/psp_out/

• ../
• ANALYSIS-HDCP-OVERFLOW-IS-DEFINITIVELY-DoS.md
• ANALYSIS-PSP-CODE-EXEC-AVENUES.md
• ANGLE-DISPLAY-SINK-INPUT-SURFACE.md
• ANGLE-EXTERNAL-INPUT-CHANNELS-RANKED.md
• ANGLE-PSP-AS-CONFUSED-DEPUTY-WRITER.md
• ANGLE-TA-KERNEL-SURFACE-CAPABILITY-BOUNDARY.md
• ARCH-INSIGHTS-FROM-AMD-SP-SOURCE.md
• ARCH-INSIGHTS-FROM-DAYZEROSEC-POSTS.md
• ARCH-INSIGHTS-FROM-STALEUS-PAPER.md
• ARCH-SMN-APERTURE-PRIVILEGE.md
• ASD-REACHABLE-AUDIT.md
• ATTACK-SURFACE.md
• AUDIT-ASD-LINK-OPS-VENEERS.md
• AUDIT-ASD-REACHABLE-COMPLETE.md
• AUDIT-OBJECT-LIFETIME-AND-STATE.md
• AUDIT-ROUND-NEW-VULN-HUNT.md
• AUDIT-ROUND-RAS-DTM-SYSDRV.md
• AUDIT-SMU-I2C-NUMCMDS.md
• AUDIT-SOS-SRC-POINTER-TOCTOU.md
• AUDIT-TA-KERNEL-BOUNDARY.md
• AUDIT-TEE-PARAM-MARSHALLING.md
• BUG-TINYGRAD-PSP-RING-NO-WRAP.md
• CARD-STATE-ACCESS-INVENTORY.md
• CLOSURES-VERSION-DIFF-ARC.md
• CONFIRMED-FIRMWARE-ROLLBACK-WORKS.md
• CONSTRAINTS.md
• CRASH-RECORD.md
• DISCLOSURE-SUMMARY.md
• DISTINCT-WRITE-HUNT.md
• FINDING-ASD-0x403-UNBOUNDED-TABLE-INDEX.md
• FINDING-ASD-IS-DRIVER-CLASS-NOT-INVOKABLE.md
• FINDING-ASD-SVC-STUBS-LOAD-BEARING.md
• FINDING-ASD-VERSION-HISTORY-AND-ENCODER-BOUND.md
• FINDING-CONTAINER-SIGNATURE-FORMAT-AND-KEYRING.md
• FINDING-CORRECTED-GUARD-SWEEP-COMPLETE.md
• FINDING-DF-FLASH-APERTURE-HOST-READABLE.md
• FINDING-DRAM-PROTECT-ONLY-ENFORCED-IF-HOST-DECLARES-IT.md
• FINDING-DTM-SNAPSHOT-ADDED-AFTER-OUR-BUILD.md
• FINDING-FEATURE-MASK-GET-UNBOUNDED-INDEX.md
• FINDING-FIRMWARE-CORPUS-WAS-40-PERCENT-COMPLETE.md
• FINDING-FULL-SOS-BOOT-IN-EMULATOR.md
• FINDING-HDCP-VERSION-HISTORY-NEGATIVE.md
• FINDING-HOST-MAILBOX-AND-RING-IN-EMULATOR.md
• FINDING-HOST-READ-SLWR-AND-SYSHUB.md
• FINDING-IFWI-PARSER-FUZZ.md
• FINDING-IFWI-WRAP-CONFIRMED-IN-EMULATOR.md
• FINDING-LIVE-VERSION-IS-53-NOT-54.md
• FINDING-LOADIPFW-VCN-REGWRITE.md
• FINDING-LOADTA-ADDRESS-CLASSIFICATION-ORACLE.md
• FINDING-NO-CONSUMABLE-CORRUPTION-ANYWHERE.md
• FINDING-NO-PSP-MEMORY-APERTURE.md
• FINDING-PSS-PARSER-DIFFERENTIAL.md
• FINDING-RAS-INJECT-TMR-PROTECTION-IS-CORRECT.md
• FINDING-RAS-IS-REACHABLE-AND-AUDITED.md
• FINDING-RING-LOADTA-WORKS-RAS-SPECIFIC-FAILURE.md
• FINDING-ROUTEC-WINDOW-IDENTIFIED.md
• FINDING-SLWR-ALLOWLIST-EXTRACTED.md
• FINDING-SMU-MAILBOX-HOST-REACHABLE.md
• FINDING-SMUIO-AND-UNKNOWN-BASES.md
• FINDING-SOS-AND-TAS-BOOT-IN-EMULATOR.md
• FINDING-SOS-CCP-WINDOW-FIXED-IN-54.md
• FINDING-SOS-RING-EMULATION-AND-3137-SKIP.md
• FINDING-SYSDRV-ACL-RANGE-TABLE.md
• FINDING-SYSDRV-CHIPLET-UNBOUNDED-INDEX.md
• FINDING-SYSDRV-SHAREDMEM-RANGE-FIXED-IN-54.md
• FINDING-SYSDRV-VCCC-DOUBLEFETCH-UNDERFLOW.md
• FINDING-TMR-FENCE-IS-TAG-AGNOSTIC.md
• FINDING-TOCTOU-SEARCH.md
• FINDING-TSU-CHAIN-E2E-IN-EMULATOR.md
• FINDING-TSU-MAILBOX-HOST-REACHABLE.md
• FINDING-UMC-NOT-REACHABLE-VIA-SMN.md
• FINDING-VCN-GATE-OPENS-VIA-SMU-POWERUP.md
• FINDINGS-SUMMARY.md
• FINDINGS.md
• FIRMWARE-COVERAGE-MATRIX.md
• FIRMWARE-INVENTORY.md
• FUZZING-EMULATED.md
• FUZZING-RESULTS.md
• GFX-HANDLER-COVERAGE.md
• GUARD-INIT-CHAIN.md
• HANG-FREE-OVERFLOW-LEAD.md
• HANG-ROOT-CAUSE.md
• HARNESS-TA-FUZZING-CORRECTIONS.md
• HDCP-LIFECYCLE-AUDIT.md
• HDCP-TA-AUDIT.md
• HUNT-HOST-REACHABLE-HEAP-CORRUPTION.md
• HW-RAS-ON-CARD.md
• HW-TA-VERSION-REPRODUCTION.md
• HW-VALIDATION-RX7900XTX.md
• INDEX.md
• LATENT-ASD-ENCODER-STATE-CHECK-UNBOUNDED-INDEX.md
• LATENT-RAS-PARAM-ARRAY-OOB.md
• LEAD-FUSE-DEBUG-REACHABILITY-ROUND1.md
• LEAD-STAGE2-TASK-BLOCKED-ON-UNMAPPED-20A000.md
• LEAD-SYSDRV-DMA-TRANSFER-CLIENT-BUFFER.md
• LEAD-SYSDRV-FUSE-DEBUG-DMA-SURFACE.md
• LEAD-SYSDRV-LOADIPFW-DOUBLEFETCH.md
• LEAD-TRNG-CANARY-PREDICTION.md
• MEC-PM4-FOOTHOLD.md
• METHODOLOGY-INLINING-VS-ADDED-GUARDS.md
• NEW-AREAS-ROUND.md
• NEXT-ASD-OLD-BUILD-TARGETS.md
• NV22-MEMMAP-MINED.md
• OBSERVATION-SESSION-TABLE-REDZONE-UNDER-REAL-INIT.md
• OBSERVATION-SYSDRV-3141-NULL-PTR-NONZERO-LEN.md
• ORPHAN-CODE-SWEEP.md
• OVERFLOW-SURFACE-AUDIT.md
• PARSER-SURFACE-FROM-BUGS.md
• PHASE2-PORT-RESULTS.md
• PHASE5-TRIAGE-RESULTS.md
• PLAN-BOOT-WINDOW-ROMSW.md
• PLAN-COMPLETE-VERSION-DIFF.md
• READ-PRIMITIVE-HUNT-HDCP.md
• RERATE-ROUTEC-TARGET-MAY-BE-VCN.md
• RESOLUTION-DUAL-BIOS.md
• REVIEW-NEW-ROUTE-A-B.md
• REVIEW-OPEN-THREADS.md
• RING-FRAME-FIELD-MAP.md
• ROUND3-FINDINGS.md
• SERVICE1-CRYPTO-ANALYSIS.md
• SESSION-NEWPRIMITIVE-HUNT.md
• SMN-MAP-HEALTHY-CARD.md
• SOURCE-AMD-SP-TREE-WHAT-IT-GIVES-US.md
• STATE-CONFUSION-AUDIT.md
• STRATEGY-MEASUREMENT-FIRST.md
• SUBCMD12-RESOLVED.md
• SURFACE-SDMA-RLC-IMU.md
• SVC-OVERVIEW.md
• SYNTHESIS-CROSS-FINDING-COMPOUNDS.md
• SYSDRV-ALL-HANDLERS.dump
• TA-CODE-EXEC-ANALYSIS.md
• TOOLING-EMITTER-SCAN-FIX.md
• VCN-FIRMWARE-FOOTHOLD.md
• VERSION-AUDIT-STATUS.md
• VULN-ASD-202-CANARY-LEAK.md
• VULN-ASD-308-BYPASS.md
• VULN-ASD-308-REACHABLE.md
• VULN-ASD-SRM-V9-WALKER-OOB-READ.md
• VULN-ASD-SRM-WALKER-OOB-READ.md
• VULN-AUDIT-WHAT-WE-ACTUALLY-HAVE.md
• VULN-CONFIRMED-TMR-RANGE-ROLLBACK.md
• VULN-HDCP-BRANCHB-HANGFREE-OOB.md
• VULN-HDCP-SESSION-STATE-BYPASS.md
• VULN-HDCP-TA-STACK-OVERFLOW.md
• VULN-LOADIPFW-UNSIGNED-REGWRITE.md
• VULN-SOS-PROCSWITCH-MSG-HEADROOM.md
• VULN-SYSDRV-3103-OVERFLOW.md
• VULN-SYSDRV-HEAP-OVERFLOW-COPYSTATE.md
• WRITE-PRIMITIVE.md
• access_inventory.py
• annotate_hdcp.py
• asd2.elf
• asd_code.bin
• asd_full.bin
• atx_cycle_and_clear.py
• atx_race.py
• bisect_bound.py
• catch_and_clear_marker.py
• check_procswitch_headroom.py
• check_retractions.py
• consume_scan.py
• craft_leak_image.py
• crafted_leak.bin
• crashmap.py
• dce_survey.py
• df_cfg_probe.py
• df_flash_window.py
• df_psp_probe.py
• df_survey.py
• dfscan.py
• dfscan2.py
• dfscan3.py
• dfscan4.py
• diff_asd.py
• diff_versions.py
• display_core_bringup.py
• drivers
• dtm.elf
• dtm2.elf
• dtm_code.bin
• dtm_full.bin
• elf
• emitscan.py
• explain_discovery.py
• exploit_asd308_bypass.py
• exploit_branchB_oob.py
• exploit_hdcp_oob.py
• extract_sigs.py
• f32_probe.py
• faultcheck.py
• find_discovery.py
• flash_BIOS1_STUCK_20260917.bin
• flash_BIOS2_KNOWNGOOD_20260917.bin
• flash_fw
• flash_live_diff.py
• fuse_reach.py
• fuzz_0f_struct.py
• fuzz_campaign.py
• fuzz_gfx_lens.py
• fuzz_gfx_ring.py
• fuzz_hdcp_10_13.py
• fuzz_one_cmd.py
• fuzz_ras.py
• fuzz_ras_trigger.py
• fuzz_ta_deep.py
• fuzz_ta_invoke.py
• fwdbg.py
• gc_11_0_0_imu.bin
• gc_11_0_0_rlc.bin
• gcp_playready_certchain.xml
• gfxanom_01_r5.bin
• gfxanom_01_r9.bin
• gfxanom_04_r10.bin
• gfxanom_0c_r8.bin
• gfxanom_10000_r7.bin
• gfxanom_22_r6.bin
• gfxleak_00_r38.bin
• gfxleak_01_r12.bin
• gfxleak_01_r13.bin
• gfxleak_01_r5.bin
• gfxleak_01_r9.bin
• gfxleak_02_r11.bin
• gfxleak_02_r14.bin
• gfxleak_02_r15.bin
• gfxleak_02_r2.bin
• gfxleak_02_r3.bin
• gfxleak_03_r35.bin
• gfxleak_04_r1.bin
• gfxleak_04_r10.bin
• gfxleak_04_r20.bin
• gfxleak_04_r24.bin
• gfxleak_0c_r8.bin
• gfxleak_0d_r31.bin
• gfxleak_0e_r84.bin
• gfxleak_0f_r55.bin
• gfxleak_10000_r7.bin
• gfxleak_11_r140.bin
• gfxleak_17_r186.bin
• gfxleak_1f_r71.bin
• gfxleak_20_r22.bin
• gfxleak_20_r23.bin
• gfxleak_22_r16.bin
• gfxleak_22_r17.bin
• gfxleak_22_r4.bin
• gfxleak_22_r6.bin
• gfxleak_23_r19.bin
• gfxleak_23_r21.bin
• gfxleak_26_r34.bin
• gfxleak_27_r33.bin
• gfxleak_28_r18.bin
• gfxleak_3f_r41.bin
• gfxleak_f0000_r0.bin
• gfxleak_ff_r65.bin
• guard_delta.py
• guard_sweep.py
• handlers
• handover
• hang_iso_cmd03.bin
• hang_payload_cmd02.bin
• hang_seq_cmd03.bin
• hdcp2.elf
• hdcp_annotated_bundle.c
• hdcp_code.bin
• hdcp_full.bin
• hdcp_subcmd12_rxinfo_annotated.c
• heap_copystate_params.py
• hunt_leak_0f.py
• hunt_leak_0f2.py
• hunt_psp_disclosure.py
• hunt_psp_memory_aperture.py
• hunt_uninit_0f.py
• hw
• ifwi_parse_model.py
• import_sos_symbols.py
• ip_map.py
• lma_probe.py
• load_ta.py
• measure_ta_outputs.py
• mec_11_0_0.bin
• mec_11_0_0.elf
• mec_ucode.bin
• mkelf.py
• mkelf_riscv.py
• mkelf_xtensa.py
• mmio_map.py
• mmio_table.py
• moddis.py
• new
• novel_dtm_02_10263.bin
• novel_dtm_02_10264.bin
• novel_dtm_02_2147483648.bin
• novel_dtm_02_24.bin
• novel_dtm_02_255.bin
• novel_dtm_02_33.bin
• novel_dtm_02_62.bin
• novel_dtm_02_65535.bin
• novel_dtm_02_8.bin
• novel_dtm_03_10264.bin
• novel_dtm_03_2147483647.bin
• novel_dtm_03_25.bin
• novel_dtm_03_256.bin
• novel_dtm_03_3.bin
• novel_dtm_03_32.bin
• novel_dtm_03_4294967294.bin
• novel_dtm_03_5121.bin
• novel_dtm_04_10264.bin
• novel_dtm_04_24.bin
• novel_dtm_04_32.bin
• novel_dtm_04_4.bin
• novel_dtm_04_65536.bin
• novel_dtm_04_8.bin
• novel_hdcp_0f_0.bin
• novel_hdcp_0f_21.bin
• outlier_0f_r1344_in.bin
• outlier_0f_r1344_out.bin
• outlier_0f_r2048_in.bin
• outlier_0f_r2048_out.bin
• outlier_0f_r2240_in.bin
• outlier_0f_r2240_out.bin
• outlier_0f_r3392_in.bin
• outlier_0f_r3392_out.bin
• phase1_build_idbs.py
• phase1_coverage.json
• phase2_port.json
• phase2_port_symbols.py
• phase3
• phase3_decompile.py
• phase4_diff.py
• phase4_diffs.json
• phase5_triage.py
• phase6_dump_c.py
• poc_asd202_canary_leak.py
• poc_asd202_leak_sentinels.py
• poc_srm_v9_walker_oob.py
• poc_srm_walker_oob.py
• probe_asd308_cf.py
• probe_asd308_fptr.py
• probe_asd308_window.py
• probe_asd308_writebranch.py
• probe_asd_308.py
• probe_asd_308_gate.py
• probe_asd_as_ta.py
• probe_asd_direct_invoke.py
• probe_attestation.py
• probe_branchB.py
• probe_bss_overflow.py
• probe_bss_proof.py
• probe_c2p_mailbox.py
• probe_canaryfill.py
• probe_fuzz1.py
• probe_fuzz2.py
• probe_gate.py
• probe_hang_faultscan.py
• probe_i2c_baseline.py
• probe_i2c_numcmds_timing.py
• probe_invoke_exhaust.py
• probe_loadipfw_smallsize.py
• probe_magic_tamper.py
• probe_ras.py
• probe_ras_resp.py
• probe_routec_regwrite.py
• probe_smn_read_routec.py
• probe_smu_confused_deputy.py
• probe_smu_dma_addr.py
• probe_smu_dram2smu_fuzz.py
• probe_smu_i2c_numcmds.py
• probe_smu_index_fuzz.py
• probe_smu_mailbox.py
• probe_smu_voltage_oob.py
• probe_smu_workload_index.py
• probe_stateconf.py
• probe_ta_load_exhaust.py
• probe_ta_session_uaf.py
• probe_tmr_base_sweep.py
• probe_tmr_fence.py
• probe_tmr_footprint.py
• probe_tmr_writes_real.py
• probe_tsu_mailbox.py
• probe_tsu_readoracle.py
• probe_vccc_0x26.py
• probe_vccc_control.py
• psp_liveness_evidence.py
• psp_recover.py
• pte_attr_probe.py
• race_flash_sector.py
• ras2.elf
• ras_code.bin
• ras_full.bin
• rasdis.py
• regguard.py
• replay_outlier.py
• repro_hang.py
• repro_seq_123.py
• retry_link.py
• rsmu_survey.py
• rw_diff.py
• rw_test.py
• scan_bootstage_regs.py
• scratch
• sdma_6_0_0.bin
• sdma_prev.bin
• signscan.py
• sigs
• slwr_hostread.py
• slwr_parse.py
• smn_ipbases.py
• smn_name.py
• smn_probe.py
• smn_probe2.py
• smn_survey.py
• smn_sweep.py
• smu_fw
• smuio_and_unknowns.py
• sos2.elf
• sos_code.bin
• sos_full.bin
• sos_symbols.json
• spiflash.bin
• sub_402A88_decompiled.c
• svcscan.py
• sys_drv2.elf
• sys_drv_code.bin
• ta_raw.bin
• test_encoder_oob.py
• test_encoder_oob2.py
• test_encoder_oob3.py
• test_encoder_oob4.py
• test_range_polarity.py
• test_regguard.py
• test_regguard_offline.py
• test_rollback_51.py
• test_tmr_impact.py
• test_tmr_protection.py
• test_tmr_range_guard.py
• timing_map.py
• timing_sc.py
• timing_validate.py
• tmz_probe.py
• tmz_raw.py
• toctou_behavior.py
• toctou_bridge.py
• toctou_curve.py
• toctou_detect.py
• toctou_prove.py
• toctou_prove2.py
• toctou_rejcurve.py
• toctou_replicate.py
• toctou_run.sh
• toctou_sweep.py
• toctou_sysdrv.py
• toctou_sysdrv2.py
• toctou_ta.py
• toctou_tashm.py
• umc_recheck.py
• umc_survey.py
• umc_validate.py
• undoc_probe.py
• v53
• validate_disclosure_detector.py
• validate_ifwi.py
• vcn_4_0_0.bin
• vcn_confirm.py
• vcn_gate_probe.py
• vcn_index_probe.py
• vcn_map_calib.py
• vcn_size_probe.py
• vcn_sweep_detect.py
• vcn_ucode.bin
• vcn_write_detect.py
• vdiff
• vdiff2.py
• vdiff_func.py
• verify_idbs.py
• verify_nondet.py
• versions
• versions_lfw
• versions_win
• vport.py
• vport2.py
• vport_emit.py
• vram_check.py
• vram_probe.py