@Rairii@haqueers.com
@Rairii@haqueers.com avatar

Rairii

@Rairii@haqueers.com

Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; software preservationist; knows how not to use cryptography.

Currently finding bugs in Windows bootloaders.

You may also know me from capcom.sys.

#nobot

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Rairii, to random
@Rairii@haqueers.com avatar

interesting

fixed one of my dolphin-specific hooks so things actually work (but even slower now as now it's detecting process switches properly and wiping jit cache on all of them)

and now stepping through taskmgr shows user32!CreateDialogParamW crashes

Rairii, to random
@Rairii@haqueers.com avatar

"Microsoft Printer Metadata Troubleshooter Tool December 2023"

includes a build for armv7 NT

...huh.

Rairii, to random
@Rairii@haqueers.com avatar

current status: IOS just stops responding to sdmc read/write commands after a while

not sure if it's something i'm doing wrong or just because i'm hammering this old sd card too much for its liking

will try in wii u vwii with other sd card

Rairii, to random
@Rairii@haqueers.com avatar

current status: fast keymashing causes nt to freeze

...so, as it is now, bottoms can't use it :P

Rairii, to random
@Rairii@haqueers.com avatar

LOL

time to copy arcdisk01.img back to the SD card

autochk decided to delete system32, and i am not joking

Rairii, to random
@Rairii@haqueers.com avatar

so the issue I had was something clobbering code that NT placed at physical address 0x31A0

it appears that the WLAN driver in IOS regularly(?) writes to that location, specifically u16 unk; u8 unk2;

so yeah, avoid that location if you're porting an OS to the Wii, and want to proxy through IOS because you're lazy!

Rairii, to random
@Rairii@haqueers.com avatar

The NetBIOS domain name for Nintendo of America is NOANT

I don't think this is what they had in mind.

(It boots much faster than on emulator)

Rairii, to random
@Rairii@haqueers.com avatar

if i ported NT to the PS2

(kernel patches would be required to work around the missing instructions)

then there'd be a parser for PS/2 scancodes (converted fron USB HID) on the PS2

Rairii, to random
@Rairii@haqueers.com avatar

i think i might put the nt on wii project on hiatus for a while

debugging this hardware weirdness with just dumping state on bugcheck or printf debugging is just going to take too long

i looked at NDEVs on ebay over the last little while, kinda amazed the one priced at £900 or so actually sold, i didn't think it would

Rairii, to random
@Rairii@haqueers.com avatar

NT is on hold, but that doesn't mean I don't have to do more cursed powerpc things. I have an ARC firmware after all

on a completely unrelated note, I'm downloading the ill-fated OS/2 port to PowerPC.

Rairii, to random
@Rairii@haqueers.com avatar

modified the registry HKLM\SYSTEM\Setup!CmdLine to get this

I had to add an extra kernel hook on dolphin to wipe the jit cache on every process switch, because the two really aren't compatible... which tanks performance even more!

and yes, the default name/org before syssetup changes it is Bill Gates.

Rairii, to random
@Rairii@haqueers.com avatar

so, the bugcheck on real hardware was because the cache invalidation in MmMapViewOfSection was causing things to blow up (an exception was taken inside a first level exception handler!)

I added some disc slot-LED blinking to the sdmc driver on activity just so I can get an idea if things have hung or not lol

Rairii, to random
@Rairii@haqueers.com avatar

so yeah, I think next step is to figure out what's fucking up on real hardware lol

Rairii, to random
@Rairii@haqueers.com avatar

SYSSETUP RUNS NOW

Rairii, to random
@Rairii@haqueers.com avatar

how my NT on Wii debugging environment looks like

Rairii, to random
@Rairii@haqueers.com avatar

another null deref in win32k

and judging by the dolphin logs, syssetup is actually running now?

Rairii, to random
@Rairii@haqueers.com avatar

lol

guess what's clobbering the data structure

it's the truetype VM interpreter lol

Rairii, to random
@Rairii@haqueers.com avatar

this bugcheck is in what looks like the font rendering code, yay

Rairii, to random
@Rairii@haqueers.com avatar

hmm

so when it maps sserife.fon something fucks up and the earlier file mapping gets wiped

Rairii, to random
@Rairii@haqueers.com avatar

....ah

the exception handler is inflooping lol

Rairii, to random
@Rairii@haqueers.com avatar

next up: null deref in win32k

Rairii, to random
@Rairii@haqueers.com avatar

...i think i found the issue

kbdclass is configured to initialise 3 keyboard devices

only 1 exists

so trying to open the second device fails, and a bug in kbdclass causes the use of uninitialised pointers when opening the keyboard class device lol

Rairii, to random
@Rairii@haqueers.com avatar

win32k lives!

Rairii, to random
@Rairii@haqueers.com avatar

dammit i just put a breakpoint on the wrong blrl call

it literally takes several minutes for nt to boot :D

Rairii, to random
@Rairii@haqueers.com avatar

very close now!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • provamag3
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • anitta
  • Leos
  • tester
  • JUstTest
  • All magazines