ps5-uart

靠近 salina 的 24 针排针（EDM-010） emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. 在 emc 启动时拉低会导致 emc rom 进入 uart shell @ 460800 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3，当 emc 复位时变为低电平 9 0v？ 10 gnd 11 titania uart0 tx（efc 固件：460800，eap 固件：691200） 12 titania uart0 rx（efc 固件：460800，eap 固件：691200） 1...

fusee-gelee

fusee-gelee 这是针对 Nintendo Switch 的 Fusee Gelee 漏洞（CVE-2018-6242）的一种实现，基于 Kate Temkin / ReSwitched 在 2018 年 3 月披露的漏洞。 可在处于 USB 恢复模式（RCM）的 Tegra X1 设备上启动任意载荷（例如 hekate），完全绕过 Boot ROM 的签名验证。 背景 什么是 RCM？ RCM（恢复模式）是内置于 Tegra X1 Boot ROM 的基于 USB 的恢复协议。NVIDIA 设计它是为了将小程序（“applet”）加载到设备上进行诊断或修复——例如，当 Swit...

CVE-2024-56426

SM-G985F / Exynos9830 Bootrom 漏洞利用 !CAUTION 当前的密钥包和生成的文件具备熔断（fusing）能力。一旦设备被熔断， eFuse 更改将不可逆，并且设备必须继续使用与该熔断密钥匹配的引导镜像和密钥材料。 由于熔断行为，使用这些文件或流程的风险自负； 所有后果均由运行它们的用户承担。在运行任何熔断流程之前，请核实 eFuse 文件、私钥、 已签名的 FWBL1、LK / sboot.bin 镜像以及目标设备。 目录 仓库结构 环境要求 镜像准备 Payload 构建 已签名 SBoot 镜像生成 漏洞利用模式 Exynos 9830 引导链...

am335xbootrom

逆向工程 AM335x 引导 ROM 从我第一次拿到几块从垃圾堆里救出来的 Beaglebone Black 板子算起，大概已经过去十八个月了。不幸的是，这些板子无法立即正常工作。这是我第一次接触这类板子，或者说第一次接触任何单板计算机，所以我不确定问题是出在我自己的操作上，还是板子本身有问题（也许这正是它们当初被扔进垃圾堆的原因）。我花了相当长的时间和大量精力，才让这些板子真正开始启动，但我他妈的做到了。以下就是我在这个过程中学到的东西。 注意：如何使用 Ghidra XML 文件 我在这个仓库里包含了一些实用工具，以及一个从 Ghidra 导出的 xml...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-50719: Improper Access Control

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50720: Improper Verification of Cryptographic Signature

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

CVE-2026-50719

The Ingenic T41 , and likely the T32, T40, and A1 SoCs, are vulnerable in their boot ROMs due to an improper handling of the SPL header init table. The boot ROM parses and executes an attacker-controlled init table before performing secure boot state checks or signature verification. Because the ...

PT-2026-78354

Name of the Vulnerable Software and Affected Versions Ingenic T41 affected versions not specified Ingenic T32 affected versions not specified Ingenic T40 affected versions not specified Ingenic A1 affected versions not specified Description Boot ROMs in certain SoC System on Chip components parse...

CVE-2026-50719

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

EUVD-2026-28232

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

Microsoft Xbox One Hacked

It's an impressive feat, over a decade after the box was released: Since reset glitching wasn't possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pins the hacker targeted the momentary collapse of the CPU voltage rail. This was...

EUVD-2021-13172

Malware in sbrugna...

EUVD-2022-41261

Malicious code in bioql PyPI...

EUVD-2022-41265

Malicious code in bioql PyPI...

CVE-2022-38695

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

SUSE CVE-2021-26315

When the AMD Platform Security Processor PSP boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used...