#!/usr/bin/env python3 """Signed .54 0x101D: determine if default per-caller crypto gate reaches +52 read. No crypto/session state is planted or modified on hardware. """ from pathlib import Path import sys from unicorn import UC_HOOK_CODE sys.path.insert(0,str(Path(__file__).resolve().parents[1])) from pspemu import sysdrv_env SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf' def main(): sd=sysdrv_env.make() assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes() r,f,_=sysdrv_env.run_init(sd) assert r==0 and not f and sysdrv_env.init_flag(sd)==1 req,cfg,inp,out=[sd.alloc(n) for n in (0x100,0x400,0x80,0x40)] sd.write(cfg,bytes(0x400));sd.write(inp,bytes(0x80));sd.write(out,bytes(0x40)) reads=[] sd.uc.hook_add(UC_HOOK_CODE,lambda uc,ea,size,data:reads.append(ea),begin=0xE1F6EA,end=0xE1F6EB) sd.write(req,bytes(0x100)) for i,v in ((0,0x101D),(1,2),(2,inp),(3,4),(4,out),(5,4), (sysdrv_env.REQ_CONFIG_DWORD,cfg)): sd.wr32(req+4*i,v) rv=sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000) assert not reads and not sd.faults,(rv,reads) print(f'signed 0x101D default emulator: gate_status={rv:#x}, nested+52_read_reached=False; conditional signed path remains untested') if __name__=='__main__':main()