We started looking at the RCM code.

我们开始查看 RCM 代码。

And it turns out the bug is actually in the RCM code.

事实证明，该错误实际上存在于 RCM 代码中。

And it directly goes into the RCM path.

直接进入 RCM 路径。

This is what one of these RCM messages looks like.

这是其中一条 RCM 消息的样子。

RCM itself is a relatively simple USB protocol using so-called bulk transfers.

RCM 本身是一个相对简单的 USB 协议，使用所谓的批量传输。

And this will most likely be done by code that's being downloaded by RCM.

这很可能是 RCM 的代码完成的。

Of course, we can't just use this because RCM as well enforces security.

当然，我们不能只使用，因为 RCM 也会强制执行安全性。

Then it determines what to do, either boot into RCM or do a warm boot or where to load the boot loader from.

然后确什么，引导进入 RCM 或进行热引导或从何处加引导加程序。

Then we jump into this RCM thing.

然后我们跳进这个 RCM 的事情。

You hold plus, turn it on, and you're in RCM, and you can launch the exploit.

你按住加号，打开，你就在 RCM 中，你可以启动漏洞利用。

It has no other chance than to go into RCM, so we can exploit it.

除了进入 RCM，没有其他机会，所以我们可以利用。

So this RCM message buffer is the header where it checks this length, for example.

因此，例如，此 RCM 消息缓冲区是检查此长度的标头。

So then it copies the payload also into memory into a different place than this RCM message buffer.

因此，将有效负也复制到内存中与此 RCM 消息缓冲区不同的位置。

RCM, I said earlier, this is the other path that you saw earlier when you press a magic button combination or the thing cannot boot.

RCM，我之前说过，这是您之前在按魔术按钮组合或无法启动时看到的另一条路径。

RCM uses the control endpoint, of course, because it has to be there.

当然，RCM 使用控制端点，因为必须在那里。

And then here is the RCM payload buffer.

然后这里是 RCM 有效负缓冲区。

So it never returns from this RCM receive message function.

所以永远不会从此 RCM 接收消息函数返回。

So we have this try load from RCM call.

所以我们从 RCM 调用中尝试加。

For example, this one here is right now used for the bulk transfer to receive the RCM message.

例如，这里的这个现在用于批量传输以接收 RCM 消息。

And then the following code that calls try to load from RCM is just going to jump into the code that you just downloaded.

然后调用尝试从 RCM 加的以代码将跳转到您刚刚的代码中。