Bilingual

Apple Neural Engine: Architecture, Programming, and Performance
25 days ago
- The Apple Neural Engine (ANE) is a fixed-function matrix accelerator used in Apple A11 through A18 and M1 through M5 chips.
- It is accessible through Core ML, but this article reverse-engineers its architecture, programming, and performance via direct measurements and static analysis.
- Documentation includes the datapath, roofline model, dispatch route, compiler, on-disk program format, weight compression, and kernel driver/firmware.
- Direct measurements were performed on M1 and M5 chips, with claims categorized as measured, decompile-derived, or predicted.
- An undocumented user-space callable route is described, intended for research and measurement, not for shipping software, where Core ML remains the supported path.
FSF Librephone update: Ensuring freedom, one blob at a time
21 days ago
- The Free Software Foundation (FSF) supports the GNU Project, which creates important free software and inspires advocacy for software freedom.
- FSF launched LibrePhone to reverse-engineer nonfree blobs in mobile SoCs, focusing on radio blobs for WiFi, Bluetooth, NFC, and cellular communications to advance mobile phone freedom.
- Lead developer Rob Savoye extracted firmware from over 200 Lineage packages, processed 85GB of files, and found shared software across devices, accelerating progress.
- Despite challenges like proprietary baseband firmware and threats to digital rights, FSF continues developing free software, with each freed blob representing progress.
- Free software powers two-thirds of internet servers, all top 500 supercomputers, and 98% of codebases, with widespread use on personal devices, showcasing the impact of the four freedoms.
- LibrePhone is a long-term project requiring time, financial support, and volunteers, similar to the GNU Project, to achieve free mobile phone computing.
Reverse-engineering Codemasters' BIGF archive format in Ruby
23 days ago
- Ruby's strings can be used as byte buffers, making it suitable for reverse-engineering binary file formats, particularly with `File.binread` and slicing operations.
- The `String#unpack` method is a key tool in Ruby for decoding binary data, supporting directives for integers and floats with specified endianness, and it is fast due to being C-implemented.
- Ruby allows reading binary files without external dependencies, using standard library features to handle tasks like parsing headers, directories, and data sections, and providing REPL support for interactive exploration.
- The article details parsing Codemasters' BIGF archive format, including handling different directory layouts, classifying records by bit patterns, and addressing issues like NaN values and endianness.
- Ruby's ergonomic features, such as string slicing, NUL-terminated string handling, and clear code that mirrors specifications, make it effective for reverse-engineering tasks.
Protocol Prying: Vulnerability Research in AirDrop and Quick Share
18 days ago
- First systematic security study of Apple AirDrop and Google/Samsung Quick Share proximity file-transfer protocols, used by over 5 billion devices.
- Reverse-engineered AirDrop's seven-layer state machine and DVZip compression, and built AIRFUZZ for protocol-aware fuzzing.
- Discovered six vulnerabilities: three in AirDrop (e.g., Swift DoS, XML recursion), two in Samsung Quick Share (e.g., encryption bypass), and one in Google Quick Share for Windows (heap use-after-free).
- Responsible disclosure led to acknowledgments from Apple, Samsung, and Google, with a bounty awarded for one vulnerability.
Why 'com_maxfps 250x' uncaps Quake Live's frame rate
11 days ago
- A Discord community event involved playing Quake Live, prompting the author to check game settings and refresh rate.
- The author discovered a bug where setting com_maxfps to '250x' bypassed the 250 FPS cap, allowing up to 1000 FPS due to a parsing error in Cvar_ParseInteger().
- Analysis revealed the bug occurred because strstr() incorrectly identified '250x' as a hex string, leading sscanf() to fail and return 0, while clamping used the float value (250.0), not the integer.
- The bug was specific to Quake Live, as Quake 3 used atoi() for parsing, and no other cvars were found to exploit this issue.

Hasty Briefsbeta

#reverse engineering

Apple Neural Engine: Architecture, Programming, and Performance

FSF Librephone update: Ensuring freedom, one blob at a time

Reverse-engineering Codemasters' BIGF archive format in Ruby

Protocol Prying: Vulnerability Research in AirDrop and Quick Share

Why 'com_maxfps 250x' uncaps Quake Live's frame rate