aboutsummaryrefslogtreecommitdiffstats
path: root/psp_out (follow)
Commit message (Expand)AuthorAge
* CORRECTION: crypto buffer confinement is the type-5 svc-0xf2 window [0x400000...user2026-10-08
* map the TA->kernel SVC surface under ROP; correct two SVC-OVERVIEW errors; ra...user2026-10-08
* [HW] FE0A selector 8 confirmed on silicon: the store is real and host-aimed, ...user2026-10-07
* LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed...user2026-10-07
* extend the decompilation to ASD and the three handover-symbol typesuser2026-10-01
* build a symbolicated, diffable decompilation of every GCP builduser2026-10-01
* index this session's findings, which existed but were unindexeduser2026-09-30
* write up the rollback finding for disclosureuser2026-09-30
* finding: the ring base is accepted misaligned and then wedges on first submituser2026-09-30
* close the ring index: bounded, and handled gracefullyuser2026-09-30
* close the last ring-frame field and publish the complete field mapuser2026-09-30
* hundredth pass: consolidate the denial-of-service family into a disclosure-re...user2026-09-30
* eighty-ninth pass: characterise the last two unread GFX commands and TMR relo...user2026-09-30
* seventieth pass: consolidate into a disclosure-ready report and index ituser2026-09-30
* [ST] overturn the SYS_DRV 0x60xx 'no emitter' negative: POWERPLAY emits ituser2026-09-29
* fw: restore AMD's own function names and apply prototypes/types across the TAsuser2026-09-29
* [HW] new finding: GCP crypto-session acquire gate bypassed by retryinguser2026-09-29
* psp_out: fold the twelve-TA round into the authoritative audit and disclosure...user2026-09-29
* fw: reverse-engineer and annotate all twelve newly-hittable TAs in IDAuser2026-09-29
* fw: triage the twelve unaudited TA types this card accepts; TMZ is a stub, RA...user2026-09-29
* HDCP: map the oldest TA build (23.0.4.49) and sweep the overflow shape across...user2026-09-29
* fw: harvest all 53 Windows driver versions -- 110 new firmware images, 17 TA ...user2026-09-29
* fw: carve PSP firmware from AMD Windows drivers; 10 TA types the Linux corpus...user2026-09-29
* ASD 0x202: two new negative axes, and name the question that actually decides ituser2026-09-29
* Disclosure summary: correct 0x3103 reasoning, bound the VCN half, surface GPU...user2026-09-29
* VCN DPG round 2: LMA writes latch nothing reachable; false positive caught by...user2026-09-29
* VCN DPG round: un-gate VCN registers, explain the old constant-window, sound ...user2026-09-29
* VCN type-49 closure: target space identified as the DPG shadow register fileuser2026-09-29
* VCN type-49: validated read channel, first sound write-observation, two new p...user2026-09-29
* SYS_DRV 0x3103: close reachability -- the stored length is pinned at zerouser2026-09-29
* TSU round 7: live mailbox survey -- no command populates the gating tableuser2026-09-28
* TSU round 6: void the mailbox survey -- it failed its own liveness controluser2026-09-28
* TSU round 5: answer the open question; the gating table is never populateduser2026-09-28
* TSU round 4: no writer found for the bound word; correct round 3's over-readuser2026-09-28
* TSU: the verify abort is an empty registry, not a security checkuser2026-09-28
* TSU disclosure: investigate the verify gate, and propagate the caveatuser2026-09-28
* MEC/PM4 round 10: no firmware privilege check on MAP_QUEUES; thread closeduser2026-09-28
* MEC/PM4 round 9: stop the KIQ port on cost/benefit, name the cheaper routeuser2026-09-28
* Record the stuck-HQD hazard from the KIQ port, and the ATX recoveryuser2026-09-28
* MEC/PM4 round 8: port amdgpu's KIQ slot selection; queue activates, still stallsuser2026-09-28
* Consolidate the GPU-engine campaign into the authoritative validity audituser2026-09-28
* MEC/PM4 round 7: HIQ plumbing blocked, blocker characterised preciselyuser2026-09-28
* MEC/PM4 round 6: MAP_QUEUES chain is untested, not closeduser2026-09-28
* MEC/PM4 round 5 [HW]: the user->kernel register boundary holdsuser2026-09-28
* MEC/PM4 round 4: correct the dispatch table, refute the length-bound guessuser2026-09-28
* Synthesise the corpus: test the strongest compound, and reorder the targetsuser2026-09-28
* Scope the DMCUB findings by reachability, and test the user-influenced pathuser2026-09-28
* Inventory every loadable firmware component, and record the sweep hazarduser2026-09-28
* Refute the TA-to-SMU reframing: SVC 0xE8/0xE9 are stubsuser2026-09-26
* Correct the SMU entry: not an attacker channel, and not currently truncating ...user2026-09-26
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-05 00:12:18 +0000 — sl0p fork