1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
# Free SYS_DRV `.54` `0x1028`: caller-chosen dword in indexed CPU window
**Signed-code fixed-window write capability, synthetic target only; no
live other-client/security effect.** Historical inventory called
`0x1028` a tiny/query getter, but signed `sub_E105A8` case 4136
calls `sub_E13A2C(msg+14)`. It bounds inline `msg[14]` to **0..15**.
When `msg[16] != 0`, it copies a word from
`*(u32 *)(*0xE2579C + 0x500 + 4*index)` to inline `msg[15]`;
when `msg[16] == 0`, it writes the **caller-chosen `msg[15]`** to
that same fixed indexed word. There is no per-caller owner/record
comparison in this leaf. This is a **CPU-MMU virtual-address dereference
through a SYS_DRV-private pointer**, not `SVC 0x7C` and not an
arbitrary PSP virtual or fabric address.
`psp_emu/harness/probe_sysdrv_1028_base_readonly.py` found signed
modeled init sets `*0xE2579C` from 0 to **`0x03010000`**, placing
the indexed window at `0x03010500..0x0301053F`; the emulator maps
that region through its generic `MMIO_BASE=0x03010000` window
(`psp_emu/pspemu/memmap.py`). It **did not read any word contents**.
Model MMIO backing is not proof of the real card's PTE attributes,
other-client ownership, register meanings or exact live pointer.
`psp_emu/harness/probe_sysdrv_1028_synthetic_window.py` passed on
signed dispatch with modeled caller caps 2. It temporarily swapped
`*0xE2579C` to a fresh **synthetic owned buffer**, wrote
`0x2468ACE0` at selected index 3, read it back through signed
`0x1028`, and verified adjacent words stayed zero. Index 16
returned `0xFFFF0006` without a store. The pointer was restored in
**emulator memory**; the original `0x03010000` window was never
read or written. This proves a signed selected-word store in the
swapped model, not a card CPU-MMU/MMIO effect or cross-client victim.
A scoped signed-image direct-base-reference survey found no
other explicit `+0x500` field access among the 31 functions that
refer directly to `0xE2579C`; indirect pointers and hardware
consumers remain unexamined. The signed setter of the pointer,
natural users of the 16 fields, live values, effective MMU mappings and an exact hardware restoration
oracle remain open. Do **not** write to this window on the card merely
for readback/return status. Calling this an arbitrary RAM write or
security bypass would overstate the evidence.
|
