marcan

Starlet memory map

00000000-04000000: MEM1 area (2 mirrors, 0x2000000 each)
	0000000-1800000: MEM1 (0x1800000)
	1800000-2000000: unimplemented / bus noise / junk? (looks like uninitialized memory but unwritable)

04000000-08000000: unimplemented, read as zeroes

08000000-10000000: register/SRAM area (8 mirrors, 0x800000 each)
	000000-400000: registers (4 mirrors, 0x100000 each) CANONICAL ADDRESSES: 0x0d000000 and 0x0d800000

marcan

/*
	mini - a Free Software replacement for the Nintendo/BroadOn IOS.
	ghettohci - debug over FT232 over OHCI

Copyright (C) 2012	Hector Martin "marcan" <marcan@marcansoft.com>

# This code is licensed to you under the terms of the GNU GPL, version 2;
# see file COPYING or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
*/

marcan

import numpy, math

N = 32 # image size
M = 8 # number of DCT coefficients

def dcthash(data):
    k = math.sqrt(2.0 / N)
    dct_k = numpy.matrix([
        [k * math.cos((math.pi / 2 / N) * y * (2 * x + 1)) for x in range(N)]
        for y in range(M)

marcan

import hmac, hashlib

# Data from I²C trace at https://hackaday.io/project/19480-raspberry-pi-camera-v21-reversed/log/52547-i2c-logic-analyzer-trace
# Secret key from VideoCore blob

# serial[8], serial[7:4], serial[3:0]
serial = bytes.fromhex("EE8C196D8301230B59")

# rPi -> camera random number
numIn = bytes.fromhex("5805F3C898C3133154498E082F2E703516F2DBD1")

marcan

#!/usr/bin/python3
# Solution to the challenge at https://gist.github.com/ehmo/7f515ac6461c1c4d3e5a74f12e6eb5ea
# Sample solution: https://twitter.com/marcan42/status/1428933147660492800
#
# Given an input base image, computes two derivative images that have different
# perceptual hashes, yet differ by only one pixel.
#
# Usage: hash_bisector.py <input.png> <output_a.png> <output_b.png>
#
# Licensed under the terms of the STRONGEST PUBLIC LICENSE, Draft 1:

marcan

commit e89c8eecc756600ec3dbf1fed73620592eae55af
Author: Hector Martin <marcan@marcan.st>
Date:   Mon Dec 20 19:15:58 2021 +0900

    brcmfmac: cfg80211: Pass PMK in binary
    
    Apparently the hex passphrase mechanism does not work on newer firmware.
    (Does this need a feature flag?)
    
    Signed-off-by: Hector Martin <marcan@marcan.st>

marcan

commit 71f7c79c7af817477e553103c9eb03926e12ada4
Author: Hector Martin <marcan@marcan.st>
Date:   Mon Dec 20 20:00:57 2021 +0900

    brcmfmac: chip: Only disable D11 cores; handle an arbitrary number
    
    At least on BCM4387, the D11 cores are held in reset on cold startup and
    firmware expects to release reset itself. Just assert reset here and let
    firmware deassert it. Premature deassertion causes weird
    nondeterministic AXI errors on firmware startup.

marcan

FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-m-2.3.txt SHA256 de541e00d270f9281aae26e69b725726377a0a723ae6a2ad6f5fd5695ecf2bd9
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-m-2.5.txt SHA256 3534748e3002b261d9a762e6193151d6d6a96afe3a15e828740af609b5be250e
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-u-4.1.txt SHA256 58b46c15ff838c090ad368f7efd8c05b9987f512bed1593eae691fa115fe3d30
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-u-4.3.txt SHA256 45f9bc9979e3a56161a536a0bd93794ab7c145aef979669703f6a82f913923ae
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.bin SHA256 da0c4591cbbd9a3c2b5b442eb8411d127a0f12272e334e30e57e9555ddd62606
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.clm_blob SHA256 a0c2064e73343e0ce163899fd830a93675882ed7b6aad1685dfd522fae47b33c
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.txcap_blob SHA256 017fafaf3d046aff93dda1108e3e5f15901e8d9175bf9e429827d4d45acffc3c
FILE brcm/brcmfmac4364b2-pcie.apple,ekans-HRPN-m-5.1.txt SHA256 5fcf696134db0a446e9226680f6134ba97179fbc8e1c4d5d8a2c19794815bc72
FILE b

marcan

#!/bin/sh
# Brainfuck interpreter implemented in pure POSIX sh builtins only (except I/O)
# Tested in bash and busybox ash (getchar uses a bash-specific read)

# === I/O ===
getchar() {
    # bashism
    IFS= read -rN 1 a
    if [ -z "$a" ]; then
        echo $th

marcan

#!/usr/bin/env python3
import os, tempfile, shutil, subprocess, ctypes

class BaseAsmFunc(object):
    def __init__(self, sfunc):
        self.source = sfunc.__doc__
        self._tmp = tempfile.mkdtemp() + os.sep
        self.compile(self.source)

    def compile(self, source):