Bilingual

Apple Neural Engine: Architecture, Programming, and Performance
a month ago
- The Apple Neural Engine (ANE) is a fixed-function matrix accelerator used in Apple A11 through A18 and M1 through M5 chips.
- It is accessible through Core ML, but this article reverse-engineers its architecture, programming, and performance via direct measurements and static analysis.
- Documentation includes the datapath, roofline model, dispatch route, compiler, on-disk program format, weight compression, and kernel driver/firmware.
- Direct measurements were performed on M1 and M5 chips, with claims categorized as measured, decompile-derived, or predicted.
- An undocumented user-space callable route is described, intended for research and measurement, not for shipping software, where Core ML remains the supported path.
FSF Librephone update: Ensuring freedom, one blob at a time
25 days ago
- The Free Software Foundation (FSF) supports the GNU Project, which creates important free software and inspires advocacy for software freedom.
- FSF launched LibrePhone to reverse-engineer nonfree blobs in mobile SoCs, focusing on radio blobs for WiFi, Bluetooth, NFC, and cellular communications to advance mobile phone freedom.
- Lead developer Rob Savoye extracted firmware from over 200 Lineage packages, processed 85GB of files, and found shared software across devices, accelerating progress.
- Despite challenges like proprietary baseband firmware and threats to digital rights, FSF continues developing free software, with each freed blob representing progress.
- Free software powers two-thirds of internet servers, all top 500 supercomputers, and 98% of codebases, with widespread use on personal devices, showcasing the impact of the four freedoms.
- LibrePhone is a long-term project requiring time, financial support, and volunteers, similar to the GNU Project, to achieve free mobile phone computing.
Reverse-engineering Codemasters' BIGF archive format in Ruby
a month ago
- Ruby's strings can be used as byte buffers, making it suitable for reverse-engineering binary file formats, particularly with `File.binread` and slicing operations.
- The `String#unpack` method is a key tool in Ruby for decoding binary data, supporting directives for integers and floats with specified endianness, and it is fast due to being C-implemented.
- Ruby allows reading binary files without external dependencies, using standard library features to handle tasks like parsing headers, directories, and data sections, and providing REPL support for interactive exploration.
- The article details parsing Codemasters' BIGF archive format, including handling different directory layouts, classifying records by bit patterns, and addressing issues like NaN values and endianness.
- Ruby's ergonomic features, such as string slicing, NUL-terminated string handling, and clear code that mirrors specifications, make it effective for reverse-engineering tasks.
Protocol Prying: Vulnerability Research in AirDrop and Quick Share
22 days ago
- First systematic security study of Apple AirDrop and Google/Samsung Quick Share proximity file-transfer protocols, used by over 5 billion devices.
- Reverse-engineered AirDrop's seven-layer state machine and DVZip compression, and built AIRFUZZ for protocol-aware fuzzing.
- Discovered six vulnerabilities: three in AirDrop (e.g., Swift DoS, XML recursion), two in Samsung Quick Share (e.g., encryption bypass), and one in Google Quick Share for Windows (heap use-after-free).
- Responsible disclosure led to acknowledgments from Apple, Samsung, and Google, with a bounty awarded for one vulnerability.
Why 'com_maxfps 250x' uncaps Quake Live's frame rate
15 days ago
- A Discord community event involved playing Quake Live, prompting the author to check game settings and refresh rate.
- The author discovered a bug where setting com_maxfps to '250x' bypassed the 250 FPS cap, allowing up to 1000 FPS due to a parsing error in Cvar_ParseInteger().
- Analysis revealed the bug occurred because strstr() incorrectly identified '250x' as a hex string, leading sscanf() to fail and return 0, while clamping used the float value (250.0), not the integer.
- The bug was specific to Quake Live, as Quake 3 used atoi() for parsing, and no other cvars were found to exploit this issue.
Show HN: Discrete6502 – one thing led to another
5 hours ago
- The project rebuilds the MOS 6502 CPU using 4,051 individual discrete transistors (SOT-323 packages) on a large A4-sized board, replicating the original silicon die layout transistor-for-transistor.
- It uses the original dynamic NMOS logic design, not static logic, relying on charge stored on wire capacitance and requiring clock refresh, with 1,023 pull-up resistors replacing depletion-mode loads.
- The board operates at 10–20 kHz (vs. 1 MHz original) to allow visual observation of operation; it includes 55 register LEDs to show CPU state.
- Verification is done entirely through simulation and netlist equivalence before fabrication, with no physical board yet built; the first power-up is the real test.
- A Raspberry Pi Pico 2 W provides clock and memory emulation, making the board self-contained for testing.

Hasty Briefsbeta

reverse engineering

Apple Neural Engine: Architecture, Programming, and Performance

FSF Librephone update: Ensuring freedom, one blob at a time

Reverse-engineering Codemasters' BIGF archive format in Ruby

Protocol Prying: Vulnerability Research in AirDrop and Quick Share

Why 'com_maxfps 250x' uncaps Quake Live's frame rate

Show HN: Discrete6502 – one thing led to another