We started looking at the RCM code.

我们开始查看 RCM 代码。

And it turns out the bug is actually in the RCM code.

事实证明，该错误实际上存在于 RCM 代码中。

And it directly goes into the RCM path.

直接进入 RCM 路。

This is what one of these RCM messages looks like.

其中一条 RCM 消息的样子。

RCM itself is a relatively simple USB protocol using so-called bulk transfers.

RCM 本身一个相对简单的 USB 协议，使用所谓的批量传输。

And this will most likely be done by code that's being downloaded by RCM.

很可能由 RCM 下载的代码完成的。

Of course, we can't just use this because RCM as well enforces security.

当然，我们不能只使用，因为 RCM 也会强制执行安全性。

Then it determines what to do, either boot into RCM or do a warm boot or where to load the boot loader from.

然后确定要做什么，引导进入 RCM 或进行热引导或从何处加载引导加载程序。

Then we jump into this RCM thing.

然后我们跳进个 RCM 的事情。

You hold plus, turn it on, and you're in RCM, and you can launch the exploit.

加号，打开，就在 RCM 中，可以启动漏洞利用。

It has no other chance than to go into RCM, so we can exploit it.

除了进入 RCM，没有其他机会，所以我们可以利用。

So this RCM message buffer is the header where it checks this length, for example.

因此，例如，此 RCM 消息缓冲区检查此长度的标头。

So then it copies the payload also into memory into a different place than this RCM message buffer.

因此，将有效负载也复制到内存中与此 RCM 消息缓冲区不同的位置。

RCM, I said earlier, this is the other path that you saw earlier when you press a magic button combination or the thing cannot boot.

RCM，我之前说过，您之前在下魔术钮组合或无法启动时看到的另一条路。

RCM uses the control endpoint, of course, because it has to be there.

当然，RCM 使用控制端点，因为必须在那里。

And then here is the RCM payload buffer.

然后里 RCM 有效负载缓冲区。

So it never returns from this RCM receive message function.

所以永远不会从此 RCM 接收消息函数返回。

So we have this try load from RCM call.

所以我们从 RCM 调用中尝试加载。

For example, this one here is right now used for the bulk transfer to receive the RCM message.

例如，里的个现在用于批量传输以接收 RCM 消息。

And then the following code that calls try to load from RCM is just going to jump into the code that you just downloaded.

然后调用尝试从 RCM 加载的以下代码将跳转到您刚刚下载的代码中。