{"entry_id": "7d788ec4-cf5c-429c-9d83-880a683e5c5d", "infos": [{"txt": "Being Overlord on the Steam Deck with 1 Byte", "language": "english", "position": {"atoms": [{"position_id": 0, "txt": "Being Overlord on the Steam Deck with 1 Byte", "x": "//title"}]}, "tags": [], "label": "O", "web_segment_id": 0, "global_sentence_id": 0, "edu_l1_label": "EDU_O"}, {"txt": "                        Being Overlord on the Steam Deck with 1 Byte                    ", "language": "english", "position": {"atoms": [{"position_id": 1803, "txt": "\n                        Being Overlord on the Steam Deck with 1 Byte\n                    ", "x": "/html/body/div[2]/div/div[1]/section/article/header/h1/a"}]}, "tags": ["h1"], "label": "article_title", "web_segment_id": 2, "global_sentence_id": 1, "edu_l1_label": "BOT"}, {"txt": "In this blog post we explain the consequences of asking our R&D boss for a Steam Deck as a Christmas gift.", "language": "english", "position": {"atoms": [{"position_id": 1805, "txt": "In this blog post we explain the consequences of asking our R&D boss for a Steam Deck as a Christmas gift.", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[2]/p"}]}, "tags": [], "label": "content", "web_segment_id": 7, "global_sentence_id": 2, "edu_l1_label": "BOS"}, {"txt": " It involves a couple of vulnerabilities, limited primitives, challenging exploitation and a long disclosure process.", "language": "english", "position": {"atoms": [{"position_id": 1806, "txt": " It involves a couple of vulnerabilities, limited primitives, challenging exploitation and a long disclosure process.", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[2]/p"}]}, "tags": [], "label": "content", "web_segment_id": 7, "global_sentence_id": 3, "edu_l1_label": "IOS"}, {"txt": "Introduction", "language": "english", "position": {"atoms": [{"position_id": 1808, "txt": "Introduction", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[1]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 8, "global_sentence_id": 4, "edu_l1_label": "BOS"}, {"txt": "Serious Story", "language": "english", "position": {"atoms": [{"position_id": 1810, "txt": "Serious Story", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[1]"}]}, "tags": ["h3"], "label": "content", "web_segment_id": 9, "global_sentence_id": 5, "edu_l1_label": "IOS"}, {"txt": "This blog post aims to showcase a couple of bugs affecting Valve's Steam Deck and generally various devices running on AMD.", "language": "english", "position": {"atoms": [{"position_id": 1812, "txt": "This blog post aims to showcase a couple of bugs affecting Valve's Steam Deck and generally various devices running on AMD.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[1]"}]}, "tags": [], "label": "content", "web_segment_id": 10, "global_sentence_id": 6, "edu_l1_label": "IOS"}, {"txt": " Some of the primitives induced by these bugs are very limited and offer a good playground to work on exploitation techniques.", "language": "english", "position": {"atoms": [{"position_id": 1813, "txt": " Some of the primitives induced by these bugs are very limited and offer a good playground to work on exploitation techniques.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[1]"}]}, "tags": [], "label": "content", "web_segment_id": 10, "global_sentence_id": 7, "edu_l1_label": "IOS"}, {"txt": "Context", "language": "english", "position": {"atoms": [{"position_id": 1815, "txt": "Context", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[2]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 11, "global_sentence_id": 8, "edu_l1_label": "IOS"}, {"txt": "Go directly to the technical details if you want to skip useless rambling.", "language": "english", "position": {"atoms": [{"position_id": 1817, "txt": "Go directly to the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[2]/em"}, {"position_id": 1819, "txt": "technical details", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[2]/em/a"}, {"position_id": 1821, "txt": " if you want to skip useless rambling.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[2]/em/a"}]}, "tags": ["em"], "label": "content", "web_segment_id": 12, "global_sentence_id": 9, "edu_l1_label": "IOS"}, {"txt": "The idea of this research started around December 2023, right in the timeframe when you need to rush and buy gifts because you're too lazy to hunt for them in advance.", "language": "english", "position": {"atoms": [{"position_id": 1823, "txt": "The idea of this research started around December 2023, right in the timeframe when you need to rush and buy gifts because you're too lazy to hunt for them in advance.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[3]"}]}, "tags": [], "label": "content", "web_segment_id": 13, "global_sentence_id": 10, "edu_l1_label": "IOS"}, {"txt": " As a pure matter of coincidence, this timeframe matched the release of the new OLED version of the Steam Deck.", "language": "english", "position": {"atoms": [{"position_id": 1824, "txt": " As a pure matter of coincidence, this timeframe matched the release of the new OLED version of the Steam Deck.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[3]"}]}, "tags": [], "label": "content", "web_segment_id": 13, "global_sentence_id": 11, "edu_l1_label": "IOS"}, {"txt": "For non-gamer readers, Valve's Steam Deck is a small handheld PC specifically designed to let people play wherever they want.", "language": "english", "position": {"atoms": [{"position_id": 1826, "txt": "For non-gamer readers, Valve's Steam Deck is a small handheld PC specifically designed to let people play wherever they want.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[4]"}]}, "tags": [], "label": "content", "web_segment_id": 14, "global_sentence_id": 12, "edu_l1_label": "IOS"}, {"txt": " It embarks a custom AMD APU, dubbed Van Gogh, based on the Zen 2 microarchitecture.", "language": "english", "position": {"atoms": [{"position_id": 1827, "txt": " It embarks a custom AMD APU, dubbed Van Gogh, based on the Zen 2 microarchitecture.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[4]"}]}, "tags": [], "label": "content", "web_segment_id": 14, "global_sentence_id": 13, "edu_l1_label": "IOS"}, {"txt": " Its operating system, SteamOS 3.0, is a modified version of Archlinux that runs on a read-only file system (except for a few writable directories).", "language": "english", "position": {"atoms": [{"position_id": 1828, "txt": " Its operating system, SteamOS 3.0, is a modified version of Archlinux that runs on a read-only file system (except for a few writable directories).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[4]"}]}, "tags": [], "label": "content", "web_segment_id": 14, "global_sentence_id": 14, "edu_l1_label": "IOS"}, {"txt": " On top of that lies Proton, a piece of software that provides the compatibility layer needed for games developed for Windows to run on the device.", "language": "english", "position": {"atoms": [{"position_id": 1829, "txt": " On top of that lies Proton, a piece of software that provides the compatibility layer needed for games developed for Windows to run on the device.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[4]"}]}, "tags": [], "label": "content", "web_segment_id": 14, "global_sentence_id": 15, "edu_l1_label": "IOS"}, {"txt": " Basically, that's just a cool tiny gamer PC shaped as a portable console.", "language": "english", "position": {"atoms": [{"position_id": 1830, "txt": " Basically, that's just a cool tiny gamer PC shaped as a portable console.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[4]"}]}, "tags": [], "label": "content", "web_segment_id": 14, "global_sentence_id": 16, "edu_l1_label": "IOS"}, {"txt": "As a couch potato princess with a substantial Steam library (and no clue about what to offer to friends and family), it was not that long before the dilemma arose between either disappearing with a new shiny toy for a month or behaving as a socially adapted person and enduring this dreadful period.", "language": "english", "position": {"atoms": [{"position_id": 1832, "txt": "As a couch potato princess with a substantial Steam library (and no clue about what to offer to friends and family), it was not that long before the dilemma arose between either disappearing with a new shiny toy for a month or behaving as a socially adapted person and enduring this dreadful period.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[5]"}]}, "tags": [], "label": "content", "web_segment_id": 15, "global_sentence_id": 17, "edu_l1_label": "IOS"}, {"txt": "While both possibilities could appear tempting, a third one was eventually devised after a lot of pondering:", "language": "english", "position": {"atoms": [{"position_id": 1834, "txt": "While both possibilities could appear tempting, a third one was eventually devised after a lot of pondering:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[6]"}]}, "tags": [], "label": "content", "web_segment_id": 16, "global_sentence_id": 18, "edu_l1_label": "IOS"}, {"txt": " try to push someone to buy the device and test it after Christmas (and also find proper gifts too).", "language": "english", "position": {"atoms": [{"position_id": 1835, "txt": " try to push someone to buy the device and test it after Christmas (and also find proper gifts too).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[6]"}]}, "tags": [], "label": "content", "web_segment_id": 16, "global_sentence_id": 19, "edu_l1_label": "IOS"}, {"txt": "And since \"mastermind\" is definitely not a skill in the regular gears of a couch potato, the most straightforward way is to bluntly ask the company to acquire it.", "language": "english", "position": {"atoms": [{"position_id": 1837, "txt": "And since \"mastermind\" is definitely not a skill in the regular gears of a couch potato, the most straightforward way is to bluntly ask the company to acquire it.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[7]"}]}, "tags": [], "label": "content", "web_segment_id": 17, "global_sentence_id": 20, "edu_l1_label": "IOS"}, {"txt": "Long story short, the response was: \"", "language": "english", "position": {"atoms": [{"position_id": 1839, "txt": "Long story short, the response was: \"", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[8]"}]}, "tags": [], "label": "content", "web_segment_id": 18, "global_sentence_id": 21, "edu_l1_label": "IOS"}, {"txt": "Okay, finish your current mission, pwn it and bring us some cool R&D\".", "language": "english", "position": {"atoms": [{"position_id": 1840, "txt": "Okay, finish your current mission, pwn it and bring us some cool R&D\".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[8]"}]}, "tags": [], "label": "content", "web_segment_id": 18, "global_sentence_id": 22, "edu_l1_label": "IOS"}, {"txt": "Setup", "language": "english", "position": {"atoms": [{"position_id": 1842, "txt": "Setup", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[2]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 19, "global_sentence_id": 23, "edu_l1_label": "BOS"}, {"txt": "As our main topic of interest at the moment is UEFI, we exclusively focused on the Steam Deck bios for this research.", "language": "english", "position": {"atoms": [{"position_id": 1844, "txt": "As our main topic of interest at the moment is UEFI, we exclusively focused on the Steam Deck bios for this research.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[9]"}]}, "tags": [], "label": "content", "web_segment_id": 20, "global_sentence_id": 24, "edu_l1_label": "IOS"}, {"txt": "Retrieving the firmware is very easy and can be done in various ways. ", "language": "english", "position": {"atoms": [{"position_id": 1846, "txt": "Retrieving the firmware is very easy and can be done in various ways. ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[10]"}]}, "tags": [], "label": "content", "web_segment_id": 21, "global_sentence_id": 25, "edu_l1_label": "IOS"}, {"txt": "Since it is built from Insyde's code base, the most straightforward method is to simply dump the SPI flash with the vendor's flashing utility:", "language": "english", "position": {"atoms": [{"position_id": 1848, "txt": "Since it is built from ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[11]"}, {"position_id": 1850, "txt": "Insyde", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[11]/a"}, {"position_id": 1852, "txt": "'s code base, the most straightforward method is to simply dump the SPI flash with the vendor's flashing utility:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[11]/a"}]}, "tags": [], "label": "content", "web_segment_id": 22, "global_sentence_id": 26, "edu_l1_label": "IOS"}, {"txt": "sudo /usr/share/jupiter_bios_updater/h2offt /home/deck/biosbkp.fd -O", "language": "english", "position": {"atoms": [{"position_id": 1854, "txt": "sudo /usr/share/jupiter_bios_updater/h2offt /home/deck/biosbkp.fd -O\n", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[3]/pre/code"}]}, "tags": [], "label": "code", "web_segment_id": 23, "global_sentence_id": 27, "edu_l1_label": "IOS"}, {"txt": "Alternatively, another good solution is to download the last version from the unofficial public repository on gitlab.", "language": "english", "position": {"atoms": [{"position_id": 1856, "txt": "Alternatively, another good solution is to download the last version from the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]"}, {"position_id": 1858, "txt": "unofficial public repository", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/a"}, {"position_id": 1860, "txt": " on gitlab.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/a"}]}, "tags": [], "label": "content", "web_segment_id": 24, "global_sentence_id": 28, "edu_l1_label": "IOS"}, {"txt": "The images labeled as F7A0* are for the LCD model, while the F7G0* ones are related to the OLED version.", "language": "english", "position": {"atoms": [{"position_id": 1861, "txt": "\nThe images labeled as ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/a"}, {"position_id": 1863, "txt": "F7A0*", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/code[1]"}, {"position_id": 1865, "txt": " are for the LCD model, while the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/code[1]"}, {"position_id": 1867, "txt": "F7G0*", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/code[2]"}, {"position_id": 1869, "txt": " ones are related to the OLED version.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[12]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 24, "global_sentence_id": 29, "edu_l1_label": "IOS"}, {"txt": "Finally, if for some reason both previous ways didn't work out, the SPI chip (Winbond W25Q128JW) is accessible in the back of the Steam Deck and can be read with a chip programmer.", "language": "english", "position": {"atoms": [{"position_id": 1871, "txt": "Finally, if for some reason both previous ways didn't work out, the SPI chip (Winbond W25Q128JW) is accessible in the back of the Steam Deck and can be read with a chip programmer.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[13]"}]}, "tags": [], "label": "content", "web_segment_id": 25, "global_sentence_id": 30, "edu_l1_label": "IOS"}, {"txt": " For the record, iFixit teams published a detailed teardown that can be a great source of information for people wanting to poke the hardware.", "language": "english", "position": {"atoms": [{"position_id": 1872, "txt": " For the record, iFixit teams published a ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[13]"}, {"position_id": 1874, "txt": "detailed teardown", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[13]/a"}, {"position_id": 1876, "txt": " that can be a great source of information for people wanting to poke the hardware.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[13]/a"}]}, "tags": [], "label": "content", "web_segment_id": 25, "global_sentence_id": 31, "edu_l1_label": "IOS"}, {"txt": "With the firmware at hand, extracting and analyzing the modules is a child play with UEFITool and EfiXplorer.", "language": "english", "position": {"atoms": [{"position_id": 1878, "txt": "With the firmware at hand, extracting and analyzing the modules is a child play with ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[14]"}, {"position_id": 1880, "txt": "UEFITool", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[14]/a[1]"}, {"position_id": 1882, "txt": " and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[14]/a[1]"}, {"position_id": 1884, "txt": "EfiXplorer", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[14]/a[2]"}, {"position_id": 1886, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[14]/a[2]"}]}, "tags": [], "label": "content", "web_segment_id": 26, "global_sentence_id": 32, "edu_l1_label": "IOS"}, {"txt": "Another great tool to have is EfiPy.", "language": "english", "position": {"atoms": [{"position_id": 1888, "txt": "Another great tool to have is ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]"}, {"position_id": 1890, "txt": "EfiPy", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[1]"}, {"position_id": 1892, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[1]"}]}, "tags": [], "label": "content", "web_segment_id": 27, "global_sentence_id": 33, "edu_l1_label": "IOS"}, {"txt": " This small library can be compiled, alongside chipsec, with Python368.efi and greatly helps prototyping PoC from the UEFI Shell.", "language": "english", "position": {"atoms": [{"position_id": 1893, "txt": " This small library can be compiled, alongside ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[1]"}, {"position_id": 1895, "txt": "chipsec", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[2]"}, {"position_id": 1897, "txt": ", with ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[2]"}, {"position_id": 1899, "txt": "Python368.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[3]"}, {"position_id": 1901, "txt": " and greatly helps prototyping PoC from the UEFI Shell.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[15]/a[3]"}]}, "tags": [], "label": "content", "web_segment_id": 27, "global_sentence_id": 34, "edu_l1_label": "IOS"}, {"txt": "With this, we're ready to start playing around with our target.", "language": "english", "position": {"atoms": [{"position_id": 1903, "txt": "With this, we're ready to start playing around with our target.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[16]"}]}, "tags": [], "label": "content", "web_segment_id": 28, "global_sentence_id": 35, "edu_l1_label": "IOS"}, {"txt": "Technical details", "language": "english", "position": {"atoms": [{"position_id": 1905, "txt": "Technical details", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[3]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 29, "global_sentence_id": 36, "edu_l1_label": "BOS"}, {"txt": "If you're not familiar with the UEFI ecosystem, we recommend to start with the first part of this blog post about a tiny bug in EDK2 implementation, or even better dig into Tianocore's white papers.", "language": "english", "position": {"atoms": [{"position_id": 1907, "txt": "If you're not familiar with the UEFI ecosystem, we recommend to start with the first part of ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[17]"}, {"position_id": 1909, "txt": "this blog post about a tiny bug in EDK2 implementation", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[17]/a[1]"}, {"position_id": 1911, "txt": ", or even better dig into Tianocore's ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[17]/a[1]"}, {"position_id": 1913, "txt": "white papers", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[17]/a[2]"}, {"position_id": 1915, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[17]/a[2]"}]}, "tags": [], "label": "content", "web_segment_id": 30, "global_sentence_id": 37, "edu_l1_label": "IOS"}, {"txt": "That said, two vulnerabilities[*] were identified in the UEFI firmware running on the Steam Deck.", "language": "english", "position": {"atoms": [{"position_id": 1917, "txt": "That said, two vulnerabilities[*] were identified in the UEFI firmware running on the Steam Deck.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[18]"}]}, "tags": [], "label": "content", "web_segment_id": 31, "global_sentence_id": 38, "edu_l1_label": "IOS"}, {"txt": " Both of them are the consequence of improper data validation issues.", "language": "english", "position": {"atoms": [{"position_id": 1918, "txt": " Both of them are the consequence of improper data validation issues.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[18]"}]}, "tags": [], "label": "content", "web_segment_id": 31, "global_sentence_id": 39, "edu_l1_label": "IOS"}, {"txt": " For this blog post, we will mainly focus on only one of them as it is the most interesting to explain and exploit.", "language": "english", "position": {"atoms": [{"position_id": 1919, "txt": " For this blog post, we will mainly focus on only one of them as it is the most interesting to explain and exploit.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[18]"}]}, "tags": [], "label": "content", "web_segment_id": 31, "global_sentence_id": 40, "edu_l1_label": "IOS"}, {"txt": "While impacting multiple families of devices, we will solely focus on the Steam Deck here.", "language": "english", "position": {"atoms": [{"position_id": 1921, "txt": "While impacting multiple families of devices, we will solely focus on the Steam Deck here.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[19]"}]}, "tags": [], "label": "content", "web_segment_id": 32, "global_sentence_id": 41, "edu_l1_label": "IOS"}, {"txt": " The provided offsets match the binaries in the bios version F7A0120.", "language": "english", "position": {"atoms": [{"position_id": 1922, "txt": " The provided offsets match the binaries in the bios version ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[19]"}, {"position_id": 1924, "txt": "F7A0120", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[19]/code"}, {"position_id": 1926, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[19]/code"}]}, "tags": [], "label": "content", "web_segment_id": 32, "global_sentence_id": 42, "edu_l1_label": "IOS"}, {"txt": "[*] Actually there is a third one that was not patched in Valve's build, but since it is already known (CVE-2022-35894, CVE-2022-35895, CVE-2021-33627), we won't speak about it in this blog post.", "language": "english", "position": {"atoms": [{"position_id": 1928, "txt": "[*] Actually there is a third one that was not patched in Valve's build, but since it is already known (CVE-2022-35894, CVE-2022-35895, CVE-2021-33627), we won't speak about it in this blog post.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[20]"}]}, "tags": [], "label": "content", "web_segment_id": 33, "global_sentence_id": 43, "edu_l1_label": "IOS"}, {"txt": "The Vulnerabilities", "language": "english", "position": {"atoms": [{"position_id": 1930, "txt": "The Vulnerabilities", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[3]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 34, "global_sentence_id": 44, "edu_l1_label": "IOS"}, {"txt": "Bug #1 - AmdPspP2CmboxV2.efi (CVE-2024-21925)", "language": "english", "position": {"atoms": [{"position_id": 1932, "txt": "Bug #1 - AmdPspP2CmboxV2.efi (CVE-2024-21925)", "x": "/html/body/div[2]/div/div[1]/section/article/div/h4[1]"}]}, "tags": ["h4"], "label": "content", "web_segment_id": 35, "global_sentence_id": 45, "edu_l1_label": "IOS"}, {"txt": "The first bug, located in AmdPspP2CmboxV2.efi (4759E93E-8F44-448F-88A1-BD97FC47BEA5), is very straightforward and can be summarized as a lack of validation in the parameters sent to the SMM communication handler.", "language": "english", "position": {"atoms": [{"position_id": 1934, "txt": "The first bug, located in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[21]"}, {"position_id": 1936, "txt": "AmdPspP2CmboxV2.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[21]/code[1]"}, {"position_id": 1938, "txt": " (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[21]/code[1]"}, {"position_id": 1940, "txt": "4759E93E-8F44-448F-88A1-BD97FC47BEA5", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[21]/code[2]"}, {"position_id": 1942, "txt": "), is very straightforward and can be summarized as a lack of validation in the parameters sent to the SMM communication handler.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[21]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 36, "global_sentence_id": 46, "edu_l1_label": "IOS"}, {"txt": "This handler (offset 0x26D0) expects the following structure as buffer input:", "language": "english", "position": {"atoms": [{"position_id": 1944, "txt": "This handler (offset 0x26D0) expects the following structure as buffer input:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[22]"}]}, "tags": [], "label": "content", "web_segment_id": 37, "global_sentence_id": 47, "edu_l1_label": "IOS"}, {"txt": "// Handler GUID:", "language": "english", "position": {"atoms": [{"position_id": 1946, "txt": "// Handler GUID:", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[1]"}]}, "tags": [], "label": "code", "web_segment_id": 38, "global_sentence_id": 48, "edu_l1_label": "EDU_O"}, {"txt": " B2ABCCBF-02E1-436F-98B020599C49E2A1structComm_Buffer{/*000*/UINT32cmd_id;/*004*/UINT8psp_cmd;/*008*/UINT64arg0;/*010*/UINT64arg1;/*018*/UINT64arg2;/*020*/UINT64arg3;}", "language": "english", "position": {"atoms": [{"position_id": 1947, "txt": " B2ABCCBF-02E1-436F-98B020599C49E2A1", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[1]"}, {"position_id": 1949, "txt": "struct", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[2]"}, {"position_id": 1951, "txt": "Comm_Buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[4]"}, {"position_id": 1953, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[6]"}, {"position_id": 1955, "txt": "/*000*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[8]"}, {"position_id": 1957, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[10]"}, {"position_id": 1959, "txt": "cmd_id", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[12]"}, {"position_id": 1961, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[13]"}, {"position_id": 1963, "txt": "/*004*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[15]"}, {"position_id": 1965, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[17]"}, {"position_id": 1967, "txt": "psp_cmd", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[19]"}, {"position_id": 1969, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[20]"}, {"position_id": 1971, "txt": "/*008*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[22]"}, {"position_id": 1973, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[24]"}, {"position_id": 1975, "txt": "arg0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[26]"}, {"position_id": 1977, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[27]"}, {"position_id": 1979, "txt": "/*010*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[29]"}, {"position_id": 1981, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[31]"}, {"position_id": 1983, "txt": "arg1", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[33]"}, {"position_id": 1985, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[34]"}, {"position_id": 1987, "txt": "/*018*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[36]"}, {"position_id": 1989, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[38]"}, {"position_id": 1991, "txt": "arg2", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[40]"}, {"position_id": 1993, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[41]"}, {"position_id": 1995, "txt": "/*020*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[43]"}, {"position_id": 1997, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[45]"}, {"position_id": 1999, "txt": "arg3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[47]"}, {"position_id": 2001, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[48]"}, {"position_id": 2003, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[4]/pre/code/span[49]"}]}, "tags": [], "label": "code", "web_segment_id": 38, "global_sentence_id": 49, "edu_l1_label": "EDU_O"}, {"txt": "The cmd_id field determines the action the module should perform:", "language": "english", "position": {"atoms": [{"position_id": 2005, "txt": "The ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[23]"}, {"position_id": 2007, "txt": "cmd_id", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[23]/code"}, {"position_id": 2009, "txt": " field determines the action the module should perform:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[23]/code"}]}, "tags": [], "label": "content", "web_segment_id": 39, "global_sentence_id": 50, "edu_l1_label": "IOS"}, {"txt": "1:", "language": "english", "position": {"atoms": [{"position_id": 2011, "txt": "1:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 40, "global_sentence_id": 51, "edu_l1_label": "IOS"}, {"txt": " Get information related to the flash regions.", "language": "english", "position": {"atoms": [{"position_id": 2012, "txt": " Get information related to the flash regions.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 40, "global_sentence_id": 52, "edu_l1_label": "IOS"}, {"txt": "2:", "language": "english", "position": {"atoms": [{"position_id": 2014, "txt": "2:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 41, "global_sentence_id": 53, "edu_l1_label": "IOS"}, {"txt": " Read flash region;", "language": "english", "position": {"atoms": [{"position_id": 2015, "txt": " Read flash region;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 41, "global_sentence_id": 54, "edu_l1_label": "IOS"}, {"txt": "3:", "language": "english", "position": {"atoms": [{"position_id": 2017, "txt": "3:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 42, "global_sentence_id": 55, "edu_l1_label": "IOS"}, {"txt": " Write flash region;", "language": "english", "position": {"atoms": [{"position_id": 2018, "txt": " Write flash region;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 42, "global_sentence_id": 56, "edu_l1_label": "IOS"}, {"txt": "4:", "language": "english", "position": {"atoms": [{"position_id": 2020, "txt": "4:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[4]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 43, "global_sentence_id": 57, "edu_l1_label": "IOS"}, {"txt": " Erase flash region;", "language": "english", "position": {"atoms": [{"position_id": 2021, "txt": " Erase flash region;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[4]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 43, "global_sentence_id": 58, "edu_l1_label": "IOS"}, {"txt": "5:", "language": "english", "position": {"atoms": [{"position_id": 2023, "txt": "5:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[5]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 44, "global_sentence_id": 59, "edu_l1_label": "IOS"}, {"txt": " Unregister handler;", "language": "english", "position": {"atoms": [{"position_id": 2024, "txt": " Unregister handler;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[5]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 44, "global_sentence_id": 60, "edu_l1_label": "IOS"}, {"txt": "6:", "language": "english", "position": {"atoms": [{"position_id": 2026, "txt": "6:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[6]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 45, "global_sentence_id": 61, "edu_l1_label": "IOS"}, {"txt": " Send data to the PSP;", "language": "english", "position": {"atoms": [{"position_id": 2027, "txt": " Send data to the PSP;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[6]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 45, "global_sentence_id": 62, "edu_l1_label": "IOS"}, {"txt": "7:", "language": "english", "position": {"atoms": [{"position_id": 2029, "txt": "7:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[7]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 46, "global_sentence_id": 63, "edu_l1_label": "IOS"}, {"txt": " Retrieve data from the PSP;", "language": "english", "position": {"atoms": [{"position_id": 2030, "txt": " Retrieve data from the PSP;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[1]/li[7]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 46, "global_sentence_id": 64, "edu_l1_label": "IOS"}, {"txt": "While the communication buffer is verified, the parameters inside the structure are, in some cases, not.", "language": "english", "position": {"atoms": [{"position_id": 2032, "txt": "While the communication buffer is verified, the parameters inside the structure are, in some cases, not.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[24]"}]}, "tags": [], "label": "content", "web_segment_id": 47, "global_sentence_id": 65, "edu_l1_label": "IOS"}, {"txt": " Therefore, several commands can be used to leak or tamper with the SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 2033, "txt": " Therefore, several commands can be used to leak or tamper with the SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[24]"}]}, "tags": [], "label": "content", "web_segment_id": 47, "global_sentence_id": 66, "edu_l1_label": "IOS"}, {"txt": "As an example, the id 2, responsible for reading and returning flash regions ensures that the destination (represented with arg0 as its address and arg1 as its size) is valid but does not enforce such check on the source address (arg2), leading to data leak from SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 2035, "txt": "As an example, the id 2, responsible for reading and returning flash regions ensures that the destination (represented with ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]"}, {"position_id": 2037, "txt": "arg0", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[1]"}, {"position_id": 2039, "txt": " as its address and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[1]"}, {"position_id": 2041, "txt": "arg1", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[2]"}, {"position_id": 2043, "txt": " as its size) is valid but does not enforce such check on the source address (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[2]"}, {"position_id": 2045, "txt": "arg2", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[3]"}, {"position_id": 2047, "txt": "), leading to data leak from SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[25]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 48, "global_sentence_id": 67, "edu_l1_label": "IOS"}, {"txt": "The commands 3 and 4, used to write and erase a flash region, are prone to the same issue.", "language": "english", "position": {"atoms": [{"position_id": 2049, "txt": "The commands 3 and 4, used to write and erase a flash region, are prone to the same issue.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[26]"}]}, "tags": [], "label": "content", "web_segment_id": 49, "global_sentence_id": 68, "edu_l1_label": "IOS"}, {"txt": " However, due to some restrictions in the underlying module,FwBlockServiceSmm.efi, in charge of updating the firmware, it is not possible to easily overwrite the SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 2050, "txt": " However, due to some restrictions in the underlying module,", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[26]"}, {"position_id": 2052, "txt": "FwBlockServiceSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[26]/code"}, {"position_id": 2054, "txt": ", in charge of updating the firmware, it is not possible to easily overwrite the SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[26]/code"}]}, "tags": [], "label": "content", "web_segment_id": 49, "global_sentence_id": 69, "edu_l1_label": "IOS"}, {"txt": "The commands 6 and 7 are used to communicate with the Platform Security Processor through a mechanism of mailboxes.", "language": "english", "position": {"atoms": [{"position_id": 2056, "txt": "The commands 6 and 7 are used to communicate with the Platform Security Processor through a mechanism of mailboxes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[27]"}]}, "tags": [], "label": "content", "web_segment_id": 50, "global_sentence_id": 70, "edu_l1_label": "IOS"}, {"txt": " Here again, the parameters are not sanitized enough:", "language": "english", "position": {"atoms": [{"position_id": 2057, "txt": " Here again, the parameters are not sanitized enough:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[27]"}]}, "tags": [], "label": "content", "web_segment_id": 50, "global_sentence_id": 71, "edu_l1_label": "IOS"}, {"txt": " by providing an address in SMRAM as a response buffer (arg2), an attacker can overwrite data in SMM with PSP answers.", "language": "english", "position": {"atoms": [{"position_id": 2058, "txt": " by providing an address in SMRAM as a response buffer (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[27]"}, {"position_id": 2060, "txt": "arg2", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[27]/code"}, {"position_id": 2062, "txt": "), an attacker can overwrite data in SMM with PSP answers.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[27]/code"}]}, "tags": [], "label": "content", "web_segment_id": 50, "global_sentence_id": 72, "edu_l1_label": "IOS"}, {"txt": "It should be noted that, this handler is removed before entering the Run Time phase, when AmdPspDxeV2Ff3.sys executes its notification routine for the EFI_EVENT_EXIT_BOOT_SERVICES_GUID event.", "language": "english", "position": {"atoms": [{"position_id": 2064, "txt": "It should be noted that, this handler is removed before entering the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]"}, {"position_id": 2066, "txt": "Run Time phase", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/a"}, {"position_id": 2068, "txt": ", when ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/a"}, {"position_id": 2070, "txt": "AmdPspDxeV2Ff3.sys", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/code[1]"}, {"position_id": 2072, "txt": " executes its notification routine for the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/code[1]"}, {"position_id": 2074, "txt": "EFI_EVENT_EXIT_BOOT_SERVICES_GUID", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/code[2]"}, {"position_id": 2076, "txt": " event.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[28]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 51, "global_sentence_id": 73, "edu_l1_label": "IOS"}, {"txt": "Therefore, one must have physical access to the device to reach the vulnerability, which can appear rather inconvenient in some contexts.", "language": "english", "position": {"atoms": [{"position_id": 2078, "txt": "Therefore, one must have physical access to the device to reach the vulnerability, which can appear rather inconvenient in some contexts.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[29]"}]}, "tags": [], "label": "content", "web_segment_id": 52, "global_sentence_id": 74, "edu_l1_label": "IOS"}, {"txt": " Still, to experiment with the Steam Deck, this is a neat capability to have.", "language": "english", "position": {"atoms": [{"position_id": 2079, "txt": " Still, to experiment with the Steam Deck, this is a neat capability to have.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[29]"}]}, "tags": [], "label": "content", "web_segment_id": 52, "global_sentence_id": 75, "edu_l1_label": "IOS"}, {"txt": "Bug #2:", "language": "english", "position": {"atoms": [{"position_id": 2081, "txt": "Bug #2:", "x": "/html/body/div[2]/div/div[1]/section/article/div/h4[2]"}]}, "tags": ["h4"], "label": "title3", "web_segment_id": 53, "global_sentence_id": 76, "edu_l1_label": "IOS"}, {"txt": " AmdCpmDisplayFeatureSmm.efi (CVE-2024-0179)", "language": "english", "position": {"atoms": [{"position_id": 2082, "txt": " AmdCpmDisplayFeatureSmm.efi (CVE-2024-0179)", "x": "/html/body/div[2]/div/div[1]/section/article/div/h4[2]"}]}, "tags": ["h4"], "label": "title3", "web_segment_id": 53, "global_sentence_id": 77, "edu_l1_label": "IOS"}, {"txt": "The second vulnerability lies in an SMM module called AmdCpmDisplayFeatureSmm.efi (30AF4110-A58E-4EF7-8C75-B725939B3B9F).", "language": "english", "position": {"atoms": [{"position_id": 2084, "txt": "The second vulnerability lies in an SMM module called ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]"}, {"position_id": 2086, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[1]"}, {"position_id": 2088, "txt": " (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[1]"}, {"position_id": 2090, "txt": "30AF4110-A58E-4EF7-8C75-B725939B3B9F", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[2]"}, {"position_id": 2092, "txt": ").", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 54, "global_sentence_id": 78, "edu_l1_label": "IOS"}, {"txt": " As the name suggests, this module seems related to a hardware device:", "language": "english", "position": {"atoms": [{"position_id": 2093, "txt": " As the name suggests, this module seems related to a hardware device:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 54, "global_sentence_id": 79, "edu_l1_label": "IOS"}, {"txt": " the CCIX-PCIe Module (CPM).", "language": "english", "position": {"atoms": [{"position_id": 2094, "txt": " the CCIX-PCIe Module (CPM).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 54, "global_sentence_id": 80, "edu_l1_label": "IOS"}, {"txt": " We won't go too far in the explanation, but a bit of googling presents the Cache Coherent Interconnect for Accelerators standard, or CCIX, as a technology providing cache-coherent shared memory across hardware components.", "language": "english", "position": {"atoms": [{"position_id": 2095, "txt": " We won't go too far in the explanation, but a bit of ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/code[2]"}, {"position_id": 2097, "txt": "googling", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/a"}, {"position_id": 2099, "txt": " presents the Cache Coherent Interconnect for Accelerators standard, or CCIX, as a technology providing cache-coherent shared memory across hardware components.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[30]/a"}]}, "tags": [], "label": "content", "web_segment_id": 54, "global_sentence_id": 81, "edu_l1_label": "IOS"}, {"txt": "Two other UEFI modules mainly interact with AmdCpmDisplayFeatureSmm.efi:", "language": "english", "position": {"atoms": [{"position_id": 2101, "txt": "Two other UEFI modules mainly interact with ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]"}, {"position_id": 2103, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[1]"}, {"position_id": 2105, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 55, "global_sentence_id": 82, "edu_l1_label": "IOS"}, {"txt": " its DXE counterpart named AmdCpmDisplayFeatureDxe.efi, and another one in SMM called AmdCpmInitSmm.efi.", "language": "english", "position": {"atoms": [{"position_id": 2106, "txt": " its DXE counterpart named ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[1]"}, {"position_id": 2108, "txt": "AmdCpmDisplayFeatureDxe.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[2]"}, {"position_id": 2110, "txt": ", and another one in SMM called ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[2]"}, {"position_id": 2112, "txt": "AmdCpmInitSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[3]"}, {"position_id": 2114, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 55, "global_sentence_id": 83, "edu_l1_label": "IOS"}, {"txt": " The three of them appear to be used to initialize and provide information from/to the CPM.", "language": "english", "position": {"atoms": [{"position_id": 2115, "txt": " The three of them appear to be used to initialize and provide information from/to the CPM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[31]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 55, "global_sentence_id": 84, "edu_l1_label": "IOS"}, {"txt": "AmdCpmDisplayFeatureSmm.efi registers two software SMI (SWSMI):", "language": "english", "position": {"atoms": [{"position_id": 2117, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[32]/code"}, {"position_id": 2119, "txt": " registers two software SMI (SWSMI):", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[32]/code"}]}, "tags": [], "label": "content", "web_segment_id": 56, "global_sentence_id": 85, "edu_l1_label": "IOS"}, {"txt": "a handler with the ID 0xE3 and located at offset 0x3364;", "language": "english", "position": {"atoms": [{"position_id": 2121, "txt": "a handler with the ID 0xE3 and located at offset 0x3364;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[2]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 57, "global_sentence_id": 86, "edu_l1_label": "IOS"}, {"txt": "a handler with the ID 0xED and located at offset 0x3488;", "language": "english", "position": {"atoms": [{"position_id": 2123, "txt": "a handler with the ID 0xED and located at offset 0x3488;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[2]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 58, "global_sentence_id": 87, "edu_l1_label": "IOS"}, {"txt": "The whole process involved in these handlers is quite complex and won't be described in this post. ", "language": "english", "position": {"atoms": [{"position_id": 2125, "txt": "The whole process involved in these handlers is quite complex and won't be described in this post. ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[33]"}]}, "tags": [], "label": "content", "web_segment_id": 59, "global_sentence_id": 88, "edu_l1_label": "IOS"}, {"txt": "The functions relevant in the context of the vulnerability are at offset 0x2304 (called by the handler 0xED) and 0x280C (called by the handler 0xE3) in the vulnerable module.", "language": "english", "position": {"atoms": [{"position_id": 2127, "txt": "The functions relevant in the context of the vulnerability are at offset 0x2304 (called by the handler 0xED) and 0x280C (called by the handler 0xE3) in the vulnerable module.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]"}]}, "tags": [], "label": "content", "web_segment_id": 60, "global_sentence_id": 89, "edu_l1_label": "IOS"}, {"txt": "They rely on the information provided by AmdCpmDisplayFeatureDxe.efi and on a data array, dubbed CPMConfigTable in this post, which is accessible through AmdCpmInitSmm.efi interface.", "language": "english", "position": {"atoms": [{"position_id": 2128, "txt": "\nThey rely on the information provided by ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]"}, {"position_id": 2130, "txt": "AmdCpmDisplayFeatureDxe.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[1]"}, {"position_id": 2132, "txt": " and on a data array, dubbed ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[1]"}, {"position_id": 2134, "txt": "CPMConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[2]"}, {"position_id": 2136, "txt": " in this post, which is accessible through ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[2]"}, {"position_id": 2138, "txt": "AmdCpmInitSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[3]"}, {"position_id": 2140, "txt": " interface.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 60, "global_sentence_id": 90, "edu_l1_label": "IOS"}, {"txt": " These elements are located in DXE and are used to compute offsets and addresses in the memory space of what seems to be the CPM.", "language": "english", "position": {"atoms": [{"position_id": 2141, "txt": " These elements are located in DXE and are used to compute offsets and addresses in the memory space of what seems to be the CPM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[34]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 60, "global_sentence_id": 91, "edu_l1_label": "IOS"}, {"txt": "As an example, the computation for function 0x2304 can be summarized with the following code:", "language": "english", "position": {"atoms": [{"position_id": 2143, "txt": "As an example, the computation for function 0x2304 can be summarized with the following code:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[35]"}]}, "tags": [], "label": "content", "web_segment_id": 61, "global_sentence_id": 92, "edu_l1_label": "IOS"}, {"txt": "UINT8*CPMConfigTable=(UINT8*)(AmdCpmInitSmmInterface+8);UINT8*AmdCpmDisplayTable=(UINT8*)(AmdCpmDisplayFeatureDxeInterface+0x10);if(*(UINT16*)&CPMConfigTable[0x63]!=0x400||AmdCpmDisplayTable[0x2c]==0){return;}UINT8val_2c=AmdCpmDisplayTable[0x2c];UINT8val_2d=AmdCpmDisplayTable[0x2d];UINT32value=AmdCpmInitSmmInterface.readDwordFromAddress(val_2d,val_2c>>3,val_2c&7,0);AmdCpmInitSmmInterface.writeDwordToAddress(val_2d,val_2c>>3,val_2c&7,0x24,AmdCpmDisplayTable[0x12c])// ...value=value>>0x10;UINT32temp=0;if(value<=0x67C0)temp=0x10;elseif(value<=0x67E0)temp=0x11;// ...elseif(value<=0x7420)temp=0x28;if(temp!=0){hw_addr=AmdCpmInitSmmInterface.readDwordFromAddress(val_2d,val_2c>>3,val_2c&7,0x24);}else{hw_addr_hi=AmdCpmInitSmmInterface.readDwordFromAddress(val_2d,val_2c>>3,val_2c&7,0x1c);hw_addr_low=AmdCpmInitSmmInterface.readDwordFromAddress(val_2d,val_2c>>3,val_2c&7,0x18);hw_addr=(hw_addr_hi<<0x20)|hw_addr_low;}hw_addr&=0xFFFFFFFFFFFFFFF0;if(temp>0x20)hw_addr[0x34E0]&=0xEFFFFFFF;elseif(temp>0x10)hw_addr[0x540C]&=0xFFFFEFFF;elsehw_addr[0x5418]&=0xFFFFFFFD;// ...", "language": "english", "position": {"atoms": [{"position_id": 2145, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[1]"}, {"position_id": 2147, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[3]"}, {"position_id": 2149, "txt": "CPMConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[4]"}, {"position_id": 2151, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[6]"}, {"position_id": 2153, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[8]"}, {"position_id": 2155, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[9]"}, {"position_id": 2157, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[11]"}, {"position_id": 2159, "txt": ")(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[12]"}, {"position_id": 2161, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[13]"}, {"position_id": 2163, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[15]"}, {"position_id": 2165, "txt": "8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[17]"}, {"position_id": 2167, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[18]"}, {"position_id": 2169, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[19]"}, {"position_id": 2171, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[21]"}, {"position_id": 2173, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[22]"}, {"position_id": 2175, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[24]"}, {"position_id": 2177, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[26]"}, {"position_id": 2179, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[27]"}, {"position_id": 2181, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[29]"}, {"position_id": 2183, "txt": ")(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[30]"}, {"position_id": 2185, "txt": "AmdCpmDisplayFeatureDxeInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[31]"}, {"position_id": 2187, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[33]"}, {"position_id": 2189, "txt": "0x10", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[35]"}, {"position_id": 2191, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[36]"}, {"position_id": 2193, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[37]"}, {"position_id": 2195, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[38]"}, {"position_id": 2197, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[39]"}, {"position_id": 2199, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[40]"}, {"position_id": 2201, "txt": "UINT16", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[41]"}, {"position_id": 2203, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[42]"}, {"position_id": 2205, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[43]"}, {"position_id": 2207, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[44]"}, {"position_id": 2209, "txt": "CPMConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[45]"}, {"position_id": 2211, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[46]"}, {"position_id": 2213, "txt": "0x63", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[47]"}, {"position_id": 2215, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[48]"}, {"position_id": 2217, "txt": "!=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[50]"}, {"position_id": 2219, "txt": "0x400", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[52]"}, {"position_id": 2221, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[54]"}, {"position_id": 2223, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[56]"}, {"position_id": 2225, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[57]"}, {"position_id": 2227, "txt": "0x2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[58]"}, {"position_id": 2229, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[59]"}, {"position_id": 2231, "txt": "==", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[61]"}, {"position_id": 2233, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[63]"}, {"position_id": 2235, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[64]"}, {"position_id": 2237, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[66]"}, {"position_id": 2239, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[67]"}, {"position_id": 2241, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[68]"}, {"position_id": 2243, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[69]"}, {"position_id": 2245, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[71]"}, {"position_id": 2247, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[73]"}, {"position_id": 2249, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[75]"}, {"position_id": 2251, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[76]"}, {"position_id": 2253, "txt": "0x2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[77]"}, {"position_id": 2255, "txt": "];", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[78]"}, {"position_id": 2257, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[79]"}, {"position_id": 2259, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[81]"}, {"position_id": 2261, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[83]"}, {"position_id": 2263, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[85]"}, {"position_id": 2265, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[86]"}, {"position_id": 2267, "txt": "0x2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[87]"}, {"position_id": 2269, "txt": "];", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[88]"}, {"position_id": 2271, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[89]"}, {"position_id": 2273, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[91]"}, {"position_id": 2275, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[93]"}, {"position_id": 2277, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[95]"}, {"position_id": 2279, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[96]"}, {"position_id": 2281, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[97]"}, {"position_id": 2283, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[98]"}, {"position_id": 2285, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[99]"}, {"position_id": 2287, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[100]"}, {"position_id": 2289, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[102]"}, {"position_id": 2291, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[104]"}, {"position_id": 2293, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[106]"}, {"position_id": 2295, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[107]"}, {"position_id": 2297, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[109]"}, {"position_id": 2299, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[111]"}, {"position_id": 2301, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[113]"}, {"position_id": 2303, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[114]"}, {"position_id": 2305, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[116]"}, {"position_id": 2307, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[117]"}, {"position_id": 2309, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[118]"}, {"position_id": 2311, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[119]"}, {"position_id": 2313, "txt": "writeDwordToAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[120]"}, {"position_id": 2315, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[121]"}, {"position_id": 2317, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[122]"}, {"position_id": 2319, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[123]"}, {"position_id": 2321, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[125]"}, {"position_id": 2323, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[127]"}, {"position_id": 2325, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[129]"}, {"position_id": 2327, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[130]"}, {"position_id": 2329, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[132]"}, {"position_id": 2331, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[134]"}, {"position_id": 2333, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[136]"}, {"position_id": 2335, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[137]"}, {"position_id": 2337, "txt": "0x24", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[139]"}, {"position_id": 2339, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[140]"}, {"position_id": 2341, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[142]"}, {"position_id": 2343, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[143]"}, {"position_id": 2345, "txt": "0x12c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[144]"}, {"position_id": 2347, "txt": "])", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[145]"}, {"position_id": 2349, "txt": "// ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[146]"}, {"position_id": 2351, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[147]"}, {"position_id": 2353, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[149]"}, {"position_id": 2355, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[151]"}, {"position_id": 2357, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[153]"}, {"position_id": 2359, "txt": "0x10", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[155]"}, {"position_id": 2361, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[156]"}, {"position_id": 2363, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[157]"}, {"position_id": 2365, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[159]"}, {"position_id": 2367, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[161]"}, {"position_id": 2369, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[163]"}, {"position_id": 2371, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[164]"}, {"position_id": 2373, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[165]"}, {"position_id": 2375, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[166]"}, {"position_id": 2377, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[167]"}, {"position_id": 2379, "txt": "<=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[169]"}, {"position_id": 2381, "txt": "0x67C0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[171]"}, {"position_id": 2383, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[172]"}, {"position_id": 2385, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[174]"}, {"position_id": 2387, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[176]"}, {"position_id": 2389, "txt": "0x10", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[178]"}, {"position_id": 2391, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[179]"}, {"position_id": 2393, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[180]"}, {"position_id": 2395, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[182]"}, {"position_id": 2397, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[183]"}, {"position_id": 2399, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[184]"}, {"position_id": 2401, "txt": "<=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[186]"}, {"position_id": 2403, "txt": "0x67E0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[188]"}, {"position_id": 2405, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[189]"}, {"position_id": 2407, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[191]"}, {"position_id": 2409, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[193]"}, {"position_id": 2411, "txt": "0x11", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[195]"}, {"position_id": 2413, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[196]"}, {"position_id": 2415, "txt": "// ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[197]"}, {"position_id": 2417, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[198]"}, {"position_id": 2419, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[200]"}, {"position_id": 2421, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[201]"}, {"position_id": 2423, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[202]"}, {"position_id": 2425, "txt": "<=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[204]"}, {"position_id": 2427, "txt": "0x7420", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[206]"}, {"position_id": 2429, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[207]"}, {"position_id": 2431, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[209]"}, {"position_id": 2433, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[211]"}, {"position_id": 2435, "txt": "0x28", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[213]"}, {"position_id": 2437, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[214]"}, {"position_id": 2439, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[215]"}, {"position_id": 2441, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[216]"}, {"position_id": 2443, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[217]"}, {"position_id": 2445, "txt": "!=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[219]"}, {"position_id": 2447, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[221]"}, {"position_id": 2449, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[222]"}, {"position_id": 2451, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[224]"}, {"position_id": 2453, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[226]"}, {"position_id": 2455, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[228]"}, {"position_id": 2457, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[229]"}, {"position_id": 2459, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[230]"}, {"position_id": 2461, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[231]"}, {"position_id": 2463, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[232]"}, {"position_id": 2465, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[233]"}, {"position_id": 2467, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[235]"}, {"position_id": 2469, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[237]"}, {"position_id": 2471, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[239]"}, {"position_id": 2473, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[240]"}, {"position_id": 2475, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[242]"}, {"position_id": 2477, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[244]"}, {"position_id": 2479, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[246]"}, {"position_id": 2481, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[247]"}, {"position_id": 2483, "txt": "0x24", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[249]"}, {"position_id": 2485, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[250]"}, {"position_id": 2487, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[251]"}, {"position_id": 2489, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[252]"}, {"position_id": 2491, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[253]"}, {"position_id": 2493, "txt": "hw_addr_hi", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[255]"}, {"position_id": 2495, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[257]"}, {"position_id": 2497, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[259]"}, {"position_id": 2499, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[260]"}, {"position_id": 2501, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[261]"}, {"position_id": 2503, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[262]"}, {"position_id": 2505, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[263]"}, {"position_id": 2507, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[264]"}, {"position_id": 2509, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[266]"}, {"position_id": 2511, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[268]"}, {"position_id": 2513, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[270]"}, {"position_id": 2515, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[271]"}, {"position_id": 2517, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[273]"}, {"position_id": 2519, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[275]"}, {"position_id": 2521, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[277]"}, {"position_id": 2523, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[278]"}, {"position_id": 2525, "txt": "0x1c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[280]"}, {"position_id": 2527, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[281]"}, {"position_id": 2529, "txt": "hw_addr_low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[283]"}, {"position_id": 2531, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[285]"}, {"position_id": 2533, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[287]"}, {"position_id": 2535, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[288]"}, {"position_id": 2537, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[289]"}, {"position_id": 2539, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[290]"}, {"position_id": 2541, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[291]"}, {"position_id": 2543, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[292]"}, {"position_id": 2545, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[294]"}, {"position_id": 2547, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[296]"}, {"position_id": 2549, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[298]"}, {"position_id": 2551, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[299]"}, {"position_id": 2553, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[301]"}, {"position_id": 2555, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[303]"}, {"position_id": 2557, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[305]"}, {"position_id": 2559, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[306]"}, {"position_id": 2561, "txt": "0x18", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[308]"}, {"position_id": 2563, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[309]"}, {"position_id": 2565, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[311]"}, {"position_id": 2567, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[313]"}, {"position_id": 2569, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[315]"}, {"position_id": 2571, "txt": "hw_addr_hi", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[316]"}, {"position_id": 2573, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[318]"}, {"position_id": 2575, "txt": "0x20", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[320]"}, {"position_id": 2577, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[321]"}, {"position_id": 2579, "txt": "|", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[323]"}, {"position_id": 2581, "txt": "hw_addr_low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[325]"}, {"position_id": 2583, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[326]"}, {"position_id": 2585, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[327]"}, {"position_id": 2587, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[329]"}, {"position_id": 2589, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[331]"}, {"position_id": 2591, "txt": "0xFFFFFFFFFFFFFFF0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[333]"}, {"position_id": 2593, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[334]"}, {"position_id": 2595, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[336]"}, {"position_id": 2597, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[338]"}, {"position_id": 2599, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[339]"}, {"position_id": 2601, "txt": ">", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[341]"}, {"position_id": 2603, "txt": "0x20", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[343]"}, {"position_id": 2605, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[344]"}, {"position_id": 2607, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[346]"}, {"position_id": 2609, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[347]"}, {"position_id": 2611, "txt": "0x34E0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[348]"}, {"position_id": 2613, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[349]"}, {"position_id": 2615, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[351]"}, {"position_id": 2617, "txt": "0xEFFFFFFF", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[353]"}, {"position_id": 2619, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[354]"}, {"position_id": 2621, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[356]"}, {"position_id": 2623, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[358]"}, {"position_id": 2625, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[360]"}, {"position_id": 2627, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[361]"}, {"position_id": 2629, "txt": ">", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[363]"}, {"position_id": 2631, "txt": "0x10", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[365]"}, {"position_id": 2633, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[366]"}, {"position_id": 2635, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[368]"}, {"position_id": 2637, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[369]"}, {"position_id": 2639, "txt": "0x540C", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[370]"}, {"position_id": 2641, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[371]"}, {"position_id": 2643, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[373]"}, {"position_id": 2645, "txt": "0xFFFFEFFF", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[375]"}, {"position_id": 2647, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[376]"}, {"position_id": 2649, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[378]"}, {"position_id": 2651, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[380]"}, {"position_id": 2653, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[381]"}, {"position_id": 2655, "txt": "0x5418", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[382]"}, {"position_id": 2657, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[383]"}, {"position_id": 2659, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[385]"}, {"position_id": 2661, "txt": "0xFFFFFFFD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[387]"}, {"position_id": 2663, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[388]"}, {"position_id": 2665, "txt": "// ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[5]/pre/code/span[389]"}]}, "tags": [], "label": "code", "web_segment_id": 62, "global_sentence_id": 93, "edu_l1_label": "EDU_O"}, {"txt": "where readDwordFromAddress and writeDwordToAddress are provided by AmdCpmInitSmm.efi and can be described as follows:", "language": "english", "position": {"atoms": [{"position_id": 2667, "txt": "where ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]"}, {"position_id": 2669, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[1]"}, {"position_id": 2671, "txt": " and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[1]"}, {"position_id": 2673, "txt": "writeDwordToAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[2]"}, {"position_id": 2675, "txt": " are provided by ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[2]"}, {"position_id": 2677, "txt": "AmdCpmInitSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[3]"}, {"position_id": 2679, "txt": " and can be described as follows:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[36]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 63, "global_sentence_id": 94, "edu_l1_label": "IOS"}, {"txt": "UINT32readDwordFromAddress(UINT8high,UINT8middle,UINT8low,UINT8offset){UINT64base=*(UINT64*)&CpmConfigTable[0x33];UINT32*addr=(high<<0x14)+(middle<<0xf)+(low<<0xc)+offset+base;return*addr;}UINT32writeDwordToAddress(UINT8high,UINT8middle,UINT8low,UINT8offset,UINT32value){UINT64base=*(UINT64*)&CpmConfigTable[0x33];UINT32*addr=(high<<0x14)+(middle<<0xf)+(low<<0xc)+offset+base;*addr=value;}", "language": "english", "position": {"atoms": [{"position_id": 2681, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[1]"}, {"position_id": 2683, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[3]"}, {"position_id": 2685, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[4]"}, {"position_id": 2687, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[5]"}, {"position_id": 2689, "txt": "high", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[7]"}, {"position_id": 2691, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[8]"}, {"position_id": 2693, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[10]"}, {"position_id": 2695, "txt": "middle", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[12]"}, {"position_id": 2697, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[13]"}, {"position_id": 2699, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[15]"}, {"position_id": 2701, "txt": "low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[17]"}, {"position_id": 2703, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[18]"}, {"position_id": 2705, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[20]"}, {"position_id": 2707, "txt": "offset", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[22]"}, {"position_id": 2709, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[23]"}, {"position_id": 2711, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[25]"}, {"position_id": 2713, "txt": "base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[27]"}, {"position_id": 2715, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[29]"}, {"position_id": 2717, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[31]"}, {"position_id": 2719, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[32]"}, {"position_id": 2721, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[33]"}, {"position_id": 2723, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[34]"}, {"position_id": 2725, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[35]"}, {"position_id": 2727, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[36]"}, {"position_id": 2729, "txt": "CpmConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[37]"}, {"position_id": 2731, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[38]"}, {"position_id": 2733, "txt": "0x33", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[39]"}, {"position_id": 2735, "txt": "];", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[40]"}, {"position_id": 2737, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[42]"}, {"position_id": 2739, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[44]"}, {"position_id": 2741, "txt": "addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[45]"}, {"position_id": 2743, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[47]"}, {"position_id": 2745, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[49]"}, {"position_id": 2747, "txt": "high", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[50]"}, {"position_id": 2749, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[52]"}, {"position_id": 2751, "txt": "0x14", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[54]"}, {"position_id": 2753, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[55]"}, {"position_id": 2755, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[57]"}, {"position_id": 2757, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[59]"}, {"position_id": 2759, "txt": "middle", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[60]"}, {"position_id": 2761, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[62]"}, {"position_id": 2763, "txt": "0xf", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[64]"}, {"position_id": 2765, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[65]"}, {"position_id": 2767, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[67]"}, {"position_id": 2769, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[69]"}, {"position_id": 2771, "txt": "low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[70]"}, {"position_id": 2773, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[72]"}, {"position_id": 2775, "txt": "0xc", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[74]"}, {"position_id": 2777, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[75]"}, {"position_id": 2779, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[77]"}, {"position_id": 2781, "txt": "offset", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[79]"}, {"position_id": 2783, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[81]"}, {"position_id": 2785, "txt": "base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[83]"}, {"position_id": 2787, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[84]"}, {"position_id": 2789, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[86]"}, {"position_id": 2791, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[88]"}, {"position_id": 2793, "txt": "addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[89]"}, {"position_id": 2795, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[90]"}, {"position_id": 2797, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[91]"}, {"position_id": 2799, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[92]"}, {"position_id": 2801, "txt": "writeDwordToAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[94]"}, {"position_id": 2803, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[95]"}, {"position_id": 2805, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[96]"}, {"position_id": 2807, "txt": "high", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[98]"}, {"position_id": 2809, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[99]"}, {"position_id": 2811, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[101]"}, {"position_id": 2813, "txt": "middle", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[103]"}, {"position_id": 2815, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[104]"}, {"position_id": 2817, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[106]"}, {"position_id": 2819, "txt": "low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[108]"}, {"position_id": 2821, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[109]"}, {"position_id": 2823, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[111]"}, {"position_id": 2825, "txt": "offset", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[113]"}, {"position_id": 2827, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[114]"}, {"position_id": 2829, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[116]"}, {"position_id": 2831, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[118]"}, {"position_id": 2833, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[119]"}, {"position_id": 2835, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[121]"}, {"position_id": 2837, "txt": "base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[123]"}, {"position_id": 2839, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[125]"}, {"position_id": 2841, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[127]"}, {"position_id": 2843, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[128]"}, {"position_id": 2845, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[129]"}, {"position_id": 2847, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[130]"}, {"position_id": 2849, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[131]"}, {"position_id": 2851, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[132]"}, {"position_id": 2853, "txt": "CpmConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[133]"}, {"position_id": 2855, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[134]"}, {"position_id": 2857, "txt": "0x33", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[135]"}, {"position_id": 2859, "txt": "];", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[136]"}, {"position_id": 2861, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[138]"}, {"position_id": 2863, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[140]"}, {"position_id": 2865, "txt": "addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[141]"}, {"position_id": 2867, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[143]"}, {"position_id": 2869, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[145]"}, {"position_id": 2871, "txt": "high", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[146]"}, {"position_id": 2873, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[148]"}, {"position_id": 2875, "txt": "0x14", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[150]"}, {"position_id": 2877, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[151]"}, {"position_id": 2879, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[153]"}, {"position_id": 2881, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[155]"}, {"position_id": 2883, "txt": "middle", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[156]"}, {"position_id": 2885, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[158]"}, {"position_id": 2887, "txt": "0xf", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[160]"}, {"position_id": 2889, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[161]"}, {"position_id": 2891, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[163]"}, {"position_id": 2893, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[165]"}, {"position_id": 2895, "txt": "low", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[166]"}, {"position_id": 2897, "txt": "<<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[168]"}, {"position_id": 2899, "txt": "0xc", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[170]"}, {"position_id": 2901, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[171]"}, {"position_id": 2903, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[173]"}, {"position_id": 2905, "txt": "offset", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[175]"}, {"position_id": 2907, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[177]"}, {"position_id": 2909, "txt": "base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[179]"}, {"position_id": 2911, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[180]"}, {"position_id": 2913, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[182]"}, {"position_id": 2915, "txt": "addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[183]"}, {"position_id": 2917, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[185]"}, {"position_id": 2919, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[187]"}, {"position_id": 2921, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[188]"}, {"position_id": 2923, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[6]/pre/code/span[189]"}]}, "tags": [], "label": "code", "web_segment_id": 64, "global_sentence_id": 95, "edu_l1_label": "EDU_O"}, {"txt": "The process in the function at offset 0x280C is quite similar but involves different offsets and values.", "language": "english", "position": {"atoms": [{"position_id": 2925, "txt": "The process in the function at offset 0x280C is quite similar but involves different offsets and values.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[37]"}]}, "tags": [], "label": "content", "web_segment_id": 65, "global_sentence_id": 96, "edu_l1_label": "IOS"}, {"txt": " Furthermore, the final operation differs from the logical AND shown above:", "language": "english", "position": {"atoms": [{"position_id": 2926, "txt": " Furthermore, the final operation differs from the logical ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[37]"}, {"position_id": 2928, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[37]/code"}, {"position_id": 2930, "txt": " shown above:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[37]/code"}]}, "tags": [], "label": "content", "web_segment_id": 65, "global_sentence_id": 97, "edu_l1_label": "IOS"}, {"txt": "// ...hw_addr=AmdCpmInitSmmInterface.readDwordFromAddress(val_2d,val_2c>>3,val_2c&7,0x24);hw_addr&=0xFFFFFFFFFFFFFFF0;if(temp>0x20){hw_addr[0x5780]&=0xFFFFFFFD;}elseif(temp>0x10){hw_addr[0x53F4]&=0x0FFFFFF00;hw_addr[0x53F4]|=0x83;}// ...", "language": "english", "position": {"atoms": [{"position_id": 2932, "txt": "// ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[1]"}, {"position_id": 2934, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[2]"}, {"position_id": 2936, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[4]"}, {"position_id": 2938, "txt": "AmdCpmInitSmmInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[6]"}, {"position_id": 2940, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[7]"}, {"position_id": 2942, "txt": "readDwordFromAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[8]"}, {"position_id": 2944, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[9]"}, {"position_id": 2946, "txt": "val_2d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[10]"}, {"position_id": 2948, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[11]"}, {"position_id": 2950, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[13]"}, {"position_id": 2952, "txt": ">>", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[15]"}, {"position_id": 2954, "txt": "3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[17]"}, {"position_id": 2956, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[18]"}, {"position_id": 2958, "txt": "val_2c", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[20]"}, {"position_id": 2960, "txt": "&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[22]"}, {"position_id": 2962, "txt": "7", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[24]"}, {"position_id": 2964, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[25]"}, {"position_id": 2966, "txt": "0x24", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[27]"}, {"position_id": 2968, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[28]"}, {"position_id": 2970, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[29]"}, {"position_id": 2972, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[31]"}, {"position_id": 2974, "txt": "0xFFFFFFFFFFFFFFF0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[33]"}, {"position_id": 2976, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[34]"}, {"position_id": 2978, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[35]"}, {"position_id": 2980, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[37]"}, {"position_id": 2982, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[38]"}, {"position_id": 2984, "txt": ">", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[40]"}, {"position_id": 2986, "txt": "0x20", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[42]"}, {"position_id": 2988, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[43]"}, {"position_id": 2990, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[45]"}, {"position_id": 2992, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[46]"}, {"position_id": 2994, "txt": "0x5780", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[47]"}, {"position_id": 2996, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[48]"}, {"position_id": 2998, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[50]"}, {"position_id": 3000, "txt": "0xFFFFFFFD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[52]"}, {"position_id": 3002, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[53]"}, {"position_id": 3004, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[54]"}, {"position_id": 3006, "txt": "else", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[55]"}, {"position_id": 3008, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[57]"}, {"position_id": 3010, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[59]"}, {"position_id": 3012, "txt": "temp", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[60]"}, {"position_id": 3014, "txt": ">", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[62]"}, {"position_id": 3016, "txt": "0x10", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[64]"}, {"position_id": 3018, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[65]"}, {"position_id": 3020, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[67]"}, {"position_id": 3022, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[68]"}, {"position_id": 3024, "txt": "0x53F4", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[69]"}, {"position_id": 3026, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[70]"}, {"position_id": 3028, "txt": "&=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[72]"}, {"position_id": 3030, "txt": "0x0FFFFFF00", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[74]"}, {"position_id": 3032, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[75]"}, {"position_id": 3034, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[77]"}, {"position_id": 3036, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[78]"}, {"position_id": 3038, "txt": "0x53F4", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[79]"}, {"position_id": 3040, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[80]"}, {"position_id": 3042, "txt": "|=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[82]"}, {"position_id": 3044, "txt": "0x83", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[84]"}, {"position_id": 3046, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[85]"}, {"position_id": 3048, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[86]"}, {"position_id": 3050, "txt": "// ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[7]/pre/code/span[88]"}]}, "tags": [], "label": "code", "web_segment_id": 66, "global_sentence_id": 98, "edu_l1_label": "EDU_O"}, {"txt": "As both AmdCpmDisplayFeatureDxe.efi interface and CPMConfigTable table are located in DXE, it is possible to modify their content and change the value of hw_addr to an address in SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 3052, "txt": "As both ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]"}, {"position_id": 3054, "txt": "AmdCpmDisplayFeatureDxe.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[1]"}, {"position_id": 3056, "txt": " interface and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[1]"}, {"position_id": 3058, "txt": "CPMConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[2]"}, {"position_id": 3060, "txt": " table are located in DXE, it is possible to modify their content and change the value of ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[2]"}, {"position_id": 3062, "txt": "hw_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[3]"}, {"position_id": 3064, "txt": " to an address in SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 67, "global_sentence_id": 99, "edu_l1_label": "IOS"}, {"txt": " This leads to the possibility for an attacker to gain two primitives:", "language": "english", "position": {"atoms": [{"position_id": 3065, "txt": " This leads to the possibility for an attacker to gain two primitives:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[38]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 67, "global_sentence_id": 100, "edu_l1_label": "IOS"}, {"txt": "arbitrary logical AND with a mask of either 0xEFFFFFFF, 0xFFFFEFFF or 0xFFFFFFFD, depending on the address alignment;", "language": "english", "position": {"atoms": [{"position_id": 3067, "txt": "arbitrary logical ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]"}, {"position_id": 3069, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[1]"}, {"position_id": 3071, "txt": " with a mask of either ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[1]"}, {"position_id": 3073, "txt": "0xEFFFFFFF", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[2]"}, {"position_id": 3075, "txt": ", ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[2]"}, {"position_id": 3077, "txt": "0xFFFFEFFF", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[3]"}, {"position_id": 3079, "txt": " or ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[3]"}, {"position_id": 3081, "txt": "0xFFFFFFFD", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[4]"}, {"position_id": 3083, "txt": ", depending on the address alignment;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[1]/code[4]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 68, "global_sentence_id": 101, "edu_l1_label": "IOS"}, {"txt": "arbitrary write of 1 bytes (0x83) at addresses having the lowest nibble equal to 4.", "language": "english", "position": {"atoms": [{"position_id": 3085, "txt": "arbitrary write of 1 bytes (", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[2]"}, {"position_id": 3087, "txt": "0x83", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[2]/code"}, {"position_id": 3089, "txt": ") at addresses having the lowest nibble equal to 4.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[3]/li[2]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 69, "global_sentence_id": 102, "edu_l1_label": "IOS"}, {"txt": "For the astute reader that is currently screaming in indignation as to why the call to writeDwordToAddress is not presented as an easy peasy way to gain our write primitive, it's not because we somehow missed it, but simply due to the destination address being overwritten several times in the very long and omitted computation that happens before, in-between and after the presented snippet.", "language": "english", "position": {"atoms": [{"position_id": 3091, "txt": "For the astute reader that is currently screaming in indignation as to why the call to ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]"}, {"position_id": 3093, "txt": "writeDwordToAddress", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[1]"}, {"position_id": 3095, "txt": " is not presented as an easy peasy way to gain our write primitive, it's not because we somehow missed it, but simply due to the destination address being overwritten several times in the very long and omitted computation that happens before, in-between and after the presented snippet.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 70, "global_sentence_id": 103, "edu_l1_label": "IOS"}, {"txt": " Relying only on the aforementioned AND and OR operations are less prone to unforeseen side effects.", "language": "english", "position": {"atoms": [{"position_id": 3096, "txt": " Relying only on the aforementioned ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[1]"}, {"position_id": 3098, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[2]"}, {"position_id": 3100, "txt": " and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[2]"}, {"position_id": 3102, "txt": "OR", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[3]"}, {"position_id": 3104, "txt": " operations are less prone to unforeseen side effects.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[39]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 70, "global_sentence_id": 104, "edu_l1_label": "IOS"}, {"txt": "Anyway, although these primitives are quite limited, it is still possible to transform them to arbitrary read and write in SMRAM, and ultimately code execution.", "language": "english", "position": {"atoms": [{"position_id": 3106, "txt": "Anyway, although these primitives are quite limited, it is still possible to transform them to arbitrary read and write in SMRAM, and ultimately code execution.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[40]"}]}, "tags": [], "label": "content", "web_segment_id": 71, "global_sentence_id": 105, "edu_l1_label": "IOS"}, {"txt": "Side Note - Reaching the bug", "language": "english", "position": {"atoms": [{"position_id": 3108, "txt": "Side Note - Reaching the bug", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[4]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 72, "global_sentence_id": 106, "edu_l1_label": "IOS"}, {"txt": "As it was explained previously, the vulnerable handlers in AmdCpmDisplayFeatureSmm.efi are accessible through two SWSMIs.", "language": "english", "position": {"atoms": [{"position_id": 3110, "txt": "As it was explained previously, the vulnerable handlers in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]"}, {"position_id": 3112, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/code"}, {"position_id": 3114, "txt": " are accessible through two SWSMIs.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/code"}]}, "tags": [], "label": "content", "web_segment_id": 73, "global_sentence_id": 107, "edu_l1_label": "IOS"}, {"txt": " Unfortunately, if one tries to blindly trigger them with the usual write access to the I/O port 0xb2, such as what chipsec does, it results in, well, nothing.", "language": "english", "position": {"atoms": [{"position_id": 3115, "txt": " Unfortunately, if one tries to blindly trigger them with the usual write access to the I/O port 0xb2, such as what ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/code"}, {"position_id": 3117, "txt": "chipsec does", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/a"}, {"position_id": 3119, "txt": ", it results in, well, nothing.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/a"}]}, "tags": [], "label": "content", "web_segment_id": 73, "global_sentence_id": 108, "edu_l1_label": "IOS"}, {"txt": " :)", "language": "english", "position": {"atoms": [{"position_id": 3120, "txt": " :)", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[41]/a"}]}, "tags": [], "label": "content", "web_segment_id": 73, "global_sentence_id": 109, "edu_l1_label": "IOS"}, {"txt": "The reason is simple:", "language": "english", "position": {"atoms": [{"position_id": 3122, "txt": "The reason is simple:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[42]"}]}, "tags": [], "label": "content", "web_segment_id": 74, "global_sentence_id": 110, "edu_l1_label": "IOS"}, {"txt": " the I/O port responsible for that is different.", "language": "english", "position": {"atoms": [{"position_id": 3123, "txt": " the I/O port responsible for that is different.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[42]"}]}, "tags": [], "label": "content", "web_segment_id": 74, "global_sentence_id": 111, "edu_l1_label": "IOS"}, {"txt": "The following snippet comes from the Trigger function in AmdSmmControl.sys DXE module, which is called by PiSmmIpl.sys to send an SWSMI when using the EFI_SMM_COMMUNICATION_PROTOCOL protocol:", "language": "english", "position": {"atoms": [{"position_id": 3125, "txt": "The following snippet comes from the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]"}, {"position_id": 3127, "txt": "Trigger", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[1]"}, {"position_id": 3129, "txt": " function in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[1]"}, {"position_id": 3131, "txt": "AmdSmmControl.sys", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[2]"}, {"position_id": 3133, "txt": " DXE module, which is called by ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[2]"}, {"position_id": 3135, "txt": "PiSmmIpl.sys", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[3]"}, {"position_id": 3137, "txt": " to send an SWSMI when using the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[3]"}, {"position_id": 3139, "txt": "EFI_SMM_COMMUNICATION_PROTOCOL", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[4]"}, {"position_id": 3141, "txt": " protocol:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[43]/code[4]"}]}, "tags": [], "label": "content", "web_segment_id": 75, "global_sentence_id": 112, "edu_l1_label": "IOS"}, {"txt": "; __int64 Trigger(void *this, int *commandPort, int *dataPort, int periodic, int activationInterface)Triggerprocnear; ...movzxedx,cs:", "language": "english", "position": {"atoms": [{"position_id": 3143, "txt": "; __int64 Trigger(void *this, int *commandPort, int *dataPort, int periodic, int activationInterface)", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[1]"}, {"position_id": 3145, "txt": "Trigger", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[2]"}, {"position_id": 3147, "txt": "proc", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[4]"}, {"position_id": 3149, "txt": "near", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[6]"}, {"position_id": 3151, "txt": "; ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[7]"}, {"position_id": 3153, "txt": "movzx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[8]"}, {"position_id": 3155, "txt": "edx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[10]"}, {"position_id": 3157, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[11]"}, {"position_id": 3159, "txt": "cs", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[13]"}, {"position_id": 3161, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[14]"}]}, "tags": [], "label": "code", "web_segment_id": 76, "global_sentence_id": 113, "edu_l1_label": "EDU_O"}, {"txt": "io_portmovecx,100hmovzxeax,r10b; dataPortimuleax,ecx;    data:", "language": "english", "position": {"atoms": [{"position_id": 3163, "txt": "io_port", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[15]"}, {"position_id": 3165, "txt": "mov", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[16]"}, {"position_id": 3167, "txt": "ecx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[18]"}, {"position_id": 3169, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[19]"}, {"position_id": 3171, "txt": "100", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[21]"}, {"position_id": 3173, "txt": "h", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[22]"}, {"position_id": 3175, "txt": "movzx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[23]"}, {"position_id": 3177, "txt": "eax", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[25]"}, {"position_id": 3179, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[26]"}, {"position_id": 3181, "txt": "r10b", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[28]"}, {"position_id": 3183, "txt": "; dataPort", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[30]"}, {"position_id": 3185, "txt": "imul", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[31]"}, {"position_id": 3187, "txt": "eax", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[33]"}, {"position_id": 3189, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[34]"}, {"position_id": 3191, "txt": "ecx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[36]"}, {"position_id": 3193, "txt": ";    data:", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[38]"}]}, "tags": [], "label": "code", "web_segment_id": 76, "global_sentence_id": 114, "edu_l1_label": "EDU_O"}, {"txt": " XX00movzxecx,bl; commandPortaddax,cx;    cmd:", "language": "english", "position": {"atoms": [{"position_id": 3194, "txt": " XX00", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[38]"}, {"position_id": 3196, "txt": "movzx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[39]"}, {"position_id": 3198, "txt": "ecx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[41]"}, {"position_id": 3200, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[42]"}, {"position_id": 3202, "txt": "bl", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[44]"}, {"position_id": 3204, "txt": "; commandPort", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[46]"}, {"position_id": 3206, "txt": "add", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[47]"}, {"position_id": 3208, "txt": "ax", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[49]"}, {"position_id": 3210, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[50]"}, {"position_id": 3212, "txt": "cx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[52]"}, {"position_id": 3214, "txt": ";    cmd:", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[54]"}]}, "tags": [], "label": "code", "web_segment_id": 76, "global_sentence_id": 115, "edu_l1_label": "EDU_O"}, {"txt": " 00XXoutdx,ax; ...", "language": "english", "position": {"atoms": [{"position_id": 3215, "txt": " 00XX", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[54]"}, {"position_id": 3217, "txt": "out", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[55]"}, {"position_id": 3219, "txt": "dx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[57]"}, {"position_id": 3221, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[58]"}, {"position_id": 3223, "txt": "ax", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[60]"}, {"position_id": 3225, "txt": "; ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[8]/pre/code/span[61]"}]}, "tags": [], "label": "code", "web_segment_id": 76, "global_sentence_id": 116, "edu_l1_label": "EDU_O"}, {"txt": "The io_port global variable is initialized with a value obtained from the Power Management Registers (0xCD6/0xCD7) during the driver init:", "language": "english", "position": {"atoms": [{"position_id": 3227, "txt": "The ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[44]"}, {"position_id": 3229, "txt": "io_port", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[44]/code"}, {"position_id": 3231, "txt": " global variable is initialized with a value obtained from the Power Management Registers (0xCD6/0xCD7) during the driver init:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[44]/code"}]}, "tags": [], "label": "content", "web_segment_id": 77, "global_sentence_id": 117, "edu_l1_label": "IOS"}, {"txt": "movr9d,0CD6hlear10d,[r9+1]; ...movedx,r10dinal,dxmovcs:", "language": "english", "position": {"atoms": [{"position_id": 3233, "txt": "mov", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[1]"}, {"position_id": 3235, "txt": "r9d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[3]"}, {"position_id": 3237, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[4]"}, {"position_id": 3239, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[6]"}, {"position_id": 3241, "txt": "CD6h", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[7]"}, {"position_id": 3243, "txt": "lea", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[8]"}, {"position_id": 3245, "txt": "r10d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[10]"}, {"position_id": 3247, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[11]"}, {"position_id": 3249, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[13]"}, {"position_id": 3251, "txt": "r9", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[14]"}, {"position_id": 3253, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[15]"}, {"position_id": 3255, "txt": "1", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[16]"}, {"position_id": 3257, "txt": "]", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[17]"}, {"position_id": 3259, "txt": "; ...", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[18]"}, {"position_id": 3261, "txt": "mov", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[19]"}, {"position_id": 3263, "txt": "edx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[21]"}, {"position_id": 3265, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[22]"}, {"position_id": 3267, "txt": "r10d", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[24]"}, {"position_id": 3269, "txt": "in", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[25]"}, {"position_id": 3271, "txt": "al", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[27]"}, {"position_id": 3273, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[28]"}, {"position_id": 3275, "txt": "dx", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[30]"}, {"position_id": 3277, "txt": "mov", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[31]"}, {"position_id": 3279, "txt": "cs", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[33]"}, {"position_id": 3281, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[34]"}]}, "tags": [], "label": "code", "web_segment_id": 78, "global_sentence_id": 118, "edu_l1_label": "EDU_O"}, {"txt": "io_port,al", "language": "english", "position": {"atoms": [{"position_id": 3283, "txt": "io_port", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[35]"}, {"position_id": 3285, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[36]"}, {"position_id": 3287, "txt": "al", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[9]/pre/code/span[38]"}]}, "tags": [], "label": "code", "web_segment_id": 78, "global_sentence_id": 119, "edu_l1_label": "EDU_O"}, {"txt": "A small EFI script enables to extract the content of this variable (quick and dirty style):", "language": "english", "position": {"atoms": [{"position_id": 3289, "txt": "A small EFI script enables to extract the content of this variable (quick and dirty style):", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[45]"}]}, "tags": [], "label": "content", "web_segment_id": 79, "global_sentence_id": 120, "edu_l1_label": "IOS"}, {"txt": "fromEfiPyimport*gEfiSmmControl2Guid= \\    EFI_GUID(0x843DC720,0x0AB1E,0x42CB,(0x93,0x57,0x8A,0x0,0x78,0x0F3,0x56,0x1B))Interface=PVOID()Status=gBS.LocateProtocol(byref(gEfiSmmConfigurationProtocolGuid),None,byref(Interface))ifStatus:", "language": "english", "position": {"atoms": [{"position_id": 3291, "txt": "from", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[1]"}, {"position_id": 3293, "txt": "EfiPy", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[2]"}, {"position_id": 3295, "txt": "import", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[3]"}, {"position_id": 3297, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[4]"}, {"position_id": 3299, "txt": "gEfiSmmControl2Guid", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[5]"}, {"position_id": 3301, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[6]"}, {"position_id": 3303, "txt": " \\\n    ", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[6]"}, {"position_id": 3305, "txt": "EFI_GUID", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[7]"}, {"position_id": 3307, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[8]"}, {"position_id": 3309, "txt": "0x843DC720", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[9]"}, {"position_id": 3311, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[10]"}, {"position_id": 3313, "txt": "0x0AB1E", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[11]"}, {"position_id": 3315, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[12]"}, {"position_id": 3317, "txt": "0x42CB", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[13]"}, {"position_id": 3319, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[14]"}, {"position_id": 3321, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[15]"}, {"position_id": 3323, "txt": "0x93", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[16]"}, {"position_id": 3325, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[17]"}, {"position_id": 3327, "txt": "0x57", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[18]"}, {"position_id": 3329, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[19]"}, {"position_id": 3331, "txt": "0x8A", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[20]"}, {"position_id": 3333, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[21]"}, {"position_id": 3335, "txt": "0x0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[22]"}, {"position_id": 3337, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[23]"}, {"position_id": 3339, "txt": "0x78", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[24]"}, {"position_id": 3341, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[25]"}, {"position_id": 3343, "txt": "0x0F3", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[26]"}, {"position_id": 3345, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[27]"}, {"position_id": 3347, "txt": "0x56", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[28]"}, {"position_id": 3349, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[29]"}, {"position_id": 3351, "txt": "0x1B", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[30]"}, {"position_id": 3353, "txt": "))", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[31]"}, {"position_id": 3355, "txt": "Interface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[32]"}, {"position_id": 3357, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[33]"}, {"position_id": 3359, "txt": "PVOID", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[34]"}, {"position_id": 3361, "txt": "()", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[35]"}, {"position_id": 3363, "txt": "Status", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[36]"}, {"position_id": 3365, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[37]"}, {"position_id": 3367, "txt": "gBS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[38]"}, {"position_id": 3369, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[39]"}, {"position_id": 3371, "txt": "LocateProtocol", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[40]"}, {"position_id": 3373, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[41]"}, {"position_id": 3375, "txt": "byref", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[42]"}, {"position_id": 3377, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[43]"}, {"position_id": 3379, "txt": "gEfiSmmConfigurationProtocolGuid", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[44]"}, {"position_id": 3381, "txt": "),", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[45]"}, {"position_id": 3383, "txt": "None", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[46]"}, {"position_id": 3385, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[47]"}, {"position_id": 3387, "txt": "byref", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[48]"}, {"position_id": 3389, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[49]"}, {"position_id": 3391, "txt": "Interface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[50]"}, {"position_id": 3393, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[51]"}, {"position_id": 3395, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[52]"}, {"position_id": 3397, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[53]"}, {"position_id": 3399, "txt": "Status", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[54]"}, {"position_id": 3401, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[55]"}]}, "tags": [], "label": "code", "web_segment_id": 80, "global_sentence_id": 121, "edu_l1_label": "EDU_O"}, {"txt": "print(\"LocateProtocol() failed:", "language": "english", "position": {"atoms": [{"position_id": 3403, "txt": "print", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[56]"}, {"position_id": 3405, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[57]"}, {"position_id": 3407, "txt": "\"LocateProtocol() failed:", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[58]"}]}, "tags": [], "label": "code", "web_segment_id": 80, "global_sentence_id": 122, "edu_l1_label": "EDU_O"}, {"txt": " 0x%016x\"%Status)exit()SmmControlInterface_ofst=0x21B0SmmIOPort_ofst=0x2204AmdSmmControl_base=Interface.value-SmmControlInterface_ofstprint(\"AmdSmmControl = 0x%x\"%AmdSmmControl_base)Ioport_addr=AmdSmmControl_base+SmmIOPort_ofstIoPort=cast(Ioport_addr,POINTER(UINT8)).contents.valueprint(\"IO Port = 0x%x\"%IoPort)", "language": "english", "position": {"atoms": [{"position_id": 3408, "txt": " 0x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[58]"}, {"position_id": 3410, "txt": "%016x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[59]"}, {"position_id": 3412, "txt": "\"", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[60]"}, {"position_id": 3414, "txt": "%", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[61]"}, {"position_id": 3416, "txt": "Status", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[62]"}, {"position_id": 3418, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[63]"}, {"position_id": 3420, "txt": "exit", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[64]"}, {"position_id": 3422, "txt": "()", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[65]"}, {"position_id": 3424, "txt": "SmmControlInterface_ofst", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[66]"}, {"position_id": 3426, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[67]"}, {"position_id": 3428, "txt": "0x21B0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[68]"}, {"position_id": 3430, "txt": "SmmIOPort_ofst", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[69]"}, {"position_id": 3432, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[70]"}, {"position_id": 3434, "txt": "0x2204", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[71]"}, {"position_id": 3436, "txt": "AmdSmmControl_base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[72]"}, {"position_id": 3438, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[73]"}, {"position_id": 3440, "txt": "Interface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[74]"}, {"position_id": 3442, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[75]"}, {"position_id": 3444, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[76]"}, {"position_id": 3446, "txt": "-", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[77]"}, {"position_id": 3448, "txt": "SmmControlInterface_ofst", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[78]"}, {"position_id": 3450, "txt": "print", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[79]"}, {"position_id": 3452, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[80]"}, {"position_id": 3454, "txt": "\"AmdSmmControl = 0x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[81]"}, {"position_id": 3456, "txt": "%x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[82]"}, {"position_id": 3458, "txt": "\"", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[83]"}, {"position_id": 3460, "txt": "%", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[84]"}, {"position_id": 3462, "txt": "AmdSmmControl_base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[85]"}, {"position_id": 3464, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[86]"}, {"position_id": 3466, "txt": "Ioport_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[87]"}, {"position_id": 3468, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[88]"}, {"position_id": 3470, "txt": "AmdSmmControl_base", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[89]"}, {"position_id": 3472, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[90]"}, {"position_id": 3474, "txt": "SmmIOPort_ofst", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[91]"}, {"position_id": 3476, "txt": "IoPort", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[92]"}, {"position_id": 3478, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[93]"}, {"position_id": 3480, "txt": "cast", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[94]"}, {"position_id": 3482, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[95]"}, {"position_id": 3484, "txt": "Ioport_addr", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[96]"}, {"position_id": 3486, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[97]"}, {"position_id": 3488, "txt": "POINTER", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[98]"}, {"position_id": 3490, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[99]"}, {"position_id": 3492, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[100]"}, {"position_id": 3494, "txt": "))", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[101]"}, {"position_id": 3496, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[102]"}, {"position_id": 3498, "txt": "contents", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[103]"}, {"position_id": 3500, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[104]"}, {"position_id": 3502, "txt": "value", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[105]"}, {"position_id": 3504, "txt": "print", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[106]"}, {"position_id": 3506, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[107]"}, {"position_id": 3508, "txt": "\"IO Port = 0x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[108]"}, {"position_id": 3510, "txt": "%x", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[109]"}, {"position_id": 3512, "txt": "\"", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[110]"}, {"position_id": 3514, "txt": "%", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[111]"}, {"position_id": 3516, "txt": "IoPort", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[112]"}, {"position_id": 3518, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[10]/pre/code/span[113]"}]}, "tags": [], "label": "code", "web_segment_id": 80, "global_sentence_id": 123, "edu_l1_label": "EDU_O"}, {"txt": "Which results in:", "language": "english", "position": {"atoms": [{"position_id": 3520, "txt": "Which results in:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[46]"}]}, "tags": [], "label": "content", "web_segment_id": 81, "global_sentence_id": 124, "edu_l1_label": "IOS"}, {"txt": "FS1:", "language": "english", "position": {"atoms": [{"position_id": 3522, "txt": "FS1:", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[11]/pre/code"}]}, "tags": [], "label": "content", "web_segment_id": 82, "global_sentence_id": 125, "edu_l1_label": "IOS"}, {"txt": "\\EFI\\Tools\\> Python368.efi get_ioport.pyAmdSmmControl = 0x78efe000IO Port = 0xB0", "language": "english", "position": {"atoms": [{"position_id": 3523, "txt": "\\EFI\\Tools\\> Python368.efi get_ioport.py\nAmdSmmControl = 0x78efe000\nIO Port = 0xB0\n", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[11]/pre/code"}]}, "tags": [], "label": "content", "web_segment_id": 82, "global_sentence_id": 126, "edu_l1_label": "IOS"}, {"txt": "A regular client wishing to communicate with an SMM handler on runtime can also legitimately get this value from the Fixed ACPI Description Table (FADT) at offset 0x30.", "language": "english", "position": {"atoms": [{"position_id": 3525, "txt": "A regular client wishing to communicate with an SMM handler on runtime can also legitimately get this value from the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[47]"}, {"position_id": 3527, "txt": "Fixed ACPI Description Table (FADT)", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[47]/a"}, {"position_id": 3529, "txt": " at offset 0x30.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[47]/a"}]}, "tags": [], "label": "content", "web_segment_id": 83, "global_sentence_id": 127, "edu_l1_label": "IOS"}, {"txt": "Exploitation", "language": "english", "position": {"atoms": [{"position_id": 3531, "txt": "Exploitation", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[4]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 84, "global_sentence_id": 128, "edu_l1_label": "BOS"}, {"txt": "In this section, we will see how to leverage the second bug (in AmdCpmDisplayFeatureSmm.efi) to gain code execution in SMM on runtime.", "language": "english", "position": {"atoms": [{"position_id": 3533, "txt": "In this section, we will see how to leverage the second bug (in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[48]"}, {"position_id": 3535, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[48]/code"}, {"position_id": 3537, "txt": ") to gain code execution in SMM on runtime.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[48]/code"}]}, "tags": [], "label": "content", "web_segment_id": 85, "global_sentence_id": 129, "edu_l1_label": "IOS"}, {"txt": "AND Mask to Arbitrary Read Primitive", "language": "english", "position": {"atoms": [{"position_id": 3539, "txt": "AND Mask to Arbitrary Read Primitive", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[5]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 86, "global_sentence_id": 130, "edu_l1_label": "IOS"}, {"txt": "As we already saw, AmdPspP2CmboxV2.efi provides the capabilities to totally leak the SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 3541, "txt": "As we already saw, ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]"}, {"position_id": 3543, "txt": "AmdPspP2CmboxV2.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[1]"}, {"position_id": 3545, "txt": " provides the capabilities to totally leak the SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 87, "global_sentence_id": 131, "edu_l1_label": "IOS"}, {"txt": " The issue is that the handler can solely be reached in DXE as it is unregistered before starting the Run Time phase.", "language": "english", "position": {"atoms": [{"position_id": 3546, "txt": " The issue is that the handler can solely be reached in DXE as it is unregistered before starting the Run Time phase.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 87, "global_sentence_id": 132, "edu_l1_label": "IOS"}, {"txt": " Therefore, the other vulnerability, in AmdCpmDisplayFeatureSmm.efi, must be employed to regain such primitive from the main OS.", "language": "english", "position": {"atoms": [{"position_id": 3547, "txt": " Therefore, the other vulnerability, in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[1]"}, {"position_id": 3549, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[2]"}, {"position_id": 3551, "txt": ", must be employed to regain such primitive from the main OS.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[49]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 87, "global_sentence_id": 133, "edu_l1_label": "IOS"}, {"txt": "Also, to be totally honest, one personal hidden achievement for this research was to exploit the target only using the AND operations from the handler 0xED.", "language": "english", "position": {"atoms": [{"position_id": 3553, "txt": "Also, to be totally honest, one personal hidden achievement for this research was to exploit the target only using the AND operations from the handler 0xED.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[50]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 88, "global_sentence_id": 134, "edu_l1_label": "IOS"}, {"txt": " Unfortunately, as a down-to-earth coworker said, only puzzle game nerds would be interested in a walk through that deliberately omits an easier path just for the love of the challenge, so we stopped being a thick head after achieving the arbitrary read primitive.", "language": "english", "position": {"atoms": [{"position_id": 3554, "txt": " Unfortunately, as a down-to-earth coworker said, only puzzle game nerds would be interested in a walk through that deliberately omits an easier path just for the love of the challenge, so we stopped being a thick head after achieving the arbitrary read primitive.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[50]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 88, "global_sentence_id": 135, "edu_l1_label": "IOS"}, {"txt": "What can be controlled?", "language": "english", "position": {"atoms": [{"position_id": 3556, "txt": "What can be controlled?", "x": "/html/body/div[2]/div/div[1]/section/article/div/h4[3]"}]}, "tags": ["h4"], "label": "title3", "web_segment_id": 89, "global_sentence_id": 136, "edu_l1_label": "IOS"}, {"txt": "As it was described in the vulnerability section, exploiting the handler with ID 0xED can provide a limited AND primitive.", "language": "english", "position": {"atoms": [{"position_id": 3558, "txt": "As it was described in the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[51]"}, {"position_id": 3560, "txt": "vulnerability section", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[51]/a"}, {"position_id": 3562, "txt": ", exploiting the handler with ID 0xED can provide a limited ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[51]/a"}, {"position_id": 3564, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[51]/code"}, {"position_id": 3566, "txt": " primitive.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[51]/code"}]}, "tags": [], "label": "content", "web_segment_id": 90, "global_sentence_id": 137, "edu_l1_label": "IOS"}, {"txt": "Two conditions must be met in order to reach the interesting piece of code:", "language": "english", "position": {"atoms": [{"position_id": 3568, "txt": "Two conditions must be met in order to reach the interesting piece of code:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[52]"}]}, "tags": [], "label": "content", "web_segment_id": 91, "global_sentence_id": 138, "edu_l1_label": "IOS"}, {"txt": "The byte at offset 0x2C in AmdCpmDisplayTable must be non-null;", "language": "english", "position": {"atoms": [{"position_id": 3570, "txt": "The byte at offset 0x2C in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[1]"}, {"position_id": 3572, "txt": "AmdCpmDisplayTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[1]/code"}, {"position_id": 3574, "txt": " must be non-null;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[1]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 92, "global_sentence_id": 139, "edu_l1_label": "IOS"}, {"txt": "The 11th bit (bit 10) of the value at offset 0x63 in CPMConfigTable must be set;", "language": "english", "position": {"atoms": [{"position_id": 3576, "txt": "The 11th bit (bit 10) of the value at offset 0x63 in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[2]"}, {"position_id": 3578, "txt": "CPMConfigTable", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[2]/code"}, {"position_id": 3580, "txt": " must be set;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[4]/li[2]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 93, "global_sentence_id": 140, "edu_l1_label": "IOS"}, {"txt": "The computation to determine the destination address, described in the previous piece of code, can be summarized as:", "language": "english", "position": {"atoms": [{"position_id": 3582, "txt": "The computation to determine the destination address, described in the previous piece of code, can be summarized as:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[53]"}]}, "tags": [], "label": "content", "web_segment_id": 94, "global_sentence_id": 141, "edu_l1_label": "IOS"}, {"txt": "\"You take the base address in one table and the page number in another, it gives you the address of a value.", "language": "english", "position": {"atoms": [{"position_id": 3584, "txt": "\"You take the base address in one table and the page number in another, it gives you the address of a value.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[54]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 95, "global_sentence_id": 142, "edu_l1_label": "IOS"}, {"txt": " This value determines where the destination address will be retrieved.", "language": "english", "position": {"atoms": [{"position_id": 3585, "txt": " This value determines where the destination address will be retrieved.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[54]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 95, "global_sentence_id": 143, "edu_l1_label": "IOS"}, {"txt": " Beware, in one case, the latter actually comes from the second table.", "language": "english", "position": {"atoms": [{"position_id": 3586, "txt": " Beware, in one case, the latter actually comes from the second table.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[54]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 95, "global_sentence_id": 144, "edu_l1_label": "IOS"}, {"txt": " Anyway, a bit mask is applied on it to be sure it is aligned and then, you add hardcoded offsets and voila\".", "language": "english", "position": {"atoms": [{"position_id": 3587, "txt": " Anyway, a bit mask is applied on it to be sure it is aligned and then, you add hardcoded offsets and voila\"", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[54]/em"}, {"position_id": 3589, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[54]/em"}]}, "tags": ["em"], "label": "content", "web_segment_id": 95, "global_sentence_id": 145, "edu_l1_label": "IOS"}, {"txt": "Or with a picture:", "language": "english", "position": {"atoms": [{"position_id": 3591, "txt": "Or with a picture:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[55]"}]}, "tags": [], "label": "content", "web_segment_id": 96, "global_sentence_id": 146, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1167, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[56]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 97, "global_sentence_id": 147, "edu_l1_label": "EDU_O"}, {"txt": "While being a bit messy, the final control we gain over the memory is that we can erase one bit at this address plus the following offsets:", "language": "english", "position": {"atoms": [{"position_id": 3593, "txt": "While being a bit messy, the final control we gain over the memory is that we can erase one bit at this address plus the following offsets:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[57]"}]}, "tags": [], "label": "content", "web_segment_id": 98, "global_sentence_id": 148, "edu_l1_label": "IOS"}, {"txt": "Offset 0x34E0 (bit mask 0xEFFFFFFF) -> clear bit 0x1c;", "language": "english", "position": {"atoms": [{"position_id": 3595, "txt": "Offset 0x34E0 (bit mask 0xEFFFFFFF) -> clear bit 0x1c;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[5]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 99, "global_sentence_id": 149, "edu_l1_label": "IOS"}, {"txt": "Offset 0x540C (bit mask 0xFFFFEFFF) -> clear bit 0xc;", "language": "english", "position": {"atoms": [{"position_id": 3597, "txt": "Offset 0x540C (bit mask 0xFFFFEFFF) -> clear bit 0xc;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[5]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 100, "global_sentence_id": 150, "edu_l1_label": "IOS"}, {"txt": "Offset 0x5418 (bit mask 0xFFFFFFFD) -> clear bit 1;", "language": "english", "position": {"atoms": [{"position_id": 3599, "txt": "Offset 0x5418 (bit mask 0xFFFFFFFD) -> clear bit 1;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[5]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 101, "global_sentence_id": 151, "edu_l1_label": "IOS"}, {"txt": "As the lowest nibble of the address is zeroed before adding the offsets, the final destination cannot be shifted and has to be aligned on a 10-byte boundary.", "language": "english", "position": {"atoms": [{"position_id": 3601, "txt": "As the lowest nibble of the address is zeroed before adding the offsets, the final destination cannot be shifted and has to be aligned on a 10-byte boundary.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[58]"}]}, "tags": [], "label": "content", "web_segment_id": 102, "global_sentence_id": 152, "edu_l1_label": "IOS"}, {"txt": "It basically means that we control (or at least we can erase) the following bits:", "language": "english", "position": {"atoms": [{"position_id": 3603, "txt": "It basically means that we control (or at least we can erase) the following bits:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[59]"}]}, "tags": [], "label": "content", "web_segment_id": 103, "global_sentence_id": 153, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1176, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[60]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 104, "global_sentence_id": 154, "edu_l1_label": "EDU_O"}, {"txt": "What Could Be Tampered?", "language": "english", "position": {"atoms": [{"position_id": 3605, "txt": "What Could Be Tampered?", "x": "/html/body/div[2]/div/div[1]/section/article/div/h4[4]"}]}, "tags": ["h4"], "label": "title2", "web_segment_id": 105, "global_sentence_id": 155, "edu_l1_label": "IOS"}, {"txt": "Knowing what can be affected, we simply need to find where this can have a useful impact.", "language": "english", "position": {"atoms": [{"position_id": 3607, "txt": "Knowing what can be affected, we simply need to find where this can have a useful impact.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[61]"}]}, "tags": [], "label": "content", "web_segment_id": 106, "global_sentence_id": 156, "edu_l1_label": "IOS"}, {"txt": "For this, another SMM module present in the Steam Deck will be leveraged:", "language": "english", "position": {"atoms": [{"position_id": 3609, "txt": "For this, another SMM module present in the Steam Deck will be leveraged:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[62]"}]}, "tags": [], "label": "content", "web_segment_id": 107, "global_sentence_id": 157, "edu_l1_label": "IOS"}, {"txt": " IhisiServicesSmm.sys.", "language": "english", "position": {"atoms": [{"position_id": 3610, "txt": " ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[62]"}, {"position_id": 3612, "txt": "IhisiServicesSmm.sys", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[62]/code"}, {"position_id": 3614, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[62]/code"}]}, "tags": [], "label": "content", "web_segment_id": 107, "global_sentence_id": 158, "edu_l1_label": "IOS"}, {"txt": " Please note that this module is provided by Insyde and may not be available on other AMD-based platforms.", "language": "english", "position": {"atoms": [{"position_id": 3615, "txt": " Please note that this module is provided by Insyde and may not be available on other AMD-based platforms.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[62]/code"}]}, "tags": [], "label": "content", "web_segment_id": 107, "global_sentence_id": 159, "edu_l1_label": "IOS"}, {"txt": "IhisiServicesSmm.sys's SWSMI handler is interesting in the context of (post-)exploitation as it provides a way to register and call commands capable of performing various tasks.", "language": "english", "position": {"atoms": [{"position_id": 3617, "txt": "IhisiServicesSmm.sys", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[63]/code"}, {"position_id": 3619, "txt": "'s SWSMI handler is interesting in the context of (post-)exploitation as it provides a way to register and call commands capable of performing various tasks.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[63]/code"}]}, "tags": [], "label": "content", "web_segment_id": 108, "global_sentence_id": 160, "edu_l1_label": "IOS"}, {"txt": " Among these, we can find classical operations such as manipulating non-volatile variables, obtaining information about the platform, or reading and writing flash memory, but also others related to OEM components and mechanisms.", "language": "english", "position": {"atoms": [{"position_id": 3620, "txt": " Among these, we can find classical operations such as manipulating non-volatile variables, obtaining information about the platform, or reading and writing flash memory, but also others related to OEM components and mechanisms.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[63]/code"}]}, "tags": [], "label": "content", "web_segment_id": 108, "global_sentence_id": 161, "edu_l1_label": "IOS"}, {"txt": "These commands are identified by IDs and can be called by providing these to the IOdata port.", "language": "english", "position": {"atoms": [{"position_id": 3622, "txt": "These commands are identified by IDs and can be called by providing these to the IOdata port.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[64]"}]}, "tags": [], "label": "content", "web_segment_id": 109, "global_sentence_id": 162, "edu_l1_label": "IOS"}, {"txt": " Commands involved in the same process are labeled with the same ID, meaning that for one SWSMI triggered, multiple commands can be executed.", "language": "english", "position": {"atoms": [{"position_id": 3623, "txt": " Commands involved in the same process are labeled with the same ID, meaning that for one SWSMI triggered, multiple commands can be executed.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[64]"}]}, "tags": [], "label": "content", "web_segment_id": 109, "global_sentence_id": 163, "edu_l1_label": "IOS"}, {"txt": " Their running order is determined with a mechanism of priority.", "language": "english", "position": {"atoms": [{"position_id": 3624, "txt": " Their running order is determined with a mechanism of priority.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[64]"}]}, "tags": [], "label": "content", "web_segment_id": 109, "global_sentence_id": 164, "edu_l1_label": "IOS"}, {"txt": "It should be noted that if an error occurs during the execution of the group of commands, the process stops and the error is returned to the client as a status code.", "language": "english", "position": {"atoms": [{"position_id": 3625, "txt": "\nIt should be noted that if an error occurs during the execution of the group of commands, the process stops and the error is returned to the client as a status code.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[64]"}]}, "tags": [], "label": "content", "web_segment_id": 109, "global_sentence_id": 165, "edu_l1_label": "IOS"}, {"txt": "Data transferred to and from the commands are either passed via the registers or in a shared memory whose address and size can be requested to the module with the command ID 0x83.", "language": "english", "position": {"atoms": [{"position_id": 3627, "txt": "Data transferred to and from the commands are either passed via the registers or in a shared memory whose address and size can be requested to the module with the command ID ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[65]"}, {"position_id": 3629, "txt": "0x83", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[65]/code"}, {"position_id": 3631, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[65]/code"}]}, "tags": [], "label": "content", "web_segment_id": 110, "global_sentence_id": 166, "edu_l1_label": "IOS"}, {"txt": "For a request to be considered as valid, RBX must hold the $H2O magic.", "language": "english", "position": {"atoms": [{"position_id": 3633, "txt": "For a request to be considered as valid, RBX must hold the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[66]"}, {"position_id": 3635, "txt": "$H2O", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[66]/code"}, {"position_id": 3637, "txt": " magic.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[66]/code"}]}, "tags": [], "label": "content", "web_segment_id": 111, "global_sentence_id": 167, "edu_l1_label": "IOS"}, {"txt": " The content of the other registers are command-dependent.", "language": "english", "position": {"atoms": [{"position_id": 3638, "txt": " The content of the other registers are command-dependent.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[66]/code"}]}, "tags": [], "label": "content", "web_segment_id": 111, "global_sentence_id": 168, "edu_l1_label": "IOS"}, {"txt": "Commands manipulating memory usually employ two functions to ensure that the provided addresses are valid depending on the context:", "language": "english", "position": {"atoms": [{"position_id": 3640, "txt": "Commands manipulating memory usually employ two functions to ensure that the provided addresses are valid depending on the context:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[67]"}]}, "tags": [], "label": "content", "web_segment_id": 112, "global_sentence_id": 169, "edu_l1_label": "IOS"}, {"txt": "One ensuring that the address is within the boundaries of the shared memory (dubbed IsSharedBufferValid in this blog post);", "language": "english", "position": {"atoms": [{"position_id": 3642, "txt": "One ensuring that the address is within the boundaries of the shared memory (dubbed ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[1]"}, {"position_id": 3644, "txt": "IsSharedBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[1]/code"}, {"position_id": 3646, "txt": " in this blog post);", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[1]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 113, "global_sentence_id": 170, "edu_l1_label": "IOS"}, {"txt": "One checking whether the address is inside SMRAM or not (simply named IsInSmRam).", "language": "english", "position": {"atoms": [{"position_id": 3648, "txt": "One checking whether the address is inside SMRAM or not (simply named ", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[2]"}, {"position_id": 3650, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[2]/code"}, {"position_id": 3652, "txt": ").", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[6]/li[2]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 114, "global_sentence_id": 171, "edu_l1_label": "IOS"}, {"txt": "IsInSmRam is a very simplified version of SmmIsBufferOutsideSmmValid API:", "language": "english", "position": {"atoms": [{"position_id": 3654, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[68]/code"}, {"position_id": 3656, "txt": " is a very simplified version of ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[68]/code"}, {"position_id": 3658, "txt": "SmmIsBufferOutsideSmmValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[68]/a/code"}, {"position_id": 3660, "txt": " API:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[68]/a"}]}, "tags": [], "label": "content", "web_segment_id": 115, "global_sentence_id": 172, "edu_l1_label": "IOS"}, {"txt": "BOOLEANIsInSmRam(EFI_PHYSICAL_ADDRESSbuffer,UINT64length){EFI_PHYSICAL_ADDRESSend_buffer=buffer+(length-1);if(buffer==0||length==0)returnFALSE;if(end_buffer<buffer)returnTRUE;for(Index=0;Index<mSmmIhisiSmramCount;Index++){if((end_buffer>=mSmmIhisiSmramRanges[Index].CpuStart)&&(Buffer<mSmmIhisiSmramRanges[Index].CpuStart+mSmmIhisiSmramRanges[Index].PhysicalSize))returnTRUE;}returnFALSE;}", "language": "english", "position": {"atoms": [{"position_id": 3662, "txt": "BOOLEAN", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[1]"}, {"position_id": 3664, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[3]"}, {"position_id": 3666, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[4]"}, {"position_id": 3668, "txt": "EFI_PHYSICAL_ADDRESS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[5]"}, {"position_id": 3670, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[7]"}, {"position_id": 3672, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[8]"}, {"position_id": 3674, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[10]"}, {"position_id": 3676, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[12]"}, {"position_id": 3678, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[13]"}, {"position_id": 3680, "txt": "EFI_PHYSICAL_ADDRESS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[15]"}, {"position_id": 3682, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[17]"}, {"position_id": 3684, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[19]"}, {"position_id": 3686, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[21]"}, {"position_id": 3688, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[23]"}, {"position_id": 3690, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[25]"}, {"position_id": 3692, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[26]"}, {"position_id": 3694, "txt": "-", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[28]"}, {"position_id": 3696, "txt": "1", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[30]"}, {"position_id": 3698, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[31]"}, {"position_id": 3700, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[33]"}, {"position_id": 3702, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[34]"}, {"position_id": 3704, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[35]"}, {"position_id": 3706, "txt": "==", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[37]"}, {"position_id": 3708, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[39]"}, {"position_id": 3710, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[41]"}, {"position_id": 3712, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[43]"}, {"position_id": 3714, "txt": "==", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[45]"}, {"position_id": 3716, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[47]"}, {"position_id": 3718, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[48]"}, {"position_id": 3720, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[50]"}, {"position_id": 3722, "txt": "FALSE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[52]"}, {"position_id": 3724, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[53]"}, {"position_id": 3726, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[55]"}, {"position_id": 3728, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[56]"}, {"position_id": 3730, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[57]"}, {"position_id": 3732, "txt": "<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[59]"}, {"position_id": 3734, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[61]"}, {"position_id": 3736, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[62]"}, {"position_id": 3738, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[64]"}, {"position_id": 3740, "txt": "TRUE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[66]"}, {"position_id": 3742, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[67]"}, {"position_id": 3744, "txt": "for", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[69]"}, {"position_id": 3746, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[71]"}, {"position_id": 3748, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[72]"}, {"position_id": 3750, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[74]"}, {"position_id": 3752, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[76]"}, {"position_id": 3754, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[77]"}, {"position_id": 3756, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[79]"}, {"position_id": 3758, "txt": "<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[81]"}, {"position_id": 3760, "txt": "mSmmIhisiSmramCount", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[83]"}, {"position_id": 3762, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[84]"}, {"position_id": 3764, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[86]"}, {"position_id": 3766, "txt": "++", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[87]"}, {"position_id": 3768, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[88]"}, {"position_id": 3770, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[90]"}, {"position_id": 3772, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[92]"}, {"position_id": 3774, "txt": "((", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[94]"}, {"position_id": 3776, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[95]"}, {"position_id": 3778, "txt": ">=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[97]"}, {"position_id": 3780, "txt": "mSmmIhisiSmramRanges", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[99]"}, {"position_id": 3782, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[100]"}, {"position_id": 3784, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[101]"}, {"position_id": 3786, "txt": "].", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[102]"}, {"position_id": 3788, "txt": "CpuStart", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[103]"}, {"position_id": 3790, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[104]"}, {"position_id": 3792, "txt": "&&", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[106]"}, {"position_id": 3794, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[108]"}, {"position_id": 3796, "txt": "Buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[109]"}, {"position_id": 3798, "txt": "<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[111]"}, {"position_id": 3800, "txt": "mSmmIhisiSmramRanges", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[113]"}, {"position_id": 3802, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[114]"}, {"position_id": 3804, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[115]"}, {"position_id": 3806, "txt": "].", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[116]"}, {"position_id": 3808, "txt": "CpuStart", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[117]"}, {"position_id": 3810, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[119]"}, {"position_id": 3812, "txt": "mSmmIhisiSmramRanges", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[121]"}, {"position_id": 3814, "txt": "[", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[122]"}, {"position_id": 3816, "txt": "Index", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[123]"}, {"position_id": 3818, "txt": "].", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[124]"}, {"position_id": 3820, "txt": "PhysicalSize", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[125]"}, {"position_id": 3822, "txt": "))", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[126]"}, {"position_id": 3824, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[128]"}, {"position_id": 3826, "txt": "TRUE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[130]"}, {"position_id": 3828, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[131]"}, {"position_id": 3830, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[133]"}, {"position_id": 3832, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[135]"}, {"position_id": 3834, "txt": "FALSE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[137]"}, {"position_id": 3836, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[138]"}, {"position_id": 3838, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[12]/pre/code/span[139]"}]}, "tags": [], "label": "code", "web_segment_id": 116, "global_sentence_id": 173, "edu_l1_label": "EDU_O"}, {"txt": "To bypass this check, the most obvious way would be to put mSmmIhisiSmramCount to 0.", "language": "english", "position": {"atoms": [{"position_id": 3840, "txt": "To bypass this check, the most obvious way would be to put ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[69]"}, {"position_id": 3842, "txt": "mSmmIhisiSmramCount", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[69]/code"}, {"position_id": 3844, "txt": " to 0.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[69]/code"}]}, "tags": [], "label": "content", "web_segment_id": 117, "global_sentence_id": 174, "edu_l1_label": "IOS"}, {"txt": "Thankfully for us, the stars are somewhat aligned:", "language": "english", "position": {"atoms": [{"position_id": 3846, "txt": "Thankfully for us, the stars are somewhat aligned:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 175, "edu_l1_label": "IOS"}, {"txt": " in our firmware, mSmmIhisiSmramCount global variable is located at offset 0xF318 in the module.", "language": "english", "position": {"atoms": [{"position_id": 3847, "txt": " in our firmware, ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]"}, {"position_id": 3849, "txt": "mSmmIhisiSmramCount", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[1]"}, {"position_id": 3851, "txt": " global variable is located at offset 0xF318 in the module.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 176, "edu_l1_label": "IOS"}, {"txt": " Furthermore, the SMRAM range table holds only two entries:", "language": "english", "position": {"atoms": [{"position_id": 3852, "txt": " Furthermore, the SMRAM range table holds only two entries:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 177, "edu_l1_label": "IOS"}, {"txt": " one for the very first page of the SMRAM, another for the remaining regions.", "language": "english", "position": {"atoms": [{"position_id": 3853, "txt": " one for the very first page of the SMRAM, another for the remaining regions.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[1]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 178, "edu_l1_label": "IOS"}, {"txt": "Therefore, tweaking this variable with the AND capability (using offset 0x5418 with the bit mask 0xFFFFFFFD) would totally erase the variable.", "language": "english", "position": {"atoms": [{"position_id": 3854, "txt": "\nTherefore, tweaking this variable with the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[1]"}, {"position_id": 3856, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[2]"}, {"position_id": 3858, "txt": " capability (using offset 0x5418 with the bit mask ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[2]"}, {"position_id": 3860, "txt": "0xFFFFFFFD", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[3]"}, {"position_id": 3862, "txt": ") would totally erase the variable.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 179, "edu_l1_label": "IOS"}, {"txt": " [*]", "language": "english", "position": {"atoms": [{"position_id": 3863, "txt": " [*]", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[70]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 118, "global_sentence_id": 180, "edu_l1_label": "IOS"}, {"txt": "(For the same astute reader that screamed previously in indignation and is now ranting about how unoriginal this technique is:", "language": "english", "position": {"atoms": [{"position_id": 3865, "txt": "(For the same astute reader that screamed previously in indignation and is now ranting about how unoriginal this technique is:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[71]"}]}, "tags": [], "label": "content", "web_segment_id": 119, "global_sentence_id": 181, "edu_l1_label": "IOS"}, {"txt": " yes, you're right, this is the very same idea as what was presented in the previous blog post but with another type of primitive).", "language": "english", "position": {"atoms": [{"position_id": 3866, "txt": " yes, you're right, this is the very same idea as what was presented in the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[71]"}, {"position_id": 3868, "txt": "previous blog post", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[71]/a"}, {"position_id": 3870, "txt": " but with another type of primitive).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[71]/a"}]}, "tags": [], "label": "content", "web_segment_id": 119, "global_sentence_id": 182, "edu_l1_label": "IOS"}, {"txt": "With this check bypassed, gaining a read primitive is trivial:", "language": "english", "position": {"atoms": [{"position_id": 3872, "txt": "With this check bypassed, gaining a read primitive is trivial:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[72]"}]}, "tags": [], "label": "content", "web_segment_id": 120, "global_sentence_id": 183, "edu_l1_label": "IOS"}, {"txt": " one just need to call the operation in charge reading the flash (ID 0x14).", "language": "english", "position": {"atoms": [{"position_id": 3873, "txt": " one just need to call the operation in charge reading the flash (ID ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[72]"}, {"position_id": 3875, "txt": "0x14", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[72]/code"}, {"position_id": 3877, "txt": ").", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[72]/code"}]}, "tags": [], "label": "content", "web_segment_id": 120, "global_sentence_id": 184, "edu_l1_label": "IOS"}, {"txt": "Data are provided through the following parameters:", "language": "english", "position": {"atoms": [{"position_id": 3879, "txt": "Data are provided through the following parameters:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[73]"}]}, "tags": [], "label": "content", "web_segment_id": 121, "global_sentence_id": 185, "edu_l1_label": "IOS"}, {"txt": "RCX:", "language": "english", "position": {"atoms": [{"position_id": 3881, "txt": "RCX:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 122, "global_sentence_id": 186, "edu_l1_label": "IOS"}, {"txt": " size;", "language": "english", "position": {"atoms": [{"position_id": 3882, "txt": " size;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 122, "global_sentence_id": 187, "edu_l1_label": "IOS"}, {"txt": "RSI:", "language": "english", "position": {"atoms": [{"position_id": 3884, "txt": "RSI:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 123, "global_sentence_id": 188, "edu_l1_label": "IOS"}, {"txt": " output buffer;", "language": "english", "position": {"atoms": [{"position_id": 3885, "txt": " output buffer;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 123, "global_sentence_id": 189, "edu_l1_label": "IOS"}, {"txt": "RDI:", "language": "english", "position": {"atoms": [{"position_id": 3887, "txt": "RDI:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 124, "global_sentence_id": 190, "edu_l1_label": "IOS"}, {"txt": " source address;", "language": "english", "position": {"atoms": [{"position_id": 3888, "txt": " source address;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[7]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 124, "global_sentence_id": 191, "edu_l1_label": "IOS"}, {"txt": "Reading the flash is performed via three different commands:", "language": "english", "position": {"atoms": [{"position_id": 3890, "txt": "Reading the flash is performed via three different commands:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[74]"}]}, "tags": [], "label": "content", "web_segment_id": 125, "global_sentence_id": 192, "edu_l1_label": "IOS"}, {"txt": "S14Cs_DoBeforeRead0:", "language": "english", "position": {"atoms": [{"position_id": 3892, "txt": "S14Cs_DoBeforeRead0", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[1]/code"}, {"position_id": 3894, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[1]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 126, "global_sentence_id": 193, "edu_l1_label": "IOS"}, {"txt": " priority level 0xE0 (offset 0x5888);", "language": "english", "position": {"atoms": [{"position_id": 3895, "txt": " priority level 0xE0 (offset 0x5888);", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[1]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 126, "global_sentence_id": 194, "edu_l1_label": "IOS"}, {"txt": "S14Kn_FbtsReadProce:", "language": "english", "position": {"atoms": [{"position_id": 3897, "txt": "S14Kn_FbtsReadProce", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[2]/code"}, {"position_id": 3899, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[2]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 127, "global_sentence_id": 195, "edu_l1_label": "IOS"}, {"txt": " priority level 0x80 (offset 0x685C);", "language": "english", "position": {"atoms": [{"position_id": 3900, "txt": " priority level 0x80 (offset 0x685C);", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[2]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 127, "global_sentence_id": 196, "edu_l1_label": "IOS"}, {"txt": "S14Cs_DoAfterRead00:", "language": "english", "position": {"atoms": [{"position_id": 3902, "txt": "S14Cs_DoAfterRead00", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[3]/code"}, {"position_id": 3904, "txt": ":", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[3]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 128, "global_sentence_id": 197, "edu_l1_label": "IOS"}, {"txt": " priority level 0x20 (offset 0x5950);", "language": "english", "position": {"atoms": [{"position_id": 3905, "txt": " priority level 0x20 (offset 0x5950);", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[8]/li[3]/code"}]}, "tags": ["li"], "label": "content", "web_segment_id": 128, "global_sentence_id": 198, "edu_l1_label": "IOS"}, {"txt": "We won't go into the details of their implementation, however it should be noted that the parameters are verified before being processed:", "language": "english", "position": {"atoms": [{"position_id": 3907, "txt": "We won't go into the details of their implementation, however it should be noted that the parameters are verified before being processed:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]"}]}, "tags": [], "label": "content", "web_segment_id": 129, "global_sentence_id": 199, "edu_l1_label": "IOS"}, {"txt": " the source address should not be within the SMRAM range (IsInSmRam) and the destination must be in the shared memory boundaries (IsSharedBufferValid).", "language": "english", "position": {"atoms": [{"position_id": 3908, "txt": " the source address should not be within the SMRAM range (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]"}, {"position_id": 3910, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[1]"}, {"position_id": 3912, "txt": ") and the destination must be in the shared memory boundaries (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[1]"}, {"position_id": 3914, "txt": "IsSharedBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[2]"}, {"position_id": 3916, "txt": ").", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 129, "global_sentence_id": 200, "edu_l1_label": "IOS"}, {"txt": "As we removed the purpose of IsInSmRam, any source address is considered as valid and the handler will gladly write its content back to the shared buffer.", "language": "english", "position": {"atoms": [{"position_id": 3917, "txt": "\nAs we removed the purpose of ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[2]"}, {"position_id": 3919, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[3]"}, {"position_id": 3921, "txt": ", any source address is considered as valid and the handler will gladly write its content back to the shared buffer.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[75]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 129, "global_sentence_id": 201, "edu_l1_label": "IOS"}, {"txt": "[*]:", "language": "english", "position": {"atoms": [{"position_id": 3923, "txt": "[*]:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[76]"}]}, "tags": [], "label": "content", "web_segment_id": 130, "global_sentence_id": 202, "edu_l1_label": "IOS"}, {"txt": " Actually, since the handler 0xE3 also provides the possibility to apply the same 0xFFFFFFFD bit mask on addresses aligned on a 0x10-byte boundary, it would still be possible to exploit the targeted variable should it be shifted elsewhere in memory.", "language": "english", "position": {"atoms": [{"position_id": 3924, "txt": " Actually, since the handler 0xE3 also provides the possibility to apply the same ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[76]"}, {"position_id": 3926, "txt": "0xFFFFFFFD", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[76]/code"}, {"position_id": 3928, "txt": " bit mask on addresses aligned on a 0x10-byte boundary, it would still be possible to exploit the targeted variable should it be shifted elsewhere in memory.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[76]/code"}]}, "tags": [], "label": "content", "web_segment_id": 130, "global_sentence_id": 203, "edu_l1_label": "IOS"}, {"txt": "1-Fixed Byte Write to Arbitrary Write Primitive", "language": "english", "position": {"atoms": [{"position_id": 3930, "txt": "1-Fixed Byte Write to Arbitrary Write Primitive", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[6]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 131, "global_sentence_id": 204, "edu_l1_label": "IOS"}, {"txt": "While we leveraged the command responsible for reading the flash in order to gain a read primitive in SMRAM, one can hardly do the same with its write counterpart.", "language": "english", "position": {"atoms": [{"position_id": 3932, "txt": "While we leveraged the command responsible for reading the flash in order to gain a read primitive in SMRAM, one can hardly do the same with its write counterpart.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]"}]}, "tags": [], "label": "content", "web_segment_id": 132, "global_sentence_id": 205, "edu_l1_label": "IOS"}, {"txt": " Indeed, both read and write mechanisms rely on the same \"backend\" as AmdPspP2CmboxV2.efi (FwBlockServiceSmm.efi).", "language": "english", "position": {"atoms": [{"position_id": 3933, "txt": " Indeed, both read and write mechanisms rely on the same \"backend\" as ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]"}, {"position_id": 3935, "txt": "AmdPspP2CmboxV2.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]/code[1]"}, {"position_id": 3937, "txt": " (", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]/code[1]"}, {"position_id": 3939, "txt": "FwBlockServiceSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]/code[2]"}, {"position_id": 3941, "txt": ").", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 132, "global_sentence_id": 206, "edu_l1_label": "IOS"}, {"txt": " Thus, the command suffers from the same kind of limitations as what was presented previously, and it is rather tedious to leverage it to gain our write primitive.", "language": "english", "position": {"atoms": [{"position_id": 3942, "txt": " Thus, the command suffers from the same kind of limitations as what was presented previously, and it is rather tedious to leverage it to gain our write primitive.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[77]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 132, "global_sentence_id": 207, "edu_l1_label": "IOS"}, {"txt": "Still, using this specific command is not needed as long as we bypass the second validation of the read one.", "language": "english", "position": {"atoms": [{"position_id": 3944, "txt": "Still, using this specific command is not needed as long as we bypass the second validation of the read one.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[78]"}]}, "tags": [], "label": "content", "web_segment_id": 133, "global_sentence_id": 208, "edu_l1_label": "IOS"}, {"txt": "As we described previously, the destination buffer for this command is verified with IsSharedBufferValid function, which can be summarized as:", "language": "english", "position": {"atoms": [{"position_id": 3946, "txt": "As we described previously, the destination buffer for this command is verified with ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[79]"}, {"position_id": 3948, "txt": "IsSharedBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[79]/code"}, {"position_id": 3950, "txt": " function, which can be summarized as:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[79]/code"}]}, "tags": [], "label": "content", "web_segment_id": 134, "global_sentence_id": 209, "edu_l1_label": "IOS"}, {"txt": "BOOLEANIsSharedBufferValid(EFI_PHYSICAL_ADDRESSbuffer,UINT64length){EFI_PHYSICAL_ADDRESSend_buffer=buffer+(length-1);if(buffer==0||length==0||end_buffer<buffer||buffer<mIhisiCommandBuf||end_buffer>mIhisiCommandBuf+mIhisiCommandBufSize)returnFALSE;returnTRUE;}", "language": "english", "position": {"atoms": [{"position_id": 3952, "txt": "BOOLEAN", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[1]"}, {"position_id": 3954, "txt": "IsSharedBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[3]"}, {"position_id": 3956, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[4]"}, {"position_id": 3958, "txt": "EFI_PHYSICAL_ADDRESS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[5]"}, {"position_id": 3960, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[7]"}, {"position_id": 3962, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[8]"}, {"position_id": 3964, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[10]"}, {"position_id": 3966, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[12]"}, {"position_id": 3968, "txt": "){", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[13]"}, {"position_id": 3970, "txt": "EFI_PHYSICAL_ADDRESS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[15]"}, {"position_id": 3972, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[17]"}, {"position_id": 3974, "txt": "=", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[19]"}, {"position_id": 3976, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[21]"}, {"position_id": 3978, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[23]"}, {"position_id": 3980, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[25]"}, {"position_id": 3982, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[26]"}, {"position_id": 3984, "txt": "-", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[28]"}, {"position_id": 3986, "txt": "1", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[30]"}, {"position_id": 3988, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[31]"}, {"position_id": 3990, "txt": "if", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[33]"}, {"position_id": 3992, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[34]"}, {"position_id": 3994, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[35]"}, {"position_id": 3996, "txt": "==", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[37]"}, {"position_id": 3998, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[39]"}, {"position_id": 4000, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[41]"}, {"position_id": 4002, "txt": "length", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[43]"}, {"position_id": 4004, "txt": "==", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[45]"}, {"position_id": 4006, "txt": "0", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[47]"}, {"position_id": 4008, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[49]"}, {"position_id": 4010, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[52]"}, {"position_id": 4012, "txt": "<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[54]"}, {"position_id": 4014, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[56]"}, {"position_id": 4016, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[58]"}, {"position_id": 4018, "txt": "buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[60]"}, {"position_id": 4020, "txt": "<", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[62]"}, {"position_id": 4022, "txt": "mIhisiCommandBuf", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[64]"}, {"position_id": 4024, "txt": "||", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[66]"}, {"position_id": 4026, "txt": "end_buffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[68]"}, {"position_id": 4028, "txt": ">", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[70]"}, {"position_id": 4030, "txt": "mIhisiCommandBuf", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[72]"}, {"position_id": 4032, "txt": "+", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[74]"}, {"position_id": 4034, "txt": "mIhisiCommandBufSize", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[76]"}, {"position_id": 4036, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[77]"}, {"position_id": 4038, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[79]"}, {"position_id": 4040, "txt": "FALSE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[81]"}, {"position_id": 4042, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[82]"}, {"position_id": 4044, "txt": "return", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[84]"}, {"position_id": 4046, "txt": "TRUE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[86]"}, {"position_id": 4048, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[87]"}, {"position_id": 4050, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[13]/pre/code/span[88]"}]}, "tags": [], "label": "code", "web_segment_id": 135, "global_sentence_id": 210, "edu_l1_label": "EDU_O"}, {"txt": "Here, solely relying on the AND capabilities is not possible as both mIhisiCommandBuf and mIhisiCommandBufSize are aligned on a 0x10-byte boundary and the bit mask won't affect them.", "language": "english", "position": {"atoms": [{"position_id": 4052, "txt": "Here, solely relying on the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]"}, {"position_id": 4054, "txt": "AND", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[1]"}, {"position_id": 4056, "txt": " capabilities is not possible as both ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[1]"}, {"position_id": 4058, "txt": "mIhisiCommandBuf", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[2]"}, {"position_id": 4060, "txt": " and ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[2]"}, {"position_id": 4062, "txt": "mIhisiCommandBufSize", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[3]"}, {"position_id": 4064, "txt": " are aligned on a 0x10-byte boundary and the bit mask won't affect them.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 136, "global_sentence_id": 211, "edu_l1_label": "IOS"}, {"txt": " Thus the second primitive (1-fixed byte write) must be employed.", "language": "english", "position": {"atoms": [{"position_id": 4065, "txt": " Thus the second primitive (1-fixed byte write) must be employed.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[80]/code[3]"}]}, "tags": [], "label": "content", "web_segment_id": 136, "global_sentence_id": 212, "edu_l1_label": "IOS"}, {"txt": "As we saw previously, this primitive offers the possibility to write 0x83 at any address which has the lowest nibble equal to 4. This is somewhat restrictive but still perfect to get rid of the check in this specific context.", "language": "english", "position": {"atoms": [{"position_id": 4067, "txt": "As we saw previously, this primitive offers the possibility to write ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[81]"}, {"position_id": 4069, "txt": "0x83", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[81]/code"}, {"position_id": 4071, "txt": " at any address which has the lowest nibble equal to 4. This is somewhat restrictive but still perfect to get rid of the check in this specific context.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[81]/code"}]}, "tags": [], "label": "content", "web_segment_id": 137, "global_sentence_id": 213, "edu_l1_label": "IOS"}, {"txt": "mIhisiCommandBufSize being a 64-bit long variable, overwriting its highest bytes enables to extend the shared buffer far enough to overlap it with the SMRAM.", "language": "english", "position": {"atoms": [{"position_id": 4073, "txt": "mIhisiCommandBufSize", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[82]/code"}, {"position_id": 4075, "txt": " being a 64-bit long variable, overwriting its highest bytes enables to extend the shared buffer far enough to overlap it with the SMRAM.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[82]/code"}]}, "tags": [], "label": "content", "web_segment_id": 138, "global_sentence_id": 214, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1478, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[83]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 139, "global_sentence_id": 215, "edu_l1_label": "EDU_O"}, {"txt": "From this point, any address in SMRAM is considered by IsSharedBufferValid within the boundary of the shared memory and thus is valid.", "language": "english", "position": {"atoms": [{"position_id": 4077, "txt": "From this point, any address in SMRAM is considered by ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[84]"}, {"position_id": 4079, "txt": "IsSharedBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[84]/code"}, {"position_id": 4081, "txt": " within the boundary of the shared memory and thus is valid.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[84]/code"}]}, "tags": [], "label": "content", "web_segment_id": 140, "global_sentence_id": 216, "edu_l1_label": "IOS"}, {"txt": "Arbitrary Read-Write Primitive to Code Execution", "language": "english", "position": {"atoms": [{"position_id": 4083, "txt": "Arbitrary Read-Write Primitive to Code Execution", "x": "/html/body/div[2]/div/div[1]/section/article/div/h3[7]"}]}, "tags": ["h3"], "label": "title2", "web_segment_id": 141, "global_sentence_id": 217, "edu_l1_label": "IOS"}, {"txt": "To achieve code execution in SMM, one could simply create a fake SWSMI handler as it was described in the previous blog post.", "language": "english", "position": {"atoms": [{"position_id": 4085, "txt": "To achieve code execution in SMM, one could simply create a fake SWSMI handler as it was described in the ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[85]"}, {"position_id": 4087, "txt": "previous blog post", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[85]/a"}, {"position_id": 4089, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[85]/a"}]}, "tags": [], "label": "content", "web_segment_id": 142, "global_sentence_id": 218, "edu_l1_label": "IOS"}, {"txt": "However, in order to entertain our astute reader, we'll try something a tiny bit different.", "language": "english", "position": {"atoms": [{"position_id": 4091, "txt": "However, in order to entertain our astute reader, we'll try something a tiny bit different.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[86]"}]}, "tags": [], "label": "content", "web_segment_id": 143, "global_sentence_id": 219, "edu_l1_label": "IOS"}, {"txt": " Here again, this method will only work if the firmware is based on Insyde's project as we leverage IhisiServicesSmm's interface.", "language": "english", "position": {"atoms": [{"position_id": 4092, "txt": " Here again, this method will only work if the firmware is based on Insyde's project as we leverage ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[86]"}, {"position_id": 4094, "txt": "IhisiServicesSmm", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[86]/code"}, {"position_id": 4096, "txt": "'s interface.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[86]/code"}]}, "tags": [], "label": "content", "web_segment_id": 143, "global_sentence_id": 220, "edu_l1_label": "IOS"}, {"txt": " Since the module was already used to gain previous primitives anyway, we hope our hot-headed reader won't complain too much about the technique not being generic at this point.", "language": "english", "position": {"atoms": [{"position_id": 4097, "txt": " Since the module was already used to gain previous primitives anyway, we hope our hot-headed reader won't complain too much about the technique not being generic at this point.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[86]/code"}]}, "tags": [], "label": "content", "web_segment_id": 143, "global_sentence_id": 221, "edu_l1_label": "IOS"}, {"txt": "Ihisi commands can be dynamically added and removed via IhisiServicesSmm's interface:", "language": "english", "position": {"atoms": [{"position_id": 4099, "txt": "Ihisi commands can be dynamically added and removed via ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[87]"}, {"position_id": 4101, "txt": "IhisiServicesSmm", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[87]/code"}, {"position_id": 4103, "txt": "'s interface:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[87]/code"}]}, "tags": [], "label": "content", "web_segment_id": 144, "global_sentence_id": 222, "edu_l1_label": "IOS"}, {"txt": "structEFI_SMM_IHISI_PROTOCOL{UINT64Size;IHISI_ADD_IHISI_CMDAddIhisCmd;// add new commandIHISI_REMOVE_IHISI_CMDRemoveIhisCmd;// remove commandsIHISI_CALL_CMD_GROUPCallCmdGroup;IHISI_READ_SAVE_STATEReadSaveState;IHISI_WRITE_SAVE_STATEWriteSaveState;IHISI_IS_IN_SMRAMIsInSmRam;IHISI_IS_BUFFER_VALIDIsBufferValid;IHISI_GET_AUTH_STATUSGetAuthStatus;IHISI_GET_CMD_BUFFERGetCmdBuffer;IHISI_UNKNOWNGetUnknownBuffer;IHISI_IS_UNKN_BUF_VALIDIsUnkBufValid;IHISI_CALL_COMMANDCallCommand;}typedefEFI_STATUS(EFIAPI*IHISI_ADD_IHISI_CMD)(UINT32CmdId,IHISI_FUNCTIONFunction,UINT8Priority);typedefEFI_STATUS(EFIAPI*IHISI_REMOVE_IHISI_CMD)(UINT32CmdId,UINT8Priority_min,UINT8Priority_max);", "language": "english", "position": {"atoms": [{"position_id": 4105, "txt": "struct", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[1]"}, {"position_id": 4107, "txt": "EFI_SMM_IHISI_PROTOCOL", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[3]"}, {"position_id": 4109, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[5]"}, {"position_id": 4111, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[7]"}, {"position_id": 4113, "txt": "Size", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[9]"}, {"position_id": 4115, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[10]"}, {"position_id": 4117, "txt": "IHISI_ADD_IHISI_CMD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[12]"}, {"position_id": 4119, "txt": "AddIhisCmd", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[14]"}, {"position_id": 4121, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[15]"}, {"position_id": 4123, "txt": "// add new command", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[17]"}, {"position_id": 4125, "txt": "IHISI_REMOVE_IHISI_CMD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[19]"}, {"position_id": 4127, "txt": "RemoveIhisCmd", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[21]"}, {"position_id": 4129, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[22]"}, {"position_id": 4131, "txt": "// remove commands", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[24]"}, {"position_id": 4133, "txt": "IHISI_CALL_CMD_GROUP", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[26]"}, {"position_id": 4135, "txt": "CallCmdGroup", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[28]"}, {"position_id": 4137, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[29]"}, {"position_id": 4139, "txt": "IHISI_READ_SAVE_STATE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[31]"}, {"position_id": 4141, "txt": "ReadSaveState", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[33]"}, {"position_id": 4143, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[34]"}, {"position_id": 4145, "txt": "IHISI_WRITE_SAVE_STATE", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[36]"}, {"position_id": 4147, "txt": "WriteSaveState", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[38]"}, {"position_id": 4149, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[39]"}, {"position_id": 4151, "txt": "IHISI_IS_IN_SMRAM", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[41]"}, {"position_id": 4153, "txt": "IsInSmRam", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[43]"}, {"position_id": 4155, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[44]"}, {"position_id": 4157, "txt": "IHISI_IS_BUFFER_VALID", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[46]"}, {"position_id": 4159, "txt": "IsBufferValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[48]"}, {"position_id": 4161, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[49]"}, {"position_id": 4163, "txt": "IHISI_GET_AUTH_STATUS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[51]"}, {"position_id": 4165, "txt": "GetAuthStatus", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[53]"}, {"position_id": 4167, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[54]"}, {"position_id": 4169, "txt": "IHISI_GET_CMD_BUFFER", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[56]"}, {"position_id": 4171, "txt": "GetCmdBuffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[58]"}, {"position_id": 4173, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[59]"}, {"position_id": 4175, "txt": "IHISI_UNKNOWN", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[61]"}, {"position_id": 4177, "txt": "GetUnknownBuffer", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[63]"}, {"position_id": 4179, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[64]"}, {"position_id": 4181, "txt": "IHISI_IS_UNKN_BUF_VALID", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[66]"}, {"position_id": 4183, "txt": "IsUnkBufValid", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[68]"}, {"position_id": 4185, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[69]"}, {"position_id": 4187, "txt": "IHISI_CALL_COMMAND", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[71]"}, {"position_id": 4189, "txt": "CallCommand", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[73]"}, {"position_id": 4191, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[74]"}, {"position_id": 4193, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[76]"}, {"position_id": 4195, "txt": "typedef", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[77]"}, {"position_id": 4197, "txt": "EFI_STATUS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[79]"}, {"position_id": 4199, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[81]"}, {"position_id": 4201, "txt": "EFIAPI", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[82]"}, {"position_id": 4203, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[84]"}, {"position_id": 4205, "txt": "IHISI_ADD_IHISI_CMD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[85]"}, {"position_id": 4207, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[86]"}, {"position_id": 4209, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[88]"}, {"position_id": 4211, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[90]"}, {"position_id": 4213, "txt": "CmdId", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[92]"}, {"position_id": 4215, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[93]"}, {"position_id": 4217, "txt": "IHISI_FUNCTION", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[95]"}, {"position_id": 4219, "txt": "Function", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[97]"}, {"position_id": 4221, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[98]"}, {"position_id": 4223, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[100]"}, {"position_id": 4225, "txt": "Priority", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[102]"}, {"position_id": 4227, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[103]"}, {"position_id": 4229, "txt": "typedef", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[104]"}, {"position_id": 4231, "txt": "EFI_STATUS", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[106]"}, {"position_id": 4233, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[108]"}, {"position_id": 4235, "txt": "EFIAPI", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[109]"}, {"position_id": 4237, "txt": "*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[111]"}, {"position_id": 4239, "txt": "IHISI_REMOVE_IHISI_CMD", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[112]"}, {"position_id": 4241, "txt": ")", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[113]"}, {"position_id": 4243, "txt": "(", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[115]"}, {"position_id": 4245, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[117]"}, {"position_id": 4247, "txt": "CmdId", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[119]"}, {"position_id": 4249, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[120]"}, {"position_id": 4251, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[122]"}, {"position_id": 4253, "txt": "Priority_min", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[124]"}, {"position_id": 4255, "txt": ",", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[125]"}, {"position_id": 4257, "txt": "UINT8", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[127]"}, {"position_id": 4259, "txt": "Priority_max", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[129]"}, {"position_id": 4261, "txt": ");", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[14]/pre/code/span[130]"}]}, "tags": [], "label": "code", "web_segment_id": 145, "global_sentence_id": 223, "edu_l1_label": "EDU_O"}, {"txt": "In order to keep track of what was registered, the module holds a double linked list of objects representing each command.", "language": "english", "position": {"atoms": [{"position_id": 4263, "txt": "In order to keep track of what was registered, the module holds a double linked list of objects representing each command.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[88]"}]}, "tags": [], "label": "content", "web_segment_id": 146, "global_sentence_id": 224, "edu_l1_label": "IOS"}, {"txt": "structEFI_SMM_IHISI_CONTEXT{UINT32Signature;// 'SIHI'EFI_SMM_IHISI_PROTOCOLIhisiInterface;LIST_ENTRYCmdList;// IHIS_COMMAND_GROUP objects listUINT64CpuIndex;EFI_SMM_CPU_PROTOCOLSmmCpuInterface;}structIHIS_COMMAND_GROUP{UINT64Signature;// 'SIHI'              LIST_ENTRYCmdList;UINT64CmdId;LIST_ENTRYHandlerList;//   IHIS_API_LIST_ENTRY objects list           };structIHIS_CMD_HANDLER{UINT64Signature;LIST_ENTRYHandlerList;UINT64Handler;UINT64PriorityLevel;}/*For the very nitpicking astute reader, yes, the source code for this module was leaked few years ago.", "language": "english", "position": {"atoms": [{"position_id": 4265, "txt": "struct", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[1]"}, {"position_id": 4267, "txt": "EFI_SMM_IHISI_CONTEXT", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[3]"}, {"position_id": 4269, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[5]"}, {"position_id": 4271, "txt": "UINT32", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[7]"}, {"position_id": 4273, "txt": "Signature", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[9]"}, {"position_id": 4275, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[10]"}, {"position_id": 4277, "txt": "// 'SIHI'", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[12]"}, {"position_id": 4279, "txt": "EFI_SMM_IHISI_PROTOCOL", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[14]"}, {"position_id": 4281, "txt": "IhisiInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[16]"}, {"position_id": 4283, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[17]"}, {"position_id": 4285, "txt": "LIST_ENTRY", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[19]"}, {"position_id": 4287, "txt": "CmdList", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[21]"}, {"position_id": 4289, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[22]"}, {"position_id": 4291, "txt": "// IHIS_COMMAND_GROUP objects list", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[24]"}, {"position_id": 4293, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[26]"}, {"position_id": 4295, "txt": "CpuIndex", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[28]"}, {"position_id": 4297, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[29]"}, {"position_id": 4299, "txt": "EFI_SMM_CPU_PROTOCOL", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[31]"}, {"position_id": 4301, "txt": "SmmCpuInterface", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[33]"}, {"position_id": 4303, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[34]"}, {"position_id": 4305, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[35]"}, {"position_id": 4307, "txt": "struct", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[36]"}, {"position_id": 4309, "txt": "IHIS_COMMAND_GROUP", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[38]"}, {"position_id": 4311, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[40]"}, {"position_id": 4313, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[42]"}, {"position_id": 4315, "txt": "Signature", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[44]"}, {"position_id": 4317, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[45]"}, {"position_id": 4319, "txt": "// 'SIHI'              ", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[47]"}, {"position_id": 4321, "txt": "LIST_ENTRY", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[49]"}, {"position_id": 4323, "txt": "CmdList", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[51]"}, {"position_id": 4325, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[52]"}, {"position_id": 4327, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[55]"}, {"position_id": 4329, "txt": "CmdId", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[57]"}, {"position_id": 4331, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[58]"}, {"position_id": 4333, "txt": "LIST_ENTRY", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[61]"}, {"position_id": 4335, "txt": "HandlerList", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[63]"}, {"position_id": 4337, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[64]"}, {"position_id": 4339, "txt": "//   IHIS_API_LIST_ENTRY objects list           ", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[66]"}, {"position_id": 4341, "txt": "};", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[67]"}, {"position_id": 4343, "txt": "struct", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[68]"}, {"position_id": 4345, "txt": "IHIS_CMD_HANDLER", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[70]"}, {"position_id": 4347, "txt": "{", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[72]"}, {"position_id": 4349, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[74]"}, {"position_id": 4351, "txt": "Signature", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[76]"}, {"position_id": 4353, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[77]"}, {"position_id": 4355, "txt": "LIST_ENTRY", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[79]"}, {"position_id": 4357, "txt": "HandlerList", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[81]"}, {"position_id": 4359, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[82]"}, {"position_id": 4361, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[84]"}, {"position_id": 4363, "txt": "Handler", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[86]"}, {"position_id": 4365, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[87]"}, {"position_id": 4367, "txt": "UINT64", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[90]"}, {"position_id": 4369, "txt": "PriorityLevel", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[92]"}, {"position_id": 4371, "txt": ";", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[93]"}, {"position_id": 4373, "txt": "}", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[94]"}, {"position_id": 4375, "txt": "/*", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[95]"}, {"position_id": 4377, "txt": "For the very nitpicking astute reader, yes, the source code for this module was leaked few years ago.", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[96]"}]}, "tags": [], "label": "code", "web_segment_id": 147, "global_sentence_id": 225, "edu_l1_label": "EDU_O"}, {"txt": " These snippets are coming from my understanding of the mechanism, though, so they may not be the exact translation of the original code.*/", "language": "english", "position": {"atoms": [{"position_id": 4378, "txt": " These snippets are coming from my understanding of the mechanism, though, so they may not be the exact translation of the original code.", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[96]"}, {"position_id": 4380, "txt": "*/", "x": "/html/body/div[2]/div/div[1]/section/article/div/div[15]/pre/code/span[97]"}]}, "tags": [], "label": "code", "web_segment_id": 147, "global_sentence_id": 226, "edu_l1_label": "EDU_O"}, {"txt": "Or in a more graphical way:", "language": "english", "position": {"atoms": [{"position_id": 4382, "txt": "Or in a more graphical way:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[89]"}]}, "tags": [], "label": "content", "web_segment_id": 148, "global_sentence_id": 227, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1726, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[90]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 149, "global_sentence_id": 228, "edu_l1_label": "EDU_O"}, {"txt": "To gain code execution, one might craft a fake command and add it to the double linked list of aforementioned objects.", "language": "english", "position": {"atoms": [{"position_id": 4384, "txt": "To gain code execution, one might craft a fake command and add it to the double linked list of aforementioned objects.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[91]"}]}, "tags": [], "label": "content", "web_segment_id": 150, "global_sentence_id": 229, "edu_l1_label": "IOS"}, {"txt": " As Insyde provides a legitimate driver for clients wishing to execute commands on runtime, the communication vector needed to interact with our rogue handler is already provided, which is pretty handy for lazy couch potatoes.", "language": "english", "position": {"atoms": [{"position_id": 4385, "txt": " As Insyde provides a legitimate driver for clients wishing to execute commands on runtime, the communication vector needed to interact with our rogue handler is already provided, which is pretty handy for lazy couch potatoes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[91]"}]}, "tags": [], "label": "content", "web_segment_id": 150, "global_sentence_id": 230, "edu_l1_label": "IOS"}, {"txt": "The shared memory used by the mechanism is rather big and most of the registered commands don't even use half of it.", "language": "english", "position": {"atoms": [{"position_id": 4387, "txt": "The shared memory used by the mechanism is rather big and most of the registered commands don't even use half of it.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[92]"}]}, "tags": [], "label": "content", "web_segment_id": 151, "global_sentence_id": 231, "edu_l1_label": "IOS"}, {"txt": " Therefore, it is possible to use it to put everything needed to execute the first stage in the exploitation process.", "language": "english", "position": {"atoms": [{"position_id": 4388, "txt": " Therefore, it is possible to use it to put everything needed to execute the first stage in the exploitation process.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[92]"}]}, "tags": [], "label": "content", "web_segment_id": 151, "global_sentence_id": 232, "edu_l1_label": "IOS"}, {"txt": "Unfortunately, in UEFI, memory access protection is enforced at the page table level and those tables are write-protected.", "language": "english", "position": {"atoms": [{"position_id": 4390, "txt": "Unfortunately, in UEFI, ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]"}, {"position_id": 4392, "txt": "memory access protection", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]/a"}, {"position_id": 4394, "txt": " is enforced at the page table level and those tables are write-protected.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]/a"}]}, "tags": [], "label": "content", "web_segment_id": 152, "global_sentence_id": 233, "edu_l1_label": "IOS"}, {"txt": " The communication buffer, as well as all pages allocated as EfiRuntimeServicesData, are not executable, meaning that it is not possible to execute code directly from them.", "language": "english", "position": {"atoms": [{"position_id": 4395, "txt": " The communication buffer, as well as all pages allocated as ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]/a"}, {"position_id": 4397, "txt": "EfiRuntimeServicesData", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]/code"}, {"position_id": 4399, "txt": ", are not executable, meaning that it is not possible to execute code directly from them.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[93]/code"}]}, "tags": [], "label": "content", "web_segment_id": 152, "global_sentence_id": 234, "edu_l1_label": "IOS"}, {"txt": "To make a RW page executable, one needs to swap the write protect bit in the CR0 register and clear the NX bit for the page entry corresponding to the targeted page address.", "language": "english", "position": {"atoms": [{"position_id": 4401, "txt": "To make a RW page executable, one needs to swap the write protect bit in the CR0 register and clear the NX bit for the page entry corresponding to the targeted page address.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[94]"}]}, "tags": [], "label": "content", "web_segment_id": 153, "global_sentence_id": 235, "edu_l1_label": "IOS"}, {"txt": "This can easily be done via a small ropchain.", "language": "english", "position": {"atoms": [{"position_id": 4403, "txt": "This can easily be done via a small ropchain.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[95]"}]}, "tags": [], "label": "content", "web_segment_id": 154, "global_sentence_id": 236, "edu_l1_label": "IOS"}, {"txt": " While we won't go into the tiny details of its implementation, the gist is the following:", "language": "english", "position": {"atoms": [{"position_id": 4404, "txt": " While we won't go into the tiny details of its implementation, the gist is the following:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[95]"}]}, "tags": [], "label": "content", "web_segment_id": 154, "global_sentence_id": 237, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1735, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[96]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 155, "global_sentence_id": 238, "edu_l1_label": "EDU_O"}, {"txt": "Step 0:", "language": "english", "position": {"atoms": [{"position_id": 4406, "txt": "Step 0:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 156, "global_sentence_id": 239, "edu_l1_label": "IOS"}, {"txt": " Overwrite an object (for an unused handler) to craft a fake stack and redirect to the ropchain in shared memory;", "language": "english", "position": {"atoms": [{"position_id": 4407, "txt": " Overwrite an object (for an unused handler) to craft a fake stack and redirect to the ropchain in shared memory;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[1]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 156, "global_sentence_id": 240, "edu_l1_label": "IOS"}, {"txt": "Step 1:", "language": "english", "position": {"atoms": [{"position_id": 4409, "txt": "Step 1:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 157, "global_sentence_id": 241, "edu_l1_label": "IOS"}, {"txt": " Get the PML4 value and allocate a new buffer;", "language": "english", "position": {"atoms": [{"position_id": 4410, "txt": " Get the PML4 value and allocate a new buffer;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[2]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 157, "global_sentence_id": 242, "edu_l1_label": "IOS"}, {"txt": "Step 2:", "language": "english", "position": {"atoms": [{"position_id": 4412, "txt": "Step 2:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 158, "global_sentence_id": 243, "edu_l1_label": "IOS"}, {"txt": " Go through the page table entries and remove the NX protection for the buffer;", "language": "english", "position": {"atoms": [{"position_id": 4413, "txt": " Go through the page table entries and remove the NX protection for the buffer;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[3]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 158, "global_sentence_id": 244, "edu_l1_label": "IOS"}, {"txt": "Step 3:", "language": "english", "position": {"atoms": [{"position_id": 4415, "txt": "Step 3:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[4]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 159, "global_sentence_id": 245, "edu_l1_label": "IOS"}, {"txt": " Clean the object that was used for the stack pivot and write the fake handler;", "language": "english", "position": {"atoms": [{"position_id": 4416, "txt": " Clean the object that was used for the stack pivot and write the fake handler;", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[9]/li[4]"}]}, "tags": ["li"], "label": "content", "web_segment_id": 159, "global_sentence_id": 246, "edu_l1_label": "IOS"}, {"txt": "With this, we gained our exploitation primitive.", "language": "english", "position": {"atoms": [{"position_id": 4418, "txt": "With this, we gained our exploitation primitive.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[97]"}]}, "tags": [], "label": "content", "web_segment_id": 160, "global_sentence_id": 247, "edu_l1_label": "IOS"}, {"txt": " Victory!!", "language": "english", "position": {"atoms": [{"position_id": 4419, "txt": " Victory!!", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[97]"}]}, "tags": [], "label": "content", "web_segment_id": 160, "global_sentence_id": 248, "edu_l1_label": "IOS"}, {"txt": "Post-Exploitation", "language": "english", "position": {"atoms": [{"position_id": 4421, "txt": "Post-Exploitation", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[5]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 161, "global_sentence_id": 249, "edu_l1_label": "BOS"}, {"txt": "Okay, cool story.", "language": "english", "position": {"atoms": [{"position_id": 4423, "txt": "Okay, cool story.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[98]"}]}, "tags": [], "label": "content", "web_segment_id": 162, "global_sentence_id": 250, "edu_l1_label": "IOS"}, {"txt": " But what can we actually do with this new handler?", "language": "english", "position": {"atoms": [{"position_id": 4424, "txt": " But what can we actually do with this new handler?", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[98]"}]}, "tags": [], "label": "content", "web_segment_id": 162, "global_sentence_id": 251, "edu_l1_label": "IOS"}, {"txt": " For now, even though we're overlords on the machine (kind of), the handler is only capable of executing code in SMM, which is cool but a bit too restrictive to consider the target totally wrecked.", "language": "english", "position": {"atoms": [{"position_id": 4425, "txt": " For now, even though we're overlords on the machine (kind of), the handler is only capable of executing code in SMM, which is cool but a bit too restrictive to consider the target totally wrecked.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[98]"}]}, "tags": [], "label": "content", "web_segment_id": 162, "global_sentence_id": 252, "edu_l1_label": "IOS"}, {"txt": "As a matter of fact, even though the SMM mode can interact with the entire physical memory, it runs in huge real mode making access to the OS unpractical.", "language": "english", "position": {"atoms": [{"position_id": 4427, "txt": "As a matter of fact, even though the SMM mode can interact with the entire physical memory, it runs in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[99]"}, {"position_id": 4429, "txt": "huge real mode", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[99]/a"}, {"position_id": 4431, "txt": " making access to the OS unpractical.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[99]/a"}]}, "tags": [], "label": "content", "web_segment_id": 163, "global_sentence_id": 253, "edu_l1_label": "IOS"}, {"txt": "In order to read or write data in the context of the OS (kernel or userland), one needs to do some gymnastics.", "language": "english", "position": {"atoms": [{"position_id": 4433, "txt": "In order to read or write data in the context of the OS (kernel or userland), one needs to do some gymnastics.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[100]"}]}, "tags": [], "label": "content", "web_segment_id": 164, "global_sentence_id": 254, "edu_l1_label": "IOS"}, {"txt": " The process is to go through the OS page tables entries to resolve the virtual addresses while ensuring that each and every physical page we use are mapped in SMM before accessing it.", "language": "english", "position": {"atoms": [{"position_id": 4434, "txt": " The process is to go through the OS page tables entries to resolve the virtual addresses while ensuring that each and every physical page we use are mapped in SMM before accessing it.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[100]"}]}, "tags": [], "label": "content", "web_segment_id": 164, "global_sentence_id": 255, "edu_l1_label": "IOS"}, {"txt": "If the physical page is present, the process is straightforward and nothing much needs to be done, however, if it's not, we have to map it ourselves.", "language": "english", "position": {"atoms": [{"position_id": 4436, "txt": "If the physical page is present, the process is straightforward and nothing much needs to be done, however, if it's not, we have to map it ourselves.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]"}]}, "tags": [], "label": "content", "web_segment_id": 165, "global_sentence_id": 256, "edu_l1_label": "IOS"}, {"txt": " As it's rather stupid to try and reinvent the wheel instead of reusing smart techniques, we'll just copycat Dmytro Oleksiuk's ideas from his SMM backdoor.", "language": "english", "position": {"atoms": [{"position_id": 4437, "txt": " As it's rather stupid to try and reinvent the wheel instead of reusing smart techniques, we'll just copycat ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]"}, {"position_id": 4439, "txt": "Dmytro Oleksiuk", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]/a[1]"}, {"position_id": 4441, "txt": "'s ideas from his ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]/a[1]"}, {"position_id": 4443, "txt": "SMM backdoor", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]/a[2]"}, {"position_id": 4445, "txt": ".", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[101]/a[2]"}]}, "tags": [], "label": "content", "web_segment_id": 165, "global_sentence_id": 257, "edu_l1_label": "IOS"}, {"txt": "Without paraphrasing him, the gist of his technique is to tamper with the page table entry of the first page in SMRAM to make it point to the one to remap.", "language": "english", "position": {"atoms": [{"position_id": 4447, "txt": "Without paraphrasing him, the gist of his technique is to tamper with the page table entry of the first page in SMRAM to make it point to the one to remap.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[102]"}]}, "tags": [], "label": "content", "web_segment_id": 166, "global_sentence_id": 258, "edu_l1_label": "IOS"}, {"txt": " This way, reading or writing data in the first page will instead affect the targeted one.", "language": "english", "position": {"atoms": [{"position_id": 4448, "txt": " This way, reading or writing data in the first page will instead affect the targeted one.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[102]"}]}, "tags": [], "label": "content", "web_segment_id": 166, "global_sentence_id": 259, "edu_l1_label": "IOS"}, {"txt": "<img img", "language": "english", "position": {"atoms": [{"position_id": 1752, "txt": "<img img", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[103]/img"}]}, "tags": ["img"], "label": "figure", "web_segment_id": 167, "global_sentence_id": 260, "edu_l1_label": "EDU_O"}, {"txt": "And voila.", "language": "english", "position": {"atoms": [{"position_id": 4450, "txt": "And voila.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[104]"}]}, "tags": [], "label": "content", "web_segment_id": 168, "global_sentence_id": 261, "edu_l1_label": "IOS"}, {"txt": " With a bit of engineering, we can build a useful tool to monitor everything that runs on the machine in a transparent way for the OS (well, except when poping a calc, of course).", "language": "english", "position": {"atoms": [{"position_id": 4451, "txt": " With a bit of engineering, we can build a useful tool to monitor everything that runs on the machine in a transparent way for the OS (well, except when poping a calc, of course).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[104]"}]}, "tags": [], "label": "content", "web_segment_id": 168, "global_sentence_id": 262, "edu_l1_label": "IOS"}, {"txt": "For the astute reader that is wondering why the demo showcases a Windows OS instead of the regular SteamOS:", "language": "english", "position": {"atoms": [{"position_id": 4453, "txt": "For the astute reader that is wondering why the demo showcases a Windows OS instead of the regular SteamOS:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[105]"}]}, "tags": [], "label": "content", "web_segment_id": 169, "global_sentence_id": 263, "edu_l1_label": "IOS"}, {"txt": " it's just a question of preferences for the post-exploitation part.", "language": "english", "position": {"atoms": [{"position_id": 4454, "txt": " it's just a question of preferences for the post-exploitation part.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[105]"}]}, "tags": [], "label": "content", "web_segment_id": 169, "global_sentence_id": 264, "edu_l1_label": "IOS"}, {"txt": "Conclusion", "language": "english", "position": {"atoms": [{"position_id": 4456, "txt": "Conclusion", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[6]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 170, "global_sentence_id": 265, "edu_l1_label": "BOS"}, {"txt": "In this blog post, we presented two bugs that impact many devices running on AMD:", "language": "english", "position": {"atoms": [{"position_id": 4458, "txt": "In this blog post, we presented two bugs that impact many devices running on AMD:", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]"}]}, "tags": [], "label": "content", "web_segment_id": 171, "global_sentence_id": 266, "edu_l1_label": "IOS"}, {"txt": " one in AmdCpmDisplayFeatureSmm.efi accessible through the SWSMIs 0xED and 0xE3, and the other in a communication buffer provided to AmdPspP2CmboxV2.efi SMM driver.", "language": "english", "position": {"atoms": [{"position_id": 4459, "txt": " one in ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]"}, {"position_id": 4461, "txt": "AmdCpmDisplayFeatureSmm.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]/code[1]"}, {"position_id": 4463, "txt": " accessible through the SWSMIs 0xED and 0xE3, and the other in a communication buffer provided to ", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]/code[1]"}, {"position_id": 4465, "txt": "AmdPspP2CmboxV2.efi", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]/code[2]"}, {"position_id": 4467, "txt": " SMM driver.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 171, "global_sentence_id": 267, "edu_l1_label": "IOS"}, {"txt": " Both of them are the result of a lack of validation on the data used by the handlers in their respective processes.", "language": "english", "position": {"atoms": [{"position_id": 4468, "txt": " Both of them are the result of a lack of validation on the data used by the handlers in their respective processes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[106]/code[2]"}]}, "tags": [], "label": "content", "web_segment_id": 171, "global_sentence_id": 268, "edu_l1_label": "IOS"}, {"txt": "These vulnerabilities can be leveraged to gain code execution in SMM either via the DXE phase or on runtime.", "language": "english", "position": {"atoms": [{"position_id": 4470, "txt": "These vulnerabilities can be leveraged to gain code execution in SMM either via the DXE phase or on runtime.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[107]"}]}, "tags": [], "label": "content", "web_segment_id": 172, "global_sentence_id": 269, "edu_l1_label": "IOS"}, {"txt": " The primitives induced by them are somewhat restrictive, but rather neat to transform, making our target, the Steam Deck, a good playground in another way than the one initially intended by its creators.", "language": "english", "position": {"atoms": [{"position_id": 4471, "txt": " The primitives induced by them are somewhat restrictive, but rather neat to transform, making our target, the Steam Deck, a good playground in another way than the one initially intended by its creators.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[107]"}]}, "tags": [], "label": "content", "web_segment_id": 172, "global_sentence_id": 270, "edu_l1_label": "IOS"}, {"txt": "Acknowledgement", "language": "english", "position": {"atoms": [{"position_id": 4473, "txt": "Acknowledgement", "x": "/html/body/div[2]/div/div[1]/section/article/div/h1"}]}, "tags": ["h1"], "label": "title1", "web_segment_id": 173, "global_sentence_id": 271, "edu_l1_label": "EDU_O"}, {"txt": "Many thanks to the R&D team for approving this silly research without questioning my dubious motivations (and especially to Ivan for handling the disclosure process).", "language": "english", "position": {"atoms": [{"position_id": 4475, "txt": "Many thanks to the R&D team for approving this silly research without questioning my dubious motivations (and especially to Ivan for handling the disclosure process).", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[108]"}]}, "tags": [], "label": "content", "web_segment_id": 174, "global_sentence_id": 272, "edu_l1_label": "EDU_O"}, {"txt": " Also, kudos to Pauline for being a cool and understanding manager.", "language": "english", "position": {"atoms": [{"position_id": 4476, "txt": " Also, kudos to Pauline for being a cool and understanding manager.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[108]"}]}, "tags": [], "label": "content", "web_segment_id": 174, "global_sentence_id": 273, "edu_l1_label": "EDU_O"}, {"txt": " ;)", "language": "english", "position": {"atoms": [{"position_id": 4477, "txt": " ;)", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[108]"}]}, "tags": [], "label": "content", "web_segment_id": 174, "global_sentence_id": 274, "edu_l1_label": "EDU_O"}, {"txt": "Thumbs-up to Thierry for challenging my reasoning and to all the proofreaders that work hard to enhance the quality of this blog.", "language": "english", "position": {"atoms": [{"position_id": 4479, "txt": "Thumbs-up to Thierry for challenging my reasoning and to all the proofreaders that work hard to enhance the quality of this blog.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[109]"}]}, "tags": [], "label": "content", "web_segment_id": 175, "global_sentence_id": 275, "edu_l1_label": "EDU_O"}, {"txt": "And last but not least, many many thanks to Mengsi and Eloïse for the cute phone holder that also fits surprisingly very well the Steam Deck.", "language": "english", "position": {"atoms": [{"position_id": 4481, "txt": "And last but not least, many many thanks to Mengsi and Eloïse for the cute phone holder that also fits surprisingly very well the Steam Deck.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[110]"}]}, "tags": [], "label": "content", "web_segment_id": 176, "global_sentence_id": 276, "edu_l1_label": "EDU_O"}, {"txt": " You rock, girls!", "language": "english", "position": {"atoms": [{"position_id": 4482, "txt": " You rock, girls!", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[110]"}]}, "tags": [], "label": "content", "web_segment_id": 176, "global_sentence_id": 277, "edu_l1_label": "EDU_O"}, {"txt": "Disclosure timeline", "language": "english", "position": {"atoms": [{"position_id": 4484, "txt": "Disclosure timeline", "x": "/html/body/div[2]/div/div[1]/section/article/div/h2[7]"}]}, "tags": ["h2"], "label": "title1", "web_segment_id": 177, "global_sentence_id": 278, "edu_l1_label": "EDU_O"}, {"txt": "Below we include a timeline of all the relevant events during the coordinated vulnerability disclosure process with the intent of providing transparency to the whole process and our actions.", "language": "english", "position": {"atoms": [{"position_id": 4486, "txt": "Below we include a timeline of all the relevant events during the coordinated vulnerability disclosure process with the intent of providing transparency to the whole process and our actions.", "x": "/html/body/div[2]/div/div[1]/section/article/div/p[111]"}]}, "tags": [], "label": "content", "web_segment_id": 178, "global_sentence_id": 279, "edu_l1_label": "EDU_O"}, {"txt": "2024-07-06", "language": "english", "position": {"atoms": [{"position_id": 4488, "txt": "2024-07-06", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[1]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 179, "global_sentence_id": 280, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab sent a report of the vulnerabilities to AMD PSIRT, publication deadline is set to October 1st, 2024", "language": "english", "position": {"atoms": [{"position_id": 4490, "txt": " Quarkslab sent a report of the vulnerabilities to AMD PSIRT, publication deadline is set to October 1st, 2024", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[1]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 179, "global_sentence_id": 281, "edu_l1_label": "EDU_O"}, {"txt": "2024-07-08", "language": "english", "position": {"atoms": [{"position_id": 4492, "txt": "2024-07-08", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[2]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 180, "global_sentence_id": 282, "edu_l1_label": "EDU_O"}, {"txt": " AMD PSIRT acknowledged the report and assigned internal IDs (SWSPLAT-455, SWSPLAT-613) to track them.", "language": "english", "position": {"atoms": [{"position_id": 4494, "txt": " AMD PSIRT acknowledged the report and assigned internal IDs (SWSPLAT-455, SWSPLAT-613) to track them.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[2]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 180, "global_sentence_id": 283, "edu_l1_label": "EDU_O"}, {"txt": " The vendor stated that the proposed deadline would not be viable and asked if it could be extended.", "language": "english", "position": {"atoms": [{"position_id": 4495, "txt": " The vendor stated that the proposed deadline would not be viable and asked if it could be extended.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[2]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 180, "global_sentence_id": 284, "edu_l1_label": "EDU_O"}, {"txt": "2024-07-26", "language": "english", "position": {"atoms": [{"position_id": 4497, "txt": "2024-07-26", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[3]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 181, "global_sentence_id": 285, "edu_l1_label": "EDU_O"}, {"txt": " AMD said they were still analyzing the issues and asked for a reply to their request to extend the disclosure deadline.", "language": "english", "position": {"atoms": [{"position_id": 4499, "txt": " AMD said they were still analyzing the issues and asked for a reply to their request to extend the disclosure deadline.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[3]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 181, "global_sentence_id": 286, "edu_l1_label": "EDU_O"}, {"txt": "2024-07-30", "language": "english", "position": {"atoms": [{"position_id": 4501, "txt": "2024-07-30", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[4]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 182, "global_sentence_id": 287, "edu_l1_label": "EDU_O"}, {"txt": " AMD informed that their teams had reviewed the vulnerabilities and determined that the fix for one of them would require a system reboot and noted that data center customers are reluctant to such fixes.", "language": "english", "position": {"atoms": [{"position_id": 4503, "txt": " AMD informed that their teams had reviewed the vulnerabilities and determined that the fix for one of them would require a system reboot and noted that data center customers are reluctant to such fixes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[4]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 182, "global_sentence_id": 288, "edu_l1_label": "EDU_O"}, {"txt": " They proposed August 12th, 2025 as disclosure date to give customers time to deploy fixes.", "language": "english", "position": {"atoms": [{"position_id": 4504, "txt": " They proposed August 12th, 2025 as disclosure date to give customers time to deploy fixes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[4]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 182, "global_sentence_id": 289, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-01", "language": "english", "position": {"atoms": [{"position_id": 4506, "txt": "2024-08-01", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[5]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 183, "global_sentence_id": 290, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab replied that the vulnerabilities were part of a research project that had to be published before the end of 2024 and the proposed embargo period of more than one year since the initial report was not acceptable.", "language": "english", "position": {"atoms": [{"position_id": 4508, "txt": " Quarkslab replied that the vulnerabilities were part of a research project that had to be published before the end of 2024 and the proposed embargo period of more than one year since the initial report was not acceptable.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[5]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 183, "global_sentence_id": 291, "edu_l1_label": "EDU_O"}, {"txt": " Noted that Quarkslab and its customers are AMD customers too.", "language": "english", "position": {"atoms": [{"position_id": 4509, "txt": " Noted that Quarkslab and its customers are AMD customers too.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[5]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 183, "global_sentence_id": 292, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab said it did not consider reasonable the request to keep its customers uninformed about the risk to their compute infrastructure because some other AMD customers have longer patch deployment schedules and are sensitive about reboots.", "language": "english", "position": {"atoms": [{"position_id": 4510, "txt": " Quarkslab said it did not consider reasonable the request to keep its customers uninformed about the risk to their compute infrastructure because some other AMD customers have longer patch deployment schedules and are sensitive about reboots.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[5]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 183, "global_sentence_id": 293, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab said it was willing to extend the embargo period to 120 days since initial report (which is a reasonable upper bound) provided that AMD gave an status update and actual estimated date for the release of patches.", "language": "english", "position": {"atoms": [{"position_id": 4511, "txt": " Quarkslab said it was willing to extend the embargo period to 120 days since initial report (which is a reasonable upper bound) provided that AMD gave an status update and actual estimated date for the release of patches.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[5]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 183, "global_sentence_id": 294, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-12", "language": "english", "position": {"atoms": [{"position_id": 4513, "txt": "2024-08-12", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[6]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 184, "global_sentence_id": 295, "edu_l1_label": "EDU_O"}, {"txt": " AMD provided a status update.", "language": "english", "position": {"atoms": [{"position_id": 4515, "txt": " AMD provided a status update.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[6]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 184, "global_sentence_id": 296, "edu_l1_label": "EDU_O"}, {"txt": " Both vulnerabilities were being fixed and their estimated release date was December 10th, 2024. The vendor explained that once the patches are shared with customers, some of them expect 3-4 months to triage, integrate, test the fixes and prepare their disclosures/security advisories and Quarkslab proposed 120-day embargo period would set the disclosure date to November 4th, 2024, which doesn’t give AMD customers enough room.", "language": "english", "position": {"atoms": [{"position_id": 4516, "txt": " Both vulnerabilities were being fixed and their estimated release date was December 10th, 2024. The vendor explained that once the patches are shared with customers, some of them expect 3-4 months to triage, integrate, test the fixes and prepare their disclosures/security advisories and Quarkslab proposed 120-day embargo period would set the disclosure date to November 4th, 2024, which doesn’t give AMD customers enough room.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[6]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 184, "global_sentence_id": 297, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-15", "language": "english", "position": {"atoms": [{"position_id": 4518, "txt": "2024-08-15", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[7]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 185, "global_sentence_id": 298, "edu_l1_label": "EDU_O"}, {"txt": " AMD provided a status update.", "language": "english", "position": {"atoms": [{"position_id": 4520, "txt": " AMD provided a status update.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[7]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 185, "global_sentence_id": 299, "edu_l1_label": "EDU_O"}, {"txt": " The release date for fixes could be advanced to October 21st, 2024. Therefore they proposed February 11th, 2025 as disclosure date.", "language": "english", "position": {"atoms": [{"position_id": 4521, "txt": " The release date for fixes could be advanced to October 21st, 2024. Therefore they proposed February 11th, 2025 as disclosure date.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[7]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 185, "global_sentence_id": 300, "edu_l1_label": "EDU_O"}, {"txt": " That would give AMD customers enough time to integrate, test and deploy them.", "language": "english", "position": {"atoms": [{"position_id": 4522, "txt": " That would give AMD customers enough time to integrate, test and deploy them.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[7]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 185, "global_sentence_id": 301, "edu_l1_label": "EDU_O"}, {"txt": " AMD offered to discuss the matter in a conference call.", "language": "english", "position": {"atoms": [{"position_id": 4523, "txt": " AMD offered to discuss the matter in a conference call.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[7]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 185, "global_sentence_id": 302, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-20", "language": "english", "position": {"atoms": [{"position_id": 4525, "txt": "2024-08-20", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[8]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 186, "global_sentence_id": 303, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab replied that it could readily agree to extend the embargo date to December 10th, 2024 (157 days since initial report) but extending the disclosure deadline beyond 2024 would be problematic, nonetheless agreed to discuss it internally and committed to provide an answer by August 22nd, 2024. Reminded AMD that vulnreport@quarkslab.com is the only point of contact to discuss vulnerability disclosure coordination and asked AMD to refrain from reaching out to other contacts to avoid confusion.", "language": "english", "position": {"atoms": [{"position_id": 4527, "txt": " Quarkslab replied that it could readily agree to extend the embargo date to December 10th, 2024 (157 days since initial report) but extending the disclosure deadline beyond 2024 would be problematic, nonetheless agreed to discuss it internally and committed to provide an answer by August 22nd, 2024. Reminded AMD that vulnreport@quarkslab.com is the only point of contact to discuss vulnerability disclosure coordination and asked AMD to refrain from reaching out to other contacts to avoid confusion.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[8]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 186, "global_sentence_id": 304, "edu_l1_label": "EDU_O"}, {"txt": " Also explained that Quarkslab prefers to conduct all vulnerability coordination over email so it is possible to keep an accurate record of all communications, discussions and decisions.", "language": "english", "position": {"atoms": [{"position_id": 4528, "txt": " Also explained that Quarkslab prefers to conduct all vulnerability coordination over email so it is possible to keep an accurate record of all communications, discussions and decisions.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[8]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 186, "global_sentence_id": 305, "edu_l1_label": "EDU_O"}, {"txt": " For the same reason Quarkslabs tries to avoid conference calls and reporting on vendor's web sites or ticketing systems.", "language": "english", "position": {"atoms": [{"position_id": 4529, "txt": " For the same reason Quarkslabs tries to avoid conference calls and reporting on vendor's web sites or ticketing systems.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[8]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 186, "global_sentence_id": 306, "edu_l1_label": "EDU_O"}, {"txt": " Of course, exceptions are made in emergency situations or when the coordination requires interaction with multiple parties, but the current case did not qualify for exceptions.", "language": "english", "position": {"atoms": [{"position_id": 4530, "txt": " Of course, exceptions are made in emergency situations or when the coordination requires interaction with multiple parties, but the current case did not qualify for exceptions.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[8]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 186, "global_sentence_id": 307, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-22", "language": "english", "position": {"atoms": [{"position_id": 4532, "txt": "2024-08-22", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[9]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 187, "global_sentence_id": 308, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab sent notice to AMD saying that after discussing their deadline proposal internally it decided to agree to extend the embargo to February 11th, 2025. The new date was considered final.", "language": "english", "position": {"atoms": [{"position_id": 4534, "txt": " Quarkslab sent notice to AMD saying that after discussing their deadline proposal internally it decided to agree to extend the embargo to February 11th, 2025. The new date was considered final.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[9]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 187, "global_sentence_id": 309, "edu_l1_label": "EDU_O"}, {"txt": " To postpone the disclosure Quarkslab considered that if fixes were released in December, deploying them in the end of year time frame would be problematic for many vulnerable organizations, even if they were immediately available from OEMs.", "language": "english", "position": {"atoms": [{"position_id": 4535, "txt": " To postpone the disclosure Quarkslab considered that if fixes were released in December, deploying them in the end of year time frame would be problematic for many vulnerable organizations, even if they were immediately available from OEMs.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[9]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 187, "global_sentence_id": 310, "edu_l1_label": "EDU_O"}, {"txt": " The new deadline should allow a more orderly deployment of the fixes.", "language": "english", "position": {"atoms": [{"position_id": 4536, "txt": " The new deadline should allow a more orderly deployment of the fixes.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[9]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 187, "global_sentence_id": 311, "edu_l1_label": "EDU_O"}, {"txt": "2024-08-22", "language": "english", "position": {"atoms": [{"position_id": 4538, "txt": "2024-08-22", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 312, "edu_l1_label": "EDU_O"}, {"txt": " AMD thanked Quarkslab for agreeing with the proposed deadline.", "language": "english", "position": {"atoms": [{"position_id": 4540, "txt": " AMD thanked Quarkslab for agreeing with the proposed deadline.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 313, "edu_l1_label": "EDU_O"}, {"txt": " Provided their CVSS 3.1 score for the vulnerabilities (CVSS:", "language": "english", "position": {"atoms": [{"position_id": 4541, "txt": " Provided their CVSS 3.1 score for the vulnerabilities (CVSS:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 188, "global_sentence_id": 314, "edu_l1_label": "EDU_O"}, {"txt": "3.1/AV:", "language": "english", "position": {"atoms": [{"position_id": 4542, "txt": "3.1/AV:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 315, "edu_l1_label": "EDU_O"}, {"txt": "L/AC:", "language": "english", "position": {"atoms": [{"position_id": 4543, "txt": "L/AC:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 188, "global_sentence_id": 316, "edu_l1_label": "EDU_O"}, {"txt": "L/PR:", "language": "english", "position": {"atoms": [{"position_id": 4544, "txt": "L/PR:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 317, "edu_l1_label": "EDU_O"}, {"txt": "H/UI:", "language": "english", "position": {"atoms": [{"position_id": 4545, "txt": "H/UI:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 318, "edu_l1_label": "EDU_O"}, {"txt": "N/S:", "language": "english", "position": {"atoms": [{"position_id": 4546, "txt": "N/S:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 319, "edu_l1_label": "EDU_O"}, {"txt": "C/C:", "language": "english", "position": {"atoms": [{"position_id": 4547, "txt": "C/C:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 320, "edu_l1_label": "EDU_O"}, {"txt": "H/I:", "language": "english", "position": {"atoms": [{"position_id": 4548, "txt": "H/I:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 321, "edu_l1_label": "EDU_O"}, {"txt": "H/A:", "language": "english", "position": {"atoms": [{"position_id": 4549, "txt": "H/A:", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 188, "global_sentence_id": 322, "edu_l1_label": "EDU_O"}, {"txt": "H vector and 8.2 score).", "language": "english", "position": {"atoms": [{"position_id": 4550, "txt": "H vector and 8.2 score).", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[10]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 188, "global_sentence_id": 323, "edu_l1_label": "EDU_O"}, {"txt": "2024-11-27", "language": "english", "position": {"atoms": [{"position_id": 4552, "txt": "2024-11-27", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[11]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 189, "global_sentence_id": 324, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab asked AMD if there were any news about the fixes and reminded them the disclosure date was February 11th, 2025.", "language": "english", "position": {"atoms": [{"position_id": 4554, "txt": " Quarkslab asked AMD if there were any news about the fixes and reminded them the disclosure date was February 11th, 2025.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[11]/strong"}]}, "tags": ["strong", "li"], "label": "content", "web_segment_id": 189, "global_sentence_id": 325, "edu_l1_label": "EDU_O"}, {"txt": "2024-12-04", "language": "english", "position": {"atoms": [{"position_id": 4556, "txt": "2024-12-04", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[12]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 190, "global_sentence_id": 326, "edu_l1_label": "EDU_O"}, {"txt": " AMD replied that fixes had already been released to NDA customers for their integration, and they didn't have concerns with Quarkslab going public on February 11th, 2025.", "language": "english", "position": {"atoms": [{"position_id": 4558, "txt": " AMD replied that fixes had already been released to NDA customers for their integration, and they didn't have concerns with Quarkslab going public on February 11th, 2025.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[12]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 190, "global_sentence_id": 327, "edu_l1_label": "EDU_O"}, {"txt": "2025-02-10", "language": "english", "position": {"atoms": [{"position_id": 4560, "txt": "2025-02-10", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[13]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 191, "global_sentence_id": 328, "edu_l1_label": "EDU_O"}, {"txt": " Quarkslab reminded AMD of the upcoming disclosure on Feb. 11th.", "language": "english", "position": {"atoms": [{"position_id": 4562, "txt": " Quarkslab reminded AMD of the upcoming disclosure on Feb. 11th.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[13]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 191, "global_sentence_id": 329, "edu_l1_label": "EDU_O"}, {"txt": " and asked if the vulnerabilities were assigned CVE IDs.", "language": "english", "position": {"atoms": [{"position_id": 4563, "txt": " and asked if the vulnerabilities were assigned CVE IDs.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[13]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 191, "global_sentence_id": 330, "edu_l1_label": "EDU_O"}, {"txt": "2025-02-10", "language": "english", "position": {"atoms": [{"position_id": 4565, "txt": "2025-02-10", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[14]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 192, "global_sentence_id": 331, "edu_l1_label": "EDU_O"}, {"txt": " AMD replied with CVE IDs fo the two vulnerabilities.", "language": "english", "position": {"atoms": [{"position_id": 4567, "txt": " AMD replied with CVE IDs fo the two vulnerabilities.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[14]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 192, "global_sentence_id": 332, "edu_l1_label": "EDU_O"}, {"txt": "2025-02-11", "language": "english", "position": {"atoms": [{"position_id": 4569, "txt": "2025-02-11", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[15]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 193, "global_sentence_id": 333, "edu_l1_label": "EDU_O"}, {"txt": " This blog post was published.", "language": "english", "position": {"atoms": [{"position_id": 4571, "txt": " This blog post was published.", "x": "/html/body/div[2]/div/div[1]/section/article/div/ul[10]/li[15]/strong"}]}, "tags": ["li", "strong"], "label": "content", "web_segment_id": 193, "global_sentence_id": 334, "edu_l1_label": "EDU_O"}, {"txt": "If you would like to learn more about our security audits and explore how we can help you, get in touch with us!", "language": "english", "position": {"atoms": [{"position_id": 4573, "txt": "If you would like to learn more about our security audits and explore how we can help you, ", "x": "/html/body/div[2]/div/div[1]/section/article/p"}, {"position_id": 4575, "txt": "get in touch with us", "x": "/html/body/div[2]/div/div[1]/section/article/p/a"}, {"position_id": 4577, "txt": "!", "x": "/html/body/div[2]/div/div[1]/section/article/p/a"}]}, "tags": [], "label": "O", "web_segment_id": 194, "global_sentence_id": 335, "edu_l1_label": "EDU_O"}], "type": "WEB"}
#                         Being Overlord on the Steam Deck with 1 Byte                    
## Introduction
### Serious Story
### Context
## Setup
## Technical details
### The Vulnerabilities
#### Bug #1 - AmdPspP2CmboxV2.efi (CVE-2024-21925)
#### Bug #2: AmdCpmDisplayFeatureSmm.efi (CVE-2024-0179)
### Side Note - Reaching the bug
## Exploitation
### AND Mask to Arbitrary Read Primitive
#### What can be controlled?
#### What Could Be Tampered?
### 1-Fixed Byte Write to Arbitrary Write Primitive
### Arbitrary Read-Write Primitive to Code Execution
## Post-Exploitation
## Conclusion
