Skip to content

Instantly share code, notes, and snippets.

View marcan's full-sized avatar

Hector Martin marcan

View GitHub Profile
@marcan
marcan / apple-wifi-fw-manifest.txt
Created December 26, 2021 13:22
Firmware manifest for firmware extracted from macOS 12.0.1
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-m-2.3.txt SHA256 de541e00d270f9281aae26e69b725726377a0a723ae6a2ad6f5fd5695ecf2bd9
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-m-2.5.txt SHA256 3534748e3002b261d9a762e6193151d6d6a96afe3a15e828740af609b5be250e
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-u-4.1.txt SHA256 58b46c15ff838c090ad368f7efd8c05b9987f512bed1593eae691fa115fe3d30
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii-YSBC-u-4.3.txt SHA256 45f9bc9979e3a56161a536a0bd93794ab7c145aef979669703f6a82f913923ae
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.bin SHA256 da0c4591cbbd9a3c2b5b442eb8411d127a0f12272e334e30e57e9555ddd62606
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.clm_blob SHA256 a0c2064e73343e0ce163899fd830a93675882ed7b6aad1685dfd522fae47b33c
FILE brcm/brcmfmac4355c1-pcie.apple,hawaii.txcap_blob SHA256 017fafaf3d046aff93dda1108e3e5f15901e8d9175bf9e429827d4d45acffc3c
FILE brcm/brcmfmac4364b2-pcie.apple,ekans-HRPN-m-5.1.txt SHA256 5fcf696134db0a446e9226680f6134ba97179fbc8e1c4d5d8a2c19794815bc72
FILE b
commit 71f7c79c7af817477e553103c9eb03926e12ada4
Author: Hector Martin <marcan@marcan.st>
Date: Mon Dec 20 20:00:57 2021 +0900
brcmfmac: chip: Only disable D11 cores; handle an arbitrary number
At least on BCM4387, the D11 cores are held in reset on cold startup and
firmware expects to release reset itself. Just assert reset here and let
firmware deassert it. Premature deassertion causes weird
nondeterministic AXI errors on firmware startup.
commit e89c8eecc756600ec3dbf1fed73620592eae55af
Author: Hector Martin <marcan@marcan.st>
Date: Mon Dec 20 19:15:58 2021 +0900
brcmfmac: cfg80211: Pass PMK in binary
Apparently the hex passphrase mechanism does not work on newer firmware.
(Does this need a feature flag?)
Signed-off-by: Hector Martin <marcan@marcan.st>
#!/usr/bin/python3
# Solution to the challenge at https://gist.github.com/ehmo/7f515ac6461c1c4d3e5a74f12e6eb5ea
# Sample solution: https://twitter.com/marcan42/status/1428933147660492800
#
# Given an input base image, computes two derivative images that have different
# perceptual hashes, yet differ by only one pixel.
#
# Usage: hash_bisector.py <input.png> <output_a.png> <output_b.png>
#
# Licensed under the terms of the STRONGEST PUBLIC LICENSE, Draft 1:
import numpy, math
N = 32 # image size
M = 8 # number of DCT coefficients
def dcthash(data):
k = math.sqrt(2.0 / N)
dct_k = numpy.matrix([
[k * math.cos((math.pi / 2 / N) * y * (2 * x + 1)) for x in range(N)]
for y in range(M)
@marcan
marcan / turnitdown.py
Last active July 18, 2023 16:41
Add Spotify volume normalization to Google Cast devices
#!/usr/bin/python3
#
# turnitdown.py - normalize Spotify playback volume on Google Cast devices
#
# Dependencies: pychromecast, spotipy
#
# Usage: register a Spotify app and put the credentials in the
# SPOTIPY_CLIENT_ID and SPOTIPY_CLIENT_SECRET environment variables.
# Then just launch the script. It will autodetect all cast devices
# on the network.
@marcan
marcan / m1cat.c
Last active October 26, 2023 15:42
m1cat: a PoC for the M1RACLES covert channel vulnerability in the Apple M1
/*
* m1cat: a proof of concept for the M1RACLES vulnerability in the Apple M1.
*
* This program implements a covert channel that can be used to transmit data
* between two processes when run on the Apple Silicon "M1" CPUs.
*
* The channel is slightly lossy due to (presumably) the scheduler sometimes
* scheduling us on the wrong CPU cluster, so this PoC sends every byte twice
* together with some metadata/framing bits, which is usually good enough.
* A better approach would be to use proper FEC or something like that.
/*
* m1racle-poc: a basic proof of concept for the M1RACLES vulnerability in the Apple M1.
*
* This program allows you to read and write the state of the s3_5_c15_c10_1 CPU register.
*
* Please visit m1racles.com for more information.
*
* Licensed under the MIT license.
*/
From 82f995d4e164795c69a3c67be44eacfa8f5c3c14 Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Fri, 5 Feb 2021 05:34:10 +0900
Subject: [PATCH 00/18] Apple M1 SoC platform bring-up
To: Hector Martin <marcan@marcan.st>
To: soc@kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: Marc Zyngier <maz@kernel.org>
Cc: robh+dt@kernel.org
Cc: Arnd Bergmann <arnd@kernel.org>
#!/usr/bin/python
import sys
from construct import *
LoadCmdType = "LoadCmdType" / Enum(Int32ul,
UNIXTHREAD = 0x05,
SEGMENT_64 = 0x19,
UUID = 0x1b,
BUILD_VERSION = 0x32,
DYLD_CHAINED_FIXUPS = 0x80000034,