reversing another powerpc kernel's pagefault codepath, so consulting the best readable documentation available on powerpc page tables again
for those unaware, that's the mario kart wii forums
Posts
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
patched up oah750 (ppc emulator, "rosetta") from x86 OSX 10.4.1 8B1025 to run on 10.3-era x86 darwin
tried to bring up the OSX UI stuff, and failed so far (some parts of it are actually causing a kernel panic!)
tried to bring up the OSX UI stuff, and failed so far (some parts of it are actually causing a kernel panic!)
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
did some compression reversing shenanigans to recover a couple of Mac OS 8.5 builds present (as Disk Copy 6.x compressed HFS partition images) on a badly dumped warez CD missing resource forks
https://archive.org/details/Mac.OS.8.5a6c2
https://archive.org/details/Mac.OS.8.5a7c3
https://archive.org/details/Mac.OS.8.5a6c2
https://archive.org/details/Mac.OS.8.5a7c3
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
"In December 2025, they classified drivers protected with VMProtect, Themida, or Virtualizer as malware or potential vulnerabilities without providing any notification"
...microsoft can actually do good things??? amazed i didnt hear about this until now
...microsoft can actually do good things??? amazed i didnt hear about this until now
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
@gsuberland @diagprov @manawyrm @azonenberg @jik @zackwhittaker there are two types of revocation lists, the old one that can revoke certs and binaries by hash (two different lists for boot and drivers), and the new one that's just a CiPolicy and can therefore revoke by anything that a CiPolicy supports.
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
@azonenberg @gsuberland @jik @manawyrm @zackwhittaker that said. i wonder if this is MS attempting to do some form of moderation on driver / EFI signers, given the instances of game cheat devs and outright malware actors signing drivers in the past (do i need to cite that unknowncheats thread again?)
that said, I quickly browsed around unknowncheats and didn't see anyone complaining about this, so...
that said, I quickly browsed around unknowncheats and didn't see anyone complaining about this, so...
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
@gsuberland @azonenberg @manawyrm @jik @zackwhittaker certificate expiry won't be enforced, however if outright revocation of binaries happen, that will be
0
1
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
a second osx port has hit the nintendo wii
(the first one is still unfinished)
https://bryankeller.github.io/2026/04/08/porting-mac-os-x-nintendo-wii.html
(the first one is still unfinished)
https://bryankeller.github.io/2026/04/08/porting-mac-os-x-nintendo-wii.html
0
14
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
@GossiTheDog huh, one of the samples used the warbird syscall? lol
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
@gamesthatwerent well, this looks interesting
at first glance, seems they have an engine which has two implementations, one for gba and one for win32 (where the win32 stuff is a (partial?) emulation of the gba hardware), so they can prototype stuff by using windows builds?
at first glance, seems they have an engine which has two implementations, one for gba and one for win32 (where the win32 stuff is a (partial?) emulation of the gba hardware), so they can prototype stuff by using windows builds?
1
2
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
looking further in the files that have plaintext available, and metadata of crypted files, seems this is related to a security audit on this TPM, commissioned from Thales, at a cost of 375,000 EUR
0
0
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
lol, another plaintext file is what looks like the src for the firmware signer for this TPM, with three ECC private keys hardcoded (two are commented out)
there's also the code for the firmware flasher on the device side, and binary for the util that talks to that code, with identical hardcoded key+iv for crypting the buffer transferred over uart (it's china, so as you'd expect the algorithm is SM4-CFB)
there's also the code for the firmware flasher on the device side, and binary for the util that talks to that code, with identical hardcoded key+iv for crypting the buffer transferred over uart (it's china, so as you'd expect the algorithm is SM4-CFB)
0
4
0
Rairii
@Rairii@labyrinth.zone
labyrinth.zone
oh this is interesting
a while ago ransomhouse leaked data from some chinese microcontroller company, and it seems nobody really noticed
this company also makes TPMs
a lot of the data looks crypted, but there’s some plaintext in there
including listing files (which for C code seems to be preprocessor debug-output, with single character prefix denoting what the preprocessor did, comments and preprocessor directives and preprocessor output are ALL included) for the firmware of a production TPM implementation
the anti-glitch stuff in particular seems like the usual fare for such, but if you haven’t seen such before then it looks kind of weird:
enum
{
Cpy_OK = 0x55a55aa5,
SetData_OK = 0x7CCF62F2,
XOR_OK = 0x6A17D34A,
RandomSort_OK = 0x51261DC5,
CheckOrder_OK = 0x54830C23,
Reverse_OK = 0x43C94C71,
IsZero_YES = 0x7a7a7a7a,
IsZero_NOT = 0x07070707,
IsOne_YES = 0x6a6a6a6a,
IsOne_NOT = 0x06060606,
Cmp_EQUAL = 0x4a4a4a4a,
Cmp_LESS = (int32_t)0x95959595,
Cmp_GREATER = 0x6c6c6c6c,
Cmp_ERROR = 0x00044400,
SetData_ERROR = 0x00055500,
CheckOrder_ERROR = 0x00066600,
IsZero_ERROR = 0x00077700,
Cpy_ERROR = 0x00088800,
Reverse_ERROR = 0x00099900,
XOR_ERROR = 0x000aaa00,
RandomSort_ERROR = 0x000bbb00,
};
#define TPM_ATTACK() \
{ \
tpm_set_shutdown_mode(); \
return TPM_RC_FAILURE; \
}
#define xor_sum3(a, b, c) ((UINT32)(a) ^ (UINT32)(b) ^ (UINT32)(c))
before preprocessor:
// Load the persistent data
UINT32 infoAddr = 0;
ret = Cpy_U32_sum((UINT32*)&go, (UINT32*)NV_GO_START, sizeof(go) >> 2,
xor_sum3(&go, NV_GO_START, sizeof(go) >> 2));
if (ret != Cpy_OK) {
TPM_ATTACK();
}
after preprocessor:
// Load the persistent data
UINT32 infoAddr = 0;
ret = Cpy_U32_sum((UINT32*)&go, (UINT32*)((((0x6C800 + ((0x5) << 9)) + ((0x2) << 9)) + (0x00000200)) + (0x00000200)), sizeof(go) >> 2,
((UINT32)(&go) ^ (UINT32)(((((0x6C800 + ((0x5) << 9)) + ((0x2) << 9)) + (0x00000200)) + (0x00000200))) ^ (UINT32)(sizeof(go) >> 2)));
if (ret != Cpy_OK) {
{ tpm_set_shutdown_mode(); return (TPM_RC)((TPM_RC)(0x100)+0x001); };
}
a while ago ransomhouse leaked data from some chinese microcontroller company, and it seems nobody really noticed
this company also makes TPMs
a lot of the data looks crypted, but there’s some plaintext in there
including listing files (which for C code seems to be preprocessor debug-output, with single character prefix denoting what the preprocessor did, comments and preprocessor directives and preprocessor output are ALL included) for the firmware of a production TPM implementation
the anti-glitch stuff in particular seems like the usual fare for such, but if you haven’t seen such before then it looks kind of weird:
enum
{
Cpy_OK = 0x55a55aa5,
SetData_OK = 0x7CCF62F2,
XOR_OK = 0x6A17D34A,
RandomSort_OK = 0x51261DC5,
CheckOrder_OK = 0x54830C23,
Reverse_OK = 0x43C94C71,
IsZero_YES = 0x7a7a7a7a,
IsZero_NOT = 0x07070707,
IsOne_YES = 0x6a6a6a6a,
IsOne_NOT = 0x06060606,
Cmp_EQUAL = 0x4a4a4a4a,
Cmp_LESS = (int32_t)0x95959595,
Cmp_GREATER = 0x6c6c6c6c,
Cmp_ERROR = 0x00044400,
SetData_ERROR = 0x00055500,
CheckOrder_ERROR = 0x00066600,
IsZero_ERROR = 0x00077700,
Cpy_ERROR = 0x00088800,
Reverse_ERROR = 0x00099900,
XOR_ERROR = 0x000aaa00,
RandomSort_ERROR = 0x000bbb00,
};
#define TPM_ATTACK() \
{ \
tpm_set_shutdown_mode(); \
return TPM_RC_FAILURE; \
}
#define xor_sum3(a, b, c) ((UINT32)(a) ^ (UINT32)(b) ^ (UINT32)(c))
before preprocessor:
// Load the persistent data
UINT32 infoAddr = 0;
ret = Cpy_U32_sum((UINT32*)&go, (UINT32*)NV_GO_START, sizeof(go) >> 2,
xor_sum3(&go, NV_GO_START, sizeof(go) >> 2));
if (ret != Cpy_OK) {
TPM_ATTACK();
}
after preprocessor:
// Load the persistent data
UINT32 infoAddr = 0;
ret = Cpy_U32_sum((UINT32*)&go, (UINT32*)((((0x6C800 + ((0x5) << 9)) + ((0x2) << 9)) + (0x00000200)) + (0x00000200)), sizeof(go) >> 2,
((UINT32)(&go) ^ (UINT32)(((((0x6C800 + ((0x5) << 9)) + ((0x2) << 9)) + (0x00000200)) + (0x00000200))) ^ (UINT32)(sizeof(go) >> 2)));
if (ret != Cpy_OK) {
{ tpm_set_shutdown_mode(); return (TPM_RC)((TPM_RC)(0x100)+0x001); };
}
0
4
0