Permanent virtual-network channel deadlock on sun4v (lost RX interrupt).
Affected software: drivers/net/ethernet/sun/sunvnet_common.c — mainline Linux,
all sun4v (LDoms) guests using sunvnet / ldmvsw. Verified on Debian sid
kernel 7.1.4-1 (7.1.4+deb14-sparc64-smp)
| /* SPDX-License-Identifier: GPL-2.0-or-later */ | |
| /* | |
| * FINDING-027 PoC: CXL Set Feature Missing Offset+Size Bounds Check | |
| * → Heap OOB Write | |
| * | |
| * Vulnerability: cmd_features_set_feature() in hw/cxl/cxl-mailbox-utils.c | |
| * handles 8 CXL feature UUIDs. For patrol_scrub and ECS, a bounds check | |
| * validates (hdr->offset + bytes_to_copy <= sizeof(target_struct)). For the | |
| * remaining 6 features (soft_ppr, hard_ppr, cacheline_sparing, row_sparing, | |
| * bank_sparing, rank_sparing), this check is MISSING. |
This report documents a security audit of the SMM (System Management Mode) SMI handlers present in the UEFI firmware image from an Intel NUC (Skylake generation). The firmware is an AMI Aptio V BIOS with clearly named modules. Analysis was performed using IDA Pro with MCP integration (ida-pro-mcp + idasql).
Overall Risk Assessment: CRITICAL
The firmware contains 8 CRITICAL and 3 MEDIUM severity findings (11 total) across 20 SW SMI handler registrations in 11 modules. Three distinct attack surfaces enable arbitrary SMRAM writes:
This report documents a comprehensive audit of SMM (System Management Mode) SMI handlers in the HP Elite Dragonfly laptop EFI firmware image. Using IDA Pro with efiXplorer plugin, the analysis identified ~341 unique module entry points across a 32MB flash image (72,501 functions). The firmware uses Intel Framework SMM Dispatch protocols (not PI SMM Dispatch2), plus PCH-specific dispatch protocols — an older but still common architecture.
Key Findings:
| 0000000000003320 <_aes128_encrypt>: | |
| 3320: 55 pushq %rbp | |
| 3321: 48 89 e5 movq %rsp, %rbp | |
| 3324: 41 57 pushq %r15 | |
| 3326: 41 56 pushq %r14 | |
| 3328: 41 55 pushq %r13 | |
| 332a: 41 54 pushq %r12 | |
| 332c: 53 pushq %rbx | |
| 332d: 48 81 ec f8 00 00 00 subq $248, %rsp | |
| 3334: 48 89 f0 movq %rsi, %rax |
| #!/usr/bin/env python3 | |
| # mini-openclaw.py - A minimal OpenClaw clone | |
| # Run: uv run --with anthropic --with schedule python mini-openclaw.py | |
| import anthropic | |
| import subprocess | |
| import json | |
| import os | |
| import re | |
| import threading |
SyscallProvider is a feature available from Windows 11 22H2, that allows for inline hooking of syscalls.
This unfinished research was done on Windows 11 22H2. The feature is fully undocumented at the moment and it looks like it's locked to Microsoft-signed drivers.
All of the information here was gathered by manual reverse engineering of securekernel.exe, skci.dll and ntoskrnl.exe.
The kernel exports three functions to work with the new feature: PsRegisterSyscallProvider, PsQuerySyscallProviderInformation, PsUnregisterSyscallProvider.
This writeup will explore how this feature is initialized, how it works internally, and how to interact with it and use it.
| #include "pch.h" | |
| #include <shlobj.h> | |
| #include <atlbase.h> | |
| #include <shellapi.h> | |
| #pragma comment(lib, "shell32.lib") | |
| const wchar_t* CLSID_CMSTPLUA = L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"; | |
| const wchar_t* IID_ICMLuaUtil = L"{6EDD6D74-C007-4E75-B76A-E5740995E24C}"; |
FOR EDUCATIONAL PURPOSE ONLY, CHANGING IMEI IS ILLEGAL IN MOST COUNTRIES, MAKE SURE YOU CONVINCE YOUR ACTIONS BEFORE DOING THIS.
I DON'T RESPONSIBLE IF YOUR DEVICE IS BROKEN OR THE IMEI IS NOT CHANGED CAUSED BY YOU DIDN'T FOLLOW THE STEPS CAREFULLY OR HAVING A DIFFERENT EFS PARTITION SCHEME.
This guide was tested on Google Pixel 3, different device may also have a different EFS partition scheme, please make sure you adjust it with this guide. Other Google Pixel devices may use this guide without adjusting.
