ps5-uart

살리나 근처의 24핀 헤더 EDM-010 emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. emc 부팅 시 low로 당기면 emc rom이 460800 속도로 uart 셸에 진입함 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, emc 리셋 시 low로 떨어짐 9 0v? 10 gnd 11 titania uart0 tx efc fw: 460800, eap fw: 691200 12 titania uart0 rx efc fw: 460800, eap fw:...

fusee-gelee

fusee-gelee Nintendo Switch向けのFusee Geleeエクスプロイト（CVE-2018-6242）の実装です。2018年3月にKate Temkin / ReSwitchedによって公開された脆弱性に基づいています。 USBリカバリモード（RCM）にあるTegra X1デバイス上で任意のペイロード（例：hekate）を起動し、ブートROMの署名検証を完全にバイパスします。 背景 RCMとは？ RCM（リカバリモード）は、Tegra...

CVE-2024-56426

SM-G985F / Exynos9830 Bootrom 익스플로잇 !CAUTION 현재 키 번들 및 생성된 파일은 퓨징fusing이 가능합니다. 일단 디바이스가 퓨징되면 eFuse 변경은 되돌릴 수 없으며, 디바이스는 퓨징된 키와 일치하는 부트 이미지 및 키 자료를 계속 사용해야 합니다. 퓨징 동작으로 인해 이러한 파일이나 플로우를 사용하는 것은 사용자 자신의 책임입니다; 모든 결과에 대한 책임은 이를 실행하는 사용자에게 있습니다. 퓨징 플로우를 실행하기 전에 eFuse 파일, 개인 키, 서명된 FWBL1, LK /...

am335xbootrom

AM335x 부트 ROM 리버스 엔지니어링 이 보드들Beaglebone Black을 처음 손에 넣은 지 18개월쯤 된 것 같다. 쓰레기통에서 구해낸 보드였다. 불행히도 보드들은 처음부터 제대로 작동하지 않았다. 사실 이 보드를 다루는 것도, 아니면 어떤 싱글 보드 컴퓨터든 처음이라서, 문제가 내가 뭔가 잘못하고 있는 건지, 아니면 보드 자체에 문제가 있는 건지어쩌면 그것이 애초에 쓰레기통으로 향했던 이유일지도 확신할 수 없었다. 이 보드들이 실제로 부팅을 시작하게 만드는 데 꽤 오랜 시간과 많은 노력이 걸렸지만, 그래도 해냈다...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-50719

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

PT-2026-78354

Name of the Vulnerable Software and Affected Versions Ingenic T41 affected versions not specified Ingenic T32 affected versions not specified Ingenic T40 affected versions not specified Ingenic A1 affected versions not specified Description Boot ROMs in certain SoC System on Chip components parse...

EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50719: Improper Access Control

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50720: Improper Verification of Cryptographic Signature

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-50719

The Ingenic T41 , and likely the T32, T40, and A1 SoCs, are vulnerable in their boot ROMs due to an improper handling of the SPL header init table. The boot ROM parses and executes an attacker-controlled init table before performing secure boot state checks or signature verification. Because the ...

EUVD-2026-28232

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

Microsoft Xbox One Hacked

It's an impressive feat, over a decade after the box was released: Since reset glitching wasn't possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pins the hacker targeted the momentary collapse of the CPU voltage rail. This was...

EUVD-2021-13172

Malware in sbrugna...

EUVD-2022-41265

Malicious code in bioql PyPI...

EUVD-2022-41261

Malicious code in bioql PyPI...

CVE-2022-38695

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

SUSE CVE-2021-26315

When the AMD Platform Security Processor PSP boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used...