orangecms

#!/bin/sh

# have rkbin and xrock in the same directory
# https://github.com/rockchip-linux/rkbin
# https://github.com/xboot/xrock

# Run this in the xboot directory.
# Have rkbin in the same parent directory.
_BDIR=../rkbin/bin/rk35
# DRAM init binary

orangecms

• Allwinner
• Amlogic
• Broadcom
• Rockchip
• TI
• HiSilicon
• MediaTek
• Qualcomm
• Samsung
• NXP

orangecms

#!/bin/env python3

# convert time in microseconds to a human readable timestamp, e.g. 0:13:37.000123

from datetime import timedelta
import sys
ts=int(sys.argv[1])
td=timedelta(microseconds=ts)
print(str(td))

orangecms

see PSPReverse/PSPTool#63

Diffing G733PYV323.rom vs GX650PY319.rom

Second gen (after Picasso/Raven Ridge) vs Second gen (after Picasso/Raven Ridge)
IMC Firmware                                  both empty
Gigabit ethernet firmware                     both empty
XHCI firmware                                 both empty
Fam 17 Model 00-0f BIOS                       both empty

orangecms

/home:
  |
  |  0008 .            636d d  |  0000 ..           41ed d  |  0009 RTFD         63c0 d  |
  |  0011 bup          63f9 d  |  0023 cls          63c0 d  |  0025 dal_ivm      63c0 d  |
  |  0035 dal_sdm      63c0 d  |  0040 fpf          63ff d  |  0043 fwupdate     63e8 d  |
  |  0055 gpio         63f8 d  |  0060 hotham       63fe d  |  0064 icc          63e8 d  |
  |  0092 ish_srv      63e0 d  |  0096 loadmgr      63c0 d  |  0099 manuf        63f8 d  |
  |  0101 mca          63ed d  |  0108 mca_temp     63c0 d  |  0110 mctp         63e8 d  |
  |  0117 nfc          63e8 d  |  0120 nvinf        63ff d  |  0122 pavp         63f8 d  |
  |  0145 pmt          63e8 d  |  0148 policy       63f9 d  |  0174 ptt          63c0 d  |

orangecms

Vendor docs

https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3

https://docs.banana-pi.org/en/BPI-F3/GettingStarted_BPI-F3

https://wiki.banana-pi.org/Banana_Pi_BPI-F3

Preparation

orangecms

kexec file patch series test

This test is based on the patches from https://github.com/torvalds/linux/compare/master...bjoto:linux:kexec-image-v2-fixup. I have ported them both to 6.9.7 and 6.10-rc6 with success.

My branch: https://github.com/orangecms/linux/tree/6.10-jh7110-cpu

Additional kexec-tools patches: https://github.com/sugarfillet/kexec-tools/commits/main_rv

orangecms

oreboot 🦀 bt0 on Arm
1091555380
boot_log_len: 2359

>>> BEGIN OF BOOT LOG
B. I:V/3360889e/7vcz:g2a3d7b10/0/40000000.
SCS/0/0. I:ep_swinfo.
 I:sw_info=0x0
 I:EP:0x3050134/0x0.
 I:EP:0x305013c/0x0.

orangecms

#!/bin/bash

# get a toolchain; the one in current Ubuntu is not suitable, so use Zephyr's
# TOOLCHAIN_DL_BASE=https://github.com/zephyrproject-rtos/sdk-ng/releases/download
# TOOLCHAIN_VER=v0.16.5-rc1
# TOOLCHAIN_TAR=toolchain_linux-x86_64_riscv64-zephyr-elf.tar.xz
# wget $TOOLCHAIN_DL_BASE/$TOOLCHAIN_VER/$TOOLCHAIN_TAR
# tar -xf $TOOLCHAIN_TAR

TOOLCHAIN_DIR=$(pwd)/riscv64-zephyr-elf

orangecms

Abstract

We take a look at UEFI platform initialization firmware such as found on many current mainboards like laptops, desktops and servers.

Many security flaws, such as the recently discovered LogoFAIL vulnerability, expose both consumers and organizations to severe risks.

What strategies are there to find such issues, and how do we exploit them?

Description