1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
"""Diff LIVE flash (via the DF aperture) against our archived image.
Any region that differs is runtime-mutable state -- anti-rollback counters,
secure NVRAM, RAS EEPROM records, event logs. Those are regions the PSP writes
and trusts, which makes them interesting targets.
READ-ONLY. No SPI commands. SMN reads are slow over USB (~3 transactions per
dword), so this samples rather than dumping 1 MB.
"""
import sys, struct, time
sys.path.insert(0,"/Users/user/src/tinygrad")
from tinygrad import Device
d=Device["AMD"]; adev=d.iface.dev_impl
def rd(a):
adev.wreg(14,a&0xffffffff); return adev.rreg(15)
BASE=0xd800000; FOFF=0x20000; SPAN=0xe0000 # verified linear region
fl=open('flash_BIOS2_KNOWNGOOD_20260917.bin','rb').read()
def chunk(delta, n=8):
return b"".join(struct.pack('<I',rd(BASE+delta+4*i)) for i in range(n))
print("live-flash aperture: DF %#x .. +%#x == flash[%#x .. %#x]"%(BASE,SPAN,FOFF,FOFF+SPAN))
print("sampling every 0x1000 (32 bytes per sample)...")
t0=time.time(); diffs=[]; n=0
for delta in range(0, SPAN, 0x1000):
live=chunk(delta); disk=fl[FOFF+delta:FOFF+delta+32]; n+=1
if live!=disk:
diffs.append((delta, FOFF+delta, live, disk))
print(" DIFF flash %#08x live=%s"%(FOFF+delta, live[:16].hex()))
print(" disk=%s"%disk[:16].hex())
print("\nsampled %d points in %.0fs ; %d differ"%(n, time.time()-t0, len(diffs)))
if not diffs:
print(" live flash matches the archive at every sampled point ->")
print(" no runtime-mutable region detected in [%#x,%#x)"%(FOFF,FOFF+SPAN))
print("\n=== also probe the region BELOW the aperture start (flash 0..0x20000) ===")
B2=0xd300000 # maps flash 0x0
for delta in range(0, 0x20000, 0x2000):
live=b"".join(struct.pack('<I',rd(B2+delta+4*i)) for i in range(8))
disk=fl[delta:delta+32]
if live!=disk:
print(" DIFF flash %#08x live=%s disk=%s"%(delta,live[:16].hex(),disk[:16].hex()))
print(" (done)")
print("\nMEMSIZE=%s sos_alive=%s"%(hex(adev.rreg(0xde3)),adev.psp.is_sos_alive()))
|
