tripdout

Also somewhat related:

(TP-Link Firmware Decryption C210 V2 cloud camera bootloaders) https://watchfulip.github.io/28-12-24/tp-link_c210_v2.html?u...

> The tool outputs the current date and time, so you can double-check that your code won't expire (at :00 seconds) before you get a chance to type it in

A lot of TOTP verifiers often check within ±1 time interval, so you can often just use the first code you see, no need e.g. to wait for it to roll over.

This works really well for 3-4 person group projects in school where a lot of thinking about the design, as well as how to navigate and use the existing codebase, is required.

For example, the Pintos [0] projects.

0: https://web.stanford.edu/class/cs140/projects/pintos/pintos_...

How does Intel SGX compare with e.g. ARM Trustzone? Seems like its similar in that information access is restricted from certain privilege levels?

Wikipedia says it's still on Xeons, so not sure what that says. But I agree with the rest of your point, it seems like an oversight to me.

The code embedded into the luminosity is sampled from a distribution resembling the noise already present in the video.

Plus, the code gives information about the frame it's embedded into, so you still have more work to do.

FWIW, it just had an XSS vulnerability fixed yesterday: https://github.com/9001/copyparty/security/advisories/GHSA-9...

The USB 3.0 spec does actually support A to A cables, but I'm not sure if any software makes use of it.

The post says it only applies to on-prem servers, not cloud ones like Microsoft 365.

Yeah, didn't know it would do that :(

Read the first paragraph and knew you were gonna talk about Nix.

Oh hey, really cool article. Do you know if I'm correct in my attempt at enabling EUD? Also I was unsure how you determined that it was disabled in the OnePlus 6? I thought only EL3 can read qfuses in general?

And you mean the apdp partition, right? That's a weird ELF file, contains almost nothing obvious (test key sig? DEBUG mention) and doesn't seem to be any executable code which I guess makes sense, but I wonder why they made it an ELF. Is there any info on interpreting these profiles?

So that profile gives you the unauthenticated ramdump as well? Seems to be a common theme with OnePlus, messing up security features.

Is there any information on those old debug protocols?

Well, no luck.

In the device tree I see (snippet):

  qcom,msm-eud@1628000 {
   compatible = "qcom,msm-eud";
   interrupt-names = "eud_irq";
   interrupts = <0x00 0xbd 0x04>;
   reg = <0x1628000 0x2000 0x162a000 0x1000 0x3e5018 0x04>;
   reg-names = "eud_base", "eud_mode_mgr2", "eud_tcsr_check_reg";
   qcom,secure-eud-en;
   qcom,eud-tcsr-check-enable;
   status = "ok";
  };

  qusb@162b000 {
   compatible = "qcom,qusb2phy-v2";
   reg = <0x162b000 0x400 0x1b40268 0x04 0x162f014 0x04 0x162a000 0x04>;
   reg-names = "qusb_phy_base", "efuse_addr", "refgen_north_bg_reg_addr", "eud_enable_reg";
   qcom,efuse-bit-pos = <0x19>;
   qcom,efuse-num-bits = <0x03>;

but `devmem 0x162A000 4 0x1` causes the system to lock up and I see the following in ramoops:

    [  433.720232] msm_watchdog f410000.qcom,wdt: Causing a QCOM Apps Watchdog bite!
    [  433.727381] msm_watchdog f410000.qcom,wdt: Wdog - STS: 0xb01a6, CTL: 0x3, BARK TIME: 0x57fdf, BITE TIME: 0x6ffd6

I'm not at all sure on the interpretation of this, but the reading at the efuse_addr (so I guess certain ones can be read from EL0?) is 0x0e000000 which has bits 25-27 set and QFPROM fuses seem to have a blown value of 1 according to Qualcomm docs, so it might be fused out?

But reading QFUSES specifically requires an EL3 loader "edl qfp qfp.bin -> To dump qfprom fuses (only on EL3 loaders)" and I don't believe most devices programmers (especially as relatively new as the OnePlus 6) run under that privilege level.

If it lets you. I think Bell modem+router+AP devices always broadcast a TV network with no way of disabling it whether you have TV service or not.

It will be really interesting to see what production devices this is enabled on - It mentions the OnePlus 6 at least which has it fused out but is still accessible.

Edit: How are they reading the eFuses on a production OnePlus 6? Do they have a Qualcomm-signed EL3 EDL loader?

It seems to exist as qcom,msm-eud in the device tree of a (unfortunately production) SM4350 device I have along with an eud_enable_reg. Time to recompile the kernel with `/dev/mem`.

Are there any terminal emulators that do server-side session management without needing Tmux?

The fact that you could buy a Pixel (or Nexus), real hardware sold to consumers as a phone, download AOSP (and proprietary blobs), and get a working build with all hardware supported with no additional work was super appreciated.

Cuttlefish, while it may be a more effective reference device, just doesn't accomplish the same thing because Pixels were used for more than just as a reference target (e.g. GrapheneOS).

Plus, there's just something cooler about running your own build of Android on real hardware v.s. a VM.

cs.android.com is a simpler alternative than downloading the whole 100+ Gb source.

On Android devices, without a serial console, this is often your best way to get logs for crashes happening before Android starts up enough to stream logs with logcat.

Sounds interesting, got a link?

How do ARM64 binaries like window managers, Firefox, etc run and with graphical acceleration on Android?

I guess as a start the chroot provides glibc and all the other libraries that run natively, but how does any of this interact with hardware?

17 out of 20. Was super easy until #10 and I had to stop and think more carefully (which was actually my first mistake), and then I got #14 and #15 wrong. The score was about what I expected, though - would've been surprised if it was <15 correct.

I wonder how much of this would come down to screen calibration / color accuracy? If everything's consistently off in 1 direction I guess not much, but I would imagine certain shades might appear effectively the same on some cheaper screens?

I don't think those would be likely to have Play Services, though.

From someone who knows nothing about this, they got some approval (presumably) to install some LoRa transmitter radios in the CN tower?

I think a lot of the work is in new device bringup, and given that they can start from official Pixel trees, it shouldn't be too much work to adapt them for whatever GrapheneOS-specific build processes they have, and then I'm assuming the rest of the GrapheneOS customizations are framework side which should be device agnostic. I guess they could have kernel changes for hardening, but not sure how easy or hard porting those would be - is the Pixel 9 series on a newer kernel version than say the Pixel 8?

The bot detection takes 5 whole seconds to solve on my phone, wow.

How successful can you consider the alternatives to be when using them means you can't (easily, potentially at all in the future with hardware backed attestation) use ChatGPT, banking apps, order McDonalds, etc.?

It's funny because this only works on a single device, the Android emulator, and not even first-party Nexus and Pixel devices without first downloading hundreds of megabytes of proprietary blobs.