1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
#!/usr/bin/env python3
"""Signed .54 0x101D: determine if default per-caller crypto gate reaches +52 read.
No crypto/session state is planted or modified on hardware.
"""
from pathlib import Path
import sys
from unicorn import UC_HOOK_CODE
sys.path.insert(0,str(Path(__file__).resolve().parents[1]))
from pspemu import sysdrv_env
SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'
def main():
sd=sysdrv_env.make()
assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes()
r,f,_=sysdrv_env.run_init(sd)
assert r==0 and not f and sysdrv_env.init_flag(sd)==1
req,cfg,inp,out=[sd.alloc(n) for n in (0x100,0x400,0x80,0x40)]
sd.write(cfg,bytes(0x400));sd.write(inp,bytes(0x80));sd.write(out,bytes(0x40))
reads=[]
sd.uc.hook_add(UC_HOOK_CODE,lambda uc,ea,size,data:reads.append(ea),begin=0xE1F6EA,end=0xE1F6EB)
sd.write(req,bytes(0x100))
for i,v in ((0,0x101D),(1,2),(2,inp),(3,4),(4,out),(5,4),
(sysdrv_env.REQ_CONFIG_DWORD,cfg)):
sd.wr32(req+4*i,v)
rv=sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000)
assert not reads and not sd.faults,(rv,reads)
print(f'signed 0x101D default emulator: gate_status={rv:#x}, nested+52_read_reached=False; conditional signed path remains untested')
if __name__=='__main__':main()
|
