Then we jump into this RCM thing.

然后我们跳进 RCM 的事情。

For example, this one here is right now used for the bulk transfer to receive the RCM message.

例如，里的在于批量传输以接收 RCM 消息。

So it never returns from this RCM receive message function.

所以它永远不会从此 RCM 接收消息函数返回。

So then it copies the payload also into memory into a different place than this RCM message buffer.

因此，它将有效负载也复制到内存中与此 RCM 消息缓冲区不同的位置。

And it turns out the bug is actually in the RCM code.

事实证明，该错误实际上存在于 RCM 代中。

RCM, I said earlier, this is the other path that you saw earlier when you press a magic button combination or the thing cannot boot.

RCM，我之前说过，是您之前在按下魔术按钮组合或无法启动时看到的另条路径。

So we have this try load from RCM call.

所以我们从 RCM 中尝试加载。

It has no other chance than to go into RCM, so we can exploit it.

除了进入 RCM，它没有其他机会，所以我们可以利它。

After that, we call a function that's called RCM receive message.

之后，我们名为 RCM 接收消息的函数。

RCM uses the control endpoint, of course, because it has to be there.

当然，RCM 使控制端点，因为它必须在那里。

And the bulk endpoint is used to move the RCM messages that are used to download code or query the version and so on to the device.

批量端点于将于下载代或查询版本等的 RCM 消息移动到设备。

So this RCM message buffer is the header where it checks this length, for example.

因此，例如，此 RCM 消息缓冲区是检查此长度的标头。

And then the following code that calls try to load from RCM is just going to jump into the code that you just downloaded.

然后尝试从 RCM 加载的以下代将跳转到您刚刚下载的代中。

Of course, we can't just use this because RCM as well enforces security.

当然，我们不能只使它，因为 RCM 也会强制执行安全性。

And then we jump to a function that's called RCM prot handle message, where it's jumping to the code or it's responding with the version information that you requested and so on.

然后我们跳转到称为 RCM prot handle message 的函数，它会跳转到代或使您请求的版本信息等进行响应。

And yeah, we just put our code here into that RCM payload.

是的，我们只是将我们的代放入 RCM 负载中。

And this struct contains all the important things that the RCM code needs to know to verify that message, the signature of that message, and what it's supposed to do.

此结构包含 RCM 代验证该消息、该消息的签名以及它应该执行的操作所需知道的所有重要内容。

You already have kernel code execution due to some other hack, and you can just set this PMC scratch register and reboot, and then the ROM sees this and just goes into the RCM path.

由于其他些 hack，您已经执行了内核代，您只需设置此 PMC 暂存寄存器并重新启动，然后 ROM 会看到它并进入 RCM 路径。

We started looking at the RCM code.

我们开始查看 RCM 代。

Then we have this RCM receive message where it puts the header in one place and the payload in the other place.

然后我们有 RCM 接收消息，它将标头放在地方，将有效负载放在另地方。