@ecopoesis/homebridge-dmx 0.1.0

package/tools/extract-frame.mjs

@@ -0,0 +1,78 @@
+// Extract one 576-byte DMX payload from a tcpdump pcap file.
+//
+// pcap format (libpcap, little-endian):
+//   24-byte global header  (magic d4c3b2a1 or a1b2c3d4)
+//   per-packet records:
+//     16-byte record header (ts_sec, ts_usec, cap_len, orig_len)
+//     <cap_len> bytes of raw frame (ethernet+IP+UDP+payload)
+//
+// We look for any packet whose IP/UDP demux says: dst=STICK_IP:STICK_PORT
+// and UDP payload length == 576.
+
+import fs from 'node:fs';
+
+const STICK_IP   = process.env.STICK_IP   || '192.168.96.2';
+const STICK_PORT = Number(process.env.STICK_PORT || 2431);
+
+const [, , pcapPath, outPath] = process.argv;
+if (!pcapPath || !outPath) {
+  console.error('usage: node tools/extract-frame.mjs <input.pcap> <output.bin>');
+  process.exit(1);
+}
+
+const buf = fs.readFileSync(pcapPath);
+if (buf.length < 24) { console.error('pcap too small'); process.exit(2); }
+
+// Magic constant `0xa1b2c3d4` is written in the writer's native byte order.
+// Reading the first 4 bytes as LE: 0xa1b2c3d4 -> file is LE
+//                                  0xd4c3b2a1 -> file is BE
+const magic = buf.readUInt32LE(0);
+let le;
+if      (magic === 0xa1b2c3d4) le = true;
+else if (magic === 0xd4c3b2a1) le = false;
+else { console.error(`unknown pcap magic 0x${magic.toString(16)}`); process.exit(2); }
+
+const linkType = le ? buf.readUInt32LE(20) : buf.readUInt32BE(20);
+// linkType 1 = Ethernet, 0 = BSD loopback / NULL header (4 bytes)
+const ethSkip = (linkType === 1) ? 14 : (linkType === 0 ? 4 : 14);
+
+let off = 24;
+let pkts = 0, matched = 0;
+while (off + 16 <= buf.length) {
+  const tsSec  = le ? buf.readUInt32LE(off)     : buf.readUInt32BE(off);
+  const tsUsec = le ? buf.readUInt32LE(off + 4) : buf.readUInt32BE(off + 4);
+  const capLen = le ? buf.readUInt32LE(off + 8) : buf.readUInt32BE(off + 8);
+  off += 16;
+  if (off + capLen > buf.length) break;
+  pkts++;
+  const pkt = buf.subarray(off, off + capLen);
+  off += capLen;
+
+  // Parse Ethernet/Null + IPv4 + UDP
+  if (pkt.length < ethSkip + 28) continue;
+  const ip = pkt.subarray(ethSkip);
+  const ihl = (ip[0] & 0x0f) * 4;
+  const proto = ip[9];
+  if (proto !== 17) continue; // not UDP
+
+  const srcIp = `${ip[12]}.${ip[13]}.${ip[14]}.${ip[15]}`;
+  const dstIp = `${ip[16]}.${ip[17]}.${ip[18]}.${ip[19]}`;
+  const udp = ip.subarray(ihl);
+  if (udp.length < 8) continue;
+  const srcPort = udp.readUInt16BE(0);
+  const dstPort = udp.readUInt16BE(2);
+  const udpLen  = udp.readUInt16BE(4);
+  const payload = udp.subarray(8, udpLen);
+
+  if (dstIp === STICK_IP && dstPort === STICK_PORT) {
+    matched++;
+    console.error(`  match #${matched}: ${srcIp}:${srcPort} -> ${dstIp}:${dstPort}  payload=${payload.length}B`);
+    if (payload.length === 576) {
+      fs.writeFileSync(outPath, payload);
+      console.error(`OK: wrote 576-byte payload to ${outPath}`);
+      process.exit(0);
+    }
+  }
+}
+console.error(`scanned ${pkts} packets, ${matched} matched dst, no 576B payload found`);
+process.exit(3);

package/tools/find-011c-key.mjs

@@ -0,0 +1,140 @@
+// Brute-force search for the AES-256 key that decrypts the 0x011c reply.
+//
+// We have constraints on the plaintext:
+//   - 240 bytes = 15 AES-CBC blocks decrypts to 236-byte useful body + 4 padding
+//   - Padding is either PKCS#7 (`04 04 04 04`) or zero-fill (`00 00 00 00`)
+//   - Per HWM (FUN_1001676a0), plaintext has a self-consistency check:
+//     plaintext[0..4] == ~plaintext[0x64..0x68] (bitwise-complement)
+//
+// Strategy: walk every 32-byte aligned offset of the HardwareManager binary
+// and try that 32 bytes as an AES-256 key against a captured (IV, ciphertext).
+// Pre-filter by padding tail; secondary-filter by the complement check.
+//
+//   node tools/find-011c-key.mjs <pcap> <hwm-binary>
+
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+
+const [, , pcapPath, hwmPath] = process.argv;
+if (!pcapPath || !hwmPath) {
+  console.error('usage: node tools/find-011c-key.mjs <pcap> <hwm-binary>');
+  process.exit(1);
+}
+
+// --- extract one 0x011c reply ---------------------------------------------
+function extractFirstReply(pcap) {
+  const buf = fs.readFileSync(pcap);
+  const le = buf.readUInt32LE(0) === 0xa1b2c3d4;
+  function ipFromEth(p) {
+    if (p.length < 14) return null;
+    let o = 12, e = p.readUInt16BE(o);
+    for (let i = 0; i < 2 && e === 0x8100; i++) { o += 4; if (o+2>p.length) return null; e = p.readUInt16BE(o); }
+    return e === 0x0800 ? p.subarray(o + 2) : null;
+  }
+  const streams = new Map();
+  let off = 24;
+  while (off + 16 <= buf.length) {
+    const capLen = le ? buf.readUInt32LE(off + 8) : buf.readUInt32BE(off + 8);
+    off += 16; if (off + capLen > buf.length) break;
+    const pkt = buf.subarray(off, off + capLen); off += capLen;
+    const ip = ipFromEth(pkt); if (!ip || ip.length < 20 || ((ip[0]>>4)&0xf)!==4) continue;
+    const ihl = (ip[0]&0x0f)*4; if (ip[9]!==6) continue;
+    const tcp = ip.subarray(ihl);
+    if (tcp.readUInt16BE(0) !== 2431) continue;
+    const seq = tcp.readUInt32BE(4);
+    const dataOff = (tcp[12]>>4)*4;
+    const payload = tcp.subarray(dataOff);
+    if (!payload.length) continue;
+    const key = `${ip[12]}.${ip[13]}.${ip[14]}.${ip[15]}:${tcp.readUInt16BE(0)}->${ip[16]}.${ip[17]}.${ip[18]}.${ip[19]}:${tcp.readUInt16BE(2)}`;
+    if (!streams.has(key)) streams.set(key, []);
+    streams.get(key).push({ seq, payload });
+  }
+  for (const segs of streams.values()) {
+    segs.sort((a,b)=>(a.seq-b.seq+0x100000000)%0x100000000);
+    const seen = new Set(); const out = [];
+    const base = segs[0].seq;
+    for (const s of segs) {
+      const k = `${s.seq}:${s.payload.length}`; if (seen.has(k)) continue; seen.add(k);
+      const o = (s.seq-base+0x100000000)%0x100000000;
+      while (out.length < o + s.payload.length) out.push(0);
+      for (let i = 0; i < s.payload.length; i++) out[o+i] = s.payload[i];
+    }
+    const r = Buffer.from(out);
+    for (let i = 0; i + 24 <= r.length; i++) {
+      if (r.subarray(i,i+8).toString() !== 'Stick_3A') continue;
+      if (r.readUInt16LE(i+8) !== 0x011c) continue;
+      const len = r.readUInt32LE(i+0x14);
+      if (len !== 284) continue;
+      const msg = r.subarray(i, i + 284);
+      return { iv: Buffer.from(msg.subarray(0x1a, 0x2a)), ct: Buffer.from(msg.subarray(0x2c, 0x2c + 240)) };
+    }
+  }
+  return null;
+}
+
+const reply = extractFirstReply(pcapPath);
+if (!reply) { console.error('no 0x011c reply in', pcapPath); process.exit(2); }
+console.log(`reply: IV=${reply.iv.toString('hex')}`);
+console.log(`ct[0:32]=${reply.ct.subarray(0,32).toString('hex')}`);
+
+// --- candidate key generator ----------------------------------------------
+const bin = fs.readFileSync(hwmPath);
+console.log(`binary: ${hwmPath}  ${bin.length} bytes`);
+
+// Try every 32-byte aligned offset.  Also try byte-aligned (stride 1) for the
+// last-pass.  Reject keys that are obviously not credible (all zero, all FF).
+function isBoring(k) {
+  let z = 0, ff = 0, distinct = new Set();
+  for (const b of k) { if (b===0) z++; if (b===0xff) ff++; distinct.add(b); }
+  if (z > 20 || ff > 20) return true;
+  if (distinct.size < 6) return true;
+  return false;
+}
+
+// Decrypt one block trial: returns Buffer or null on AES error
+function dec(keyBuf, iv, ct) {
+  try {
+    const d = crypto.createDecipheriv('aes-256-cbc', keyBuf, iv);
+    d.setAutoPadding(false);
+    return Buffer.concat([d.update(ct), d.final()]);
+  } catch { return null; }
+}
+
+// Validation:
+//  1. last 4 bytes of plaintext must be 04 04 04 04  OR  00 00 00 00
+//  2. plaintext[0..4]  XOR  plaintext[0x64..0x68]  ==  0xff,0xff,0xff,0xff
+function isValid(pt) {
+  if (!pt) return null;
+  const t0 = pt[236], t1 = pt[237], t2 = pt[238], t3 = pt[239];
+  const isPkcs7 = t0===4 && t1===4 && t2===4 && t3===4;
+  const isZero  = t0===0 && t1===0 && t2===0 && t3===0;
+  if (!isPkcs7 && !isZero) return null;
+  // self-consistency check
+  let comp = true;
+  for (let i = 0; i < 4; i++) {
+    if (((pt[i] ^ pt[0x64+i]) & 0xff) !== 0xff) { comp = false; break; }
+  }
+  return { padKind: isPkcs7 ? 'pkcs7' : 'zero', comp };
+}
+
+console.log('\n=== pass 1: 32-byte aligned candidates ===');
+let tested = 0, hits = 0;
+for (let i = 0; i + 32 <= bin.length; i += 8) {       // 8-byte alignment is reasonable
+  const k = bin.subarray(i, i + 32);
+  if (isBoring(k)) continue;
+  const pt = dec(k, reply.iv, reply.ct);
+  tested++;
+  const v = isValid(pt);
+  if (v) {
+    hits++;
+    console.log(`  HIT @ 0x${i.toString(16)}  pad=${v.padKind}  comp=${v.comp}`);
+    console.log(`     key = ${k.toString('hex')}`);
+    console.log(`     pt[0..32]   = ${pt.subarray(0,32).toString('hex')}`);
+    console.log(`     pt[0x60..]  = ${pt.subarray(0x60,0x80).toString('hex')}`);
+    if (v.comp) console.log(`     *** complement check PASSED -- almost certainly the key ***`);
+  }
+  if (tested % 500000 === 0) {
+    console.log(`  ... tested ${tested}, hits=${hits}`);
+  }
+}
+console.log(`done: tested=${tested}  hits=${hits}`);

package/tools/find-iv.mjs

@@ -0,0 +1,153 @@
+// Recover the AES-256-CBC first-block IV construction from a pcap of frames.
+//
+// With the key known, for every frame:  D(key,C0) = IV XOR P0.
+// If the DMX state is constant across the capture, P0 is the same in every
+// frame, so for the CORRECT IV construction H(header):
+//     D(key,C0) XOR H(header)  ==  P0  ==  the same constant in every frame.
+// We test each candidate H and look for one that yields a frame-invariant
+// residual. That residual is P0 (block-0 plaintext); H is the IV rule.
+//
+// Usage:
+//   node tools/find-iv.mjs <capture.pcap> [key-hex]
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+
+const DEFAULT_KEY =
+  '531e1b9f097be5de5785f5bf86473da34839fabb76676e95c0e4b808b42f8ac0';
+
+const [, , pcapPath, keyArg] = process.argv;
+if (!pcapPath) { console.error('usage: node tools/find-iv.mjs <capture.pcap> [key-hex]'); process.exit(1); }
+const key = Buffer.from((keyArg || DEFAULT_KEY).replace(/\s/g, ''), 'hex');
+if (key.length !== 32) { console.error('key must be 32 bytes'); process.exit(1); }
+
+// --- parse pcap, collect every 576-byte UDP payload to the Stick ----------
+const STICK_IP = process.env.STICK_IP || '192.168.96.2';
+const STICK_PORT = Number(process.env.STICK_PORT || 2431);
+const buf = fs.readFileSync(pcapPath);
+const magic = buf.readUInt32LE(0);
+const le = magic === 0xa1b2c3d4;
+if (!le && magic !== 0xd4c3b2a1) { console.error('bad pcap magic'); process.exit(2); }
+const linkType = le ? buf.readUInt32LE(20) : buf.readUInt32BE(20);
+const ethSkip = linkType === 1 ? 14 : linkType === 0 ? 4 : 14;
+
+const frames = [];
+let off = 24;
+while (off + 16 <= buf.length) {
+  const capLen = le ? buf.readUInt32LE(off + 8) : buf.readUInt32BE(off + 8);
+  off += 16;
+  if (off + capLen > buf.length) break;
+  const pkt = buf.subarray(off, off + capLen);
+  off += capLen;
+  if (pkt.length < ethSkip + 28) continue;
+  const ip = pkt.subarray(ethSkip);
+  if (ip[9] !== 17) continue;                            // not UDP
+  const dstIp = `${ip[16]}.${ip[17]}.${ip[18]}.${ip[19]}`;
+  const udp = ip.subarray((ip[0] & 0x0f) * 4);
+  if (udp.length < 8) continue;
+  const dstPort = udp.readUInt16BE(2);
+  const payload = udp.subarray(8, udp.readUInt16BE(4));
+  if (dstIp === STICK_IP && dstPort === STICK_PORT && payload.length === 576)
+    frames.push(Buffer.from(payload));
+}
+console.log(`parsed ${frames.length} encrypted 576-byte frames from ${pcapPath}`);
+if (frames.length < 2) { console.error('need at least 2 frames'); process.exit(3); }
+
+// --- D(key,C0) for each frame --------------------------------------------
+function decBlock0(frame) {
+  const d = crypto.createDecipheriv('aes-256-cbc', key, Buffer.alloc(16));
+  d.setAutoPadding(false);
+  return d.update(frame.subarray(0x20, 0x30));            // D(key,C0), IV=0
+}
+function ecb(block) {
+  const c = crypto.createCipheriv('aes-256-ecb', key, null);
+  c.setAutoPadding(false);
+  return Buffer.concat([c.update(block), c.final()]);
+}
+function xor(a, b) {
+  const o = Buffer.alloc(16);
+  for (let i = 0; i < 16; i++) o[i] = a[i] ^ b[i];
+  return o;
+}
+
+const recs = frames.map(f => ({
+  hdr: f.subarray(0, 0x20),
+  nonce: Buffer.from(f.subarray(0x18, 0x20)),
+  fieldA: Buffer.from(f.subarray(0x0a, 0x12)),
+  dt0: decBlock0(f),
+}));
+
+// also reuse the per-session key material A||B from the Path C device dump,
+// if present — the IV might be keyed on that instead.
+let AB = null;
+try {
+  const dev = fs.readFileSync(
+    fs.readdirSync('/tmp').filter(f => /^stick-pathC-blob-device_/.test(f))
+      .map(f => '/tmp/' + f)[0]);
+  // cipher_obj = device + 0x1618 ; A||B at cipher_obj + 0x28
+  AB = Buffer.from(dev.subarray(0x1618 + 0x28, 0x1618 + 0x28 + 32));
+  console.log(`loaded A||B from device dump: ${AB.toString('hex')}`);
+} catch { /* optional */ }
+
+const z8 = Buffer.alloc(8);
+function blocks(r) {
+  const b = [
+    ['nonce|0',      Buffer.concat([r.nonce, z8])],
+    ['0|nonce',      Buffer.concat([z8, r.nonce])],
+    ['nonce|nonce',  Buffer.concat([r.nonce, r.nonce])],
+    ['fieldA|nonce', Buffer.concat([r.fieldA, r.nonce])],
+    ['nonce|fieldA', Buffer.concat([r.nonce, r.fieldA])],
+    ['hdr[0:16]',    Buffer.from(r.hdr.subarray(0, 16))],
+    ['hdr[16:32]',   Buffer.from(r.hdr.subarray(16, 32))],
+    ['hdr[10:26]',   Buffer.from(r.hdr.subarray(0x0a, 0x1a))],
+    ['nonce|nonceR', Buffer.concat([r.nonce, Buffer.from(r.nonce).reverse()])],
+  ];
+  return b;
+}
+
+// --- test each construction for a frame-invariant residual ---------------
+function evaluate(label, hOf) {
+  const tally = new Map();
+  for (const r of recs) {
+    const resid = xor(r.dt0, hOf(r)).toString('hex');
+    tally.set(resid, (tally.get(resid) || 0) + 1);
+  }
+  let best = null;
+  for (const [resid, n] of tally)
+    if (!best || n > best.n) best = { resid, n };
+  return { label, frac: best.n / recs.length, resid: best.resid, distinct: tally.size };
+}
+
+const names = blocks(recs[0]).map(([n]) => n);
+const results = [];
+for (let i = 0; i < names.length; i++) {
+  const name = names[i];
+  results.push(evaluate(`IV = ${name}`, r => blocks(r)[i][1]));
+  results.push(evaluate(`IV = AES(key, ${name})`, r => ecb(blocks(r)[i][1])));
+  if (AB) {
+    const abEcb = (blk) => {
+      const c = crypto.createCipheriv('aes-256-ecb', AB, null);
+      c.setAutoPadding(false);
+      return Buffer.concat([c.update(blk), c.final()]);
+    };
+    results.push(evaluate(`IV = AES(A||B, ${name})`, r => abEcb(blocks(r)[i][1])));
+  }
+}
+
+results.sort((a, b) => b.frac - a.frac);
+console.log();
+console.log('IV construction — fraction of frames sharing one residual (=P0):');
+for (const r of results.slice(0, 12))
+  console.log(`  ${(r.frac * 100).toFixed(1).padStart(5)}%  ${r.label.padEnd(26)}` +
+              `  ${r.frac > 0.8 ? 'P0=' + r.resid : `(${r.distinct} distinct)`}`);
+
+console.log();
+const win = results[0];
+if (win.frac > 0.8) {
+  console.log(`✅ IV CONSTRUCTION: ${win.label}`);
+  console.log(`   block-0 plaintext P0 = ${win.resid}`);
+} else {
+  console.log('⚠️  no construction gives a frame-invariant residual.');
+  console.log('   Either the DMX state changed during capture, or the IV uses');
+  console.log('   inputs not tested here. The residual counts above hint which.');
+}

package/tools/ghidra/README.md

@@ -0,0 +1,136 @@
+# Stick-DE3 DMX cipher RE — Ghidra static analysis
+
+Headless pyghidra scripts that reverse-engineer the DMX cipher in the
+**2024-03-21 ESA2 HardwareManager** binary at:
+
+```
+/Applications/ESA2/HardwareManager/HardwareManager.app/Contents/MacOS/HardwareManager
+```
+
+Static RE *replaces* the prior interactive-lldb attempts (see
+`memory/stick-aes-symbolized-breakthrough.md` for what didn't work, and
+`memory/stick-cipher-is-stream-not-aes.md` for what's now known).
+
+## TL;DR — the cipher IS AES-128 (with mode dispatch)
+
+The Stick3 DMX cipher is **AES-128** (custom-inlined, not Gladman), running
+in CBC or CFB mode depending on a flag in the cipher state. Earlier in this
+RE session I briefly concluded "stream cipher, not AES" — that was wrong;
+I had been looking at a sibling class (`XHL_DasEccStreamCryptography`, used
+for USB devices) whose encrypt path uses a small-state stream cipher. The
+*Stick3 ANet* path doesn't go through that. The real AES path is via
+`FUN_100107950` → `FUN_1003f6790` (CBC) / `FUN_1003f5140` (CFB) → block
+cipher at `FUN_1003f5980` / `FUN_1003f4690` with S-box at `DAT_1007c0010`.
+
+576-byte DMX frame format:
+
+```
++0x00 (8B)   session_magic    table @ DAT_100d11a90 + idx*0x0E
++0x08 (2B)   0x0019           constant
++0x0A (8B)   8-byte from vtable slot 0x78
++0x12 (2B)   port16
++0x14 (2B)   channel count (≤512)
++0x16 (1B)   100              constant
++0x17 (1B)   seq_counter++
++0x18 (8B)   8 random bytes   nonce / first-block IV seed
++0x20 (544B) ENCRYPTED        AES-128 (CBC or CFB) — 34 blocks of 16 bytes
+```
+
+## Key addresses
+
+| Addr        | Function                                            |
+|-------------|------------------------------------------------------|
+| 0x10006C8A0 | `DmxWidget::onTimerSendAndReceive` (Qt timer slot)   |
+| 0x100074090 | `DmxUniversePage::onTimerSendReceive`                |
+| 0x100073BD0 | `DmxUniversePage::sendDmx` (QtConcurrent worker fn)  |
+| 0x1001a9d50 | `Stick3CryptDmxUniverse` "send DMX" (vt[22] primary) |
+| 0x1001eeac0 | Frame-build wrapper                                  |
+| 0x1001ee990 | Build encrypted frame                                |
+| **0x100107950** | **Real encrypt entry** (mode-dispatch CBC vs CFB) |
+| 0x1003f5140 | AES-CFB outer (uses IV at +0xB0)                     |
+| **0x1003f4690** | **AES-128 block cipher (CFB path, 1153 B)**      |
+| 0x1003f6790 | AES-CBC outer (chains with previous ciphertext)      |
+| **0x1003f5980** | **AES-128 block cipher (CBC path, 1872 B)**      |
+| **DAT_1007c0010** | **AES S-box** (256 bytes)                      |
+| 0x1001b0340 | `XHL_UdpSocket::send`                                |
+| 0x100677060 | `sendto` wrapper                                     |
+
+The earlier "stream cipher" addresses (`FUN_100108200`, `FUN_1005e0530`) are
+for `XHL_DasEccStreamCryptography` — a sibling class for USB devices, NOT
+on the Stick3 DMX path.
+
+Typeinfo addresses (for further vtable hunting via `dyld_info -fixups`):
+
+| Class                          | TypeInfo @     |
+|--------------------------------|----------------|
+| XHL_Stick3CryptDmxUniverse     | 0x100970DC0    |
+| XHL_DasEccStreamCryptography   | 0x100852080    |
+| XHL_DasEccAesCryptography      | 0x100851ED8    |
+| XHL_AesOStream                 | 0x100851C48    |
+
+## Reproduce
+
+```bash
+# Install (one-time)
+brew install ghidra
+
+# Run any script (-noanalysis once initial import has been done)
+/opt/homebrew/Cellar/ghidra/12.1/bin/pyghidraRun -H \
+    tools/ghidra HwmESA2 \
+    -import /Applications/ESA2/HardwareManager/HardwareManager.app/Contents/MacOS/HardwareManager \
+    -scriptPath tools/ghidra \
+    -postScript dump-anchors.py
+```
+
+After the first run, omit `-import` and add `-process HardwareManager
+-noanalysis` to re-run scripts against the saved project (fast).
+
+## Scripts
+
+- `dump-anchors.py` — dump every named DMX/AES anchor function (Gladman, sendto, RTTI strings)
+- `find-cipher.py` — chase XHL_UdpSocket::sendto callers and any RTTI vtable
+- `find-vtables.py` — scan for typeinfo bytes in `__const` (mostly empty: Mach-O chained fixups)
+- `string-walk.py` — find typeinfo-name strings then follow their data xrefs
+- `find-stick3-crypto.py` — search Ghidra symbols by class-name keyword (mostly empty)
+- `dump-stick3-vtable.py` — dump every Stick3 primary + secondary vtable slot fn
+- `dump-cipher.py` — dump the encrypt chain rooted at `FUN_1001a9d50`
+- `dump-aes-candidates.py` — dump candidate encrypt fn vt[3] across classes
+
+## Side-channel: `dyld_info -fixups`
+
+Mach-O chained fixups aren't materialized by Ghidra for unsymbolized
+typeinfos. Use `xcrun dyld_info -fixups <binary>` to dump every rebase /
+bind. Vtables for hidden classes are reached by grepping for rebases
+targeting a known typeinfo struct address. Example:
+
+```bash
+xcrun dyld_info -fixups <binary> | grep 'rebase  0x100970DC0$'
+# Each result is a vtable's typeinfo_ptr field; vt[0] is +8.
+```
+
+## KDF — SOLVED & VERIFIED (2026-05-21)
+
+The per-session AES-256 key derivation is fully recovered by static RE and
+**verified end-to-end** against a real captured session.
+Scripts `dump-kdf-chain.py`, `dump-curve.py`, `dump-secret.py` decompile the
+chain `FUN_100178030 → FUN_100107650`. Result:
+
+- **Curve = NIST P-256.** `p`, `n`, `G`, and the `b` constant all byte-match.
+- **KDF:** `key = LE( X(d·S) XOR X(d·Q) )` — `d` ephemeral, `S` a hardcoded
+  static point (raw 33-byte SEC1 point at `0x1007b0490`), `Q` the Stick
+  pubkey from the opcode-0x0F handshake.
+- **Reference impl:** `tools/derive-dmx-key.mjs` (passing self-test).
+- **Proof:** `tools/verify-kdf.mjs` recomputes a real session's installed
+  AES key byte-for-byte (using an lldb-dumped `d` + the handshake pcap).
+
+Ghidra shows the curve-constant DATs as zero — its `__const`/`__data` blocks
+weren't materialized. Read them straight from the Mach-O file:
+`file_offset = vmaddr − 0x100000000`. Full write-up:
+`memory/stick-cipher-is-stream-not-aes.md`.
+
+## What's left
+
+1. **Session-magic table** — `DAT_100d11a90` is a table of 14-byte entries.
+   Decode it (frame `+0x00` magic + handshake validation).
+2. **Random nonce source** — `FUN_100108670` (likely `std::mt19937`).
+   Either reproduce or pick our own.