Skip to content

Instantly share code, notes, and snippets.

View tsl0922's full-sized avatar

Shuanglei Tao tsl0922

413 followers · 138 following
  • 12:11 (UTC +08:00)
View GitHub Profile
@hexkyz
hexkyz / tx_unpack.py
Last active November 23, 2024 01:39
###############################################
# TX SX OS unpacker - by hexkyz and naehrwert #
###############################################
from Crypto.Cipher import AES
from Crypto.Util import Counter
import os
import struct
"""
@joeycastillo
joeycastillo / epdnotes.cpp
Created November 30, 2019 00:18
/**************************************************************************/
/*!
@brief Custom lookup tables for full screen updates. Public domain (?) from Waveshare.
@note Video explainer: https://www.youtube.com/watch?v=MsbiO8EAsGw and more info:
https://benkrasnow.blogspot.com/2017/10/fast-partial-refresh-on-42-e-paper.html
@warning YOU CAN PERMANENELY DAMAGE YOUR DISPLAY BY ABUSING THESE LOOKUP TABLES!
Seriously, the controller is incredibly programmable and you can force all
kinds of voltages and timings onto the screen that it wasn't meant to deal
with. TWEAK AT YOUR OWN RISK!
*/
@SciresM
SciresM / gw_flash.py
Last active April 8, 2026 00:49
utility for interacting with gateway modchip updates
import sys
from struct import pack as pk, unpack as up
def u32(x):
return x & 0xFFFFFFFF
def tea_update_custom_mac(mac, v, k):
v0, v1 = v[0], v[1]
cur_sum = 0xC6EF3720
k0, k1, k2, k3 = k[0], k[1], k[2], k[3]
@pixel-stuck
pixel-stuck / writeup.md
Last active March 30, 2024 05:51

Hacking the SX Core modchip

Background

On October 2nd 2020, CVE-2020-15808 was publicly announced, detailing an out-of-bounds memory read/write vulnerability in STM's microcontroller firmware. Any chip containing STM's USB CDC driver library contains the bugged code, which represents a large amount of products on the market. While bugged STM libraries may be bad enough, this problem is much more widespread. Several companies manufacture "clones" of STM chips which, due to mostly identical MMIO (Memory Mapped Input/Output) addresses, fully support the affected STM vendor code. Most clone manufacturers don't offer their own libraries, so developers must either write their own from scratch, or they can use the STM's existing libraries, and most clone manufacturers encourage this.

Armed with this information, I became interested in exploiting and dumping the flash on the "Team Xecuter" SX Core modchip for the Nintendo Switch. The MCU used on the ch

@tsl0922
tsl0922 / input.conf
Last active August 12, 2026 03:10
input config example for https://github.com/tsl0922/mpv-menu-plugin
Ctrl+o script-message-to dialog open #menu: Open > Files...
Ctrl+O script-message-to dialog open-folder #menu: Open > Folder...
_ script-message-to dialog open append #menu: Open > Add To Playlist...
_ ignore #menu: Open > -
_ script-message-to dialog open bd-iso #menu: Open > Bluray ISO...
_ script-message-to dialog open dvd-iso #menu: Open > DVD ISO...
_ ignore #menu: Open > -
Ctrl+v script-message-to dialog open-clipboard #menu: Open > Clipboard
_ ignore #menu: Open > -
Ctrl+R script-binding recentmenu/open #menu: Open > Recently Played #@recent