ps5-uart

サリナ近くの24ピンヘッダー EDM-010 root@kitploit: emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. emc起動時にlowにするとemc romが460800でuartシェルに入る 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, emcがリセットされるとlowになる 9 0v? 10 gnd 11 titania uart0 tx efc fw: 460800, eap fw: 691200 12 titania uart0 rx efc fw: 460800, eap...

fusee-gelee

fusee-gelee An implementation of the Fusee Gelee exploit CVE-2018-6242 for the Nintendo Switch, based on the vulnerability disclosed by Kate Temkin / ReSwitched in March 2018. Launches an arbitrary payload e.g. hekate on a Tegra X1 device in USB Recovery Mode RCM, bypassing the boot ROM's signatu...

CVE-2024-56426

SM-G985F / Exynos9830 Bootrom 漏洞利用 !CAUTION 当前的密钥包和生成的文件具备熔断（fusing）能力。一旦设备被熔断， eFuse 更改将不可逆，并且设备必须继续使用与该熔断密钥匹配的引导镜像和密钥材料。 由于熔断行为，使用这些文件或流程的风险自负； 所有后果均由运行它们的用户承担。在运行任何熔断流程之前，请核实 eFuse 文件、私钥、 已签名的 FWBL1、LK / sboot.bin 镜像以及目标设备。 目录 仓库结构 环境要求 镜像准备 Payload 构建 已签名 SBoot 镜像生成 漏洞利用模式 Exynos 9830 引导链...

am335xbootrom

AM335x ブートROMのリバースエンジニアリング 私が初めて何枚かのBeaglebone...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50719

The Ingenic T41 SoC boot ROM (and likely T32, T40, and A1 ) parses and executes an attacker-controlled init table from the SPL header before performing any secure boot state check or signature verification. Because the init table parser supports full-address 32-bit write operations , an attacker ...

EUVD-2026-28232

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

Microsoft Xbox One Hacked

It's an impressive feat, over a decade after the box was released: Since reset glitching wasn't possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pins the hacker targeted the momentary collapse of the CPU voltage rail. This was...

EUVD-2021-13172

Malware in sbrugna...

EUVD-2022-41261

Malicious code in bioql PyPI...

EUVD-2022-41265

Malicious code in bioql PyPI...

CVE-2022-38695

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

SUSE CVE-2021-26315

When the AMD Platform Security Processor PSP boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

Security feature bypass

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

CVE-2022-23005 Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

CVE-2022-23005 Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...