find that fuzz_asd's coverage rests on fabricated SVC returns | user | 2026-09-23 |
| * | Measure async dispatch and scheduling instead of assuming they are absent | user | 2026-09-23 |
| * | Model the sOS gate's region validation, and retract the DACR claim | user | 2026-09-23 |
| * | Record the bounded search for what populates SYS_DRV's 0xE575B8 context | user | 2026-09-23 |
| * | Trace RAS's last blocker to uninitialised SYS_DRV context, not a bad request | user | 2026-09-23 |
| * | fuzz_sysdrv: respect the pointer allowlist by default; withdraw my own caveat | user | 2026-09-23 |
| * | full_system: require TA liveness, not just "some blocks executed" | user | 2026-09-23 |
