Skip to content

Instantly share code, notes, and snippets.

@bwrsandman
bwrsandman / O0-constant_propagation_pass.o
Created March 10, 2019 00:38
constant_propagation_pass optimization issue
O0/constant_propagation_pass.o: file format elf64-x86-64
architecture: i386:x86-64, flags 0x00000011:
HAS_RELOC, HAS_SYMS
start address 0x0000000000000000
Disassembly of section .text:
0000000000000000 <xe::cpu::compiler::passes::ConstantPropagationPass::ConstantPropagationPass()>:
@illusion0001
illusion0001 / gflags.txt
Last active April 5, 2019 23:39
List of gflags available to user.
Updated 04/07/2019
xenia: usage: xenia some.xex
Flags from xenia_main.cc:
--apu (Audio system. Use: [any, nop, xaudio2])
type: string default: "any"
--content_root (Root path for content (save/etc) storage.)
type: string default: ""
--fullscreen (Toggles fullscreen)
type: bool default: false
@ntrf
ntrf / 1-QuickClipExplanation.md
Last active December 27, 2024 13:21
QuickClip explanation.

Each entity in source engine has two hitboxes - one in quake physics world, and another in havok (or vphys) physics world. This second hitbox is called "physics shadow".

Depending on type of the entity one of the hitboxes is dominant. Each frame results of havok physics simulation for barrels, rollermines, vehicles and etc will be copied over quake hitboxes of entities. For NPCs, rockets and elevators state is copied in reverse direction - quake to havok.

Player is special. Normally quake hitbox will overwrite havok shadow, but only if its movement is not blocked by any havok hitboxes. Player's hitbox will be copied in reverse - from havok to quake - if (a) havok hitbox is valid (not stuck in quake world), (b) player is touching a vphys object.

Quickclip works, because in vehicles havok hitbox has collisions masked out for everything except pickups (health, ammo). When you exit a vehicle, collision mask for havok physics should be changed to normal, but only if vehicle is present in the world. Barnacle fo

//
// This file should be used in the following way:
// - reload executable into IDA with using switch -c
// - use File, Load IDC file and load this file.
//
// NOTE: This file doesn't contain all information from the database.
//
#define UNLOADED_FILE 1
#include <idc.idc>

The following is a write-up of how I initially achieved kernel code execution on the Nintendo Switch, very much inspired by hexkyz's write-ups. The work discussed was completed over the course of a single conversation between hthh and I during the evening of November 21st, 2017. A number of snippets are attached from that conversation as inline links, in the hopes that they'll be interesting to readers.

Background information


I would recommend one read hexkyz's recent write-up on how the switch was broken into via GPU DMA attacks. It's a great read!

In particular, he describes:

Additionally, the kernel itself would start allocating memory outside of the carveout region
@bendavis78
bendavis78 / chromeos-recovery.md
Created December 20, 2018 04:06
Chrome OS recovery images manual download
@yifanlu
yifanlu / start.sh
Created December 6, 2018 06:15
PlayStation Classic root shell through UART serial
#!/bin/sh
# THIS IS NOT FOR REGULAR USERS!!!
# You need to solder to the UART port and short the two pads under the PCB near the charger.
# Baud rate: 921600
red_led () {
SLEEP=1
LOOP=1
if [ x"$1" != x ]; then LOOP=$1; fi
@infval
infval / emuparadise.download.user.js
Last active April 11, 2025 01:55
emuparadise.me download workaround (Most games + Sega Dreamcast, Books/Comics/Guides/Magazines)
// ==UserScript==
// @name EmuParadise Download Workaround
// @version 1.2.3
// @description Replaces the download button link with a working one
// @author infval (Eptun)
// @match https://www.emuparadise.me/*/*/*
// @grant none
// ==/UserScript==
// https://www.reddit.com/r/Piracy/comments/968sm6/a_script_for_easy_downloading_of_emuparadise_roms/
// Check if the target format is 7e3 and the conversion is needed (this is
// pretty long, better to branch here).
shader_code_.push_back(ENCODE_D3D10_SB_OPCODE_TYPE(D3D10_SB_OPCODE_IF) |
ENCODE_D3D10_SB_INSTRUCTION_TEST_BOOLEAN(
D3D10_SB_INSTRUCTION_TEST_NONZERO) |
ENCODE_D3D10_SB_TOKENIZED_INSTRUCTION_LENGTH(3));
shader_code_.push_back(
EncodeVectorSelectOperand(D3D10_SB_OPERAND_TYPE_TEMP, 1, 1));
shader_code_.push_back(flags_temp);
++stat_.instruction_count;
# The following is adapted from https://github.com/reswitched/loaders/blob/master/nxo64.py
#
# ===========================================================================================
#
# Copyright 2017 Reswitched Team
#
# Permission to use, copy, modify, and/or distribute this software for any purpose with or
# without fee is hereby granted, provided that the above copyright notice and this permission
# notice appear in all copies.
#