{ "segments": [ { "id": 1, "seek": 2738, "start": 1.41, "end": 5.07, "text": " Hello everyone. Thank you for attending this talk.", "tokens": [ 50414, 2425, 1518, 13, 1044, 291, 337, 15862, 341, 751, 13, 50564 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 1.41, "end": 1.81, "word": " Hello", "probability": 0.552734375 }, { "start": 1.81, "end": 2.45, "word": " everyone", "probability": 0.6767578125 }, { "start": 2.45, "end": 2.99, "word": ".", "probability": 0.336181640625 }, { "start": 2.99, "end": 3.41, "word": " Thank", "probability": 0.8359375 }, { "start": 3.41, "end": 3.53, "word": " you", "probability": 0.8935546875 }, { "start": 3.53, "end": 3.71, "word": " for", "probability": 0.8984375 }, { "start": 3.71, "end": 4.05, "word": " attending", "probability": 0.8173828125 }, { "start": 4.05, "end": 4.39, "word": " this", "probability": 0.8759765625 }, { "start": 4.39, "end": 4.67, "word": " talk", "probability": 0.8037109375 }, { "start": 4.67, "end": 5.07, "word": ".", "probability": 0.9375 } ] }, { "id": 2, "seek": 2738, "start": 5.51, "end": 9.09, "text": " I'm Slava. I'm a security researcher at CheckPoint.", "tokens": [ 50614, 286, 478, 6187, 4061, 13, 286, 478, 257, 3825, 21751, 412, 6881, 18705, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 5.51, "end": 5.79, "word": " I'm", "probability": 0.7861328125 }, { "start": 5.79, "end": 6.25, "word": " Slava", "probability": 0.930908203125 }, { "start": 6.25, "end": 6.55, "word": ".", "probability": 0.6982421875 }, { "start": 6.55, "end": 6.79, "word": " I'm", "probability": 0.88916015625 }, { "start": 6.85, "end": 7.13, "word": " a security", "probability": 0.84716796875 }, { "start": 7.13, "end": 7.63, "word": " researcher", "probability": 0.771484375 }, { "start": 7.63, "end": 8.09, "word": " at", "probability": 0.89794921875 }, { "start": 8.09, "end": 8.69, "word": " CheckPoint", "probability": 0.5892333984375 }, { "start": 8.69, "end": 9.09, "word": ".", "probability": 0.92529296875 } ] }, { "id": 3, "seek": 2738, "start": 9.43, "end": 12.71, "text": " Security research is my daily work.", "tokens": [ 50814, 11164, 2132, 307, 452, 5212, 589, 13, 50914 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 9.43, "end": 9.93, "word": " Security", "probability": 0.84423828125 }, { "start": 9.93, "end": 10.49, "word": " research", "probability": 0.73583984375 }, { "start": 10.49, "end": 10.87, "word": " is", "probability": 0.9072265625 }, { "start": 10.87, "end": 11.13, "word": " my", "probability": 0.9052734375 }, { "start": 11.13, "end": 11.49, "word": " daily", "probability": 0.81787109375 }, { "start": 11.49, "end": 11.91, "word": " work", "probability": 0.67724609375 }, { "start": 11.91, "end": 12.71, "word": ".", "probability": 0.98583984375 } ] }, { "id": 4, "seek": 2738, "start": 12.93, "end": 16.19, "text": " Today I'm going to show how an Android application", "tokens": [ 50964, 2692, 286, 478, 516, 281, 855, 577, 364, 8853, 3861, 51114 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 12.93, "end": 13.27, "word": " Today", "probability": 0.869140625 }, { "start": 13.27, "end": 13.65, "word": " I'm", "probability": 0.790771484375 }, { "start": 13.65, "end": 13.89, "word": " going", "probability": 0.8525390625 }, { "start": 13.89, "end": 14.09, "word": " to", "probability": 0.91357421875 }, { "start": 14.09, "end": 14.37, "word": " show", "probability": 0.880859375 }, { "start": 14.37, "end": 14.85, "word": " how", "probability": 0.828125 }, { "start": 14.85, "end": 15.11, "word": " an", "probability": 0.88427734375 }, { "start": 15.11, "end": 15.43, "word": " Android", "probability": 0.865234375 }, { "start": 15.43, "end": 16.19, "word": " application", "probability": 0.76708984375 } ] }, { "id": 5, "seek": 2738, "start": 16.19, "end": 20.05, "text": " can attack the digital signal processor of a mobile device", "tokens": [ 51164, 393, 2690, 264, 4562, 6358, 15321, 295, 257, 6013, 4302, 51314 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 16.19, "end": 16.65, "word": " can", "probability": 0.89208984375 }, { "start": 16.65, "end": 17.23, "word": " attack", "probability": 0.7998046875 }, { "start": 17.23, "end": 17.57, "word": " the", "probability": 0.79931640625 }, { "start": 17.57, "end": 17.87, "word": " digital", "probability": 0.85009765625 }, { "start": 17.87, "end": 18.27, "word": " signal", "probability": 0.7392578125 }, { "start": 18.27, "end": 18.83, "word": " processor", "probability": 0.78369140625 }, { "start": 18.83, "end": 19.19, "word": " of", "probability": 0.8857421875 }, { "start": 19.33, "end": 19.57, "word": " a mobile", "probability": 0.81201171875 }, { "start": 19.57, "end": 20.05, "word": " device", "probability": 0.888671875 } ] }, { "id": 6, "seek": 2738, "start": 20.43, "end": 24.89, "text": " and thereby gain privileges and denial-of-service capabilities.", "tokens": [ 51364, 293, 28281, 6052, 32588, 293, 28754, 12, 2670, 12, 39279, 10862, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 20.43, "end": 20.83, "word": " and", "probability": 0.6494140625 }, { "start": 20.83, "end": 21.51, "word": " thereby", "probability": 0.84423828125 }, { "start": 21.51, "end": 22.11, "word": " gain", "probability": 0.85546875 }, { "start": 22.11, "end": 22.73, "word": " privileges", "probability": 0.79931640625 }, { "start": 22.73, "end": 23.15, "word": " and", "probability": 0.888671875 }, { "start": 23.15, "end": 23.49, "word": " denial", "probability": 0.236083984375 }, { "start": 23.49, "end": 23.89, "word": "-of", "probability": 0.6942138671875 }, { "start": 23.89, "end": 23.89, "word": "-service", "probability": 0.89453125 }, { "start": 23.89, "end": 24.49, "word": " capabilities", "probability": 0.86767578125 }, { "start": 24.49, "end": 24.89, "word": ".", "probability": 0.98291015625 } ] }, { "id": 7, "seek": 2738, "start": 29.6, "end": 31.88, "text": " Let's begin with a question.", "tokens": [ 51614, 961, 311, 1841, 365, 257, 1168, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.28125000901000446, "compression_ratio": 1.482608695652174, "no_speech_prob": 0.05889892578125, "words": [ { "start": 29.6, "end": 30.4, "word": " Let's", "probability": 0.94091796875 }, { "start": 30.4, "end": 30.62, "word": " begin", "probability": 0.72314453125 }, { "start": 30.62, "end": 30.8, "word": " with", "probability": 0.81201171875 }, { "start": 30.98, "end": 31.42, "word": " a question", "probability": 0.80078125 }, { "start": 31.42, "end": 31.88, "word": ".", "probability": 0.86767578125 } ] }, { "id": 8, "seek": 5574, "start": 31.88, "end": 36.36, "text": " Do you know how many processors are on your mobile phone?", "tokens": [ 50364, 1144, 291, 458, 577, 867, 27751, 366, 322, 428, 6013, 2593, 30, 50514 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 31.88, "end": 32.08, "word": " Do", "probability": 0.8037109375 }, { "start": 32.08, "end": 32.22, "word": " you", "probability": 0.8935546875 }, { "start": 32.22, "end": 32.46, "word": " know", "probability": 0.81884765625 }, { "start": 32.46, "end": 32.98, "word": " how", "probability": 0.8798828125 }, { "start": 32.98, "end": 33.36, "word": " many", "probability": 0.78564453125 }, { "start": 33.36, "end": 33.96, "word": " processors", "probability": 0.8193359375 }, { "start": 33.96, "end": 34.48, "word": " are", "probability": 0.89013671875 }, { "start": 34.48, "end": 34.72, "word": " on", "probability": 0.87646484375 }, { "start": 34.72, "end": 34.9, "word": " your", "probability": 0.78857421875 }, { "start": 34.9, "end": 35.22, "word": " mobile", "probability": 0.80859375 }, { "start": 35.22, "end": 35.62, "word": " phone", "probability": 0.47216796875 }, { "start": 35.62, "end": 36.36, "word": "?", "probability": 0.9755859375 } ] }, { "id": 9, "seek": 5574, "start": 36.4, "end": 38.64, "text": " The answer is many.", "tokens": [ 50564, 440, 1867, 307, 867, 13, 50664 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 36.4, "end": 36.72, "word": " The", "probability": 0.7841796875 }, { "start": 36.72, "end": 37.02, "word": " answer", "probability": 0.8984375 }, { "start": 37.02, "end": 37.44, "word": " is", "probability": 0.90380859375 }, { "start": 37.44, "end": 37.9, "word": " many", "probability": 0.646484375 }, { "start": 37.9, "end": 38.64, "word": ".", "probability": 0.66796875 } ] }, { "id": 10, "seek": 5574, "start": 38.66, "end": 42.72, "text": " As a single Snapdragon system on a chip embedded in Pixel,", "tokens": [ 50714, 1018, 257, 2167, 48211, 1185, 322, 257, 11409, 16741, 294, 28323, 11, 50864 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 38.66, "end": 38.88, "word": " As", "probability": 0.771484375 }, { "start": 39.2, "end": 39.48, "word": " a single", "probability": 0.88525390625 }, { "start": 39.48, "end": 39.9, "word": " Snapdragon", "probability": 0.53125 }, { "start": 39.9, "end": 40.56, "word": " system", "probability": 0.7548828125 }, { "start": 40.56, "end": 40.8, "word": " on", "probability": 0.84912109375 }, { "start": 40.92, "end": 41.1, "word": " a chip", "probability": 0.767578125 }, { "start": 41.1, "end": 41.78, "word": " embedded", "probability": 0.56103515625 }, { "start": 41.78, "end": 42.12, "word": " in", "probability": 0.8984375 }, { "start": 42.12, "end": 42.48, "word": " Pixel", "probability": 0.64892578125 }, { "start": 42.48, "end": 42.72, "word": ",", "probability": 0.91748046875 } ] }, { "id": 11, "seek": 5574, "start": 42.72, "end": 46.64, "text": " Samsung, Xiaomi, LG, OnePlus, Sony and other devices", "tokens": [ 50914, 13173, 11, 33806, 11, 25449, 11, 41352, 11, 13575, 293, 661, 5759, 51064 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 42.72, "end": 43.04, "word": " Samsung", "probability": 0.8076171875 }, { "start": 43.04, "end": 43.36, "word": ",", "probability": 0.98583984375 }, { "start": 43.36, "end": 43.76, "word": " Xiaomi", "probability": 0.8203125 }, { "start": 43.76, "end": 43.94, "word": ",", "probability": 0.96240234375 }, { "start": 43.94, "end": 44.24, "word": " LG", "probability": 0.955078125 }, { "start": 44.24, "end": 44.46, "word": ",", "probability": 0.97802734375 }, { "start": 44.46, "end": 44.7, "word": " OnePlus", "probability": 0.66796875 }, { "start": 44.7, "end": 45.08, "word": ",", "probability": 0.97412109375 }, { "start": 45.08, "end": 45.28, "word": " Sony", "probability": 0.8896484375 }, { "start": 45.28, "end": 45.56, "word": " and", "probability": 0.56005859375 }, { "start": 45.56, "end": 45.96, "word": " other", "probability": 0.7666015625 }, { "start": 45.96, "end": 46.64, "word": " devices", "probability": 0.9091796875 } ] }, { "id": 12, "seek": 5574, "start": 46.64, "end": 50.18, "text": " may include multiple CPU cores,", "tokens": [ 51114, 815, 4090, 3866, 13199, 24826, 11, 51214 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 46.64, "end": 47.36, "word": " may", "probability": 0.6416015625 }, { "start": 47.36, "end": 47.72, "word": " include", "probability": 0.76025390625 }, { "start": 47.72, "end": 48.44, "word": " multiple", "probability": 0.73681640625 }, { "start": 48.44, "end": 48.94, "word": " CPU", "probability": 0.8984375 }, { "start": 48.94, "end": 49.84, "word": " cores", "probability": 0.7626953125 }, { "start": 49.84, "end": 50.18, "word": ",", "probability": 0.52783203125 } ] }, { "id": 13, "seek": 5574, "start": 50.18, "end": 52.92, "text": " an Adreno graphic processor unit,", "tokens": [ 51264, 364, 1999, 48207, 14089, 15321, 4985, 11, 51364 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 50.18, "end": 50.3, "word": " an", "probability": 0.74169921875 }, { "start": 50.3, "end": 50.82, "word": " Adreno", "probability": 0.6141357421875 }, { "start": 50.82, "end": 51.48, "word": " graphic", "probability": 0.2841796875 }, { "start": 51.48, "end": 51.94, "word": " processor", "probability": 0.73876953125 }, { "start": 51.94, "end": 52.42, "word": " unit", "probability": 0.7783203125 }, { "start": 52.42, "end": 52.92, "word": ",", "probability": 0.9306640625 } ] }, { "id": 14, "seek": 5574, "start": 53.0, "end": 55.04, "text": " a Snapdragon wireless module,", "tokens": [ 51414, 257, 48211, 14720, 10088, 11, 51464 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 53.0, "end": 53.48, "word": " a Snapdragon", "probability": 0.6357421875 }, { "start": 53.48, "end": 54.06, "word": " wireless", "probability": 0.52490234375 }, { "start": 54.06, "end": 54.58, "word": " module", "probability": 0.69384765625 }, { "start": 54.58, "end": 55.04, "word": ",", "probability": 0.95263671875 } ] }, { "id": 15, "seek": 5574, "start": 55.16, "end": 57.34, "text": " a Hexagon digital signal processor,", "tokens": [ 51514, 257, 634, 87, 6709, 4562, 6358, 15321, 11, 51614 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 55.16, "end": 55.6, "word": " a Hexagon", "probability": 0.7220865885416666 }, { "start": 55.6, "end": 55.96, "word": " digital", "probability": 0.7314453125 }, { "start": 55.96, "end": 56.32, "word": " signal", "probability": 0.74951171875 }, { "start": 56.32, "end": 56.94, "word": " processor", "probability": 0.7822265625 }, { "start": 56.94, "end": 57.34, "word": ",", "probability": 0.38916015625 } ] }, { "id": 16, "seek": 5574, "start": 57.34, "end": 60.24, "text": " and Spectro image signal processor.", "tokens": [ 51664, 293, 27078, 340, 3256, 6358, 15321, 13, 51764 ], "temperature": 0.0, "avg_logprob": -0.23404255113069047, "compression_ratio": 1.5521739130434782, "no_speech_prob": 0.0052337646484375, "words": [ { "start": 57.34, "end": 57.54, "word": " and", "probability": 0.89306640625 }, { "start": 57.54, "end": 58.36, "word": " Spectro", "probability": 0.438232421875 }, { "start": 58.36, "end": 58.68, "word": " image", "probability": 0.81884765625 }, { "start": 58.68, "end": 59.02, "word": " signal", "probability": 0.77880859375 }, { "start": 59.02, "end": 59.5, "word": " processor", "probability": 0.487060546875 }, { "start": 59.5, "end": 60.24, "word": ".", "probability": 0.94775390625 } ] }, { "id": 17, "seek": 8550, "start": 60.24, "end": 63.58, "text": " Snapdragon product tiers are differentiated", "tokens": [ 50364, 48211, 1674, 40563, 366, 27372, 770, 50514 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 60.24, "end": 61.42, "word": " Snapdragon", "probability": 0.439208984375 }, { "start": 61.42, "end": 62.1, "word": " product", "probability": 0.72412109375 }, { "start": 62.1, "end": 62.58, "word": " tiers", "probability": 0.7265625 }, { "start": 62.58, "end": 63.08, "word": " are", "probability": 0.88720703125 }, { "start": 63.08, "end": 63.58, "word": " differentiated", "probability": 0.79736328125 } ] }, { "id": 18, "seek": 8550, "start": 63.92, "end": 69.68, "text": " by scalable computing resources for the CPU, GPU and DSP.", "tokens": [ 50564, 538, 38481, 15866, 3593, 337, 264, 13199, 11, 18407, 293, 15816, 47, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 63.92, "end": 64.24, "word": " by", "probability": 0.91552734375 }, { "start": 64.24, "end": 64.78, "word": " scalable", "probability": 0.7958984375 }, { "start": 64.78, "end": 65.48, "word": " computing", "probability": 0.78369140625 }, { "start": 65.48, "end": 66.12, "word": " resources", "probability": 0.78369140625 }, { "start": 66.12, "end": 66.58, "word": " for", "probability": 0.87451171875 }, { "start": 66.58, "end": 66.88, "word": " the", "probability": 0.76171875 }, { "start": 66.88, "end": 67.3, "word": " CPU", "probability": 0.9013671875 }, { "start": 67.3, "end": 67.58, "word": ",", "probability": 0.96435546875 }, { "start": 67.58, "end": 67.88, "word": " GPU", "probability": 0.8486328125 }, { "start": 67.88, "end": 68.46, "word": " and", "probability": 0.479736328125 }, { "start": 68.46, "end": 68.86, "word": " DSP", "probability": 0.919677734375 }, { "start": 68.86, "end": 69.68, "word": ".", "probability": 0.91845703125 } ] }, { "id": 19, "seek": 8550, "start": 69.68, "end": 74.9, "text": " The lowest tiers might contain only a single Hexagon DSP,", "tokens": [ 50814, 440, 12437, 40563, 1062, 5304, 787, 257, 2167, 634, 87, 6709, 15816, 47, 11, 51014 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 69.68, "end": 70.32, "word": " The", "probability": 0.80224609375 }, { "start": 70.32, "end": 70.56, "word": " lowest", "probability": 0.9140625 }, { "start": 70.56, "end": 71.06, "word": " tiers", "probability": 0.619140625 }, { "start": 71.06, "end": 71.64, "word": " might", "probability": 0.7861328125 }, { "start": 71.64, "end": 72.18, "word": " contain", "probability": 0.84716796875 }, { "start": 72.18, "end": 72.52, "word": " only", "probability": 0.81640625 }, { "start": 72.82, "end": 73.18, "word": " a single", "probability": 0.8974609375 }, { "start": 73.18, "end": 73.74, "word": " Hexagon", "probability": 0.6466267903645834 }, { "start": 73.74, "end": 74.3, "word": " DSP", "probability": 0.92333984375 }, { "start": 74.3, "end": 74.9, "word": ",", "probability": 0.76513671875 } ] }, { "id": 20, "seek": 8550, "start": 74.9, "end": 77.24, "text": " whereas the premium tier contains", "tokens": [ 51064, 9735, 264, 12049, 12362, 8306, 51214 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 74.9, "end": 75.28, "word": " whereas", "probability": 0.74951171875 }, { "start": 75.28, "end": 75.64, "word": " the", "probability": 0.802734375 }, { "start": 75.64, "end": 76.12, "word": " premium", "probability": 0.498046875 }, { "start": 76.12, "end": 76.6, "word": " tier", "probability": 0.767578125 }, { "start": 76.6, "end": 77.24, "word": " contains", "probability": 0.8388671875 } ] }, { "id": 21, "seek": 8550, "start": 77.98, "end": 80.58, "text": " up to four Hexagon DSP processors", "tokens": [ 51264, 493, 281, 1451, 634, 87, 6709, 15816, 47, 27751, 51364 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 77.98, "end": 78.3, "word": " up", "probability": 0.89404296875 }, { "start": 78.3, "end": 78.52, "word": " to", "probability": 0.90380859375 }, { "start": 78.52, "end": 78.86, "word": " four", "probability": 0.65673828125 }, { "start": 78.86, "end": 79.48, "word": " Hexagon", "probability": 0.9296875 }, { "start": 79.48, "end": 79.88, "word": " DSP", "probability": 0.935546875 }, { "start": 79.88, "end": 80.58, "word": " processors", "probability": 0.85498046875 } ] }, { "id": 22, "seek": 8550, "start": 80.86, "end": 83.58, "text": " dedicated for specific use cases.", "tokens": [ 51414, 8374, 337, 2685, 764, 3331, 13, 51514 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 80.86, "end": 81.36, "word": " dedicated", "probability": 0.68017578125 }, { "start": 81.36, "end": 81.86, "word": " for", "probability": 0.89794921875 }, { "start": 81.86, "end": 82.32, "word": " specific", "probability": 0.79541015625 }, { "start": 82.32, "end": 82.68, "word": " use", "probability": 0.81982421875 }, { "start": 82.68, "end": 83.08, "word": " cases", "probability": 0.79736328125 }, { "start": 83.08, "end": 83.58, "word": ".", "probability": 0.98583984375 } ] }, { "id": 23, "seek": 8550, "start": 84.3, "end": 90.0, "text": " These are modem DSP, known as baseband audio DSP,", "tokens": [ 51564, 1981, 366, 1072, 443, 15816, 47, 11, 2570, 382, 3096, 4235, 6278, 15816, 47, 11, 51764 ], "temperature": 0.0, "avg_logprob": -0.2135416702145622, "compression_ratio": 1.5170731707317073, "no_speech_prob": 0.0011911392211914062, "words": [ { "start": 84.3, "end": 84.66, "word": " These", "probability": 0.9033203125 }, { "start": 84.66, "end": 85.2, "word": " are", "probability": 0.859375 }, { "start": 85.2, "end": 85.72, "word": " modem", "probability": 0.693359375 }, { "start": 85.72, "end": 86.24, "word": " DSP", "probability": 0.89697265625 }, { "start": 86.24, "end": 86.4, "word": ",", "probability": 0.517578125 }, { "start": 86.4, "end": 86.68, "word": " known", "probability": 0.81103515625 }, { "start": 86.68, "end": 87.56, "word": " as", "probability": 0.91650390625 }, { "start": 87.56, "end": 88.24, "word": " baseband", "probability": 0.5775146484375 }, { "start": 88.24, "end": 88.98, "word": " audio", "probability": 0.72119140625 }, { "start": 88.98, "end": 89.6, "word": " DSP", "probability": 0.913330078125 }, { "start": 89.6, "end": 90.0, "word": ",", "probability": 0.970703125 } ] }, { "id": 24, "seek": 11278, "start": 90.0, "end": 93.02, "text": " compute DSP, and sensor DSP.", "tokens": [ 50364, 14722, 15816, 47, 11, 293, 10200, 15816, 47, 13, 50464 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 90.0, "end": 90.4, "word": " compute", "probability": 0.283203125 }, { "start": 90.4, "end": 90.82, "word": " DSP", "probability": 0.86962890625 }, { "start": 90.82, "end": 91.0, "word": ",", "probability": 0.2073974609375 }, { "start": 91.0, "end": 91.26, "word": " and", "probability": 0.89794921875 }, { "start": 91.26, "end": 91.72, "word": " sensor", "probability": 0.732421875 }, { "start": 91.72, "end": 92.16, "word": " DSP", "probability": 0.873046875 }, { "start": 92.16, "end": 93.02, "word": ".", "probability": 0.97265625 } ] }, { "id": 25, "seek": 11278, "start": 93.04, "end": 100.62, "text": " In this research, I turned my attention to ADSP and CDSP subsystems.", "tokens": [ 50514, 682, 341, 2132, 11, 286, 3574, 452, 3202, 281, 9135, 27921, 293, 6743, 27921, 2090, 9321, 82, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 93.04, "end": 93.54, "word": " In", "probability": 0.8994140625 }, { "start": 93.54, "end": 93.8, "word": " this", "probability": 0.8583984375 }, { "start": 93.8, "end": 94.26, "word": " research", "probability": 0.7509765625 }, { "start": 94.26, "end": 94.5, "word": ",", "probability": 0.78369140625 }, { "start": 94.5, "end": 94.68, "word": " I", "probability": 0.99853515625 }, { "start": 94.68, "end": 94.94, "word": " turned", "probability": 0.69091796875 }, { "start": 94.94, "end": 95.2, "word": " my", "probability": 0.90283203125 }, { "start": 95.2, "end": 95.68, "word": " attention", "probability": 0.86865234375 }, { "start": 95.68, "end": 96.02, "word": " to", "probability": 0.90625 }, { "start": 96.02, "end": 96.64, "word": " ADSP", "probability": 0.807373046875 }, { "start": 96.64, "end": 97.08, "word": " and", "probability": 0.8857421875 }, { "start": 97.08, "end": 97.7, "word": " CDSP", "probability": 0.869140625 }, { "start": 97.7, "end": 99.76, "word": " subsystems", "probability": 0.9353841145833334 }, { "start": 99.76, "end": 100.62, "word": ".", "probability": 0.9677734375 } ] }, { "id": 26, "seek": 11278, "start": 101.42, "end": 105.58, "text": " ADSP and CDSP processors are intended for such cool tasks", "tokens": [ 50914, 9135, 27921, 293, 6743, 27921, 27751, 366, 10226, 337, 1270, 1627, 9608, 51114 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 101.42, "end": 101.86, "word": " ADSP", "probability": 0.916259765625 }, { "start": 101.86, "end": 102.1, "word": " and", "probability": 0.8916015625 }, { "start": 102.1, "end": 102.48, "word": " CDSP", "probability": 0.943115234375 }, { "start": 102.48, "end": 103.28, "word": " processors", "probability": 0.8359375 }, { "start": 103.28, "end": 103.62, "word": " are", "probability": 0.875 }, { "start": 103.62, "end": 104.02, "word": " intended", "probability": 0.67333984375 }, { "start": 104.02, "end": 104.38, "word": " for", "probability": 0.8916015625 }, { "start": 104.38, "end": 104.72, "word": " such", "probability": 0.87353515625 }, { "start": 104.72, "end": 105.12, "word": " cool", "probability": 0.84375 }, { "start": 105.12, "end": 105.58, "word": " tasks", "probability": 0.85546875 } ] }, { "id": 27, "seek": 11278, "start": 105.58, "end": 109.46, "text": " as processing of audio and voice data,", "tokens": [ 51164, 382, 9007, 295, 6278, 293, 3177, 1412, 11, 51264 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 105.58, "end": 106.4, "word": " as", "probability": 0.87060546875 }, { "start": 106.4, "end": 107.0, "word": " processing", "probability": 0.62060546875 }, { "start": 107.0, "end": 107.38, "word": " of", "probability": 0.88330078125 }, { "start": 107.38, "end": 107.82, "word": " audio", "probability": 0.91552734375 }, { "start": 107.82, "end": 108.16, "word": " and", "probability": 0.89208984375 }, { "start": 108.16, "end": 108.54, "word": " voice", "probability": 0.8818359375 }, { "start": 108.54, "end": 108.96, "word": " data", "probability": 0.81884765625 }, { "start": 108.96, "end": 109.46, "word": ",", "probability": 0.98095703125 } ] }, { "id": 28, "seek": 11278, "start": 109.46, "end": 112.58, "text": " computer vision, machine learning calculations,", "tokens": [ 51314, 3820, 5201, 11, 3479, 2539, 20448, 11, 51464 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 109.46, "end": 109.8, "word": " computer", "probability": 0.65478515625 }, { "start": 109.8, "end": 110.28, "word": " vision", "probability": 0.80517578125 }, { "start": 110.28, "end": 110.76, "word": ",", "probability": 0.994140625 }, { "start": 110.76, "end": 110.96, "word": " machine", "probability": 0.63671875 }, { "start": 110.96, "end": 111.38, "word": " learning", "probability": 0.8212890625 }, { "start": 111.38, "end": 112.08, "word": " calculations", "probability": 0.8427734375 }, { "start": 112.08, "end": 112.58, "word": ",", "probability": 0.982421875 } ] }, { "id": 29, "seek": 11278, "start": 112.58, "end": 117.28, "text": " camera streaming, artificial intelligence, etc.", "tokens": [ 51514, 2799, 11791, 11, 11677, 7599, 11, 5183, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.2057976922706554, "compression_ratio": 1.5263157894736843, "no_speech_prob": 0.0035800933837890625, "words": [ { "start": 112.58, "end": 112.88, "word": " camera", "probability": 0.8232421875 }, { "start": 112.88, "end": 113.34, "word": " streaming", "probability": 0.74560546875 }, { "start": 113.34, "end": 113.62, "word": ",", "probability": 0.9833984375 }, { "start": 113.62, "end": 114.06, "word": " artificial", "probability": 0.7119140625 }, { "start": 114.06, "end": 115.4, "word": " intelligence", "probability": 0.70458984375 }, { "start": 115.4, "end": 115.64, "word": ",", "probability": 0.97607421875 }, { "start": 115.64, "end": 116.42, "word": " etc", "probability": 0.21435546875 }, { "start": 116.42, "end": 117.28, "word": ".", "probability": 0.9619140625 } ] }, { "id": 30, "seek": 14278, "start": 117.28, "end": 122.48, "text": " On some devices, such as the Sony Xperia XZ,", "tokens": [ 50364, 1282, 512, 5759, 11, 1270, 382, 264, 13575, 1783, 610, 654, 1783, 57, 11, 50564 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 117.28, "end": 118.02, "word": " On", "probability": 0.7646484375 }, { "start": 118.02, "end": 118.3, "word": " some", "probability": 0.8017578125 }, { "start": 118.3, "end": 118.9, "word": " devices", "probability": 0.88232421875 }, { "start": 118.9, "end": 119.5, "word": ",", "probability": 0.340576171875 }, { "start": 119.5, "end": 119.8, "word": " such", "probability": 0.8896484375 }, { "start": 119.8, "end": 120.18, "word": " as", "probability": 0.90478515625 }, { "start": 120.18, "end": 120.76, "word": " the", "probability": 0.71826171875 }, { "start": 120.76, "end": 121.04, "word": " Sony", "probability": 0.87451171875 }, { "start": 121.04, "end": 121.52, "word": " Xperia", "probability": 0.9537760416666666 }, { "start": 121.52, "end": 122.02, "word": " XZ", "probability": 0.90380859375 }, { "start": 122.02, "end": 122.48, "word": ",", "probability": 0.7744140625 } ] }, { "id": 31, "seek": 14278, "start": 122.48, "end": 127.86, "text": " only the ADSP processor is responsible for all these tasks.", "tokens": [ 50614, 787, 264, 9135, 27921, 15321, 307, 6250, 337, 439, 613, 9608, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 122.48, "end": 122.92, "word": " only", "probability": 0.82861328125 }, { "start": 122.92, "end": 123.5, "word": " the", "probability": 0.7890625 }, { "start": 123.5, "end": 124.06, "word": " ADSP", "probability": 0.761962890625 }, { "start": 124.06, "end": 124.72, "word": " processor", "probability": 0.74072265625 }, { "start": 124.72, "end": 125.06, "word": " is", "probability": 0.90185546875 }, { "start": 125.06, "end": 125.6, "word": " responsible", "probability": 0.82421875 }, { "start": 125.6, "end": 126.12, "word": " for", "probability": 0.89501953125 }, { "start": 126.12, "end": 126.5, "word": " all", "probability": 0.8740234375 }, { "start": 126.5, "end": 126.78, "word": " these", "probability": 0.6416015625 }, { "start": 126.78, "end": 127.16, "word": " tasks", "probability": 0.86328125 }, { "start": 127.16, "end": 127.86, "word": ".", "probability": 0.60986328125 } ] }, { "id": 32, "seek": 14278, "start": 127.86, "end": 132.24, "text": " But on other devices, such as the Pixel 4,", "tokens": [ 50864, 583, 322, 661, 5759, 11, 1270, 382, 264, 28323, 1017, 11, 51064 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 127.86, "end": 128.24, "word": " But", "probability": 0.85595703125 }, { "start": 128.24, "end": 128.46, "word": " on", "probability": 0.86767578125 }, { "start": 128.46, "end": 128.82, "word": " other", "probability": 0.7607421875 }, { "start": 128.82, "end": 129.32, "word": " devices", "probability": 0.90576171875 }, { "start": 129.32, "end": 129.66, "word": ",", "probability": 0.75732421875 }, { "start": 129.66, "end": 130.12, "word": " such", "probability": 0.86328125 }, { "start": 130.12, "end": 130.44, "word": " as", "probability": 0.90283203125 }, { "start": 130.44, "end": 130.72, "word": " the", "probability": 0.74951171875 }, { "start": 130.72, "end": 131.12, "word": " Pixel", "probability": 0.767578125 }, { "start": 131.12, "end": 131.7, "word": " 4", "probability": 0.9697265625 }, { "start": 131.7, "end": 132.24, "word": ",", "probability": 0.9453125 } ] }, { "id": 33, "seek": 14278, "start": 132.24, "end": 137.68, "text": " these tasks are shared between ADSP and CDSP.", "tokens": [ 51114, 613, 9608, 366, 5507, 1296, 9135, 27921, 293, 6743, 27921, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 132.24, "end": 132.44, "word": " these", "probability": 0.6689453125 }, { "start": 132.44, "end": 132.84, "word": " tasks", "probability": 0.86376953125 }, { "start": 132.84, "end": 133.94, "word": " are", "probability": 0.90185546875 }, { "start": 133.94, "end": 134.32, "word": " shared", "probability": 0.5986328125 }, { "start": 134.32, "end": 134.96, "word": " between", "probability": 0.75830078125 }, { "start": 134.96, "end": 135.64, "word": " ADSP", "probability": 0.935546875 }, { "start": 135.64, "end": 136.12, "word": " and", "probability": 0.900390625 }, { "start": 136.12, "end": 136.76, "word": " CDSP", "probability": 0.828857421875 }, { "start": 136.76, "end": 137.68, "word": ".", "probability": 0.98583984375 } ] }, { "id": 34, "seek": 14278, "start": 138.68, "end": 141.46, "text": " Let's take a look at the communication scheme", "tokens": [ 51414, 961, 311, 747, 257, 574, 412, 264, 6101, 12232, 51514 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 138.68, "end": 139.6, "word": " Let's", "probability": 0.9365234375 }, { "start": 139.6, "end": 139.76, "word": " take", "probability": 0.79443359375 }, { "start": 139.9, "end": 140.06, "word": " a look", "probability": 0.9130859375 }, { "start": 140.06, "end": 140.2, "word": " at", "probability": 0.9072265625 }, { "start": 140.2, "end": 140.36, "word": " the", "probability": 0.80810546875 }, { "start": 140.36, "end": 140.94, "word": " communication", "probability": 0.7236328125 }, { "start": 140.94, "end": 141.46, "word": " scheme", "probability": 0.87646484375 } ] }, { "id": 35, "seek": 14278, "start": 141.46, "end": 146.1, "text": " between an Android application and a DSP running library.", "tokens": [ 51564, 1296, 364, 8853, 3861, 293, 257, 15816, 47, 2614, 6405, 13, 51764 ], "temperature": 0.0, "avg_logprob": -0.19135801880447953, "compression_ratio": 1.5153061224489797, "no_speech_prob": 0.00250244140625, "words": [ { "start": 141.46, "end": 141.8, "word": " between", "probability": 0.7763671875 }, { "start": 141.8, "end": 142.14, "word": " an", "probability": 0.875 }, { "start": 142.14, "end": 142.6, "word": " Android", "probability": 0.908203125 }, { "start": 142.6, "end": 143.28, "word": " application", "probability": 0.7470703125 }, { "start": 143.28, "end": 143.86, "word": " and", "probability": 0.8896484375 }, { "start": 144.22, "end": 144.76, "word": " a DSP", "probability": 0.8603515625 }, { "start": 144.76, "end": 145.22, "word": " running", "probability": 0.560546875 }, { "start": 145.22, "end": 145.84, "word": " library", "probability": 0.67822265625 }, { "start": 145.84, "end": 146.1, "word": ".", "probability": 0.99560546875 } ] }, { "id": 36, "seek": 16913, "start": 147.62, "end": 151.65, "text": " FasterPC is a Qualcomm proprietary RPC mechanism", "tokens": [ 50364, 46665, 12986, 307, 257, 13616, 13278, 38992, 497, 12986, 7513, 50564 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 147.62, "end": 148.52, "word": " FasterPC", "probability": 0.4935302734375 }, { "start": 148.52, "end": 149.08, "word": " is", "probability": 0.89013671875 }, { "start": 149.32, "end": 149.78, "word": " a Qualcomm", "probability": 0.895263671875 }, { "start": 149.78, "end": 150.56, "word": " proprietary", "probability": 0.64208984375 }, { "start": 150.56, "end": 151.2, "word": " RPC", "probability": 0.957763671875 }, { "start": 151.2, "end": 151.65, "word": " mechanism", "probability": 0.8828125 } ] }, { "id": 37, "seek": 16913, "start": 151.94, "end": 155.62, "text": " used to enable remote code function calls", "tokens": [ 50614, 1143, 281, 9528, 8607, 3089, 2445, 5498, 50764 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 151.94, "end": 152.4, "word": " used", "probability": 0.7666015625 }, { "start": 152.4, "end": 152.64, "word": " to", "probability": 0.90380859375 }, { "start": 152.64, "end": 153.16, "word": " enable", "probability": 0.890625 }, { "start": 153.16, "end": 153.8, "word": " remote", "probability": 0.84130859375 }, { "start": 153.8, "end": 154.18, "word": " code", "probability": 0.501953125 }, { "start": 154.18, "end": 155.18, "word": " function", "probability": 0.79150390625 }, { "start": 155.18, "end": 155.62, "word": " calls", "probability": 0.7294921875 } ] }, { "id": 38, "seek": 16913, "start": 155.62, "end": 161.22, "text": " between application processor, where Android is run, and DSP.", "tokens": [ 50814, 1296, 3861, 15321, 11, 689, 8853, 307, 1190, 11, 293, 15816, 47, 13, 51014 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 155.62, "end": 156.08, "word": " between", "probability": 0.79150390625 }, { "start": 156.08, "end": 156.78, "word": " application", "probability": 0.67138671875 }, { "start": 156.78, "end": 157.4, "word": " processor", "probability": 0.64794921875 }, { "start": 157.4, "end": 157.98, "word": ",", "probability": 0.33740234375 }, { "start": 157.98, "end": 158.22, "word": " where", "probability": 0.82763671875 }, { "start": 158.22, "end": 158.58, "word": " Android", "probability": 0.87353515625 }, { "start": 158.58, "end": 158.8, "word": " is", "probability": 0.89990234375 }, { "start": 158.8, "end": 159.1, "word": " run", "probability": 0.85205078125 }, { "start": 159.1, "end": 159.66, "word": ",", "probability": 0.76806640625 }, { "start": 159.66, "end": 160.0, "word": " and", "probability": 0.89892578125 }, { "start": 160.0, "end": 160.6, "word": " DSP", "probability": 0.85888671875 }, { "start": 160.6, "end": 161.22, "word": ".", "probability": 0.9541015625 } ] }, { "id": 39, "seek": 16913, "start": 161.22, "end": 167.14, "text": " On Android side, user mode process initiates the remote invocation.", "tokens": [ 51064, 1282, 8853, 1252, 11, 4195, 4391, 1399, 6265, 1024, 264, 8607, 1048, 27943, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 161.22, "end": 161.56, "word": " On", "probability": 0.89990234375 }, { "start": 161.56, "end": 161.88, "word": " Android", "probability": 0.83544921875 }, { "start": 161.88, "end": 162.4, "word": " side", "probability": 0.70947265625 }, { "start": 162.4, "end": 162.84, "word": ",", "probability": 0.83935546875 }, { "start": 162.84, "end": 163.08, "word": " user", "probability": 0.54150390625 }, { "start": 163.08, "end": 163.4, "word": " mode", "probability": 0.56640625 }, { "start": 163.4, "end": 164.04, "word": " process", "probability": 0.8232421875 }, { "start": 164.04, "end": 164.88, "word": " initiates", "probability": 0.8818359375 }, { "start": 164.88, "end": 165.62, "word": " the", "probability": 0.78173828125 }, { "start": 165.62, "end": 165.94, "word": " remote", "probability": 0.8515625 }, { "start": 165.94, "end": 166.48, "word": " invocation", "probability": 0.841796875 }, { "start": 166.48, "end": 167.14, "word": ".", "probability": 0.96630859375 } ] }, { "id": 40, "seek": 16913, "start": 167.14, "end": 169.98, "text": " In our case, an Android application calls", "tokens": [ 51364, 682, 527, 1389, 11, 364, 8853, 3861, 5498, 51464 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 167.14, "end": 167.32, "word": " In", "probability": 0.90478515625 }, { "start": 167.32, "end": 167.56, "word": " our", "probability": 0.79931640625 }, { "start": 167.56, "end": 168.02, "word": " case", "probability": 0.814453125 }, { "start": 168.02, "end": 168.24, "word": ",", "probability": 0.90625 }, { "start": 168.24, "end": 168.44, "word": " an", "probability": 0.88232421875 }, { "start": 168.44, "end": 168.72, "word": " Android", "probability": 0.9248046875 }, { "start": 168.72, "end": 169.4, "word": " application", "probability": 0.78515625 }, { "start": 169.4, "end": 169.98, "word": " calls", "probability": 0.72412109375 } ] }, { "id": 41, "seek": 16913, "start": 169.98, "end": 173.63, "text": " one of the stub functions in its native code.", "tokens": [ 51514, 472, 295, 264, 20266, 6828, 294, 1080, 8470, 3089, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.24239309622268929, "compression_ratio": 1.6210526315789473, "no_speech_prob": 0.0013332366943359375, "words": [ { "start": 169.98, "end": 170.38, "word": " one", "probability": 0.81005859375 }, { "start": 170.38, "end": 170.74, "word": " of", "probability": 0.90673828125 }, { "start": 170.74, "end": 171.0, "word": " the", "probability": 0.78271484375 }, { "start": 171.0, "end": 171.38, "word": " stub", "probability": 0.253662109375 }, { "start": 171.38, "end": 172.06, "word": " functions", "probability": 0.89208984375 }, { "start": 172.06, "end": 172.4, "word": " in", "probability": 0.89208984375 }, { "start": 172.4, "end": 172.64, "word": " its", "probability": 0.76806640625 }, { "start": 172.64, "end": 172.94, "word": " native", "probability": 0.7255859375 }, { "start": 172.94, "end": 173.18, "word": " code", "probability": 0.54150390625 }, { "start": 173.18, "end": 173.63, "word": ".", "probability": 0.98974609375 } ] }, { "id": 42, "seek": 19437, "start": 173.63, "end": 181.99, "text": " Stub is auto-generated code that converts the function call to an RPC message.", "tokens": [ 50364, 745, 836, 307, 8399, 12, 21848, 770, 3089, 300, 38874, 264, 2445, 818, 281, 364, 497, 12986, 3636, 13, 50714 ], "temperature": 0.0, "avg_logprob": -0.21194197067192622, "compression_ratio": 1.4550898203592815, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 173.63, "end": 174.67, "word": " Stub", "probability": 0.6556396484375 }, { "start": 174.67, "end": 174.97, "word": " is", "probability": 0.80419921875 }, { "start": 174.97, "end": 175.41, "word": " auto", "probability": 0.67578125 }, { "start": 175.41, "end": 176.01, "word": "-generated", "probability": 0.8219401041666666 }, { "start": 176.01, "end": 176.41, "word": " code", "probability": 0.779296875 }, { "start": 176.41, "end": 176.73, "word": " that", "probability": 0.85107421875 }, { "start": 176.73, "end": 177.37, "word": " converts", "probability": 0.87548828125 }, { "start": 177.37, "end": 178.01, "word": " the", "probability": 0.7861328125 }, { "start": 178.01, "end": 178.43, "word": " function", "probability": 0.79345703125 }, { "start": 178.43, "end": 179.01, "word": " call", "probability": 0.61279296875 }, { "start": 179.01, "end": 179.65, "word": " to", "probability": 0.8955078125 }, { "start": 179.65, "end": 180.17, "word": " an", "probability": 0.87890625 }, { "start": 180.17, "end": 180.87, "word": " RPC", "probability": 0.9580078125 }, { "start": 180.87, "end": 181.35, "word": " message", "probability": 0.82666015625 }, { "start": 181.35, "end": 181.99, "word": ".", "probability": 0.9580078125 } ] }, { "id": 43, "seek": 19437, "start": 181.99, "end": 188.45, "text": " Generally, the stub code is compiled as a separate native library.", "tokens": [ 50764, 21082, 11, 264, 20266, 3089, 307, 36548, 382, 257, 4994, 8470, 6405, 13, 51014 ], "temperature": 0.0, "avg_logprob": -0.21194197067192622, "compression_ratio": 1.4550898203592815, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 181.99, "end": 182.61, "word": " Generally", "probability": 0.703125 }, { "start": 182.61, "end": 183.23, "word": ",", "probability": 0.78173828125 }, { "start": 183.23, "end": 183.37, "word": " the", "probability": 0.79638671875 }, { "start": 183.37, "end": 183.61, "word": " stub", "probability": 0.52392578125 }, { "start": 183.61, "end": 183.97, "word": " code", "probability": 0.685546875 }, { "start": 183.97, "end": 184.29, "word": " is", "probability": 0.9072265625 }, { "start": 184.29, "end": 184.89, "word": " compiled", "probability": 0.8525390625 }, { "start": 184.89, "end": 185.67, "word": " as", "probability": 0.90234375 }, { "start": 185.95, "end": 186.41, "word": " a separate", "probability": 0.873046875 }, { "start": 186.41, "end": 186.83, "word": " native", "probability": 0.68603515625 }, { "start": 186.83, "end": 187.41, "word": " library", "probability": 0.802734375 }, { "start": 187.41, "end": 188.45, "word": ".", "probability": 0.98291015625 } ] }, { "id": 44, "seek": 19437, "start": 188.69, "end": 195.91, "text": " The stub code loads libADSP-RPCSO and libCDSP-RPCSO built-in libraries", "tokens": [ 51064, 440, 20266, 3089, 12668, 22854, 6112, 27921, 12, 49, 12986, 17188, 293, 22854, 16508, 27921, 12, 49, 12986, 17188, 3094, 12, 259, 15148, 51414 ], "temperature": 0.0, "avg_logprob": -0.21194197067192622, "compression_ratio": 1.4550898203592815, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 188.69, "end": 188.85, "word": " The", "probability": 0.8134765625 }, { "start": 188.85, "end": 189.13, "word": " stub", "probability": 0.85546875 }, { "start": 189.13, "end": 189.59, "word": " code", "probability": 0.76171875 }, { "start": 189.59, "end": 190.29, "word": " loads", "probability": 0.67041015625 }, { "start": 190.29, "end": 191.33, "word": " libADSP", "probability": 0.443603515625 }, { "start": 191.33, "end": 192.15, "word": "-RPCSO", "probability": 0.6378173828125 }, { "start": 192.15, "end": 192.73, "word": " and", "probability": 0.84033203125 }, { "start": 192.73, "end": 193.77, "word": " libCDSP", "probability": 0.8525390625 }, { "start": 193.77, "end": 194.79, "word": "-RPCSO", "probability": 0.9622802734375 }, { "start": 194.79, "end": 195.23, "word": " built", "probability": 0.82763671875 }, { "start": 195.23, "end": 195.39, "word": "-in", "probability": 0.918212890625 }, { "start": 195.39, "end": 195.91, "word": " libraries", "probability": 0.900390625 } ] }, { "id": 45, "seek": 19437, "start": 195.91, "end": 198.87, "text": " to invoke Android drivers.", "tokens": [ 51464, 281, 41117, 8853, 11590, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.21194197067192622, "compression_ratio": 1.4550898203592815, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 195.91, "end": 196.41, "word": " to", "probability": 0.8828125 }, { "start": 196.41, "end": 196.73, "word": " invoke", "probability": 0.89404296875 }, { "start": 196.73, "end": 197.23, "word": " Android", "probability": 0.8828125 }, { "start": 197.23, "end": 197.83, "word": " drivers", "probability": 0.74658203125 }, { "start": 197.83, "end": 198.87, "word": ".", "probability": 0.99365234375 } ] }, { "id": 46, "seek": 21945, "start": 198.87, "end": 204.85, "text": " DSP-RPC drivers send the queued message to the DSP side", "tokens": [ 50364, 15816, 47, 12, 49, 12986, 11590, 2845, 264, 631, 5827, 3636, 281, 264, 15816, 47, 1252, 50664 ], "temperature": 0.0, "avg_logprob": -0.2819393360439469, "compression_ratio": 1.5176470588235293, "no_speech_prob": 0.003574371337890625, "words": [ { "start": 198.87, "end": 200.01, "word": " DSP", "probability": 0.7861328125 }, { "start": 200.01, "end": 200.41, "word": "-RPC", "probability": 0.6734212239583334 }, { "start": 200.41, "end": 201.11, "word": " drivers", "probability": 0.716796875 }, { "start": 201.11, "end": 202.01, "word": " send", "probability": 0.744140625 }, { "start": 202.01, "end": 202.35, "word": " the", "probability": 0.744140625 }, { "start": 202.35, "end": 202.67, "word": " queued", "probability": 0.844970703125 }, { "start": 202.67, "end": 203.25, "word": " message", "probability": 0.73486328125 }, { "start": 203.25, "end": 203.83, "word": " to", "probability": 0.88671875 }, { "start": 203.83, "end": 204.01, "word": " the", "probability": 0.80029296875 }, { "start": 204.01, "end": 204.39, "word": " DSP", "probability": 0.9423828125 }, { "start": 204.39, "end": 204.85, "word": " side", "probability": 0.30615234375 } ] }, { "id": 47, "seek": 21945, "start": 204.85, "end": 210.15, "text": " through the shared memory channel, and then wait for the response.", "tokens": [ 50714, 807, 264, 5507, 4675, 2269, 11, 293, 550, 1699, 337, 264, 4134, 13, 50914 ], "temperature": 0.0, "avg_logprob": -0.2819393360439469, "compression_ratio": 1.5176470588235293, "no_speech_prob": 0.003574371337890625, "words": [ { "start": 204.85, "end": 205.75, "word": " through", "probability": 0.6767578125 }, { "start": 205.75, "end": 206.01, "word": " the", "probability": 0.68798828125 }, { "start": 206.01, "end": 206.29, "word": " shared", "probability": 0.712890625 }, { "start": 206.29, "end": 206.79, "word": " memory", "probability": 0.80078125 }, { "start": 206.79, "end": 207.25, "word": " channel", "probability": 0.7783203125 }, { "start": 207.25, "end": 208.07, "word": ",", "probability": 0.289794921875 }, { "start": 208.07, "end": 208.21, "word": " and", "probability": 0.875 }, { "start": 208.21, "end": 208.49, "word": " then", "probability": 0.73876953125 }, { "start": 208.49, "end": 208.85, "word": " wait", "probability": 0.80908203125 }, { "start": 208.85, "end": 209.07, "word": " for", "probability": 0.89990234375 }, { "start": 209.07, "end": 209.23, "word": " the", "probability": 0.8095703125 }, { "start": 209.23, "end": 209.69, "word": " response", "probability": 0.89990234375 }, { "start": 209.69, "end": 210.15, "word": ".", "probability": 0.94970703125 } ] }, { "id": 48, "seek": 21945, "start": 211.51, "end": 217.27, "text": " On DSP side, a framework presented by the FasterPC shell binary", "tokens": [ 50964, 1282, 15816, 47, 1252, 11, 257, 8388, 8212, 538, 264, 46665, 12986, 8720, 17434, 51264 ], "temperature": 0.0, "avg_logprob": -0.2819393360439469, "compression_ratio": 1.5176470588235293, "no_speech_prob": 0.003574371337890625, "words": [ { "start": 211.51, "end": 212.15, "word": " On", "probability": 0.90673828125 }, { "start": 212.15, "end": 212.51, "word": " DSP", "probability": 0.776611328125 }, { "start": 212.51, "end": 212.99, "word": " side", "probability": 0.72509765625 }, { "start": 212.99, "end": 213.17, "word": ",", "probability": 0.845703125 }, { "start": 213.35, "end": 213.95, "word": " a framework", "probability": 0.78466796875 }, { "start": 213.95, "end": 214.73, "word": " presented", "probability": 0.58349609375 }, { "start": 214.73, "end": 215.21, "word": " by", "probability": 0.90673828125 }, { "start": 215.21, "end": 215.71, "word": " the", "probability": 0.791015625 }, { "start": 215.71, "end": 216.33, "word": " FasterPC", "probability": 0.38250732421875 }, { "start": 216.33, "end": 216.71, "word": " shell", "probability": 0.11602783203125 }, { "start": 216.71, "end": 217.27, "word": " binary", "probability": 0.7265625 } ] }, { "id": 49, "seek": 21945, "start": 217.87, "end": 223.95, "text": " dequeues the messages and dispatches them for processing by a skeleton.", "tokens": [ 51314, 368, 1077, 1247, 264, 7897, 293, 36729, 279, 552, 337, 9007, 538, 257, 25204, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.2819393360439469, "compression_ratio": 1.5176470588235293, "no_speech_prob": 0.003574371337890625, "words": [ { "start": 217.87, "end": 218.45, "word": " dequeues", "probability": 0.602783203125 }, { "start": 218.45, "end": 219.25, "word": " the", "probability": 0.79296875 }, { "start": 219.25, "end": 219.73, "word": " messages", "probability": 0.806640625 }, { "start": 219.73, "end": 220.09, "word": " and", "probability": 0.85888671875 }, { "start": 220.09, "end": 220.89, "word": " dispatches", "probability": 0.766357421875 }, { "start": 220.89, "end": 221.55, "word": " them", "probability": 0.72265625 }, { "start": 221.55, "end": 221.77, "word": " for", "probability": 0.82080078125 }, { "start": 221.77, "end": 222.21, "word": " processing", "probability": 0.80859375 }, { "start": 222.21, "end": 222.57, "word": " by", "probability": 0.90283203125 }, { "start": 222.85, "end": 223.25, "word": " a skeleton", "probability": 0.4560546875 }, { "start": 223.25, "end": 223.95, "word": ".", "probability": 0.58203125 } ] }, { "id": 50, "seek": 24945, "start": 223.95, "end": 230.17, "text": " And again, skeleton is auto-generated library that unmashes parameters", "tokens": [ 50364, 400, 797, 11, 25204, 307, 8399, 12, 21848, 770, 6405, 300, 517, 3799, 71, 279, 9834, 50664 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 223.95, "end": 224.85, "word": " And", "probability": 0.71875 }, { "start": 224.85, "end": 225.29, "word": " again", "probability": 0.87548828125 }, { "start": 225.29, "end": 225.83, "word": ",", "probability": 0.9267578125 }, { "start": 225.83, "end": 226.17, "word": " skeleton", "probability": 0.16796875 }, { "start": 226.17, "end": 226.73, "word": " is", "probability": 0.88671875 }, { "start": 226.73, "end": 227.19, "word": " auto", "probability": 0.59619140625 }, { "start": 227.19, "end": 227.75, "word": "-generated", "probability": 0.8268229166666666 }, { "start": 227.75, "end": 228.29, "word": " library", "probability": 0.75146484375 }, { "start": 228.29, "end": 228.69, "word": " that", "probability": 0.79345703125 }, { "start": 228.69, "end": 229.55, "word": " unmashes", "probability": 0.2453765869140625 }, { "start": 229.55, "end": 230.17, "word": " parameters", "probability": 0.7333984375 } ] }, { "id": 51, "seek": 24945, "start": 230.17, "end": 234.37, "text": " and calls the target method in the object library.", "tokens": [ 50714, 293, 5498, 264, 3779, 3170, 294, 264, 2657, 6405, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 230.17, "end": 230.77, "word": " and", "probability": 0.841796875 }, { "start": 230.77, "end": 231.31, "word": " calls", "probability": 0.71240234375 }, { "start": 231.31, "end": 231.59, "word": " the", "probability": 0.7861328125 }, { "start": 231.59, "end": 231.91, "word": " target", "probability": 0.85400390625 }, { "start": 231.91, "end": 232.43, "word": " method", "probability": 0.85986328125 }, { "start": 232.43, "end": 232.69, "word": " in", "probability": 0.89501953125 }, { "start": 232.69, "end": 232.87, "word": " the", "probability": 0.8154296875 }, { "start": 232.87, "end": 233.21, "word": " object", "probability": 0.837890625 }, { "start": 233.21, "end": 233.59, "word": " library", "probability": 0.7177734375 }, { "start": 233.59, "end": 234.37, "word": ".", "probability": 0.94580078125 } ] }, { "id": 52, "seek": 24945, "start": 234.37, "end": 239.23, "text": " The object library is some logic provided by Qualcomm or OEMs", "tokens": [ 50864, 440, 2657, 6405, 307, 512, 9952, 5649, 538, 13616, 13278, 420, 422, 6683, 82, 51114 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 234.37, "end": 234.75, "word": " The", "probability": 0.80224609375 }, { "start": 234.75, "end": 235.07, "word": " object", "probability": 0.8916015625 }, { "start": 235.07, "end": 235.49, "word": " library", "probability": 0.82373046875 }, { "start": 235.49, "end": 235.79, "word": " is", "probability": 0.8974609375 }, { "start": 235.79, "end": 236.03, "word": " some", "probability": 0.822265625 }, { "start": 236.03, "end": 236.41, "word": " logic", "probability": 0.74560546875 }, { "start": 236.41, "end": 237.01, "word": " provided", "probability": 0.83251953125 }, { "start": 237.01, "end": 237.43, "word": " by", "probability": 0.888671875 }, { "start": 237.43, "end": 238.13, "word": " Qualcomm", "probability": 0.853515625 }, { "start": 238.13, "end": 238.49, "word": " or", "probability": 0.830078125 }, { "start": 238.49, "end": 239.23, "word": " OEMs", "probability": 0.9344075520833334 } ] }, { "id": 53, "seek": 24945, "start": 239.23, "end": 242.81, "text": " and designed to run on a DSP.", "tokens": [ 51164, 293, 4761, 281, 1190, 322, 257, 15816, 47, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 239.23, "end": 239.49, "word": " and", "probability": 0.8203125 }, { "start": 239.49, "end": 239.97, "word": " designed", "probability": 0.76904296875 }, { "start": 239.97, "end": 240.73, "word": " to", "probability": 0.892578125 }, { "start": 240.73, "end": 241.07, "word": " run", "probability": 0.89697265625 }, { "start": 241.07, "end": 241.39, "word": " on", "probability": 0.89990234375 }, { "start": 241.65, "end": 242.01, "word": " a DSP", "probability": 0.80224609375 }, { "start": 242.01, "end": 242.81, "word": ".", "probability": 0.9814453125 } ] }, { "id": 54, "seek": 24945, "start": 245.07, "end": 248.25, "text": " Who can run their own code on DSP?", "tokens": [ 51314, 2102, 393, 1190, 641, 1065, 3089, 322, 15816, 47, 30, 51564 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 245.07, "end": 245.35, "word": " Who", "probability": 0.80078125 }, { "start": 245.35, "end": 245.53, "word": " can", "probability": 0.90576171875 }, { "start": 245.53, "end": 245.91, "word": " run", "probability": 0.9033203125 }, { "start": 245.91, "end": 246.21, "word": " their", "probability": 0.278076171875 }, { "start": 246.21, "end": 246.45, "word": " own", "probability": 0.76123046875 }, { "start": 246.45, "end": 246.99, "word": " code", "probability": 0.75048828125 }, { "start": 246.99, "end": 247.47, "word": " on", "probability": 0.90234375 }, { "start": 247.47, "end": 247.85, "word": " DSP", "probability": 0.888671875 }, { "start": 247.85, "end": 248.25, "word": "?", "probability": 0.97802734375 } ] }, { "id": 55, "seek": 24945, "start": 248.65, "end": 253.35, "text": " Any third-party developer can implement its own DSP library.", "tokens": [ 51614, 2639, 2636, 12, 23409, 10754, 393, 4445, 1080, 1065, 15816, 47, 6405, 13, 51814 ], "temperature": 0.0, "avg_logprob": -0.239154412465937, "compression_ratio": 1.522167487684729, "no_speech_prob": 0.005458831787109375, "words": [ { "start": 248.65, "end": 249.09, "word": " Any", "probability": 0.78759765625 }, { "start": 249.09, "end": 249.49, "word": " third", "probability": 0.76318359375 }, { "start": 249.49, "end": 249.83, "word": "-party", "probability": 0.68212890625 }, { "start": 249.83, "end": 250.37, "word": " developer", "probability": 0.64111328125 }, { "start": 250.37, "end": 250.71, "word": " can", "probability": 0.89208984375 }, { "start": 250.71, "end": 251.43, "word": " implement", "probability": 0.7744140625 }, { "start": 251.43, "end": 251.83, "word": " its", "probability": 0.73681640625 }, { "start": 251.83, "end": 252.21, "word": " own", "probability": 0.8544921875 }, { "start": 252.21, "end": 252.69, "word": " DSP", "probability": 0.909423828125 }, { "start": 252.69, "end": 253.23, "word": " library", "probability": 0.81689453125 }, { "start": 253.23, "end": 253.35, "word": ".", "probability": 0.90625 } ] }, { "id": 56, "seek": 27789, "start": 253.95, "end": 259.17, "text": " Because the Hexagon SDK, which is responsible for compiling C++ code", "tokens": [ 50364, 1436, 264, 634, 87, 6709, 37135, 11, 597, 307, 6250, 337, 715, 4883, 383, 25472, 3089, 50614 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 253.95, "end": 254.19, "word": " Because", "probability": 0.31884765625 }, { "start": 254.19, "end": 254.41, "word": " the", "probability": 0.787109375 }, { "start": 254.41, "end": 254.87, "word": " Hexagon", "probability": 0.698974609375 }, { "start": 254.87, "end": 255.49, "word": " SDK", "probability": 0.904296875 }, { "start": 255.49, "end": 256.09, "word": ",", "probability": 0.74072265625 }, { "start": 256.09, "end": 256.19, "word": " which", "probability": 0.912109375 }, { "start": 256.19, "end": 256.33, "word": " is", "probability": 0.9033203125 }, { "start": 256.33, "end": 256.91, "word": " responsible", "probability": 0.81640625 }, { "start": 256.91, "end": 257.25, "word": " for", "probability": 0.892578125 }, { "start": 257.25, "end": 257.83, "word": " compiling", "probability": 0.929931640625 }, { "start": 257.83, "end": 258.65, "word": " C++", "probability": 0.265350341796875 }, { "start": 258.65, "end": 259.17, "word": " code", "probability": 0.736328125 } ] }, { "id": 57, "seek": 27789, "start": 259.17, "end": 263.13, "text": " into Hexagon bytecode, is publicly available.", "tokens": [ 50664, 666, 634, 87, 6709, 40846, 22332, 11, 307, 14843, 2435, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 259.17, "end": 259.43, "word": " into", "probability": 0.333984375 }, { "start": 259.43, "end": 260.09, "word": " Hexagon", "probability": 0.8889973958333334 }, { "start": 260.09, "end": 260.85, "word": " bytecode", "probability": 0.769775390625 }, { "start": 260.85, "end": 261.19, "word": ",", "probability": 0.470458984375 }, { "start": 261.19, "end": 261.55, "word": " is", "probability": 0.892578125 }, { "start": 261.55, "end": 262.01, "word": " publicly", "probability": 0.85546875 }, { "start": 262.01, "end": 262.69, "word": " available", "probability": 0.76220703125 }, { "start": 262.69, "end": 263.13, "word": ".", "probability": 0.927734375 } ] }, { "id": 58, "seek": 27789, "start": 263.51, "end": 268.85, "text": " But it's impossible to run a third-party library on DSP.", "tokens": [ 50864, 583, 309, 311, 6243, 281, 1190, 257, 2636, 12, 23409, 6405, 322, 15816, 47, 13, 51064 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 263.51, "end": 264.11, "word": " But", "probability": 0.8935546875 }, { "start": 264.11, "end": 264.57, "word": " it's", "probability": 0.89697265625 }, { "start": 264.57, "end": 265.17, "word": " impossible", "probability": 0.7958984375 }, { "start": 265.17, "end": 265.57, "word": " to", "probability": 0.9091796875 }, { "start": 265.57, "end": 265.85, "word": " run", "probability": 0.89697265625 }, { "start": 266.07, "end": 266.31, "word": " a third", "probability": 0.75 }, { "start": 266.31, "end": 266.63, "word": "-party", "probability": 0.704833984375 }, { "start": 266.63, "end": 267.23, "word": " library", "probability": 0.81591796875 }, { "start": 267.23, "end": 267.61, "word": " on", "probability": 0.89599609375 }, { "start": 267.61, "end": 267.97, "word": " DSP", "probability": 0.8583984375 }, { "start": 267.97, "end": 268.85, "word": ".", "probability": 0.98486328125 } ] }, { "id": 59, "seek": 27789, "start": 268.93, "end": 274.17, "text": " For security reasons, DSP is licensed for programming by OEMs", "tokens": [ 51114, 1171, 3825, 4112, 11, 15816, 47, 307, 25225, 337, 9410, 538, 422, 6683, 82, 51364 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 268.93, "end": 269.31, "word": " For", "probability": 0.9169921875 }, { "start": 269.31, "end": 269.75, "word": " security", "probability": 0.93408203125 }, { "start": 269.75, "end": 270.31, "word": " reasons", "probability": 0.86279296875 }, { "start": 270.31, "end": 270.97, "word": ",", "probability": 0.94873046875 }, { "start": 270.97, "end": 271.33, "word": " DSP", "probability": 0.916015625 }, { "start": 271.33, "end": 271.61, "word": " is", "probability": 0.8994140625 }, { "start": 271.61, "end": 272.13, "word": " licensed", "probability": 0.83740234375 }, { "start": 272.13, "end": 272.39, "word": " for", "probability": 0.89013671875 }, { "start": 272.39, "end": 272.93, "word": " programming", "probability": 0.7265625 }, { "start": 272.93, "end": 273.73, "word": " by", "probability": 0.845703125 }, { "start": 273.73, "end": 274.17, "word": " OEMs", "probability": 0.9471028645833334 } ] }, { "id": 60, "seek": 27789, "start": 274.59, "end": 279.03, "text": " and code running on the DSP is signed by Qualcomm.", "tokens": [ 51414, 293, 3089, 2614, 322, 264, 15816, 47, 307, 8175, 538, 13616, 13278, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 274.59, "end": 274.95, "word": " and", "probability": 0.380126953125 }, { "start": 274.95, "end": 275.27, "word": " code", "probability": 0.74658203125 }, { "start": 275.27, "end": 275.73, "word": " running", "probability": 0.8662109375 }, { "start": 275.73, "end": 276.01, "word": " on", "probability": 0.88134765625 }, { "start": 276.01, "end": 276.15, "word": " the", "probability": 0.748046875 }, { "start": 276.15, "end": 276.57, "word": " DSP", "probability": 0.91845703125 }, { "start": 276.57, "end": 276.95, "word": " is", "probability": 0.904296875 }, { "start": 276.95, "end": 277.27, "word": " signed", "probability": 0.794921875 }, { "start": 277.27, "end": 277.59, "word": " by", "probability": 0.8994140625 }, { "start": 277.59, "end": 278.15, "word": " Qualcomm", "probability": 0.4669647216796875 }, { "start": 278.15, "end": 279.03, "word": ".", "probability": 0.98779296875 } ] }, { "id": 61, "seek": 27789, "start": 281.06, "end": 283.76, "text": " Who manages the DSP?", "tokens": [ 51614, 2102, 22489, 264, 15816, 47, 30, 51764 ], "temperature": 0.0, "avg_logprob": -0.17450843366344324, "compression_ratio": 1.4386792452830188, "no_speech_prob": 0.0028934478759765625, "words": [ { "start": 281.06, "end": 281.4, "word": " Who", "probability": 0.8359375 }, { "start": 281.4, "end": 282.02, "word": " manages", "probability": 0.8232421875 }, { "start": 282.02, "end": 282.94, "word": " the", "probability": 0.7978515625 }, { "start": 282.94, "end": 283.32, "word": " DSP", "probability": 0.914794921875 }, { "start": 283.32, "end": 283.76, "word": "?", "probability": 0.98828125 } ] }, { "id": 62, "seek": 30393, "start": 283.76, "end": 289.96, "text": " It's Qt, a Qualcomm proprietary multi-threaded real-time operating system.", "tokens": [ 50364, 467, 311, 1249, 83, 11, 257, 13616, 13278, 38992, 4825, 12, 392, 2538, 292, 957, 12, 3766, 7447, 1185, 13, 50614 ], "temperature": 0.0, "avg_logprob": -0.21953124925494194, "compression_ratio": 1.4371859296482412, "no_speech_prob": 0.0038394927978515625, "words": [ { "start": 283.76, "end": 284.44, "word": " It's", "probability": 0.7490234375 }, { "start": 284.44, "end": 284.86, "word": " Qt", "probability": 0.4327392578125 }, { "start": 284.86, "end": 285.18, "word": ",", "probability": 0.765625 }, { "start": 285.46, "end": 285.92, "word": " a Qualcomm", "probability": 0.927978515625 }, { "start": 285.92, "end": 286.64, "word": " proprietary", "probability": 0.6865234375 }, { "start": 286.64, "end": 287.06, "word": " multi", "probability": 0.391357421875 }, { "start": 287.06, "end": 287.66, "word": "-threaded", "probability": 0.9560546875 }, { "start": 287.66, "end": 287.9, "word": " real", "probability": 0.69873046875 }, { "start": 287.9, "end": 288.3, "word": "-time", "probability": 0.81494140625 }, { "start": 288.3, "end": 288.8, "word": " operating", "probability": 0.8681640625 }, { "start": 288.8, "end": 289.26, "word": " system", "probability": 0.87109375 }, { "start": 289.26, "end": 289.96, "word": ".", "probability": 0.888671875 } ] }, { "id": 63, "seek": 30393, "start": 289.96, "end": 293.98, "text": " Integrity of the Qt is trusted by the trust zone.", "tokens": [ 50664, 23894, 507, 295, 264, 1249, 83, 307, 16034, 538, 264, 3361, 6668, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.21953124925494194, "compression_ratio": 1.4371859296482412, "no_speech_prob": 0.0038394927978515625, "words": [ { "start": 289.96, "end": 290.5, "word": " Integrity", "probability": 0.87060546875 }, { "start": 290.5, "end": 290.74, "word": " of", "probability": 0.9091796875 }, { "start": 290.74, "end": 290.9, "word": " the", "probability": 0.716796875 }, { "start": 290.9, "end": 291.26, "word": " Qt", "probability": 0.958740234375 }, { "start": 291.26, "end": 291.52, "word": " is", "probability": 0.89111328125 }, { "start": 291.52, "end": 292.04, "word": " trusted", "probability": 0.69580078125 }, { "start": 292.04, "end": 292.34, "word": " by", "probability": 0.90478515625 }, { "start": 292.34, "end": 292.54, "word": " the", "probability": 0.796875 }, { "start": 292.54, "end": 292.84, "word": " trust", "probability": 0.59326171875 }, { "start": 292.84, "end": 293.14, "word": " zone", "probability": 0.57177734375 }, { "start": 293.14, "end": 293.98, "word": ".", "probability": 0.94775390625 } ] }, { "id": 64, "seek": 30393, "start": 293.98, "end": 299.54, "text": " Qt executable binary, different for ADSP and CDSP,", "tokens": [ 50864, 1249, 83, 7568, 712, 17434, 11, 819, 337, 9135, 27921, 293, 6743, 27921, 11, 51114 ], "temperature": 0.0, "avg_logprob": -0.21953124925494194, "compression_ratio": 1.4371859296482412, "no_speech_prob": 0.0038394927978515625, "words": [ { "start": 293.98, "end": 294.38, "word": " Qt", "probability": 0.956787109375 }, { "start": 294.38, "end": 295.24, "word": " executable", "probability": 0.73095703125 }, { "start": 295.24, "end": 296.22, "word": " binary", "probability": 0.6064453125 }, { "start": 296.22, "end": 296.84, "word": ",", "probability": 0.6513671875 }, { "start": 296.84, "end": 297.28, "word": " different", "probability": 0.66162109375 }, { "start": 297.28, "end": 297.7, "word": " for", "probability": 0.84228515625 }, { "start": 297.7, "end": 298.26, "word": " ADSP", "probability": 0.6826171875 }, { "start": 298.26, "end": 298.58, "word": " and", "probability": 0.875 }, { "start": 298.58, "end": 299.2, "word": " CDSP", "probability": 0.89990234375 }, { "start": 299.2, "end": 299.54, "word": ",", "probability": 0.8203125 } ] }, { "id": 65, "seek": 30393, "start": 299.54, "end": 305.2, "text": " is assigned and split into several files in the same way", "tokens": [ 51164, 307, 13279, 293, 7472, 666, 2940, 7098, 294, 264, 912, 636, 51414 ], "temperature": 0.0, "avg_logprob": -0.21953124925494194, "compression_ratio": 1.4371859296482412, "no_speech_prob": 0.0038394927978515625, "words": [ { "start": 299.54, "end": 299.68, "word": " is", "probability": 0.89892578125 }, { "start": 299.68, "end": 301.0, "word": " assigned", "probability": 0.763671875 }, { "start": 301.0, "end": 301.48, "word": " and", "probability": 0.88623046875 }, { "start": 301.48, "end": 302.08, "word": " split", "probability": 0.818359375 }, { "start": 302.08, "end": 303.0, "word": " into", "probability": 0.7216796875 }, { "start": 303.0, "end": 303.46, "word": " several", "probability": 0.8232421875 }, { "start": 303.46, "end": 304.0, "word": " files", "probability": 0.81640625 }, { "start": 304.0, "end": 304.24, "word": " in", "probability": 0.779296875 }, { "start": 304.24, "end": 304.44, "word": " the", "probability": 0.8095703125 }, { "start": 304.44, "end": 304.72, "word": " same", "probability": 0.8232421875 }, { "start": 304.72, "end": 305.2, "word": " way", "probability": 0.8896484375 } ] }, { "id": 66, "seek": 30393, "start": 305.2, "end": 309.8, "text": " as any other trusted application on Qualcomm devices.", "tokens": [ 51464, 382, 604, 661, 16034, 3861, 322, 13616, 13278, 5759, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.21953124925494194, "compression_ratio": 1.4371859296482412, "no_speech_prob": 0.0038394927978515625, "words": [ { "start": 305.2, "end": 305.5, "word": " as", "probability": 0.89990234375 }, { "start": 305.5, "end": 305.92, "word": " any", "probability": 0.80078125 }, { "start": 305.92, "end": 306.3, "word": " other", "probability": 0.7841796875 }, { "start": 306.3, "end": 306.74, "word": " trusted", "probability": 0.7138671875 }, { "start": 306.74, "end": 307.44, "word": " application", "probability": 0.71142578125 }, { "start": 307.44, "end": 307.86, "word": " on", "probability": 0.900390625 }, { "start": 307.86, "end": 308.32, "word": " Qualcomm", "probability": 0.92919921875 }, { "start": 308.32, "end": 308.92, "word": " devices", "probability": 0.90185546875 }, { "start": 308.92, "end": 309.8, "word": ".", "probability": 0.9892578125 } ] }, { "id": 67, "seek": 33393, "start": 310.74, "end": 315.28, "text": " For each Android process initiating the remote invocation,", "tokens": [ 50414, 1171, 1184, 8853, 1399, 6265, 990, 264, 8607, 1048, 27943, 11, 50564 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 310.74, "end": 311.54, "word": " For", "probability": 0.8544921875 }, { "start": 311.54, "end": 311.74, "word": " each", "probability": 0.85205078125 }, { "start": 311.74, "end": 312.1, "word": " Android", "probability": 0.8095703125 }, { "start": 312.1, "end": 312.66, "word": " process", "probability": 0.75146484375 }, { "start": 312.66, "end": 313.34, "word": " initiating", "probability": 0.743408203125 }, { "start": 313.34, "end": 313.56, "word": " the", "probability": 0.7958984375 }, { "start": 313.56, "end": 313.98, "word": " remote", "probability": 0.86865234375 }, { "start": 313.98, "end": 314.7, "word": " invocation", "probability": 0.848876953125 }, { "start": 314.7, "end": 315.28, "word": ",", "probability": 0.81201171875 } ] }, { "id": 68, "seek": 33393, "start": 315.28, "end": 320.28, "text": " Qt creates a separate faster PC shell process on the DSP.", "tokens": [ 50614, 1249, 83, 7829, 257, 4994, 4663, 6465, 8720, 1399, 322, 264, 15816, 47, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 315.28, "end": 315.52, "word": " Qt", "probability": 0.8720703125 }, { "start": 315.52, "end": 316.04, "word": " creates", "probability": 0.69970703125 }, { "start": 316.3, "end": 316.76, "word": " a separate", "probability": 0.794921875 }, { "start": 316.76, "end": 317.38, "word": " faster", "probability": 0.490966796875 }, { "start": 317.38, "end": 317.76, "word": " PC", "probability": 0.78271484375 }, { "start": 317.76, "end": 318.12, "word": " shell", "probability": 0.58642578125 }, { "start": 318.12, "end": 318.68, "word": " process", "probability": 0.8251953125 }, { "start": 318.68, "end": 319.0, "word": " on", "probability": 0.8740234375 }, { "start": 319.0, "end": 319.14, "word": " the", "probability": 0.8125 }, { "start": 319.14, "end": 319.48, "word": " DSP", "probability": 0.83349609375 }, { "start": 319.48, "end": 320.28, "word": ".", "probability": 0.9873046875 } ] }, { "id": 69, "seek": 33393, "start": 320.64, "end": 326.32, "text": " The DSP architecture provides different protection domains, PD.", "tokens": [ 50864, 440, 15816, 47, 9482, 6417, 819, 6334, 25514, 11, 10464, 13, 51114 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 320.64, "end": 321.0, "word": " The", "probability": 0.82177734375 }, { "start": 321.0, "end": 321.34, "word": " DSP", "probability": 0.92236328125 }, { "start": 321.34, "end": 321.98, "word": " architecture", "probability": 0.85546875 }, { "start": 321.98, "end": 323.12, "word": " provides", "probability": 0.83544921875 }, { "start": 323.12, "end": 323.86, "word": " different", "probability": 0.68115234375 }, { "start": 323.86, "end": 324.42, "word": " protection", "probability": 0.62060546875 }, { "start": 324.42, "end": 325.02, "word": " domains", "probability": 0.81005859375 }, { "start": 325.02, "end": 325.38, "word": ",", "probability": 0.79736328125 }, { "start": 325.38, "end": 325.52, "word": " PD", "probability": 0.880859375 }, { "start": 325.52, "end": 326.32, "word": ".", "probability": 0.96728515625 } ] }, { "id": 70, "seek": 33393, "start": 326.54, "end": 331.02, "text": " Kernel PD has access to all memory of all domains.", "tokens": [ 51164, 40224, 338, 10464, 575, 2105, 281, 439, 4675, 295, 439, 25514, 13, 51364 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 326.54, "end": 326.94, "word": " Kernel", "probability": 0.82568359375 }, { "start": 326.94, "end": 327.16, "word": " PD", "probability": 0.9228515625 }, { "start": 327.16, "end": 327.6, "word": " has", "probability": 0.88671875 }, { "start": 327.6, "end": 328.02, "word": " access", "probability": 0.783203125 }, { "start": 328.02, "end": 328.28, "word": " to", "probability": 0.90087890625 }, { "start": 328.28, "end": 328.7, "word": " all", "probability": 0.853515625 }, { "start": 328.7, "end": 329.18, "word": " memory", "probability": 0.76318359375 }, { "start": 329.18, "end": 329.56, "word": " of", "probability": 0.89208984375 }, { "start": 329.56, "end": 329.88, "word": " all", "probability": 0.8837890625 }, { "start": 329.88, "end": 330.38, "word": " domains", "probability": 0.81640625 }, { "start": 330.38, "end": 331.02, "word": ".", "probability": 0.54052734375 } ] }, { "id": 71, "seek": 33393, "start": 331.02, "end": 334.74, "text": " Guest OS PD has access to the memory of its own PD", "tokens": [ 51414, 2694, 377, 12731, 10464, 575, 2105, 281, 264, 4675, 295, 1080, 1065, 10464, 51564 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 331.02, "end": 331.2, "word": " Guest", "probability": 0.862548828125 }, { "start": 331.2, "end": 331.52, "word": " OS", "probability": 0.64501953125 }, { "start": 331.52, "end": 331.76, "word": " PD", "probability": 0.90673828125 }, { "start": 331.76, "end": 332.06, "word": " has", "probability": 0.892578125 }, { "start": 332.06, "end": 332.36, "word": " access", "probability": 0.86669921875 }, { "start": 332.36, "end": 332.58, "word": " to", "probability": 0.90625 }, { "start": 332.58, "end": 333.12, "word": " the", "probability": 0.78662109375 }, { "start": 333.12, "end": 333.48, "word": " memory", "probability": 0.76611328125 }, { "start": 333.48, "end": 333.8, "word": " of", "probability": 0.90234375 }, { "start": 333.8, "end": 334.04, "word": " its", "probability": 0.7666015625 }, { "start": 334.04, "end": 334.36, "word": " own", "probability": 0.7490234375 }, { "start": 334.36, "end": 334.74, "word": " PD", "probability": 0.9345703125 } ] }, { "id": 72, "seek": 33393, "start": 334.74, "end": 339.78, "text": " and memory of the user PD and some system registers.", "tokens": [ 51614, 293, 4675, 295, 264, 4195, 10464, 293, 512, 1185, 38351, 13, 51814 ], "temperature": 0.0, "avg_logprob": -0.21672793907277724, "compression_ratio": 1.6262135922330097, "no_speech_prob": 0.00441741943359375, "words": [ { "start": 334.74, "end": 335.26, "word": " and", "probability": 0.759765625 }, { "start": 335.26, "end": 335.78, "word": " memory", "probability": 0.61474609375 }, { "start": 335.78, "end": 336.6, "word": " of", "probability": 0.8974609375 }, { "start": 336.6, "end": 336.78, "word": " the", "probability": 0.80517578125 }, { "start": 336.78, "end": 337.08, "word": " user", "probability": 0.77783203125 }, { "start": 337.08, "end": 337.42, "word": " PD", "probability": 0.9072265625 }, { "start": 337.42, "end": 337.92, "word": " and", "probability": 0.8046875 }, { "start": 337.92, "end": 338.38, "word": " some", "probability": 0.8046875 }, { "start": 338.38, "end": 338.86, "word": " system", "probability": 0.87255859375 }, { "start": 338.86, "end": 339.26, "word": " registers", "probability": 0.2359619140625 }, { "start": 339.26, "end": 339.78, "word": ".", "probability": 0.9921875 } ] }, { "id": 73, "seek": 36089, "start": 340.58, "end": 345.0, "text": " User PD has access only to its own memory.", "tokens": [ 50364, 32127, 10464, 575, 2105, 787, 281, 1080, 1065, 4675, 13, 50614 ], "temperature": 0.0, "avg_logprob": -0.24661144614219666, "compression_ratio": 1.4263157894736842, "no_speech_prob": 0.0012693405151367188, "words": [ { "start": 340.58, "end": 341.34, "word": " User", "probability": 0.44873046875 }, { "start": 341.34, "end": 341.58, "word": " PD", "probability": 0.66015625 }, { "start": 341.58, "end": 341.92, "word": " has", "probability": 0.8837890625 }, { "start": 341.92, "end": 342.36, "word": " access", "probability": 0.796875 }, { "start": 342.36, "end": 342.76, "word": " only", "probability": 0.84814453125 }, { "start": 342.76, "end": 343.04, "word": " to", "probability": 0.87744140625 }, { "start": 343.04, "end": 343.42, "word": " its", "probability": 0.673828125 }, { "start": 343.42, "end": 344.12, "word": " own", "probability": 0.7392578125 }, { "start": 344.12, "end": 344.62, "word": " memory", "probability": 0.79541015625 }, { "start": 344.62, "end": 345.0, "word": ".", "probability": 0.91259765625 } ] }, { "id": 74, "seek": 36089, "start": 345.82, "end": 350.64, "text": " Skeleton and object libraries, as well as the fast RPC shell,", "tokens": [ 50664, 32344, 14806, 293, 2657, 15148, 11, 382, 731, 382, 264, 2370, 497, 12986, 8720, 11, 50864 ], "temperature": 0.0, "avg_logprob": -0.24661144614219666, "compression_ratio": 1.4263157894736842, "no_speech_prob": 0.0012693405151367188, "words": [ { "start": 345.82, "end": 346.26, "word": " Skeleton", "probability": 0.757080078125 }, { "start": 346.26, "end": 346.66, "word": " and", "probability": 0.88037109375 }, { "start": 346.66, "end": 346.98, "word": " object", "probability": 0.82958984375 }, { "start": 346.98, "end": 347.58, "word": " libraries", "probability": 0.89013671875 }, { "start": 347.58, "end": 347.92, "word": ",", "probability": 0.6005859375 }, { "start": 347.92, "end": 348.3, "word": " as", "probability": 0.88623046875 }, { "start": 348.3, "end": 348.46, "word": " well", "probability": 0.85986328125 }, { "start": 348.46, "end": 348.68, "word": " as", "probability": 0.8896484375 }, { "start": 348.68, "end": 348.96, "word": " the", "probability": 0.763671875 }, { "start": 348.96, "end": 349.26, "word": " fast", "probability": 0.5185546875 }, { "start": 349.26, "end": 349.76, "word": " RPC", "probability": 0.78076171875 }, { "start": 349.76, "end": 350.24, "word": " shell", "probability": 0.68310546875 }, { "start": 350.24, "end": 350.64, "word": ",", "probability": 0.56396484375 } ] }, { "id": 75, "seek": 36089, "start": 350.64, "end": 353.2, "text": " are running in the user PD.", "tokens": [ 50914, 366, 2614, 294, 264, 4195, 10464, 13, 51014 ], "temperature": 0.0, "avg_logprob": -0.24661144614219666, "compression_ratio": 1.4263157894736842, "no_speech_prob": 0.0012693405151367188, "words": [ { "start": 350.64, "end": 350.88, "word": " are", "probability": 0.8974609375 }, { "start": 350.88, "end": 351.24, "word": " running", "probability": 0.88671875 }, { "start": 351.24, "end": 351.56, "word": " in", "probability": 0.89990234375 }, { "start": 351.56, "end": 351.72, "word": " the", "probability": 0.806640625 }, { "start": 351.72, "end": 352.08, "word": " user", "probability": 0.61572265625 }, { "start": 352.08, "end": 352.44, "word": " PD", "probability": 0.94091796875 }, { "start": 352.44, "end": 353.2, "word": ".", "probability": 0.98974609375 } ] }, { "id": 76, "seek": 36089, "start": 355.65, "end": 362.31, "text": " The stub code provided by Qualcomm or OEMs can be skipped from the fast RPC chain.", "tokens": [ 51064, 440, 20266, 3089, 5649, 538, 13616, 13278, 420, 422, 6683, 82, 393, 312, 30193, 490, 264, 2370, 497, 12986, 5021, 13, 51414 ], "temperature": 0.0, "avg_logprob": -0.24661144614219666, "compression_ratio": 1.4263157894736842, "no_speech_prob": 0.0012693405151367188, "words": [ { "start": 355.65, "end": 355.91, "word": " The", "probability": 0.77587890625 }, { "start": 355.91, "end": 356.17, "word": " stub", "probability": 0.163330078125 }, { "start": 356.17, "end": 356.53, "word": " code", "probability": 0.6708984375 }, { "start": 356.53, "end": 357.47, "word": " provided", "probability": 0.74365234375 }, { "start": 357.47, "end": 357.77, "word": " by", "probability": 0.88525390625 }, { "start": 357.77, "end": 358.27, "word": " Qualcomm", "probability": 0.931884765625 }, { "start": 358.27, "end": 358.63, "word": " or", "probability": 0.4072265625 }, { "start": 358.63, "end": 359.33, "word": " OEMs", "probability": 0.7859700520833334 }, { "start": 359.33, "end": 359.61, "word": " can", "probability": 0.83349609375 }, { "start": 359.61, "end": 359.83, "word": " be", "probability": 0.89501953125 }, { "start": 359.83, "end": 360.19, "word": " skipped", "probability": 0.79833984375 }, { "start": 360.19, "end": 360.67, "word": " from", "probability": 0.82080078125 }, { "start": 360.67, "end": 360.91, "word": " the", "probability": 0.80908203125 }, { "start": 360.91, "end": 361.21, "word": " fast", "probability": 0.6650390625 }, { "start": 361.21, "end": 361.51, "word": " RPC", "probability": 0.96533203125 }, { "start": 361.51, "end": 361.93, "word": " chain", "probability": 0.8212890625 }, { "start": 361.93, "end": 362.31, "word": ".", "probability": 0.9912109375 } ] }, { "id": 77, "seek": 36089, "start": 363.01, "end": 368.13, "text": " As was mentioned, libADSP-RPC and libCDSP-RPC libraries", "tokens": [ 51464, 1018, 390, 2835, 11, 22854, 6112, 27921, 12, 49, 12986, 293, 22854, 16508, 27921, 12, 49, 12986, 15148, 51714 ], "temperature": 0.0, "avg_logprob": -0.24661144614219666, "compression_ratio": 1.4263157894736842, "no_speech_prob": 0.0012693405151367188, "words": [ { "start": 363.01, "end": 363.25, "word": " As", "probability": 0.896484375 }, { "start": 363.25, "end": 363.45, "word": " was", "probability": 0.88525390625 }, { "start": 363.45, "end": 363.99, "word": " mentioned", "probability": 0.76220703125 }, { "start": 363.99, "end": 364.51, "word": ",", "probability": 0.90087890625 }, { "start": 364.51, "end": 365.27, "word": " libADSP", "probability": 0.341552734375 }, { "start": 365.27, "end": 365.81, "word": "-RPC", "probability": 0.7281901041666666 }, { "start": 365.81, "end": 366.19, "word": " and", "probability": 0.880859375 }, { "start": 366.19, "end": 366.99, "word": " libCDSP", "probability": 0.8626302083333334 }, { "start": 366.99, "end": 367.47, "word": "-RPC", "probability": 0.9669596354166666 }, { "start": 367.47, "end": 368.13, "word": " libraries", "probability": 0.8828125 } ] }, { "id": 78, "seek": 38691, "start": 368.13, "end": 373.43, "text": " are responsible for communication with DSP-RPC drivers.", "tokens": [ 50364, 366, 6250, 337, 6101, 365, 15816, 47, 12, 49, 12986, 11590, 13, 50564 ], "temperature": 0.0, "avg_logprob": -0.20519302149905877, "compression_ratio": 1.5416666666666667, "no_speech_prob": 0.0019311904907226562, "words": [ { "start": 368.13, "end": 368.67, "word": " are", "probability": 0.53125 }, { "start": 368.67, "end": 369.21, "word": " responsible", "probability": 0.814453125 }, { "start": 369.21, "end": 369.63, "word": " for", "probability": 0.89404296875 }, { "start": 369.63, "end": 370.31, "word": " communication", "probability": 0.73681640625 }, { "start": 370.31, "end": 370.73, "word": " with", "probability": 0.736328125 }, { "start": 370.73, "end": 371.59, "word": " DSP", "probability": 0.791015625 }, { "start": 371.59, "end": 371.91, "word": "-RPC", "probability": 0.6695149739583334 }, { "start": 371.91, "end": 372.51, "word": " drivers", "probability": 0.76416015625 }, { "start": 372.51, "end": 373.43, "word": ".", "probability": 0.92919921875 } ] }, { "id": 79, "seek": 38691, "start": 373.81, "end": 378.57, "text": " Each library exports two major functions.", "tokens": [ 50614, 6947, 6405, 31428, 732, 2563, 6828, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.20519302149905877, "compression_ratio": 1.5416666666666667, "no_speech_prob": 0.0019311904907226562, "words": [ { "start": 373.81, "end": 374.17, "word": " Each", "probability": 0.83740234375 }, { "start": 374.17, "end": 374.81, "word": " library", "probability": 0.83154296875 }, { "start": 374.81, "end": 376.15, "word": " exports", "probability": 0.82275390625 }, { "start": 376.15, "end": 376.53, "word": " two", "probability": 0.75 }, { "start": 376.53, "end": 377.05, "word": " major", "probability": 0.7861328125 }, { "start": 377.05, "end": 377.71, "word": " functions", "probability": 0.87158203125 }, { "start": 377.71, "end": 378.57, "word": ".", "probability": 0.71826171875 } ] }, { "id": 80, "seek": 38691, "start": 378.57, "end": 383.47, "text": " Remote handle open function opens a remote session between the client", "tokens": [ 50864, 44858, 4813, 1269, 2445, 9870, 257, 8607, 5481, 1296, 264, 6423, 51114 ], "temperature": 0.0, "avg_logprob": -0.20519302149905877, "compression_ratio": 1.5416666666666667, "no_speech_prob": 0.0019311904907226562, "words": [ { "start": 378.57, "end": 378.89, "word": " Remote", "probability": 0.8701171875 }, { "start": 378.89, "end": 379.21, "word": " handle", "probability": 0.4365234375 }, { "start": 379.21, "end": 379.65, "word": " open", "probability": 0.76513671875 }, { "start": 379.65, "end": 380.23, "word": " function", "probability": 0.8515625 }, { "start": 380.23, "end": 381.23, "word": " opens", "probability": 0.66552734375 }, { "start": 381.51, "end": 381.85, "word": " a remote", "probability": 0.88525390625 }, { "start": 381.85, "end": 382.31, "word": " session", "probability": 0.80126953125 }, { "start": 382.31, "end": 382.75, "word": " between", "probability": 0.7919921875 }, { "start": 382.75, "end": 382.99, "word": " the", "probability": 0.814453125 }, { "start": 382.99, "end": 383.47, "word": " client", "probability": 0.8125 } ] }, { "id": 81, "seek": 38691, "start": 383.47, "end": 389.49, "text": " on application processor and new fast RPC shell process on the DSP.", "tokens": [ 51164, 322, 3861, 15321, 293, 777, 2370, 497, 12986, 8720, 1399, 322, 264, 15816, 47, 13, 51414 ], "temperature": 0.0, "avg_logprob": -0.20519302149905877, "compression_ratio": 1.5416666666666667, "no_speech_prob": 0.0019311904907226562, "words": [ { "start": 383.47, "end": 383.99, "word": " on", "probability": 0.81884765625 }, { "start": 383.99, "end": 384.47, "word": " application", "probability": 0.6875 }, { "start": 384.47, "end": 385.05, "word": " processor", "probability": 0.6708984375 }, { "start": 385.05, "end": 385.43, "word": " and", "probability": 0.787109375 }, { "start": 385.43, "end": 385.81, "word": " new", "probability": 0.607421875 }, { "start": 385.81, "end": 386.29, "word": " fast", "probability": 0.689453125 }, { "start": 386.29, "end": 387.09, "word": " RPC", "probability": 0.95068359375 }, { "start": 387.09, "end": 387.47, "word": " shell", "probability": 0.7119140625 }, { "start": 387.47, "end": 387.89, "word": " process", "probability": 0.4013671875 }, { "start": 387.89, "end": 388.35, "word": " on", "probability": 0.890625 }, { "start": 388.35, "end": 388.59, "word": " the", "probability": 0.791015625 }, { "start": 388.59, "end": 389.03, "word": " DSP", "probability": 0.923095703125 }, { "start": 389.03, "end": 389.49, "word": ".", "probability": 0.99169921875 } ] }, { "id": 82, "seek": 38691, "start": 389.97, "end": 394.15, "text": " The skeleton library name is provided as the first argument.", "tokens": [ 51464, 440, 25204, 6405, 1315, 307, 5649, 382, 264, 700, 6770, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.20519302149905877, "compression_ratio": 1.5416666666666667, "no_speech_prob": 0.0019311904907226562, "words": [ { "start": 389.97, "end": 390.17, "word": " The", "probability": 0.75341796875 }, { "start": 390.17, "end": 390.45, "word": " skeleton", "probability": 0.44580078125 }, { "start": 390.45, "end": 390.95, "word": " library", "probability": 0.86328125 }, { "start": 390.95, "end": 391.43, "word": " name", "probability": 0.82861328125 }, { "start": 391.43, "end": 391.65, "word": " is", "probability": 0.90283203125 }, { "start": 391.65, "end": 392.09, "word": " provided", "probability": 0.82275390625 }, { "start": 392.09, "end": 392.39, "word": " as", "probability": 0.89208984375 }, { "start": 392.39, "end": 392.51, "word": " the", "probability": 0.7080078125 }, { "start": 392.51, "end": 392.73, "word": " first", "probability": 0.78857421875 }, { "start": 392.73, "end": 393.23, "word": " argument", "probability": 0.8505859375 }, { "start": 393.23, "end": 394.15, "word": ".", "probability": 0.994140625 } ] }, { "id": 83, "seek": 41637, "start": 394.15, "end": 401.77, "text": " Remote handle invoke function is able to invoke methods exported by the skeleton library.", "tokens": [ 50364, 44858, 4813, 41117, 2445, 307, 1075, 281, 41117, 7150, 42055, 538, 264, 25204, 6405, 13, 50664 ], "temperature": 0.0, "avg_logprob": -0.20576583877415724, "compression_ratio": 1.5092592592592593, "no_speech_prob": 0.0015239715576171875, "words": [ { "start": 394.15, "end": 395.07, "word": " Remote", "probability": 0.8310546875 }, { "start": 395.07, "end": 395.45, "word": " handle", "probability": 0.533203125 }, { "start": 395.45, "end": 396.07, "word": " invoke", "probability": 0.79150390625 }, { "start": 396.07, "end": 396.65, "word": " function", "probability": 0.8623046875 }, { "start": 396.65, "end": 396.99, "word": " is", "probability": 0.88916015625 }, { "start": 396.99, "end": 397.31, "word": " able", "probability": 0.88818359375 }, { "start": 397.31, "end": 397.53, "word": " to", "probability": 0.90478515625 }, { "start": 397.53, "end": 397.97, "word": " invoke", "probability": 0.80859375 }, { "start": 397.97, "end": 398.49, "word": " methods", "probability": 0.8291015625 }, { "start": 398.49, "end": 399.51, "word": " exported", "probability": 0.81494140625 }, { "start": 399.51, "end": 399.79, "word": " by", "probability": 0.90869140625 }, { "start": 399.79, "end": 400.01, "word": " the", "probability": 0.79931640625 }, { "start": 400.01, "end": 400.25, "word": " skeleton", "probability": 0.322509765625 }, { "start": 400.25, "end": 400.85, "word": " library", "probability": 0.87353515625 }, { "start": 400.85, "end": 401.77, "word": ".", "probability": 0.8662109375 } ] }, { "id": 84, "seek": 41637, "start": 401.93, "end": 409.07, "text": " Using these two functions, an Android application can request to execute any skeleton method", "tokens": [ 50714, 11142, 613, 732, 6828, 11, 364, 8853, 3861, 393, 5308, 281, 14483, 604, 25204, 3170, 51064 ], "temperature": 0.0, "avg_logprob": -0.20576583877415724, "compression_ratio": 1.5092592592592593, "no_speech_prob": 0.0015239715576171875, "words": [ { "start": 401.93, "end": 402.43, "word": " Using", "probability": 0.8359375 }, { "start": 402.43, "end": 402.73, "word": " these", "probability": 0.693359375 }, { "start": 402.73, "end": 402.97, "word": " two", "probability": 0.7998046875 }, { "start": 402.97, "end": 403.67, "word": " functions", "probability": 0.859375 }, { "start": 403.67, "end": 403.93, "word": ",", "probability": 0.677734375 }, { "start": 403.93, "end": 404.01, "word": " an", "probability": 0.84228515625 }, { "start": 404.01, "end": 404.29, "word": " Android", "probability": 0.88818359375 }, { "start": 404.29, "end": 404.91, "word": " application", "probability": 0.77392578125 }, { "start": 404.91, "end": 405.29, "word": " can", "probability": 0.89306640625 }, { "start": 405.29, "end": 405.91, "word": " request", "probability": 0.896484375 }, { "start": 405.91, "end": 407.01, "word": " to", "probability": 0.884765625 }, { "start": 407.01, "end": 407.59, "word": " execute", "probability": 0.85693359375 }, { "start": 407.59, "end": 408.11, "word": " any", "probability": 0.7958984375 }, { "start": 408.11, "end": 408.47, "word": " skeleton", "probability": 0.556640625 }, { "start": 408.47, "end": 409.07, "word": " method", "probability": 0.767578125 } ] }, { "id": 85, "seek": 41637, "start": 409.07, "end": 412.33, "text": " without using a stub code.", "tokens": [ 51114, 1553, 1228, 257, 20266, 3089, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.20576583877415724, "compression_ratio": 1.5092592592592593, "no_speech_prob": 0.0015239715576171875, "words": [ { "start": 409.07, "end": 409.81, "word": " without", "probability": 0.7177734375 }, { "start": 409.81, "end": 410.37, "word": " using", "probability": 0.80224609375 }, { "start": 411.01, "end": 411.25, "word": " a stub", "probability": 0.01526641845703125 }, { "start": 411.25, "end": 411.87, "word": " code", "probability": 0.343505859375 }, { "start": 411.87, "end": 412.33, "word": ".", "probability": 0.98486328125 } ] }, { "id": 86, "seek": 41637, "start": 413.73, "end": 418.73, "text": " Now we have enough information to state the downgrade vulnerability.", "tokens": [ 51314, 823, 321, 362, 1547, 1589, 281, 1785, 264, 760, 8692, 24210, 13, 51514 ], "temperature": 0.0, "avg_logprob": -0.20576583877415724, "compression_ratio": 1.5092592592592593, "no_speech_prob": 0.0015239715576171875, "words": [ { "start": 413.73, "end": 414.47, "word": " Now", "probability": 0.8837890625 }, { "start": 414.47, "end": 414.67, "word": " we", "probability": 0.78466796875 }, { "start": 414.67, "end": 414.87, "word": " have", "probability": 0.87841796875 }, { "start": 414.87, "end": 415.29, "word": " enough", "probability": 0.74853515625 }, { "start": 415.29, "end": 415.87, "word": " information", "probability": 0.73974609375 }, { "start": 415.87, "end": 416.21, "word": " to", "probability": 0.9052734375 }, { "start": 416.21, "end": 416.51, "word": " state", "probability": 0.58984375 }, { "start": 416.51, "end": 416.73, "word": " the", "probability": 0.79345703125 }, { "start": 416.73, "end": 417.19, "word": " downgrade", "probability": 0.83837890625 }, { "start": 417.19, "end": 417.81, "word": " vulnerability", "probability": 0.6650390625 }, { "start": 417.81, "end": 418.73, "word": ".", "probability": 0.9755859375 } ] }, { "id": 87, "seek": 41637, "start": 419.01, "end": 423.61, "text": " DSP libraries are signed and cannot be patched.", "tokens": [ 51564, 15816, 47, 15148, 366, 8175, 293, 2644, 312, 9972, 292, 13, 51764 ], "temperature": 0.0, "avg_logprob": -0.20576583877415724, "compression_ratio": 1.5092592592592593, "no_speech_prob": 0.0015239715576171875, "words": [ { "start": 419.01, "end": 419.29, "word": " DSP", "probability": 0.764892578125 }, { "start": 419.29, "end": 420.01, "word": " libraries", "probability": 0.8564453125 }, { "start": 420.01, "end": 420.43, "word": " are", "probability": 0.85595703125 }, { "start": 420.43, "end": 420.81, "word": " signed", "probability": 0.8349609375 }, { "start": 420.81, "end": 421.27, "word": " and", "probability": 0.85888671875 }, { "start": 421.27, "end": 422.09, "word": " cannot", "probability": 0.7724609375 }, { "start": 422.09, "end": 422.39, "word": " be", "probability": 0.9072265625 }, { "start": 422.39, "end": 423.33, "word": " patched", "probability": 0.762451171875 }, { "start": 423.33, "end": 423.61, "word": ".", "probability": 0.8994140625 } ] }, { "id": 88, "seek": 43861, "start": 423.61, "end": 429.43, "text": " However, any Android application can bring a signed by Qualcomm skeleton library", "tokens": [ 50364, 2908, 11, 604, 8853, 3861, 393, 1565, 257, 8175, 538, 13616, 13278, 25204, 6405, 50664 ], "temperature": 0.0, "avg_logprob": -0.2261844755661103, "compression_ratio": 1.510752688172043, "no_speech_prob": 0.0016698837280273438, "words": [ { "start": 423.61, "end": 424.17, "word": " However", "probability": 0.7275390625 }, { "start": 424.17, "end": 424.41, "word": ",", "probability": 0.8984375 }, { "start": 424.41, "end": 424.77, "word": " any", "probability": 0.81787109375 }, { "start": 424.77, "end": 425.23, "word": " Android", "probability": 0.85205078125 }, { "start": 425.23, "end": 425.99, "word": " application", "probability": 0.75390625 }, { "start": 425.99, "end": 426.35, "word": " can", "probability": 0.89404296875 }, { "start": 426.35, "end": 426.77, "word": " bring", "probability": 0.8740234375 }, { "start": 427.39, "end": 427.69, "word": " a signed", "probability": 0.484375 }, { "start": 427.69, "end": 427.95, "word": " by", "probability": 0.626953125 }, { "start": 427.95, "end": 428.45, "word": " Qualcomm", "probability": 0.94091796875 }, { "start": 428.45, "end": 428.81, "word": " skeleton", "probability": 0.2371826171875 }, { "start": 428.81, "end": 429.43, "word": " library", "probability": 0.82763671875 } ] }, { "id": 89, "seek": 43861, "start": 429.43, "end": 433.81, "text": " in its assets and then open a remote session.", "tokens": [ 50714, 294, 1080, 9769, 293, 550, 1269, 257, 8607, 5481, 13, 50864 ], "temperature": 0.0, "avg_logprob": -0.2261844755661103, "compression_ratio": 1.510752688172043, "no_speech_prob": 0.0016698837280273438, "words": [ { "start": 429.43, "end": 430.07, "word": " in", "probability": 0.8681640625 }, { "start": 430.07, "end": 430.33, "word": " its", "probability": 0.73779296875 }, { "start": 430.33, "end": 430.83, "word": " assets", "probability": 0.76611328125 }, { "start": 430.83, "end": 431.57, "word": " and", "probability": 0.52978515625 }, { "start": 431.57, "end": 431.81, "word": " then", "probability": 0.7001953125 }, { "start": 431.81, "end": 432.27, "word": " open", "probability": 0.81640625 }, { "start": 432.43, "end": 432.69, "word": " a remote", "probability": 0.88037109375 }, { "start": 432.69, "end": 433.05, "word": " session", "probability": 0.79248046875 }, { "start": 433.05, "end": 433.81, "word": ".", "probability": 0.927734375 } ] }, { "id": 90, "seek": 43861, "start": 433.91, "end": 439.73, "text": " The library will be successfully loaded on the DSP because its signature is correct.", "tokens": [ 50914, 440, 6405, 486, 312, 10727, 13210, 322, 264, 15816, 47, 570, 1080, 13397, 307, 3006, 13, 51164 ], "temperature": 0.0, "avg_logprob": -0.2261844755661103, "compression_ratio": 1.510752688172043, "no_speech_prob": 0.0016698837280273438, "words": [ { "start": 433.91, "end": 434.13, "word": " The", "probability": 0.7880859375 }, { "start": 434.13, "end": 434.59, "word": " library", "probability": 0.82080078125 }, { "start": 434.59, "end": 434.91, "word": " will", "probability": 0.81396484375 }, { "start": 434.91, "end": 435.09, "word": " be", "probability": 0.90185546875 }, { "start": 435.09, "end": 435.65, "word": " successfully", "probability": 0.7802734375 }, { "start": 435.65, "end": 436.21, "word": " loaded", "probability": 0.8203125 }, { "start": 436.21, "end": 436.59, "word": " on", "probability": 0.88671875 }, { "start": 436.59, "end": 436.75, "word": " the", "probability": 0.81298828125 }, { "start": 436.75, "end": 437.17, "word": " DSP", "probability": 0.924560546875 }, { "start": 437.17, "end": 437.63, "word": " because", "probability": 0.7724609375 }, { "start": 437.63, "end": 437.89, "word": " its", "probability": 0.71826171875 }, { "start": 437.89, "end": 438.25, "word": " signature", "probability": 0.890625 }, { "start": 438.25, "end": 438.55, "word": " is", "probability": 0.90380859375 }, { "start": 438.55, "end": 438.97, "word": " correct", "probability": 0.8544921875 }, { "start": 438.97, "end": 439.73, "word": ".", "probability": 0.990234375 } ] }, { "id": 91, "seek": 43861, "start": 441.07, "end": 445.85, "text": " The fact that there is no version check of loading skeleton libraries", "tokens": [ 51214, 440, 1186, 300, 456, 307, 572, 3037, 1520, 295, 15114, 25204, 15148, 51464 ], "temperature": 0.0, "avg_logprob": -0.2261844755661103, "compression_ratio": 1.510752688172043, "no_speech_prob": 0.0016698837280273438, "words": [ { "start": 441.07, "end": 441.31, "word": " The", "probability": 0.81103515625 }, { "start": 441.31, "end": 441.67, "word": " fact", "probability": 0.81494140625 }, { "start": 441.67, "end": 441.99, "word": " that", "probability": 0.84912109375 }, { "start": 441.99, "end": 442.45, "word": " there", "probability": 0.857421875 }, { "start": 442.45, "end": 442.63, "word": " is", "probability": 0.90185546875 }, { "start": 442.63, "end": 442.95, "word": " no", "probability": 0.90380859375 }, { "start": 442.95, "end": 443.47, "word": " version", "probability": 0.7177734375 }, { "start": 443.47, "end": 443.97, "word": " check", "probability": 0.71337890625 }, { "start": 443.97, "end": 444.35, "word": " of", "probability": 0.7412109375 }, { "start": 444.35, "end": 444.73, "word": " loading", "probability": 0.65478515625 }, { "start": 444.73, "end": 445.19, "word": " skeleton", "probability": 0.54931640625 }, { "start": 445.19, "end": 445.85, "word": " libraries", "probability": 0.9072265625 } ] }, { "id": 92, "seek": 46283, "start": 445.85, "end": 449.79, "text": " opens the possibility to run a very old skeleton lib", "tokens": [ 50364, 9870, 264, 7959, 281, 1190, 257, 588, 1331, 25204, 22854, 50564 ], "temperature": 0.0, "avg_logprob": -0.20822483114898205, "compression_ratio": 1.5191256830601092, "no_speech_prob": 0.0257568359375, "words": [ { "start": 445.85, "end": 446.39, "word": " opens", "probability": 0.053375244140625 }, { "start": 446.39, "end": 446.79, "word": " the", "probability": 0.79345703125 }, { "start": 446.79, "end": 447.37, "word": " possibility", "probability": 0.91357421875 }, { "start": 447.37, "end": 447.69, "word": " to", "probability": 0.90185546875 }, { "start": 447.69, "end": 447.89, "word": " run", "probability": 0.8935546875 }, { "start": 448.13, "end": 448.51, "word": " a very", "probability": 0.76318359375 }, { "start": 448.51, "end": 448.95, "word": " old", "probability": 0.86767578125 }, { "start": 448.95, "end": 449.31, "word": " skeleton", "probability": 0.188232421875 }, { "start": 449.31, "end": 449.79, "word": " lib", "probability": 0.451904296875 } ] }, { "id": 93, "seek": 46283, "start": 450.66, "end": 454.05, "text": " with known one-day vulnerabilities on the DSP.", "tokens": [ 50614, 365, 2570, 472, 12, 810, 37633, 322, 264, 15816, 47, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.20822483114898205, "compression_ratio": 1.5191256830601092, "no_speech_prob": 0.0257568359375, "words": [ { "start": 450.66, "end": 451.03, "word": " with", "probability": 0.64453125 }, { "start": 451.03, "end": 451.33, "word": " known", "probability": 0.60888671875 }, { "start": 451.33, "end": 451.69, "word": " one", "probability": 0.66845703125 }, { "start": 451.69, "end": 451.87, "word": "-day", "probability": 0.76513671875 }, { "start": 451.87, "end": 452.57, "word": " vulnerabilities", "probability": 0.80078125 }, { "start": 452.57, "end": 452.91, "word": " on", "probability": 0.88232421875 }, { "start": 452.91, "end": 453.05, "word": " the", "probability": 0.806640625 }, { "start": 453.05, "end": 453.41, "word": " DSP", "probability": 0.871337890625 }, { "start": 453.41, "end": 454.05, "word": ".", "probability": 0.89697265625 } ] }, { "id": 94, "seek": 46283, "start": 454.05, "end": 459.47, "text": " Even if the patched skeleton library already exists on the device,", "tokens": [ 50814, 2754, 498, 264, 9972, 292, 25204, 6405, 1217, 8198, 322, 264, 4302, 11, 51014 ], "temperature": 0.0, "avg_logprob": -0.20822483114898205, "compression_ratio": 1.5191256830601092, "no_speech_prob": 0.0257568359375, "words": [ { "start": 454.05, "end": 454.59, "word": " Even", "probability": 0.80224609375 }, { "start": 454.59, "end": 455.29, "word": " if", "probability": 0.89404296875 }, { "start": 455.29, "end": 455.49, "word": " the", "probability": 0.80224609375 }, { "start": 455.49, "end": 456.19, "word": " patched", "probability": 0.823486328125 }, { "start": 456.19, "end": 456.19, "word": " skeleton", "probability": 0.64013671875 }, { "start": 456.19, "end": 456.75, "word": " library", "probability": 0.779296875 }, { "start": 456.75, "end": 457.21, "word": " already", "probability": 0.8232421875 }, { "start": 457.21, "end": 457.93, "word": " exists", "probability": 0.77880859375 }, { "start": 457.93, "end": 458.25, "word": " on", "probability": 0.8955078125 }, { "start": 458.25, "end": 458.81, "word": " the", "probability": 0.802734375 }, { "start": 458.81, "end": 459.31, "word": " device", "probability": 0.88818359375 }, { "start": 459.31, "end": 459.47, "word": ",", "probability": 0.8291015625 } ] }, { "id": 95, "seek": 46283, "start": 459.47, "end": 463.73, "text": " it is possible to load the old version of this library.", "tokens": [ 51064, 309, 307, 1944, 281, 3677, 264, 1331, 3037, 295, 341, 6405, 13, 51214 ], "temperature": 0.0, "avg_logprob": -0.20822483114898205, "compression_ratio": 1.5191256830601092, "no_speech_prob": 0.0257568359375, "words": [ { "start": 459.47, "end": 459.73, "word": " it", "probability": 0.8798828125 }, { "start": 459.73, "end": 459.87, "word": " is", "probability": 0.279052734375 }, { "start": 459.87, "end": 460.55, "word": " possible", "probability": 0.80712890625 }, { "start": 460.55, "end": 460.83, "word": " to", "probability": 0.90283203125 }, { "start": 460.83, "end": 461.09, "word": " load", "probability": 0.94580078125 }, { "start": 461.09, "end": 461.33, "word": " the", "probability": 0.78955078125 }, { "start": 461.33, "end": 461.67, "word": " old", "probability": 0.88720703125 }, { "start": 461.67, "end": 462.07, "word": " version", "probability": 0.70654296875 }, { "start": 462.07, "end": 462.35, "word": " of", "probability": 0.90087890625 }, { "start": 462.35, "end": 462.55, "word": " this", "probability": 0.82666015625 }, { "start": 462.55, "end": 462.99, "word": " library", "probability": 0.81494140625 }, { "start": 462.99, "end": 463.73, "word": ".", "probability": 0.96728515625 } ] }, { "id": 96, "seek": 46283, "start": 464.07, "end": 470.07, "text": " Any DSP code fix can be simply bypassed by an attacker.", "tokens": [ 51264, 2639, 15816, 47, 3089, 3191, 393, 312, 2935, 24996, 292, 538, 364, 35871, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.20822483114898205, "compression_ratio": 1.5191256830601092, "no_speech_prob": 0.0257568359375, "words": [ { "start": 464.07, "end": 464.45, "word": " Any", "probability": 0.81396484375 }, { "start": 464.45, "end": 464.87, "word": " DSP", "probability": 0.914306640625 }, { "start": 464.87, "end": 465.21, "word": " code", "probability": 0.80517578125 }, { "start": 465.21, "end": 465.55, "word": " fix", "probability": 0.849609375 }, { "start": 465.55, "end": 466.21, "word": " can", "probability": 0.88134765625 }, { "start": 466.21, "end": 466.47, "word": " be", "probability": 0.5185546875 }, { "start": 466.47, "end": 467.97, "word": " simply", "probability": 0.63623046875 }, { "start": 467.97, "end": 468.71, "word": " bypassed", "probability": 0.911865234375 }, { "start": 468.71, "end": 468.87, "word": " by", "probability": 0.90478515625 }, { "start": 468.87, "end": 469.01, "word": " an", "probability": 0.9072265625 }, { "start": 469.01, "end": 469.33, "word": " attacker", "probability": 0.75341796875 }, { "start": 469.33, "end": 470.07, "word": ".", "probability": 0.97900390625 } ] }, { "id": 97, "seek": 48815, "start": 471.07, "end": 475.75, "text": " Due to the lack of leads of the skeleton libraries permitted for the device,", "tokens": [ 50414, 18980, 281, 264, 5011, 295, 6689, 295, 264, 25204, 15148, 28658, 337, 264, 4302, 11, 50614 ], "temperature": 0.0, "avg_logprob": -0.2013774735755042, "compression_ratio": 1.5940594059405941, "no_speech_prob": 0.0082244873046875, "words": [ { "start": 471.07, "end": 471.47, "word": " Due", "probability": 0.7998046875 }, { "start": 471.47, "end": 471.71, "word": " to", "probability": 0.9013671875 }, { "start": 471.71, "end": 471.85, "word": " the", "probability": 0.7890625 }, { "start": 471.85, "end": 472.15, "word": " lack", "probability": 0.8115234375 }, { "start": 472.15, "end": 472.55, "word": " of", "probability": 0.91064453125 }, { "start": 472.55, "end": 472.87, "word": " leads", "probability": 0.379150390625 }, { "start": 472.87, "end": 473.31, "word": " of", "probability": 0.8369140625 }, { "start": 473.31, "end": 473.47, "word": " the", "probability": 0.76806640625 }, { "start": 473.47, "end": 473.79, "word": " skeleton", "probability": 0.56640625 }, { "start": 473.79, "end": 474.39, "word": " libraries", "probability": 0.8828125 }, { "start": 474.39, "end": 474.81, "word": " permitted", "probability": 0.77392578125 }, { "start": 474.81, "end": 475.05, "word": " for", "probability": 0.8857421875 }, { "start": 475.05, "end": 475.19, "word": " the", "probability": 0.79931640625 }, { "start": 475.19, "end": 475.59, "word": " device", "probability": 0.8662109375 }, { "start": 475.59, "end": 475.75, "word": ",", "probability": 0.76953125 } ] }, { "id": 98, "seek": 48815, "start": 475.75, "end": 479.67, "text": " it is possible to run a library intended for one device,", "tokens": [ 50664, 309, 307, 1944, 281, 1190, 257, 6405, 10226, 337, 472, 4302, 11, 50814 ], "temperature": 0.0, "avg_logprob": -0.2013774735755042, "compression_ratio": 1.5940594059405941, "no_speech_prob": 0.0082244873046875, "words": [ { "start": 475.75, "end": 475.87, "word": " it", "probability": 0.8740234375 }, { "start": 475.87, "end": 476.01, "word": " is", "probability": 0.396240234375 }, { "start": 476.01, "end": 476.45, "word": " possible", "probability": 0.84130859375 }, { "start": 476.45, "end": 476.79, "word": " to", "probability": 0.90234375 }, { "start": 476.79, "end": 477.05, "word": " run", "probability": 0.89208984375 }, { "start": 477.35, "end": 477.85, "word": " a library", "probability": 0.83740234375 }, { "start": 477.85, "end": 478.41, "word": " intended", "probability": 0.79248046875 }, { "start": 478.41, "end": 478.73, "word": " for", "probability": 0.8955078125 }, { "start": 478.73, "end": 479.03, "word": " one", "probability": 0.80517578125 }, { "start": 479.03, "end": 479.51, "word": " device", "probability": 0.8916015625 }, { "start": 479.51, "end": 479.67, "word": ",", "probability": 0.6845703125 } ] }, { "id": 99, "seek": 48815, "start": 479.67, "end": 484.99, "text": " for example, Chinese Xiaomi, on any other device, for example, Samsung.", "tokens": [ 50864, 337, 1365, 11, 4649, 33806, 11, 322, 604, 661, 4302, 11, 337, 1365, 11, 13173, 13, 51064 ], "temperature": 0.0, "avg_logprob": -0.2013774735755042, "compression_ratio": 1.5940594059405941, "no_speech_prob": 0.0082244873046875, "words": [ { "start": 479.67, "end": 479.79, "word": " for", "probability": 0.75048828125 }, { "start": 479.79, "end": 480.23, "word": " example", "probability": 0.92236328125 }, { "start": 480.23, "end": 480.43, "word": ",", "probability": 0.42236328125 }, { "start": 480.43, "end": 480.79, "word": " Chinese", "probability": 0.59375 }, { "start": 480.79, "end": 481.27, "word": " Xiaomi", "probability": 0.85302734375 }, { "start": 481.27, "end": 481.83, "word": ",", "probability": 0.7783203125 }, { "start": 481.83, "end": 482.09, "word": " on", "probability": 0.88818359375 }, { "start": 482.09, "end": 482.43, "word": " any", "probability": 0.810546875 }, { "start": 482.43, "end": 482.83, "word": " other", "probability": 0.759765625 }, { "start": 482.83, "end": 483.25, "word": " device", "probability": 0.9150390625 }, { "start": 483.25, "end": 483.33, "word": ",", "probability": 0.962890625 }, { "start": 483.33, "end": 483.45, "word": " for", "probability": 0.88134765625 }, { "start": 483.45, "end": 483.81, "word": " example", "probability": 0.9306640625 }, { "start": 483.81, "end": 483.95, "word": ",", "probability": 0.69580078125 }, { "start": 483.95, "end": 484.27, "word": " Samsung", "probability": 0.87255859375 }, { "start": 484.27, "end": 484.99, "word": ".", "probability": 0.9541015625 } ] }, { "id": 100, "seek": 48815, "start": 485.01, "end": 491.27, "text": " This means that a vulnerability discovered in one of OEM libraries", "tokens": [ 51114, 639, 1355, 300, 257, 24210, 6941, 294, 472, 295, 422, 6683, 15148, 51414 ], "temperature": 0.0, "avg_logprob": -0.2013774735755042, "compression_ratio": 1.5940594059405941, "no_speech_prob": 0.0082244873046875, "words": [ { "start": 485.01, "end": 485.31, "word": " This", "probability": 0.8125 }, { "start": 485.31, "end": 485.65, "word": " means", "probability": 0.8740234375 }, { "start": 485.65, "end": 485.89, "word": " that", "probability": 0.861328125 }, { "start": 486.05, "end": 486.61, "word": " a vulnerability", "probability": 0.89404296875 }, { "start": 486.61, "end": 487.51, "word": " discovered", "probability": 0.52490234375 }, { "start": 487.51, "end": 487.93, "word": " in", "probability": 0.8916015625 }, { "start": 487.93, "end": 488.39, "word": " one", "probability": 0.80908203125 }, { "start": 488.39, "end": 488.85, "word": " of", "probability": 0.88037109375 }, { "start": 488.85, "end": 490.27, "word": " OEM", "probability": 0.633056640625 }, { "start": 490.27, "end": 491.27, "word": " libraries", "probability": 0.80517578125 } ] }, { "id": 101, "seek": 48815, "start": 492.07, "end": 495.39, "text": " compromises all Snapdragon-based Android devices.", "tokens": [ 51464, 11482, 3598, 439, 48211, 12, 6032, 8853, 5759, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.2013774735755042, "compression_ratio": 1.5940594059405941, "no_speech_prob": 0.0082244873046875, "words": [ { "start": 492.07, "end": 492.47, "word": " compromises", "probability": 0.8154296875 }, { "start": 492.47, "end": 493.03, "word": " all", "probability": 0.86474609375 }, { "start": 493.03, "end": 493.61, "word": " Snapdragon", "probability": 0.6201171875 }, { "start": 493.61, "end": 494.07, "word": "-based", "probability": 0.748046875 }, { "start": 494.07, "end": 494.49, "word": " Android", "probability": 0.8662109375 }, { "start": 494.49, "end": 495.03, "word": " devices", "probability": 0.90283203125 }, { "start": 495.03, "end": 495.39, "word": ".", "probability": 0.9873046875 } ] }, { "id": 102, "seek": 51443, "start": 497.71, "end": 503.73, "text": " The major goal of the research was to find a way to execute custom code on a DSP", "tokens": [ 50414, 440, 2563, 3387, 295, 264, 2132, 390, 281, 915, 257, 636, 281, 14483, 2375, 3089, 322, 257, 15816, 47, 50664 ], "temperature": 0.0, "avg_logprob": -0.18967562574374525, "compression_ratio": 1.4646464646464648, "no_speech_prob": 0.00395965576171875, "words": [ { "start": 497.71, "end": 498.47, "word": " The", "probability": 0.775390625 }, { "start": 498.47, "end": 498.81, "word": " major", "probability": 0.8115234375 }, { "start": 498.81, "end": 499.21, "word": " goal", "probability": 0.90673828125 }, { "start": 499.21, "end": 499.41, "word": " of", "probability": 0.89501953125 }, { "start": 499.41, "end": 499.53, "word": " the", "probability": 0.806640625 }, { "start": 499.53, "end": 499.89, "word": " research", "probability": 0.77099609375 }, { "start": 499.89, "end": 500.19, "word": " was", "probability": 0.8837890625 }, { "start": 500.19, "end": 500.39, "word": " to", "probability": 0.90087890625 }, { "start": 500.39, "end": 500.89, "word": " find", "probability": 0.80029296875 }, { "start": 501.15, "end": 501.39, "word": " a way", "probability": 0.89599609375 }, { "start": 501.39, "end": 501.57, "word": " to", "probability": 0.9033203125 }, { "start": 501.57, "end": 501.99, "word": " execute", "probability": 0.79052734375 }, { "start": 501.99, "end": 502.49, "word": " custom", "probability": 0.7099609375 }, { "start": 502.49, "end": 502.87, "word": " code", "probability": 0.75927734375 }, { "start": 502.87, "end": 503.19, "word": " on", "probability": 0.90478515625 }, { "start": 503.35, "end": 503.73, "word": " a DSP", "probability": 0.701171875 } ] }, { "id": 103, "seek": 51443, "start": 503.73, "end": 506.83, "text": " bypassing Qualcomm's signature.", "tokens": [ 50714, 24996, 278, 13616, 13278, 311, 13397, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.18967562574374525, "compression_ratio": 1.4646464646464648, "no_speech_prob": 0.00395965576171875, "words": [ { "start": 503.73, "end": 504.99, "word": " bypassing", "probability": 0.666259765625 }, { "start": 504.99, "end": 505.69, "word": " Qualcomm's", "probability": 0.7532552083333334 }, { "start": 505.69, "end": 506.07, "word": " signature", "probability": 0.9404296875 }, { "start": 506.07, "end": 506.83, "word": ".", "probability": 0.94091796875 } ] }, { "id": 104, "seek": 51443, "start": 507.03, "end": 514.65, "text": " To do so, we had to discover and exploit a vulnerability in a DSP-running library.", "tokens": [ 50864, 1407, 360, 370, 11, 321, 632, 281, 4411, 293, 25924, 257, 24210, 294, 257, 15816, 47, 12, 45482, 6405, 13, 51214 ], "temperature": 0.0, "avg_logprob": -0.18967562574374525, "compression_ratio": 1.4646464646464648, "no_speech_prob": 0.00395965576171875, "words": [ { "start": 507.03, "end": 507.25, "word": " To", "probability": 0.90185546875 }, { "start": 507.25, "end": 507.43, "word": " do", "probability": 0.8984375 }, { "start": 507.43, "end": 507.83, "word": " so", "probability": 0.90234375 }, { "start": 507.83, "end": 507.91, "word": ",", "probability": 0.75439453125 }, { "start": 507.91, "end": 508.11, "word": " we", "probability": 0.892578125 }, { "start": 508.11, "end": 508.31, "word": " had", "probability": 0.8017578125 }, { "start": 508.31, "end": 508.47, "word": " to", "probability": 0.90576171875 }, { "start": 508.47, "end": 509.01, "word": " discover", "probability": 0.79833984375 }, { "start": 509.01, "end": 509.35, "word": " and", "probability": 0.88623046875 }, { "start": 509.35, "end": 509.85, "word": " exploit", "probability": 0.697265625 }, { "start": 510.03, "end": 510.57, "word": " a vulnerability", "probability": 0.8671875 }, { "start": 510.57, "end": 511.25, "word": " in", "probability": 0.89453125 }, { "start": 512.19, "end": 512.71, "word": " a DSP", "probability": 0.909423828125 }, { "start": 512.71, "end": 513.27, "word": "-running", "probability": 0.5599365234375 }, { "start": 513.27, "end": 513.89, "word": " library", "probability": 0.78955078125 }, { "start": 513.89, "end": 514.65, "word": ".", "probability": 0.98681640625 } ] }, { "id": 105, "seek": 51443, "start": 516.27, "end": 520.27, "text": " DSP libraries are proprietary hexagon ELFs.", "tokens": [ 51314, 15816, 47, 15148, 366, 38992, 23291, 6709, 14426, 37, 82, 13, 51464 ], "temperature": 0.0, "avg_logprob": -0.18967562574374525, "compression_ratio": 1.4646464646464648, "no_speech_prob": 0.00395965576171875, "words": [ { "start": 516.27, "end": 516.59, "word": " DSP", "probability": 0.927490234375 }, { "start": 516.59, "end": 517.19, "word": " libraries", "probability": 0.8818359375 }, { "start": 517.19, "end": 517.49, "word": " are", "probability": 0.87646484375 }, { "start": 517.49, "end": 518.07, "word": " proprietary", "probability": 0.85498046875 }, { "start": 518.07, "end": 518.81, "word": " hexagon", "probability": 0.6796875 }, { "start": 518.81, "end": 519.51, "word": " ELFs", "probability": 0.8756510416666666 }, { "start": 519.51, "end": 520.27, "word": ".", "probability": 0.98095703125 } ] }, { "id": 106, "seek": 51443, "start": 520.39, "end": 523.13, "text": " The easiest way to instrument a hexagon executable", "tokens": [ 51514, 440, 12889, 636, 281, 7198, 257, 23291, 6709, 7568, 712, 51664 ], "temperature": 0.0, "avg_logprob": -0.18967562574374525, "compression_ratio": 1.4646464646464648, "no_speech_prob": 0.00395965576171875, "words": [ { "start": 520.39, "end": 520.65, "word": " The", "probability": 0.810546875 }, { "start": 520.65, "end": 520.93, "word": " easiest", "probability": 0.79052734375 }, { "start": 520.93, "end": 521.35, "word": " way", "probability": 0.89111328125 }, { "start": 521.35, "end": 521.55, "word": " to", "probability": 0.90625 }, { "start": 521.55, "end": 522.01, "word": " instrument", "probability": 0.7626953125 }, { "start": 522.27, "end": 522.75, "word": " a hexagon", "probability": 0.907470703125 }, { "start": 522.75, "end": 523.13, "word": " executable", "probability": 0.848876953125 } ] }, { "id": 107, "seek": 54279, "start": 523.13, "end": 527.61, "text": " is to use the open-source QUIC emulator, QEMU.", "tokens": [ 50364, 307, 281, 764, 264, 1269, 12, 41676, 7246, 2532, 846, 16381, 11, 1249, 6683, 52, 13, 50564 ], "temperature": 0.0, "avg_logprob": -0.23684210651799253, "compression_ratio": 1.389908256880734, "no_speech_prob": 0.007068634033203125, "words": [ { "start": 523.13, "end": 523.75, "word": " is", "probability": 0.471435546875 }, { "start": 523.75, "end": 523.93, "word": " to", "probability": 0.87744140625 }, { "start": 523.93, "end": 524.25, "word": " use", "probability": 0.81884765625 }, { "start": 524.25, "end": 524.51, "word": " the", "probability": 0.740234375 }, { "start": 524.51, "end": 524.91, "word": " open", "probability": 0.6884765625 }, { "start": 524.91, "end": 525.35, "word": "-source", "probability": 0.5482177734375 }, { "start": 525.35, "end": 525.69, "word": " QUIC", "probability": 0.55999755859375 }, { "start": 525.69, "end": 526.23, "word": " emulator", "probability": 0.890869140625 }, { "start": 526.23, "end": 526.63, "word": ",", "probability": 0.63525390625 }, { "start": 526.63, "end": 526.97, "word": " QEMU", "probability": 0.7621256510416666 }, { "start": 526.97, "end": 527.61, "word": ".", "probability": 0.87841796875 } ] }, { "id": 108, "seek": 54279, "start": 528.19, "end": 535.79, "text": " Hexagon instruction set support was added in QEMU only in the end of 2019.", "tokens": [ 50614, 634, 87, 6709, 10951, 992, 1406, 390, 3869, 294, 1249, 6683, 52, 787, 294, 264, 917, 295, 6071, 13, 50964 ], "temperature": 0.0, "avg_logprob": -0.23684210651799253, "compression_ratio": 1.389908256880734, "no_speech_prob": 0.007068634033203125, "words": [ { "start": 528.19, "end": 528.83, "word": " Hexagon", "probability": 0.8933919270833334 }, { "start": 528.83, "end": 529.69, "word": " instruction", "probability": 0.70458984375 }, { "start": 529.69, "end": 530.15, "word": " set", "probability": 0.845703125 }, { "start": 530.15, "end": 530.71, "word": " support", "probability": 0.88671875 }, { "start": 530.71, "end": 531.29, "word": " was", "probability": 0.8828125 }, { "start": 531.29, "end": 531.63, "word": " added", "probability": 0.72265625 }, { "start": 531.63, "end": 531.91, "word": " in", "probability": 0.7666015625 }, { "start": 531.91, "end": 532.71, "word": " QEMU", "probability": 0.95166015625 }, { "start": 532.71, "end": 533.07, "word": " only", "probability": 0.7509765625 }, { "start": 533.07, "end": 533.31, "word": " in", "probability": 0.60205078125 }, { "start": 533.31, "end": 533.51, "word": " the", "probability": 0.806640625 }, { "start": 533.51, "end": 533.85, "word": " end", "probability": 0.8046875 }, { "start": 533.85, "end": 534.09, "word": " of", "probability": 0.9052734375 }, { "start": 534.09, "end": 535.15, "word": " 2019", "probability": 0.4990234375 }, { "start": 535.15, "end": 535.79, "word": ".", "probability": 0.916015625 } ] }, { "id": 109, "seek": 54279, "start": 536.03, "end": 543.05, "text": " We fixed a lot of bugs to be able to run real DSP libraries in the user mode of the emulator.", "tokens": [ 51014, 492, 6806, 257, 688, 295, 15120, 281, 312, 1075, 281, 1190, 957, 15816, 47, 15148, 294, 264, 4195, 4391, 295, 264, 846, 16381, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.23684210651799253, "compression_ratio": 1.389908256880734, "no_speech_prob": 0.007068634033203125, "words": [ { "start": 536.03, "end": 536.25, "word": " We", "probability": 0.89013671875 }, { "start": 536.25, "end": 536.57, "word": " fixed", "probability": 0.79931640625 }, { "start": 537.05, "end": 537.31, "word": " a lot", "probability": 0.8955078125 }, { "start": 537.31, "end": 537.53, "word": " of", "probability": 0.90771484375 }, { "start": 537.53, "end": 537.79, "word": " bugs", "probability": 0.76416015625 }, { "start": 537.79, "end": 537.97, "word": " to", "probability": 0.8955078125 }, { "start": 537.97, "end": 538.11, "word": " be", "probability": 0.89892578125 }, { "start": 538.11, "end": 538.29, "word": " able", "probability": 0.8857421875 }, { "start": 538.29, "end": 538.51, "word": " to", "probability": 0.904296875 }, { "start": 538.51, "end": 538.77, "word": " run", "probability": 0.89599609375 }, { "start": 538.77, "end": 539.41, "word": " real", "probability": 0.79638671875 }, { "start": 539.41, "end": 539.89, "word": " DSP", "probability": 0.824462890625 }, { "start": 539.89, "end": 540.41, "word": " libraries", "probability": 0.87841796875 }, { "start": 540.41, "end": 540.73, "word": " in", "probability": 0.8662109375 }, { "start": 540.73, "end": 540.89, "word": " the", "probability": 0.80712890625 }, { "start": 540.89, "end": 541.17, "word": " user", "probability": 0.75537109375 }, { "start": 541.17, "end": 541.45, "word": " mode", "probability": 0.78759765625 }, { "start": 541.45, "end": 541.65, "word": " of", "probability": 0.896484375 }, { "start": 541.65, "end": 541.87, "word": " the", "probability": 0.8193359375 }, { "start": 541.87, "end": 542.41, "word": " emulator", "probability": 0.92626953125 }, { "start": 542.41, "end": 543.05, "word": ".", "probability": 0.98779296875 } ] }, { "id": 110, "seek": 54279, "start": 543.97, "end": 551.49, "text": " To fast leaps on Ubuntu PC, we used American Fuzzy Loop, AFL, in combination with QEMU.", "tokens": [ 51364, 1407, 2370, 476, 2382, 322, 30230, 45605, 6465, 11, 321, 1143, 2665, 479, 30601, 45660, 11, 316, 31455, 11, 294, 6562, 365, 1249, 6683, 52, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.23684210651799253, "compression_ratio": 1.389908256880734, "no_speech_prob": 0.007068634033203125, "words": [ { "start": 543.97, "end": 544.13, "word": " To", "probability": 0.87890625 }, { "start": 544.13, "end": 544.39, "word": " fast", "probability": 0.6396484375 }, { "start": 544.39, "end": 544.71, "word": " leaps", "probability": 0.5732421875 }, { "start": 544.71, "end": 544.97, "word": " on", "probability": 0.88330078125 }, { "start": 544.97, "end": 545.29, "word": " Ubuntu", "probability": 0.7333984375 }, { "start": 545.29, "end": 545.63, "word": " PC", "probability": 0.84912109375 }, { "start": 545.63, "end": 545.89, "word": ",", "probability": 0.755859375 }, { "start": 545.89, "end": 545.99, "word": " we", "probability": 0.89990234375 }, { "start": 545.99, "end": 546.25, "word": " used", "probability": 0.73828125 }, { "start": 546.25, "end": 546.79, "word": " American", "probability": 0.64111328125 }, { "start": 546.79, "end": 547.21, "word": " Fuzzy", "probability": 0.64599609375 }, { "start": 547.21, "end": 547.51, "word": " Loop", "probability": 0.28857421875 }, { "start": 547.51, "end": 547.69, "word": ",", "probability": 0.7705078125 }, { "start": 547.69, "end": 548.13, "word": " AFL", "probability": 0.4564208984375 }, { "start": 548.13, "end": 548.29, "word": ",", "probability": 0.80859375 }, { "start": 548.29, "end": 548.47, "word": " in", "probability": 0.89306640625 }, { "start": 548.47, "end": 549.03, "word": " combination", "probability": 0.8701171875 }, { "start": 549.03, "end": 549.71, "word": " with", "probability": 0.81103515625 }, { "start": 549.71, "end": 550.85, "word": " QEMU", "probability": 0.9615885416666666 }, { "start": 550.85, "end": 551.49, "word": ".", "probability": 0.9873046875 } ] }, { "id": 111, "seek": 57117, "start": 551.49, "end": 557.31, "text": " A skeleton library is primarily a library, and we had to prepare a simple program,", "tokens": [ 50364, 316, 25204, 6405, 307, 10029, 257, 6405, 11, 293, 321, 632, 281, 5940, 257, 2199, 1461, 11, 50614 ], "temperature": 0.0, "avg_logprob": -0.23125000140246224, "compression_ratio": 1.619718309859155, "no_speech_prob": 0.0013437271118164062, "words": [ { "start": 551.49, "end": 551.77, "word": " A", "probability": 0.85986328125 }, { "start": 551.77, "end": 552.03, "word": " skeleton", "probability": 0.476318359375 }, { "start": 552.03, "end": 552.57, "word": " library", "probability": 0.85595703125 }, { "start": 552.57, "end": 553.31, "word": " is", "probability": 0.89013671875 }, { "start": 553.31, "end": 553.83, "word": " primarily", "probability": 0.80078125 }, { "start": 554.21, "end": 554.57, "word": " a library", "probability": 0.85009765625 }, { "start": 554.57, "end": 554.83, "word": ",", "probability": 0.308837890625 }, { "start": 554.83, "end": 554.85, "word": " and", "probability": 0.880859375 }, { "start": 554.85, "end": 555.01, "word": " we", "probability": 0.89599609375 }, { "start": 555.01, "end": 555.21, "word": " had", "probability": 0.791015625 }, { "start": 555.21, "end": 555.37, "word": " to", "probability": 0.89697265625 }, { "start": 555.37, "end": 555.75, "word": " prepare", "probability": 0.796875 }, { "start": 556.03, "end": 556.27, "word": " a simple", "probability": 0.9296875 }, { "start": 556.27, "end": 556.85, "word": " program", "probability": 0.68359375 }, { "start": 556.85, "end": 557.31, "word": ",", "probability": 0.615234375 } ] }, { "id": 112, "seek": 57117, "start": 557.59, "end": 561.27, "text": " a scale loader, that loads and invokes the one.", "tokens": [ 50664, 257, 4373, 3677, 260, 11, 300, 12668, 293, 1048, 8606, 264, 472, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.23125000140246224, "compression_ratio": 1.619718309859155, "no_speech_prob": 0.0013437271118164062, "words": [ { "start": 557.59, "end": 557.83, "word": " a scale", "probability": 0.46875 }, { "start": 557.83, "end": 558.33, "word": " loader", "probability": 0.853515625 }, { "start": 558.33, "end": 558.51, "word": ",", "probability": 0.529296875 }, { "start": 558.51, "end": 558.71, "word": " that", "probability": 0.876953125 }, { "start": 558.71, "end": 559.15, "word": " loads", "probability": 0.77294921875 }, { "start": 559.15, "end": 559.47, "word": " and", "probability": 0.89599609375 }, { "start": 559.47, "end": 560.13, "word": " invokes", "probability": 0.7529296875 }, { "start": 560.13, "end": 560.33, "word": " the", "probability": 0.6298828125 }, { "start": 560.33, "end": 560.51, "word": " one", "probability": 0.7236328125 }, { "start": 560.51, "end": 561.27, "word": ".", "probability": 0.97509765625 } ] }, { "id": 113, "seek": 57117, "start": 561.63, "end": 568.43, "text": " Moreover, most skeleton libraries widely use DSP framework and system calls.", "tokens": [ 50864, 19838, 11, 881, 25204, 15148, 13371, 764, 15816, 47, 8388, 293, 1185, 5498, 13, 51164 ], "temperature": 0.0, "avg_logprob": -0.23125000140246224, "compression_ratio": 1.619718309859155, "no_speech_prob": 0.0013437271118164062, "words": [ { "start": 561.63, "end": 562.15, "word": " Moreover", "probability": 0.6279296875 }, { "start": 562.15, "end": 562.43, "word": ",", "probability": 0.974609375 }, { "start": 562.43, "end": 563.45, "word": " most", "probability": 0.77099609375 }, { "start": 563.45, "end": 563.79, "word": " skeleton", "probability": 0.63427734375 }, { "start": 563.79, "end": 564.49, "word": " libraries", "probability": 0.9130859375 }, { "start": 564.49, "end": 564.91, "word": " widely", "probability": 0.88671875 }, { "start": 564.91, "end": 565.35, "word": " use", "probability": 0.7861328125 }, { "start": 565.35, "end": 565.91, "word": " DSP", "probability": 0.811767578125 }, { "start": 565.91, "end": 566.63, "word": " framework", "probability": 0.5712890625 }, { "start": 566.63, "end": 566.97, "word": " and", "probability": 0.87255859375 }, { "start": 566.97, "end": 567.37, "word": " system", "probability": 0.859375 }, { "start": 567.37, "end": 567.79, "word": " calls", "probability": 0.72314453125 }, { "start": 567.79, "end": 568.43, "word": ".", "probability": 0.9267578125 } ] }, { "id": 114, "seek": 57117, "start": 568.43, "end": 571.75, "text": " Our simple program cannot handle such requests.", "tokens": [ 51214, 2621, 2199, 1461, 2644, 4813, 1270, 12475, 13, 51364 ], "temperature": 0.0, "avg_logprob": -0.23125000140246224, "compression_ratio": 1.619718309859155, "no_speech_prob": 0.0013437271118164062, "words": [ { "start": 568.43, "end": 568.75, "word": " Our", "probability": 0.9052734375 }, { "start": 568.75, "end": 569.11, "word": " simple", "probability": 0.9189453125 }, { "start": 569.11, "end": 569.65, "word": " program", "probability": 0.72509765625 }, { "start": 569.65, "end": 570.09, "word": " cannot", "probability": 0.75732421875 }, { "start": 570.09, "end": 570.57, "word": " handle", "probability": 0.82421875 }, { "start": 570.57, "end": 570.91, "word": " such", "probability": 0.8935546875 }, { "start": 570.91, "end": 571.37, "word": " requests", "probability": 0.740234375 }, { "start": 571.37, "end": 571.75, "word": ".", "probability": 0.787109375 } ] }, { "id": 115, "seek": 57117, "start": 572.01, "end": 579.87, "text": " Therefore, we had to load the cured OS on the emulator before execution of the REST call.", "tokens": [ 51414, 7504, 11, 321, 632, 281, 3677, 264, 29617, 12731, 322, 264, 846, 16381, 949, 15058, 295, 264, 497, 14497, 818, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.23125000140246224, "compression_ratio": 1.619718309859155, "no_speech_prob": 0.0013437271118164062, "words": [ { "start": 572.01, "end": 572.39, "word": " Therefore", "probability": 0.73388671875 }, { "start": 572.39, "end": 572.73, "word": ",", "probability": 0.837890625 }, { "start": 572.73, "end": 572.99, "word": " we", "probability": 0.90380859375 }, { "start": 572.99, "end": 573.39, "word": " had", "probability": 0.79931640625 }, { "start": 573.39, "end": 573.61, "word": " to", "probability": 0.900390625 }, { "start": 573.61, "end": 574.01, "word": " load", "probability": 0.92431640625 }, { "start": 574.01, "end": 574.31, "word": " the", "probability": 0.78369140625 }, { "start": 574.31, "end": 574.69, "word": " cured", "probability": 0.286865234375 }, { "start": 574.69, "end": 575.45, "word": " OS", "probability": 0.85791015625 }, { "start": 575.45, "end": 575.75, "word": " on", "probability": 0.89208984375 }, { "start": 575.75, "end": 575.91, "word": " the", "probability": 0.81005859375 }, { "start": 575.91, "end": 576.43, "word": " emulator", "probability": 0.807373046875 }, { "start": 576.43, "end": 577.09, "word": " before", "probability": 0.77734375 }, { "start": 577.09, "end": 577.85, "word": " execution", "probability": 0.8125 }, { "start": 577.85, "end": 578.41, "word": " of", "probability": 0.8759765625 }, { "start": 578.41, "end": 578.57, "word": " the", "probability": 0.8134765625 }, { "start": 578.57, "end": 578.79, "word": " REST", "probability": 0.764892578125 }, { "start": 578.79, "end": 579.59, "word": " call", "probability": 0.81591796875 }, { "start": 579.59, "end": 579.87, "word": ".", "probability": 0.99169921875 } ] }, { "id": 116, "seek": 59913, "start": 579.87, "end": 584.53, "text": " The easiest way to do so is not to use a real cured OS,", "tokens": [ 50364, 440, 12889, 636, 281, 360, 370, 307, 406, 281, 764, 257, 957, 29617, 12731, 11, 50564 ], "temperature": 0.0, "avg_logprob": -0.25000001457722293, "compression_ratio": 1.462686567164179, "no_speech_prob": 0.001773834228515625, "words": [ { "start": 579.87, "end": 580.11, "word": " The", "probability": 0.7255859375 }, { "start": 580.11, "end": 580.35, "word": " easiest", "probability": 0.80859375 }, { "start": 580.35, "end": 580.71, "word": " way", "probability": 0.89306640625 }, { "start": 580.71, "end": 580.87, "word": " to", "probability": 0.904296875 }, { "start": 580.87, "end": 581.05, "word": " do", "probability": 0.904296875 }, { "start": 581.05, "end": 581.39, "word": " so", "probability": 0.8974609375 }, { "start": 581.39, "end": 581.69, "word": " is", "probability": 0.8232421875 }, { "start": 581.69, "end": 581.95, "word": " not", "probability": 0.8603515625 }, { "start": 581.95, "end": 582.15, "word": " to", "probability": 0.8955078125 }, { "start": 582.15, "end": 582.39, "word": " use", "probability": 0.830078125 }, { "start": 582.63, "end": 583.05, "word": " a real", "probability": 0.8828125 }, { "start": 583.05, "end": 583.59, "word": " cured", "probability": 0.1854248046875 }, { "start": 583.59, "end": 584.09, "word": " OS", "probability": 0.896484375 }, { "start": 584.09, "end": 584.53, "word": ",", "probability": 0.66552734375 } ] }, { "id": 117, "seek": 59913, "start": 584.53, "end": 592.97, "text": " but its light version, Run-ELF-PBM, adopted by Qualcomm for execution on a hexagon simulator,", "tokens": [ 50614, 457, 1080, 1442, 3037, 11, 8950, 12, 3158, 37, 12, 47, 18345, 11, 12175, 538, 13616, 13278, 337, 15058, 322, 257, 23291, 6709, 32974, 11, 50964 ], "temperature": 0.0, "avg_logprob": -0.25000001457722293, "compression_ratio": 1.462686567164179, "no_speech_prob": 0.001773834228515625, "words": [ { "start": 584.53, "end": 584.77, "word": " but", "probability": 0.89404296875 }, { "start": 584.77, "end": 585.07, "word": " its", "probability": 0.5615234375 }, { "start": 585.07, "end": 585.57, "word": " light", "probability": 0.454345703125 }, { "start": 585.57, "end": 586.17, "word": " version", "probability": 0.68798828125 }, { "start": 586.17, "end": 586.93, "word": ",", "probability": 0.4091796875 }, { "start": 586.93, "end": 587.19, "word": " Run", "probability": 0.36328125 }, { "start": 587.19, "end": 587.75, "word": "-ELF", "probability": 0.4234619140625 }, { "start": 587.75, "end": 588.05, "word": "-PBM", "probability": 0.8076171875 }, { "start": 588.05, "end": 588.55, "word": ",", "probability": 0.603515625 }, { "start": 588.55, "end": 589.21, "word": " adopted", "probability": 0.88134765625 }, { "start": 589.21, "end": 589.53, "word": " by", "probability": 0.89404296875 }, { "start": 589.53, "end": 590.01, "word": " Qualcomm", "probability": 0.932861328125 }, { "start": 590.01, "end": 590.25, "word": " for", "probability": 0.87255859375 }, { "start": 590.25, "end": 590.77, "word": " execution", "probability": 0.8759765625 }, { "start": 590.77, "end": 591.17, "word": " on", "probability": 0.89892578125 }, { "start": 591.31, "end": 591.79, "word": " a hexagon", "probability": 0.766845703125 }, { "start": 591.79, "end": 592.43, "word": " simulator", "probability": 0.87060546875 }, { "start": 592.43, "end": 592.97, "word": ",", "probability": 0.342529296875 } ] }, { "id": 118, "seek": 59913, "start": 592.97, "end": 595.95, "text": " and included in the hexagon SDK.", "tokens": [ 51014, 293, 5556, 294, 264, 23291, 6709, 37135, 13, 51164 ], "temperature": 0.0, "avg_logprob": -0.25000001457722293, "compression_ratio": 1.462686567164179, "no_speech_prob": 0.001773834228515625, "words": [ { "start": 592.97, "end": 593.19, "word": " and", "probability": 0.8876953125 }, { "start": 593.19, "end": 593.83, "word": " included", "probability": 0.78466796875 }, { "start": 593.83, "end": 594.13, "word": " in", "probability": 0.8994140625 }, { "start": 594.13, "end": 594.27, "word": " the", "probability": 0.79638671875 }, { "start": 594.27, "end": 594.81, "word": " hexagon", "probability": 0.752685546875 }, { "start": 594.81, "end": 595.11, "word": " SDK", "probability": 0.95849609375 }, { "start": 595.11, "end": 595.95, "word": ".", "probability": 0.97607421875 } ] }, { "id": 119, "seek": 59913, "start": 596.57, "end": 602.71, "text": " That's it. The IFR permutates the content of a data file", "tokens": [ 51214, 663, 311, 309, 13, 440, 26080, 49, 4784, 325, 1024, 264, 2701, 295, 257, 1412, 3991, 51464 ], "temperature": 0.0, "avg_logprob": -0.25000001457722293, "compression_ratio": 1.462686567164179, "no_speech_prob": 0.001773834228515625, "words": [ { "start": 596.57, "end": 597.25, "word": " That's", "probability": 0.885498046875 }, { "start": 597.25, "end": 597.43, "word": " it", "probability": 0.89990234375 }, { "start": 597.43, "end": 598.19, "word": ".", "probability": 0.685546875 }, { "start": 598.19, "end": 598.41, "word": " The", "probability": 0.767578125 }, { "start": 598.41, "end": 599.01, "word": " IFR", "probability": 0.09625244140625 }, { "start": 599.01, "end": 599.77, "word": " permutates", "probability": 0.9112955729166666 }, { "start": 599.77, "end": 600.19, "word": " the", "probability": 0.8125 }, { "start": 600.19, "end": 600.61, "word": " content", "probability": 0.8125 }, { "start": 600.61, "end": 600.99, "word": " of", "probability": 0.90185546875 }, { "start": 601.91, "end": 602.23, "word": " a data", "probability": 0.8125 }, { "start": 602.23, "end": 602.71, "word": " file", "probability": 0.771484375 } ] }, { "id": 120, "seek": 59913, "start": 602.71, "end": 607.83, "text": " and triggers execution of Run-ELF-PBM on the emulator.", "tokens": [ 51514, 293, 22827, 15058, 295, 8950, 12, 3158, 37, 12, 47, 18345, 322, 264, 846, 16381, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.25000001457722293, "compression_ratio": 1.462686567164179, "no_speech_prob": 0.001773834228515625, "words": [ { "start": 602.71, "end": 603.11, "word": " and", "probability": 0.73193359375 }, { "start": 603.11, "end": 603.55, "word": " triggers", "probability": 0.830078125 }, { "start": 603.55, "end": 604.25, "word": " execution", "probability": 0.54736328125 }, { "start": 604.25, "end": 604.83, "word": " of", "probability": 0.89892578125 }, { "start": 604.83, "end": 605.23, "word": " Run", "probability": 0.7861328125 }, { "start": 605.23, "end": 605.71, "word": "-ELF", "probability": 0.9503580729166666 }, { "start": 605.71, "end": 605.99, "word": "-PBM", "probability": 0.98486328125 }, { "start": 605.99, "end": 606.43, "word": " on", "probability": 0.8984375 }, { "start": 606.43, "end": 606.57, "word": " the", "probability": 0.8125 }, { "start": 606.57, "end": 606.99, "word": " emulator", "probability": 0.89111328125 }, { "start": 606.99, "end": 607.83, "word": ".", "probability": 0.72607421875 } ] }, { "id": 121, "seek": 62805, "start": 607.83, "end": 614.27, "text": " QEMU returns the code coverage matrix to the AFL after execution of the test case.", "tokens": [ 50364, 1249, 6683, 52, 11247, 264, 3089, 9645, 8141, 281, 264, 20389, 43, 934, 15058, 295, 264, 1500, 1389, 13, 50664 ], "temperature": 0.0, "avg_logprob": -0.21837349182151886, "compression_ratio": 1.55, "no_speech_prob": 0.00115966796875, "words": [ { "start": 607.83, "end": 608.25, "word": " QEMU", "probability": 0.716064453125 }, { "start": 608.25, "end": 608.73, "word": " returns", "probability": 0.701171875 }, { "start": 608.73, "end": 608.93, "word": " the", "probability": 0.55712890625 }, { "start": 608.93, "end": 609.09, "word": " code", "probability": 0.79833984375 }, { "start": 609.09, "end": 609.53, "word": " coverage", "probability": 0.75537109375 }, { "start": 609.53, "end": 610.03, "word": " matrix", "probability": 0.8603515625 }, { "start": 610.03, "end": 610.83, "word": " to", "probability": 0.8876953125 }, { "start": 610.83, "end": 611.11, "word": " the", "probability": 0.78955078125 }, { "start": 611.11, "end": 611.57, "word": " AFL", "probability": 0.941162109375 }, { "start": 611.57, "end": 611.93, "word": " after", "probability": 0.7080078125 }, { "start": 611.93, "end": 612.49, "word": " execution", "probability": 0.78076171875 }, { "start": 612.49, "end": 612.77, "word": " of", "probability": 0.896484375 }, { "start": 612.77, "end": 612.95, "word": " the", "probability": 0.7978515625 }, { "start": 612.95, "end": 613.19, "word": " test", "probability": 0.80322265625 }, { "start": 613.19, "end": 613.57, "word": " case", "probability": 0.7265625 }, { "start": 613.57, "end": 614.27, "word": ".", "probability": 0.90478515625 } ] }, { "id": 122, "seek": 62805, "start": 615.59, "end": 622.21, "text": " On this slide, you can see the data format that we used to fuzz skeleton libraries.", "tokens": [ 50764, 1282, 341, 4137, 11, 291, 393, 536, 264, 1412, 7877, 300, 321, 1143, 281, 283, 16740, 25204, 15148, 13, 51064 ], "temperature": 0.0, "avg_logprob": -0.21837349182151886, "compression_ratio": 1.55, "no_speech_prob": 0.00115966796875, "words": [ { "start": 615.59, "end": 616.39, "word": " On", "probability": 0.87890625 }, { "start": 616.39, "end": 616.65, "word": " this", "probability": 0.87353515625 }, { "start": 616.65, "end": 617.07, "word": " slide", "probability": 0.8818359375 }, { "start": 617.07, "end": 617.15, "word": ",", "probability": 0.5859375 }, { "start": 617.15, "end": 617.25, "word": " you", "probability": 0.89013671875 }, { "start": 617.25, "end": 617.45, "word": " can", "probability": 0.89453125 }, { "start": 617.45, "end": 617.75, "word": " see", "probability": 0.81201171875 }, { "start": 617.75, "end": 618.25, "word": " the", "probability": 0.78271484375 }, { "start": 618.25, "end": 618.49, "word": " data", "probability": 0.81298828125 }, { "start": 618.49, "end": 618.91, "word": " format", "probability": 0.650390625 }, { "start": 618.91, "end": 619.33, "word": " that", "probability": 0.84033203125 }, { "start": 619.33, "end": 619.51, "word": " we", "probability": 0.90234375 }, { "start": 619.51, "end": 619.79, "word": " used", "probability": 0.404296875 }, { "start": 619.79, "end": 620.03, "word": " to", "probability": 0.89794921875 }, { "start": 620.03, "end": 620.35, "word": " fuzz", "probability": 0.720703125 }, { "start": 620.35, "end": 620.77, "word": " skeleton", "probability": 0.1588134765625 }, { "start": 620.77, "end": 621.41, "word": " libraries", "probability": 0.92822265625 }, { "start": 621.41, "end": 622.21, "word": ".", "probability": 0.970703125 } ] }, { "id": 123, "seek": 62805, "start": 622.43, "end": 628.75, "text": " The first word is the second argument of the remote handle invoke function.", "tokens": [ 51114, 440, 700, 1349, 307, 264, 1150, 6770, 295, 264, 8607, 4813, 41117, 2445, 13, 51364 ], "temperature": 0.0, "avg_logprob": -0.21837349182151886, "compression_ratio": 1.55, "no_speech_prob": 0.00115966796875, "words": [ { "start": 622.43, "end": 622.65, "word": " The", "probability": 0.8154296875 }, { "start": 622.65, "end": 622.91, "word": " first", "probability": 0.78125 }, { "start": 622.91, "end": 623.33, "word": " word", "probability": 0.8310546875 }, { "start": 623.33, "end": 623.95, "word": " is", "probability": 0.890625 }, { "start": 623.95, "end": 624.11, "word": " the", "probability": 0.62939453125 }, { "start": 624.11, "end": 624.61, "word": " second", "probability": 0.783203125 }, { "start": 624.61, "end": 625.13, "word": " argument", "probability": 0.8369140625 }, { "start": 625.13, "end": 625.63, "word": " of", "probability": 0.90234375 }, { "start": 625.63, "end": 626.29, "word": " the", "probability": 0.8095703125 }, { "start": 626.29, "end": 626.79, "word": " remote", "probability": 0.619140625 }, { "start": 626.79, "end": 627.13, "word": " handle", "probability": 0.6064453125 }, { "start": 627.13, "end": 627.43, "word": " invoke", "probability": 0.607421875 }, { "start": 627.43, "end": 627.95, "word": " function", "probability": 0.86865234375 }, { "start": 627.95, "end": 628.75, "word": ".", "probability": 0.912109375 } ] }, { "id": 124, "seek": 62805, "start": 628.83, "end": 636.75, "text": " The index on the invoked method, number of input and number of output arguments are encoded there.", "tokens": [ 51414, 440, 8186, 322, 264, 1048, 9511, 3170, 11, 1230, 295, 4846, 293, 1230, 295, 5598, 12869, 366, 2058, 12340, 456, 13, 51764 ], "temperature": 0.0, "avg_logprob": -0.21837349182151886, "compression_ratio": 1.55, "no_speech_prob": 0.00115966796875, "words": [ { "start": 628.83, "end": 629.09, "word": " The", "probability": 0.79541015625 }, { "start": 629.09, "end": 629.51, "word": " index", "probability": 0.69189453125 }, { "start": 629.51, "end": 629.85, "word": " on", "probability": 0.86962890625 }, { "start": 629.85, "end": 630.11, "word": " the", "probability": 0.806640625 }, { "start": 630.11, "end": 630.67, "word": " invoked", "probability": 0.74658203125 }, { "start": 630.67, "end": 631.25, "word": " method", "probability": 0.9130859375 }, { "start": 631.25, "end": 631.49, "word": ",", "probability": 0.66748046875 }, { "start": 631.49, "end": 631.85, "word": " number", "probability": 0.7958984375 }, { "start": 631.85, "end": 632.15, "word": " of", "probability": 0.8876953125 }, { "start": 632.15, "end": 632.55, "word": " input", "probability": 0.82080078125 }, { "start": 632.55, "end": 632.99, "word": " and", "probability": 0.83544921875 }, { "start": 632.99, "end": 633.45, "word": " number", "probability": 0.86767578125 }, { "start": 633.45, "end": 633.77, "word": " of", "probability": 0.89892578125 }, { "start": 633.77, "end": 634.29, "word": " output", "probability": 0.81494140625 }, { "start": 634.29, "end": 634.99, "word": " arguments", "probability": 0.77392578125 }, { "start": 634.99, "end": 635.31, "word": " are", "probability": 0.57373046875 }, { "start": 635.31, "end": 635.65, "word": " encoded", "probability": 0.862060546875 }, { "start": 635.65, "end": 635.95, "word": " there", "probability": 0.82861328125 }, { "start": 635.95, "end": 636.75, "word": ".", "probability": 0.9970703125 } ] }, { "id": 125, "seek": 65351, "start": 636.75, "end": 641.41, "text": " Next several words we take as the size of arguments,", "tokens": [ 50364, 3087, 2940, 2283, 321, 747, 382, 264, 2744, 295, 12869, 11, 50564 ], "temperature": 0.0, "avg_logprob": -0.22359155433278688, "compression_ratio": 1.4945652173913044, "no_speech_prob": 0.0009241104125976562, "words": [ { "start": 636.75, "end": 637.67, "word": " Next", "probability": 0.80859375 }, { "start": 637.67, "end": 638.09, "word": " several", "probability": 0.60302734375 }, { "start": 638.09, "end": 638.49, "word": " words", "probability": 0.6533203125 }, { "start": 638.49, "end": 638.73, "word": " we", "probability": 0.64892578125 }, { "start": 638.73, "end": 639.05, "word": " take", "probability": 0.705078125 }, { "start": 639.05, "end": 639.49, "word": " as", "probability": 0.896484375 }, { "start": 639.49, "end": 639.85, "word": " the", "probability": 0.79541015625 }, { "start": 639.85, "end": 640.31, "word": " size", "probability": 0.76123046875 }, { "start": 640.31, "end": 640.55, "word": " of", "probability": 0.900390625 }, { "start": 640.55, "end": 641.15, "word": " arguments", "probability": 0.69677734375 }, { "start": 641.15, "end": 641.41, "word": ",", "probability": 0.451904296875 } ] }, { "id": 126, "seek": 65351, "start": 641.41, "end": 646.15, "text": " then we expect to see a value of input arguments.", "tokens": [ 50614, 550, 321, 2066, 281, 536, 257, 2158, 295, 4846, 12869, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.22359155433278688, "compression_ratio": 1.4945652173913044, "no_speech_prob": 0.0009241104125976562, "words": [ { "start": 641.41, "end": 642.07, "word": " then", "probability": 0.6708984375 }, { "start": 642.07, "end": 642.55, "word": " we", "probability": 0.88818359375 }, { "start": 642.55, "end": 642.91, "word": " expect", "probability": 0.857421875 }, { "start": 642.91, "end": 643.11, "word": " to", "probability": 0.90576171875 }, { "start": 643.11, "end": 643.39, "word": " see", "probability": 0.81494140625 }, { "start": 643.71, "end": 644.03, "word": " a value", "probability": 0.9169921875 }, { "start": 644.03, "end": 644.37, "word": " of", "probability": 0.90087890625 }, { "start": 644.37, "end": 644.75, "word": " input", "probability": 0.7763671875 }, { "start": 644.75, "end": 645.31, "word": " arguments", "probability": 0.669921875 }, { "start": 645.31, "end": 646.15, "word": ".", "probability": 0.90966796875 } ] }, { "id": 127, "seek": 65351, "start": 647.27, "end": 651.05, "text": " We were surprised by the fuzzing result.", "tokens": [ 50864, 492, 645, 6100, 538, 264, 283, 3334, 8781, 1874, 13, 51014 ], "temperature": 0.0, "avg_logprob": -0.22359155433278688, "compression_ratio": 1.4945652173913044, "no_speech_prob": 0.0009241104125976562, "words": [ { "start": 647.27, "end": 647.91, "word": " We", "probability": 0.90087890625 }, { "start": 647.91, "end": 648.11, "word": " were", "probability": 0.873046875 }, { "start": 648.11, "end": 648.75, "word": " surprised", "probability": 0.82958984375 }, { "start": 648.75, "end": 649.29, "word": " by", "probability": 0.9111328125 }, { "start": 649.29, "end": 649.53, "word": " the", "probability": 0.80419921875 }, { "start": 649.53, "end": 649.81, "word": " fuzzing", "probability": 0.8994140625 }, { "start": 649.81, "end": 650.29, "word": " result", "probability": 0.63720703125 }, { "start": 650.29, "end": 651.05, "word": ".", "probability": 0.76171875 } ] }, { "id": 128, "seek": 65351, "start": 651.05, "end": 656.09, "text": " Crashes were found in all DSP libraries that we choose to fuzz.", "tokens": [ 51064, 4779, 12808, 645, 1352, 294, 439, 15816, 47, 15148, 300, 321, 2826, 281, 283, 16740, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.22359155433278688, "compression_ratio": 1.4945652173913044, "no_speech_prob": 0.0009241104125976562, "words": [ { "start": 651.05, "end": 651.53, "word": " Crashes", "probability": 0.669921875 }, { "start": 651.53, "end": 651.87, "word": " were", "probability": 0.5078125 }, { "start": 651.87, "end": 652.27, "word": " found", "probability": 0.73583984375 }, { "start": 652.27, "end": 652.55, "word": " in", "probability": 0.90087890625 }, { "start": 652.55, "end": 652.95, "word": " all", "probability": 0.8916015625 }, { "start": 652.95, "end": 653.37, "word": " DSP", "probability": 0.775146484375 }, { "start": 653.37, "end": 653.91, "word": " libraries", "probability": 0.90087890625 }, { "start": 653.91, "end": 654.41, "word": " that", "probability": 0.85400390625 }, { "start": 654.41, "end": 654.59, "word": " we", "probability": 0.875 }, { "start": 654.59, "end": 654.79, "word": " choose", "probability": 0.59326171875 }, { "start": 654.79, "end": 655.03, "word": " to", "probability": 0.9052734375 }, { "start": 655.03, "end": 655.53, "word": " fuzz", "probability": 0.842529296875 }, { "start": 655.53, "end": 656.09, "word": ".", "probability": 0.97314453125 } ] }, { "id": 129, "seek": 65351, "start": 656.09, "end": 662.21, "text": " Besides, most issues were discovered exactly in skeleton libraries.", "tokens": [ 51314, 13212, 11, 881, 2663, 645, 6941, 2293, 294, 25204, 15148, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.22359155433278688, "compression_ratio": 1.4945652173913044, "no_speech_prob": 0.0009241104125976562, "words": [ { "start": 656.09, "end": 656.73, "word": " Besides", "probability": 0.904296875 }, { "start": 656.73, "end": 657.53, "word": ",", "probability": 0.7109375 }, { "start": 657.53, "end": 657.91, "word": " most", "probability": 0.81591796875 }, { "start": 657.91, "end": 658.45, "word": " issues", "probability": 0.71875 }, { "start": 658.45, "end": 659.13, "word": " were", "probability": 0.8642578125 }, { "start": 659.13, "end": 659.59, "word": " discovered", "probability": 0.65673828125 }, { "start": 659.59, "end": 660.25, "word": " exactly", "probability": 0.78173828125 }, { "start": 660.25, "end": 660.59, "word": " in", "probability": 0.9033203125 }, { "start": 660.59, "end": 660.99, "word": " skeleton", "probability": 0.414794921875 }, { "start": 660.99, "end": 661.61, "word": " libraries", "probability": 0.8876953125 }, { "start": 661.61, "end": 662.21, "word": ".", "probability": 0.94140625 } ] }, { "id": 130, "seek": 67401, "start": 662.21, "end": 667.29, "text": " This means that hexagon SDK reduces vulnerable code.", "tokens": [ 50364, 639, 1355, 300, 23291, 6709, 37135, 18081, 10955, 3089, 13, 50564 ], "temperature": 0.0, "avg_logprob": -0.26081730310733503, "compression_ratio": 1.435374149659864, "no_speech_prob": 0.0032444000244140625, "words": [ { "start": 662.21, "end": 662.43, "word": " This", "probability": 0.77734375 }, { "start": 662.43, "end": 662.81, "word": " means", "probability": 0.87255859375 }, { "start": 662.81, "end": 663.23, "word": " that", "probability": 0.87548828125 }, { "start": 663.23, "end": 663.83, "word": " hexagon", "probability": 0.656494140625 }, { "start": 663.83, "end": 664.21, "word": " SDK", "probability": 0.78076171875 }, { "start": 664.21, "end": 665.21, "word": " reduces", "probability": 0.414306640625 }, { "start": 665.21, "end": 666.01, "word": " vulnerable", "probability": 0.6591796875 }, { "start": 666.01, "end": 666.39, "word": " code", "probability": 0.59423828125 }, { "start": 666.39, "end": 667.29, "word": ".", "probability": 0.9423828125 } ] }, { "id": 131, "seek": 67401, "start": 668.97, "end": 678.53, "text": " Hexagon SDK automatically generates stub and scale code for marshalling and unmarshalling of function arguments.", "tokens": [ 50664, 634, 87, 6709, 37135, 6772, 23815, 20266, 293, 4373, 3089, 337, 21653, 24021, 293, 517, 76, 7064, 24021, 295, 2445, 12869, 13, 51114 ], "temperature": 0.0, "avg_logprob": -0.26081730310733503, "compression_ratio": 1.435374149659864, "no_speech_prob": 0.0032444000244140625, "words": [ { "start": 668.97, "end": 669.49, "word": " Hexagon", "probability": 0.9435221354166666 }, { "start": 669.49, "end": 670.03, "word": " SDK", "probability": 0.84033203125 }, { "start": 670.03, "end": 671.09, "word": " automatically", "probability": 0.78369140625 }, { "start": 671.09, "end": 672.19, "word": " generates", "probability": 0.8603515625 }, { "start": 672.19, "end": 672.77, "word": " stub", "probability": 0.427490234375 }, { "start": 672.77, "end": 672.99, "word": " and", "probability": 0.8154296875 }, { "start": 672.99, "end": 673.31, "word": " scale", "probability": 0.60009765625 }, { "start": 673.31, "end": 673.79, "word": " code", "probability": 0.51513671875 }, { "start": 673.79, "end": 674.37, "word": " for", "probability": 0.8759765625 }, { "start": 674.37, "end": 674.93, "word": " marshalling", "probability": 0.603515625 }, { "start": 674.93, "end": 675.33, "word": " and", "probability": 0.8388671875 }, { "start": 675.33, "end": 676.19, "word": " unmarshalling", "probability": 0.62957763671875 }, { "start": 676.19, "end": 676.53, "word": " of", "probability": 0.5634765625 }, { "start": 676.53, "end": 676.95, "word": " function", "probability": 0.65185546875 }, { "start": 676.95, "end": 677.63, "word": " arguments", "probability": 0.76611328125 }, { "start": 677.63, "end": 678.53, "word": ".", "probability": 0.984375 } ] }, { "id": 132, "seek": 67401, "start": 678.65, "end": 682.71, "text": " Let's take a look at an example of such code.", "tokens": [ 51164, 961, 311, 747, 257, 574, 412, 364, 1365, 295, 1270, 3089, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.26081730310733503, "compression_ratio": 1.435374149659864, "no_speech_prob": 0.0032444000244140625, "words": [ { "start": 678.65, "end": 679.01, "word": " Let's", "probability": 0.945556640625 }, { "start": 679.01, "end": 679.15, "word": " take", "probability": 0.8173828125 }, { "start": 679.29, "end": 679.45, "word": " a look", "probability": 0.92041015625 }, { "start": 679.45, "end": 679.71, "word": " at", "probability": 0.9169921875 }, { "start": 679.71, "end": 680.29, "word": " an", "probability": 0.904296875 }, { "start": 680.29, "end": 680.83, "word": " example", "probability": 0.92919921875 }, { "start": 680.83, "end": 681.17, "word": " of", "probability": 0.9033203125 }, { "start": 681.17, "end": 681.45, "word": " such", "probability": 0.90283203125 }, { "start": 681.45, "end": 681.81, "word": " code", "probability": 0.79638671875 }, { "start": 681.81, "end": 682.71, "word": ".", "probability": 0.98681640625 } ] }, { "id": 133, "seek": 69995, "start": 685.15, "end": 695.51, "text": " Stub and scale code based on interface definition language modus, IDL modus, prepared by the developer.", "tokens": [ 50414, 745, 836, 293, 4373, 3089, 2361, 322, 9226, 7123, 2856, 705, 67, 301, 11, 7348, 43, 1072, 301, 11, 4927, 538, 264, 10754, 13, 50964 ], "temperature": 0.0, "avg_logprob": -0.2767210214034371, "compression_ratio": 1.435483870967742, "no_speech_prob": 0.00994110107421875, "words": [ { "start": 685.15, "end": 686.03, "word": " Stub", "probability": 0.24755859375 }, { "start": 686.03, "end": 686.23, "word": " and", "probability": 0.80322265625 }, { "start": 686.23, "end": 686.51, "word": " scale", "probability": 0.46875 }, { "start": 686.51, "end": 686.89, "word": " code", "probability": 0.7626953125 }, { "start": 686.89, "end": 687.59, "word": " based", "probability": 0.69091796875 }, { "start": 687.59, "end": 688.27, "word": " on", "probability": 0.90087890625 }, { "start": 688.27, "end": 689.47, "word": " interface", "probability": 0.52587890625 }, { "start": 689.47, "end": 690.01, "word": " definition", "probability": 0.67578125 }, { "start": 690.01, "end": 690.67, "word": " language", "probability": 0.65771484375 }, { "start": 690.67, "end": 691.23, "word": " modus", "probability": 0.3595987955729167 }, { "start": 691.23, "end": 691.51, "word": ",", "probability": 0.6689453125 }, { "start": 691.51, "end": 691.99, "word": " IDL", "probability": 0.712646484375 }, { "start": 691.99, "end": 692.65, "word": " modus", "probability": 0.85205078125 }, { "start": 692.65, "end": 692.89, "word": ",", "probability": 0.671875 }, { "start": 692.89, "end": 693.39, "word": " prepared", "probability": 0.6982421875 }, { "start": 693.39, "end": 693.73, "word": " by", "probability": 0.90673828125 }, { "start": 693.73, "end": 694.01, "word": " the", "probability": 0.75 }, { "start": 694.01, "end": 694.79, "word": " developer", "probability": 0.57373046875 }, { "start": 694.79, "end": 695.51, "word": ".", "probability": 0.99072265625 } ] }, { "id": 134, "seek": 69995, "start": 695.51, "end": 704.67, "text": " Here you can see an example of the IDL declaration of two functions in the neural network library, HexagonNN.", "tokens": [ 51014, 1692, 291, 393, 536, 364, 1365, 295, 264, 7348, 43, 27606, 295, 732, 6828, 294, 264, 18161, 3209, 6405, 11, 634, 87, 6709, 45, 45, 13, 51414 ], "temperature": 0.0, "avg_logprob": -0.2767210214034371, "compression_ratio": 1.435483870967742, "no_speech_prob": 0.00994110107421875, "words": [ { "start": 695.51, "end": 695.79, "word": " Here", "probability": 0.79345703125 }, { "start": 695.79, "end": 695.95, "word": " you", "probability": 0.75927734375 }, { "start": 695.95, "end": 696.11, "word": " can", "probability": 0.8935546875 }, { "start": 696.11, "end": 696.33, "word": " see", "probability": 0.8125 }, { "start": 696.33, "end": 696.51, "word": " an", "probability": 0.90478515625 }, { "start": 696.51, "end": 696.97, "word": " example", "probability": 0.9287109375 }, { "start": 696.97, "end": 697.51, "word": " of", "probability": 0.90478515625 }, { "start": 697.51, "end": 697.95, "word": " the", "probability": 0.78125 }, { "start": 697.95, "end": 698.57, "word": " IDL", "probability": 0.9267578125 }, { "start": 698.57, "end": 699.21, "word": " declaration", "probability": 0.71044921875 }, { "start": 699.21, "end": 699.53, "word": " of", "probability": 0.78271484375 }, { "start": 699.53, "end": 699.71, "word": " two", "probability": 0.80126953125 }, { "start": 699.71, "end": 700.39, "word": " functions", "probability": 0.80615234375 }, { "start": 700.39, "end": 700.77, "word": " in", "probability": 0.78857421875 }, { "start": 700.77, "end": 700.97, "word": " the", "probability": 0.61328125 }, { "start": 700.97, "end": 701.39, "word": " neural", "probability": 0.3818359375 }, { "start": 701.39, "end": 701.87, "word": " network", "probability": 0.8232421875 }, { "start": 701.87, "end": 702.45, "word": " library", "probability": 0.80224609375 }, { "start": 702.45, "end": 702.91, "word": ",", "probability": 0.78857421875 }, { "start": 702.91, "end": 703.81, "word": " HexagonNN", "probability": 0.7278564453125 }, { "start": 703.81, "end": 704.67, "word": ".", "probability": 0.6923828125 } ] }, { "id": 135, "seek": 69995, "start": 704.67, "end": 708.65, "text": " A vulnerable code will be generated for both of them.", "tokens": [ 51464, 316, 10955, 3089, 486, 312, 10833, 337, 1293, 295, 552, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.2767210214034371, "compression_ratio": 1.435483870967742, "no_speech_prob": 0.00994110107421875, "words": [ { "start": 704.67, "end": 704.95, "word": " A", "probability": 0.853515625 }, { "start": 704.95, "end": 705.41, "word": " vulnerable", "probability": 0.7705078125 }, { "start": 705.41, "end": 705.81, "word": " code", "probability": 0.80859375 }, { "start": 705.81, "end": 706.03, "word": " will", "probability": 0.82275390625 }, { "start": 706.03, "end": 706.19, "word": " be", "probability": 0.900390625 }, { "start": 706.19, "end": 706.71, "word": " generated", "probability": 0.79248046875 }, { "start": 706.71, "end": 707.01, "word": " for", "probability": 0.8896484375 }, { "start": 707.01, "end": 707.39, "word": " both", "probability": 0.7861328125 }, { "start": 707.39, "end": 707.57, "word": " of", "probability": 0.90966796875 }, { "start": 707.57, "end": 707.77, "word": " them", "probability": 0.728515625 }, { "start": 707.77, "end": 708.65, "word": ".", "probability": 0.990234375 } ] }, { "id": 136, "seek": 72567, "start": 710.35, "end": 718.87, "text": " HexagonNN SMP print function passes an input-output buffer argument to the DSP.", "tokens": [ 50414, 634, 87, 6709, 45, 45, 318, 12224, 4482, 2445, 11335, 364, 4846, 12, 346, 2582, 21762, 6770, 281, 264, 15816, 47, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.21535326432490695, "compression_ratio": 1.5057471264367817, "no_speech_prob": 0.00592803955078125, "words": [ { "start": 710.35, "end": 711.27, "word": " HexagonNN", "probability": 0.804345703125 }, { "start": 711.27, "end": 711.99, "word": " SMP", "probability": 0.45147705078125 }, { "start": 711.99, "end": 712.75, "word": " print", "probability": 0.5615234375 }, { "start": 712.75, "end": 713.39, "word": " function", "probability": 0.81494140625 }, { "start": 713.39, "end": 714.51, "word": " passes", "probability": 0.5625 }, { "start": 714.51, "end": 714.99, "word": " an", "probability": 0.818359375 }, { "start": 714.99, "end": 715.51, "word": " input", "probability": 0.798828125 }, { "start": 715.51, "end": 716.09, "word": "-output", "probability": 0.744873046875 }, { "start": 716.09, "end": 716.43, "word": " buffer", "probability": 0.70751953125 }, { "start": 716.43, "end": 717.13, "word": " argument", "probability": 0.80810546875 }, { "start": 717.13, "end": 717.41, "word": " to", "probability": 0.8955078125 }, { "start": 717.41, "end": 717.75, "word": " the", "probability": 0.75439453125 }, { "start": 717.75, "end": 718.25, "word": " DSP", "probability": 0.862060546875 }, { "start": 718.25, "end": 718.87, "word": ".", "probability": 0.94873046875 } ] }, { "id": 137, "seek": 72567, "start": 718.87, "end": 726.51, "text": " In the stub code this buffer will be split into two separate buffers, the input and the output.", "tokens": [ 50864, 682, 264, 20266, 3089, 341, 21762, 486, 312, 7472, 666, 732, 4994, 9204, 433, 11, 264, 4846, 293, 264, 5598, 13, 51214 ], "temperature": 0.0, "avg_logprob": -0.21535326432490695, "compression_ratio": 1.5057471264367817, "no_speech_prob": 0.00592803955078125, "words": [ { "start": 718.87, "end": 719.31, "word": " In", "probability": 0.91455078125 }, { "start": 719.31, "end": 719.47, "word": " the", "probability": 0.7236328125 }, { "start": 719.47, "end": 719.71, "word": " stub", "probability": 0.2496337890625 }, { "start": 719.71, "end": 720.13, "word": " code", "probability": 0.728515625 }, { "start": 720.13, "end": 720.45, "word": " this", "probability": 0.2275390625 }, { "start": 720.45, "end": 720.91, "word": " buffer", "probability": 0.71533203125 }, { "start": 720.91, "end": 721.53, "word": " will", "probability": 0.81005859375 }, { "start": 721.53, "end": 721.73, "word": " be", "probability": 0.88818359375 }, { "start": 721.73, "end": 722.07, "word": " split", "probability": 0.86083984375 }, { "start": 722.07, "end": 722.41, "word": " into", "probability": 0.7216796875 }, { "start": 722.41, "end": 722.79, "word": " two", "probability": 0.7802734375 }, { "start": 722.79, "end": 723.35, "word": " separate", "probability": 0.8642578125 }, { "start": 723.35, "end": 723.87, "word": " buffers", "probability": 0.899169921875 }, { "start": 723.87, "end": 724.43, "word": ",", "probability": 0.6494140625 }, { "start": 724.43, "end": 724.61, "word": " the", "probability": 0.806640625 }, { "start": 724.61, "end": 724.93, "word": " input", "probability": 0.8720703125 }, { "start": 724.93, "end": 725.31, "word": " and", "probability": 0.8994140625 }, { "start": 725.31, "end": 725.45, "word": " the", "probability": 0.7177734375 }, { "start": 725.45, "end": 726.05, "word": " output", "probability": 0.806640625 }, { "start": 726.05, "end": 726.51, "word": ".", "probability": 0.98486328125 } ] }, { "id": 138, "seek": 72567, "start": 726.51, "end": 734.37, "text": " The value of the buffer length will also be duplicated and therefore serialized twice.", "tokens": [ 51264, 440, 2158, 295, 264, 21762, 4641, 486, 611, 312, 1581, 564, 3587, 293, 4412, 17436, 1602, 6091, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.21535326432490695, "compression_ratio": 1.5057471264367817, "no_speech_prob": 0.00592803955078125, "words": [ { "start": 726.51, "end": 726.73, "word": " The", "probability": 0.81591796875 }, { "start": 726.73, "end": 727.03, "word": " value", "probability": 0.90869140625 }, { "start": 727.03, "end": 727.29, "word": " of", "probability": 0.9052734375 }, { "start": 727.29, "end": 727.47, "word": " the", "probability": 0.80615234375 }, { "start": 727.47, "end": 727.85, "word": " buffer", "probability": 0.74853515625 }, { "start": 727.85, "end": 728.67, "word": " length", "probability": 0.52783203125 }, { "start": 728.67, "end": 728.99, "word": " will", "probability": 0.8037109375 }, { "start": 728.99, "end": 729.61, "word": " also", "probability": 0.81494140625 }, { "start": 729.61, "end": 729.85, "word": " be", "probability": 0.8955078125 }, { "start": 729.85, "end": 730.51, "word": " duplicated", "probability": 0.9313151041666666 }, { "start": 730.51, "end": 731.09, "word": " and", "probability": 0.69970703125 }, { "start": 731.09, "end": 732.11, "word": " therefore", "probability": 0.6376953125 }, { "start": 732.11, "end": 732.91, "word": " serialized", "probability": 0.935791015625 }, { "start": 732.91, "end": 733.45, "word": " twice", "probability": 0.89453125 }, { "start": 733.45, "end": 734.37, "word": ".", "probability": 0.9921875 } ] }, { "id": 139, "seek": 75231, "start": 735.87, "end": 744.69, "text": " The scale function copies the input of the output buffer before calling an objects function.", "tokens": [ 50414, 440, 4373, 2445, 14341, 264, 4846, 295, 264, 5598, 21762, 949, 5141, 364, 6565, 2445, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.22631448460003686, "compression_ratio": 1.6101694915254237, "no_speech_prob": 0.005641937255859375, "words": [ { "start": 735.87, "end": 736.71, "word": " The", "probability": 0.73681640625 }, { "start": 736.71, "end": 737.05, "word": " scale", "probability": 0.59326171875 }, { "start": 737.05, "end": 737.85, "word": " function", "probability": 0.8515625 }, { "start": 737.85, "end": 738.67, "word": " copies", "probability": 0.9091796875 }, { "start": 738.67, "end": 738.93, "word": " the", "probability": 0.8056640625 }, { "start": 738.93, "end": 739.51, "word": " input", "probability": 0.3232421875 }, { "start": 739.51, "end": 740.21, "word": " of", "probability": 0.7470703125 }, { "start": 740.21, "end": 740.37, "word": " the", "probability": 0.8115234375 }, { "start": 740.37, "end": 740.79, "word": " output", "probability": 0.76904296875 }, { "start": 740.79, "end": 741.21, "word": " buffer", "probability": 0.701171875 }, { "start": 741.21, "end": 741.77, "word": " before", "probability": 0.77978515625 }, { "start": 741.77, "end": 742.65, "word": " calling", "probability": 0.59521484375 }, { "start": 742.65, "end": 742.97, "word": " an", "probability": 0.8681640625 }, { "start": 742.97, "end": 743.39, "word": " objects", "probability": 0.392333984375 }, { "start": 743.39, "end": 743.97, "word": " function", "probability": 0.86865234375 }, { "start": 743.97, "end": 744.69, "word": ".", "probability": 0.9404296875 } ] }, { "id": 140, "seek": 75231, "start": 744.69, "end": 751.29, "text": " The size of data to be copied is one of the transmitted buffer lengths.", "tokens": [ 50864, 440, 2744, 295, 1412, 281, 312, 25365, 307, 472, 295, 264, 25355, 21762, 26329, 13, 51114 ], "temperature": 0.0, "avg_logprob": -0.22631448460003686, "compression_ratio": 1.6101694915254237, "no_speech_prob": 0.005641937255859375, "words": [ { "start": 744.69, "end": 744.87, "word": " The", "probability": 0.79296875 }, { "start": 744.87, "end": 745.27, "word": " size", "probability": 0.76806640625 }, { "start": 745.27, "end": 745.83, "word": " of", "probability": 0.90966796875 }, { "start": 745.83, "end": 746.13, "word": " data", "probability": 0.7763671875 }, { "start": 746.13, "end": 746.35, "word": " to", "probability": 0.900390625 }, { "start": 746.35, "end": 746.49, "word": " be", "probability": 0.90283203125 }, { "start": 746.49, "end": 746.85, "word": " copied", "probability": 0.828125 }, { "start": 746.85, "end": 747.81, "word": " is", "probability": 0.8818359375 }, { "start": 747.81, "end": 748.19, "word": " one", "probability": 0.794921875 }, { "start": 748.19, "end": 748.47, "word": " of", "probability": 0.89794921875 }, { "start": 748.47, "end": 748.61, "word": " the", "probability": 0.81884765625 }, { "start": 748.61, "end": 749.23, "word": " transmitted", "probability": 0.9052734375 }, { "start": 749.23, "end": 749.81, "word": " buffer", "probability": 0.72607421875 }, { "start": 749.81, "end": 750.45, "word": " lengths", "probability": 0.39208984375 }, { "start": 750.45, "end": 751.29, "word": ".", "probability": 0.8974609375 } ] }, { "id": 141, "seek": 75231, "start": 751.31, "end": 753.69, "text": " An attacker controls this value.", "tokens": [ 51164, 1107, 35871, 9003, 341, 2158, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.22631448460003686, "compression_ratio": 1.6101694915254237, "no_speech_prob": 0.005641937255859375, "words": [ { "start": 751.31, "end": 751.43, "word": " An", "probability": 0.83203125 }, { "start": 751.43, "end": 751.75, "word": " attacker", "probability": 0.71533203125 }, { "start": 751.75, "end": 752.43, "word": " controls", "probability": 0.62060546875 }, { "start": 752.43, "end": 752.67, "word": " this", "probability": 0.86376953125 }, { "start": 752.67, "end": 753.03, "word": " value", "probability": 0.666015625 }, { "start": 753.03, "end": 753.69, "word": ".", "probability": 0.7294921875 } ] }, { "id": 142, "seek": 75231, "start": 753.69, "end": 761.01, "text": " All verification checks can simply be bypassed by using a negative input buffer length.", "tokens": [ 51314, 1057, 30206, 13834, 393, 2935, 312, 24996, 292, 538, 1228, 257, 3671, 4846, 21762, 4641, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.22631448460003686, "compression_ratio": 1.6101694915254237, "no_speech_prob": 0.005641937255859375, "words": [ { "start": 753.69, "end": 753.91, "word": " All", "probability": 0.8486328125 }, { "start": 753.91, "end": 754.53, "word": " verification", "probability": 0.91650390625 }, { "start": 754.53, "end": 755.05, "word": " checks", "probability": 0.71826171875 }, { "start": 755.05, "end": 755.45, "word": " can", "probability": 0.89892578125 }, { "start": 755.45, "end": 756.11, "word": " simply", "probability": 0.79931640625 }, { "start": 756.11, "end": 756.39, "word": " be", "probability": 0.8642578125 }, { "start": 756.39, "end": 757.19, "word": " bypassed", "probability": 0.89404296875 }, { "start": 757.19, "end": 757.77, "word": " by", "probability": 0.89404296875 }, { "start": 757.77, "end": 758.15, "word": " using", "probability": 0.814453125 }, { "start": 758.39, "end": 758.75, "word": " a negative", "probability": 0.90087890625 }, { "start": 758.75, "end": 759.33, "word": " input", "probability": 0.84326171875 }, { "start": 759.33, "end": 759.69, "word": " buffer", "probability": 0.7109375 }, { "start": 759.69, "end": 760.17, "word": " length", "probability": 0.74560546875 }, { "start": 760.17, "end": 761.01, "word": ".", "probability": 0.986328125 } ] }, { "id": 143, "seek": 77937, "start": 761.01, "end": 771.09, "text": " Typecasting to the signed int type on checking buffer boundaries is a bug leading to heap overflow.", "tokens": [ 50364, 15576, 48860, 281, 264, 8175, 560, 2010, 322, 8568, 21762, 13180, 307, 257, 7426, 5775, 281, 33591, 37772, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.2455729236205419, "compression_ratio": 1.3937823834196892, "no_speech_prob": 0.007904052734375, "words": [ { "start": 761.01, "end": 762.55, "word": " Typecasting", "probability": 0.702392578125 }, { "start": 762.55, "end": 762.85, "word": " to", "probability": 0.8857421875 }, { "start": 762.85, "end": 763.17, "word": " the", "probability": 0.80419921875 }, { "start": 763.17, "end": 763.67, "word": " signed", "probability": 0.52294921875 }, { "start": 763.67, "end": 764.17, "word": " int", "probability": 0.468505859375 }, { "start": 764.17, "end": 764.79, "word": " type", "probability": 0.62255859375 }, { "start": 764.79, "end": 765.15, "word": " on", "probability": 0.78759765625 }, { "start": 765.15, "end": 765.59, "word": " checking", "probability": 0.80078125 }, { "start": 765.59, "end": 766.31, "word": " buffer", "probability": 0.47265625 }, { "start": 766.31, "end": 767.03, "word": " boundaries", "probability": 0.81591796875 }, { "start": 767.03, "end": 767.45, "word": " is", "probability": 0.8681640625 }, { "start": 767.85, "end": 768.11, "word": " a bug", "probability": 0.93359375 }, { "start": 768.11, "end": 768.55, "word": " leading", "probability": 0.58349609375 }, { "start": 768.55, "end": 769.15, "word": " to", "probability": 0.904296875 }, { "start": 769.15, "end": 769.53, "word": " heap", "probability": 0.955078125 }, { "start": 769.53, "end": 770.09, "word": " overflow", "probability": 0.7900390625 }, { "start": 770.09, "end": 771.09, "word": ".", "probability": 0.93212890625 } ] }, { "id": 144, "seek": 77937, "start": 772.07, "end": 788.07, "text": " To summarize, the automatically generated code injects vulnerabilities into the libraries of Qualcomm, OEMs and all other third-party developers who use the Hexagon SDK.", "tokens": [ 50914, 1407, 20858, 11, 264, 6772, 10833, 3089, 10711, 82, 37633, 666, 264, 15148, 295, 13616, 13278, 11, 422, 6683, 82, 293, 439, 661, 2636, 12, 23409, 8849, 567, 764, 264, 634, 87, 6709, 37135, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.2455729236205419, "compression_ratio": 1.3937823834196892, "no_speech_prob": 0.007904052734375, "words": [ { "start": 772.07, "end": 772.91, "word": " To", "probability": 0.908203125 }, { "start": 772.91, "end": 773.33, "word": " summarize", "probability": 0.6982421875 }, { "start": 773.33, "end": 774.43, "word": ",", "probability": 0.86328125 }, { "start": 774.43, "end": 774.71, "word": " the", "probability": 0.75634765625 }, { "start": 774.71, "end": 775.31, "word": " automatically", "probability": 0.6904296875 }, { "start": 775.31, "end": 776.35, "word": " generated", "probability": 0.74072265625 }, { "start": 776.35, "end": 776.71, "word": " code", "probability": 0.806640625 }, { "start": 776.71, "end": 777.95, "word": " injects", "probability": 0.845947265625 }, { "start": 777.95, "end": 778.63, "word": " vulnerabilities", "probability": 0.8251953125 }, { "start": 778.63, "end": 779.41, "word": " into", "probability": 0.7197265625 }, { "start": 779.41, "end": 780.03, "word": " the", "probability": 0.7958984375 }, { "start": 780.03, "end": 780.45, "word": " libraries", "probability": 0.88427734375 }, { "start": 780.45, "end": 780.97, "word": " of", "probability": 0.90478515625 }, { "start": 780.97, "end": 781.71, "word": " Qualcomm", "probability": 0.899658203125 }, { "start": 781.71, "end": 782.07, "word": ",", "probability": 0.95166015625 }, { "start": 782.07, "end": 782.77, "word": " OEMs", "probability": 0.9244791666666666 }, { "start": 782.77, "end": 783.05, "word": " and", "probability": 0.40087890625 }, { "start": 783.05, "end": 783.47, "word": " all", "probability": 0.8642578125 }, { "start": 783.47, "end": 783.97, "word": " other", "probability": 0.75146484375 }, { "start": 783.97, "end": 784.25, "word": " third", "probability": 0.81787109375 }, { "start": 784.25, "end": 784.53, "word": "-party", "probability": 0.761962890625 }, { "start": 784.53, "end": 785.19, "word": " developers", "probability": 0.7001953125 }, { "start": 785.19, "end": 785.77, "word": " who", "probability": 0.7646484375 }, { "start": 785.77, "end": 786.05, "word": " use", "probability": 0.80859375 }, { "start": 786.05, "end": 786.21, "word": " the", "probability": 0.4248046875 }, { "start": 786.21, "end": 786.69, "word": " Hexagon", "probability": 0.8089192708333334 }, { "start": 786.69, "end": 787.07, "word": " SDK", "probability": 0.88134765625 }, { "start": 787.07, "end": 788.07, "word": ".", "probability": 0.9755859375 } ] }, { "id": 145, "seek": 80521, "start": 788.07, "end": 798.57, "text": " Dozens of DSP skeleton libraries pre-installed on Android smartphones are vulnerable due to serious bugs in the SDK.", "tokens": [ 50364, 1144, 16515, 295, 15816, 47, 25204, 15148, 659, 12, 13911, 8907, 322, 8853, 26782, 366, 10955, 3462, 281, 3156, 15120, 294, 264, 37135, 13, 50864 ], "temperature": 0.0, "avg_logprob": -0.267693013391074, "compression_ratio": 1.3837837837837839, "no_speech_prob": 0.0015554428100585938, "words": [ { "start": 788.07, "end": 788.85, "word": " Dozens", "probability": 0.872314453125 }, { "start": 788.85, "end": 789.23, "word": " of", "probability": 0.89794921875 }, { "start": 789.23, "end": 789.71, "word": " DSP", "probability": 0.8466796875 }, { "start": 789.71, "end": 790.19, "word": " skeleton", "probability": 0.44091796875 }, { "start": 790.19, "end": 790.85, "word": " libraries", "probability": 0.88720703125 }, { "start": 790.85, "end": 791.25, "word": " pre", "probability": 0.78515625 }, { "start": 791.25, "end": 791.75, "word": "-installed", "probability": 0.8509114583333334 }, { "start": 791.75, "end": 792.05, "word": " on", "probability": 0.90234375 }, { "start": 792.05, "end": 792.59, "word": " Android", "probability": 0.818359375 }, { "start": 792.59, "end": 793.45, "word": " smartphones", "probability": 0.8935546875 }, { "start": 793.45, "end": 794.11, "word": " are", "probability": 0.8662109375 }, { "start": 794.11, "end": 794.65, "word": " vulnerable", "probability": 0.8212890625 }, { "start": 794.65, "end": 795.15, "word": " due", "probability": 0.87744140625 }, { "start": 795.15, "end": 795.37, "word": " to", "probability": 0.9072265625 }, { "start": 795.37, "end": 795.71, "word": " serious", "probability": 0.666015625 }, { "start": 795.71, "end": 796.15, "word": " bugs", "probability": 0.7939453125 }, { "start": 796.15, "end": 796.61, "word": " in", "probability": 0.8955078125 }, { "start": 796.61, "end": 797.01, "word": " the", "probability": 0.53564453125 }, { "start": 797.01, "end": 797.65, "word": " SDK", "probability": 0.92431640625 }, { "start": 797.65, "end": 798.57, "word": ".", "probability": 0.822265625 } ] }, { "id": 146, "seek": 80521, "start": 800.05, "end": 806.23, "text": " So, we discovered many vulnerabilities. Let's exploit one of them.", "tokens": [ 50964, 407, 11, 321, 6941, 867, 37633, 13, 961, 311, 25924, 472, 295, 552, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.267693013391074, "compression_ratio": 1.3837837837837839, "no_speech_prob": 0.0015554428100585938, "words": [ { "start": 800.05, "end": 800.97, "word": " So", "probability": 0.63232421875 }, { "start": 800.97, "end": 801.11, "word": ",", "probability": 0.380859375 }, { "start": 801.11, "end": 801.23, "word": " we", "probability": 0.89892578125 }, { "start": 801.23, "end": 801.65, "word": " discovered", "probability": 0.607421875 }, { "start": 801.65, "end": 802.01, "word": " many", "probability": 0.80322265625 }, { "start": 802.01, "end": 802.59, "word": " vulnerabilities", "probability": 0.79345703125 }, { "start": 802.59, "end": 803.19, "word": ".", "probability": 0.64990234375 }, { "start": 803.19, "end": 803.93, "word": " Let's", "probability": 0.932373046875 }, { "start": 803.93, "end": 804.51, "word": " exploit", "probability": 0.712890625 }, { "start": 804.51, "end": 804.87, "word": " one", "probability": 0.8134765625 }, { "start": 804.87, "end": 805.21, "word": " of", "probability": 0.89599609375 }, { "start": 805.21, "end": 805.77, "word": " them", "probability": 0.73095703125 }, { "start": 805.77, "end": 806.23, "word": ".", "probability": 0.9482421875 } ] }, { "id": 147, "seek": 80521, "start": 807.41, "end": 813.91, "text": " LibFastCV, a DSP-scale SO library, can be found on most Android devices.", "tokens": [ 51314, 15834, 37, 525, 34, 53, 11, 257, 15816, 47, 12, 20033, 10621, 6405, 11, 393, 312, 1352, 322, 881, 8853, 5759, 13, 51614 ], "temperature": 0.0, "avg_logprob": -0.267693013391074, "compression_ratio": 1.3837837837837839, "no_speech_prob": 0.0015554428100585938, "words": [ { "start": 807.41, "end": 808.31, "word": " LibFastCV", "probability": 0.57958984375 }, { "start": 808.31, "end": 808.39, "word": ",", "probability": 0.285400390625 }, { "start": 808.53, "end": 808.87, "word": " a DSP", "probability": 0.958740234375 }, { "start": 808.87, "end": 809.23, "word": "-scale", "probability": 0.6229248046875 }, { "start": 809.23, "end": 809.55, "word": " SO", "probability": 0.63037109375 }, { "start": 809.55, "end": 810.17, "word": " library", "probability": 0.52001953125 }, { "start": 810.17, "end": 810.67, "word": ",", "probability": 0.59228515625 }, { "start": 810.67, "end": 810.85, "word": " can", "probability": 0.900390625 }, { "start": 810.85, "end": 811.05, "word": " be", "probability": 0.90673828125 }, { "start": 811.05, "end": 811.43, "word": " found", "probability": 0.89208984375 }, { "start": 811.43, "end": 811.75, "word": " on", "probability": 0.9013671875 }, { "start": 811.75, "end": 812.21, "word": " most", "probability": 0.80712890625 }, { "start": 812.21, "end": 812.61, "word": " Android", "probability": 0.912109375 }, { "start": 812.61, "end": 813.19, "word": " devices", "probability": 0.90380859375 }, { "start": 813.19, "end": 813.91, "word": ".", "probability": 0.97314453125 } ] }, { "id": 148, "seek": 83153, "start": 813.91, "end": 821.11, "text": " In this example, I used the lib extracted from the Sony Xperia XZ Premium device.", "tokens": [ 50364, 682, 341, 1365, 11, 286, 1143, 264, 22854, 34086, 490, 264, 13575, 1783, 610, 654, 1783, 57, 34881, 4302, 13, 50664 ], "temperature": 0.0, "avg_logprob": -0.21093749813735485, "compression_ratio": 1.4537037037037037, "no_speech_prob": 0.0013074874877929688, "words": [ { "start": 813.91, "end": 814.11, "word": " In", "probability": 0.8388671875 }, { "start": 814.11, "end": 814.33, "word": " this", "probability": 0.87744140625 }, { "start": 814.33, "end": 814.83, "word": " example", "probability": 0.91845703125 }, { "start": 814.83, "end": 815.07, "word": ",", "probability": 0.740234375 }, { "start": 815.07, "end": 815.53, "word": " I", "probability": 0.9814453125 }, { "start": 815.53, "end": 815.91, "word": " used", "probability": 0.75341796875 }, { "start": 815.91, "end": 816.35, "word": " the", "probability": 0.796875 }, { "start": 816.35, "end": 816.53, "word": " lib", "probability": 0.3544921875 }, { "start": 816.53, "end": 817.15, "word": " extracted", "probability": 0.66162109375 }, { "start": 817.15, "end": 817.51, "word": " from", "probability": 0.81201171875 }, { "start": 817.51, "end": 817.73, "word": " the", "probability": 0.751953125 }, { "start": 817.73, "end": 818.03, "word": " Sony", "probability": 0.8818359375 }, { "start": 818.03, "end": 818.95, "word": " Xperia", "probability": 0.9620768229166666 }, { "start": 818.95, "end": 819.45, "word": " XZ", "probability": 0.94580078125 }, { "start": 819.45, "end": 819.81, "word": " Premium", "probability": 0.478271484375 }, { "start": 819.81, "end": 820.35, "word": " device", "probability": 0.8447265625 }, { "start": 820.35, "end": 821.11, "word": ".", "probability": 0.89990234375 } ] }, { "id": 149, "seek": 83153, "start": 821.39, "end": 830.15, "text": " A malicious Android application can cause this lib to crash by providing crafted arguments to the remote handling function.", "tokens": [ 50714, 316, 33496, 8853, 3861, 393, 3082, 341, 22854, 281, 8252, 538, 6530, 36213, 12869, 281, 264, 8607, 13175, 2445, 13, 51164 ], "temperature": 0.0, "avg_logprob": -0.21093749813735485, "compression_ratio": 1.4537037037037037, "no_speech_prob": 0.0013074874877929688, "words": [ { "start": 821.39, "end": 821.49, "word": " A", "probability": 0.97900390625 }, { "start": 821.49, "end": 821.79, "word": " malicious", "probability": 0.81787109375 }, { "start": 821.79, "end": 822.17, "word": " Android", "probability": 0.8935546875 }, { "start": 822.17, "end": 822.87, "word": " application", "probability": 0.74365234375 }, { "start": 822.87, "end": 823.27, "word": " can", "probability": 0.8955078125 }, { "start": 823.27, "end": 823.77, "word": " cause", "probability": 0.8095703125 }, { "start": 823.77, "end": 824.15, "word": " this", "probability": 0.8564453125 }, { "start": 824.15, "end": 824.41, "word": " lib", "probability": 0.75439453125 }, { "start": 824.41, "end": 824.61, "word": " to", "probability": 0.9033203125 }, { "start": 824.61, "end": 824.99, "word": " crash", "probability": 0.84814453125 }, { "start": 824.99, "end": 825.43, "word": " by", "probability": 0.87158203125 }, { "start": 825.43, "end": 825.89, "word": " providing", "probability": 0.81640625 }, { "start": 825.89, "end": 826.45, "word": " crafted", "probability": 0.7490234375 }, { "start": 826.45, "end": 827.21, "word": " arguments", "probability": 0.80517578125 }, { "start": 827.21, "end": 827.79, "word": " to", "probability": 0.8935546875 }, { "start": 827.79, "end": 827.99, "word": " the", "probability": 0.80224609375 }, { "start": 827.99, "end": 828.35, "word": " remote", "probability": 0.537109375 }, { "start": 828.35, "end": 828.79, "word": " handling", "probability": 0.73193359375 }, { "start": 828.79, "end": 829.39, "word": " function", "probability": 0.46240234375 }, { "start": 829.39, "end": 830.15, "word": ".", "probability": 0.9814453125 } ] }, { "id": 150, "seek": 83153, "start": 831.55, "end": 840.23, "text": " The 3F method allows us to read and write everything that we want within the other space of the DSP process.", "tokens": [ 51264, 440, 805, 37, 3170, 4045, 505, 281, 1401, 293, 2464, 1203, 300, 321, 528, 1951, 264, 661, 1901, 295, 264, 15816, 47, 1399, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.21093749813735485, "compression_ratio": 1.4537037037037037, "no_speech_prob": 0.0013074874877929688, "words": [ { "start": 831.55, "end": 832.31, "word": " The", "probability": 0.81298828125 }, { "start": 832.31, "end": 832.85, "word": " 3F", "probability": 0.796142578125 }, { "start": 832.85, "end": 833.31, "word": " method", "probability": 0.80078125 }, { "start": 833.31, "end": 834.25, "word": " allows", "probability": 0.75732421875 }, { "start": 834.25, "end": 834.65, "word": " us", "probability": 0.89306640625 }, { "start": 834.65, "end": 834.87, "word": " to", "probability": 0.90869140625 }, { "start": 834.87, "end": 835.11, "word": " read", "probability": 0.88525390625 }, { "start": 835.11, "end": 835.39, "word": " and", "probability": 0.89208984375 }, { "start": 835.39, "end": 835.71, "word": " write", "probability": 0.7998046875 }, { "start": 835.71, "end": 836.29, "word": " everything", "probability": 0.89013671875 }, { "start": 836.29, "end": 836.63, "word": " that", "probability": 0.814453125 }, { "start": 836.63, "end": 836.81, "word": " we", "probability": 0.9052734375 }, { "start": 836.81, "end": 837.25, "word": " want", "probability": 0.81689453125 }, { "start": 837.25, "end": 837.57, "word": " within", "probability": 0.71435546875 }, { "start": 837.57, "end": 837.83, "word": " the", "probability": 0.8134765625 }, { "start": 837.83, "end": 838.11, "word": " other", "probability": 0.33349609375 }, { "start": 838.11, "end": 838.65, "word": " space", "probability": 0.79833984375 }, { "start": 838.65, "end": 838.89, "word": " of", "probability": 0.90087890625 }, { "start": 838.89, "end": 839.05, "word": " the", "probability": 0.81201171875 }, { "start": 839.05, "end": 839.37, "word": " DSP", "probability": 0.916015625 }, { "start": 839.37, "end": 839.85, "word": " process", "probability": 0.74951171875 }, { "start": 839.85, "end": 840.23, "word": ".", "probability": 0.98486328125 } ] }, { "id": 151, "seek": 85967, "start": 840.23, "end": 849.11, "text": " It's enough to implement an exploit and execute an unsigned payload in the user protection domain.", "tokens": [ 50364, 467, 311, 1547, 281, 4445, 364, 25924, 293, 14483, 364, 2693, 16690, 30918, 294, 264, 4195, 6334, 9274, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.23622532424173856, "compression_ratio": 1.495, "no_speech_prob": 0.0008625984191894531, "words": [ { "start": 840.23, "end": 841.33, "word": " It's", "probability": 0.8681640625 }, { "start": 841.33, "end": 841.71, "word": " enough", "probability": 0.7646484375 }, { "start": 841.71, "end": 842.19, "word": " to", "probability": 0.89697265625 }, { "start": 842.19, "end": 842.69, "word": " implement", "probability": 0.74755859375 }, { "start": 842.69, "end": 843.03, "word": " an", "probability": 0.5751953125 }, { "start": 843.03, "end": 843.61, "word": " exploit", "probability": 0.77880859375 }, { "start": 843.61, "end": 844.07, "word": " and", "probability": 0.8544921875 }, { "start": 844.07, "end": 844.91, "word": " execute", "probability": 0.841796875 }, { "start": 844.91, "end": 845.25, "word": " an", "probability": 0.86083984375 }, { "start": 845.25, "end": 845.83, "word": " unsigned", "probability": 0.89599609375 }, { "start": 845.83, "end": 846.43, "word": " payload", "probability": 0.93017578125 }, { "start": 846.43, "end": 846.83, "word": " in", "probability": 0.8701171875 }, { "start": 846.83, "end": 846.99, "word": " the", "probability": 0.80078125 }, { "start": 846.99, "end": 847.31, "word": " user", "probability": 0.73828125 }, { "start": 847.31, "end": 847.93, "word": " protection", "probability": 0.64306640625 }, { "start": 847.93, "end": 848.31, "word": " domain", "probability": 0.354248046875 }, { "start": 848.31, "end": 849.11, "word": ".", "probability": 0.94091796875 } ] }, { "id": 152, "seek": 85967, "start": 850.23, "end": 854.71, "text": " Ok, we got code execution. What can we do with it?", "tokens": [ 50814, 3477, 11, 321, 658, 3089, 15058, 13, 708, 393, 321, 360, 365, 309, 30, 51014 ], "temperature": 0.0, "avg_logprob": -0.23622532424173856, "compression_ratio": 1.495, "no_speech_prob": 0.0008625984191894531, "words": [ { "start": 850.23, "end": 850.77, "word": " Ok", "probability": 0.1375732421875 }, { "start": 850.77, "end": 851.05, "word": ",", "probability": 0.5419921875 }, { "start": 851.05, "end": 851.21, "word": " we", "probability": 0.88330078125 }, { "start": 851.21, "end": 851.41, "word": " got", "probability": 0.7607421875 }, { "start": 851.41, "end": 851.93, "word": " code", "probability": 0.62890625 }, { "start": 851.93, "end": 852.47, "word": " execution", "probability": 0.90478515625 }, { "start": 852.47, "end": 852.97, "word": ".", "probability": 0.60986328125 }, { "start": 852.97, "end": 853.19, "word": " What", "probability": 0.81103515625 }, { "start": 853.19, "end": 853.39, "word": " can", "probability": 0.890625 }, { "start": 853.39, "end": 853.53, "word": " we", "probability": 0.8984375 }, { "start": 853.53, "end": 853.67, "word": " do", "probability": 0.9111328125 }, { "start": 853.67, "end": 853.83, "word": " with", "probability": 0.80712890625 }, { "start": 853.83, "end": 853.99, "word": " it", "probability": 0.8935546875 }, { "start": 853.99, "end": 854.71, "word": "?", "probability": 0.98779296875 } ] }, { "id": 153, "seek": 85967, "start": 854.71, "end": 863.47, "text": " We can crash the DSP, we can hide malicious code, we can try to access camera sensors and more.", "tokens": [ 51064, 492, 393, 8252, 264, 15816, 47, 11, 321, 393, 6479, 33496, 3089, 11, 321, 393, 853, 281, 2105, 2799, 14840, 293, 544, 13, 51464 ], "temperature": 0.0, "avg_logprob": -0.23622532424173856, "compression_ratio": 1.495, "no_speech_prob": 0.0008625984191894531, "words": [ { "start": 854.71, "end": 855.23, "word": " We", "probability": 0.88818359375 }, { "start": 855.23, "end": 855.47, "word": " can", "probability": 0.89697265625 }, { "start": 855.47, "end": 856.43, "word": " crash", "probability": 0.810546875 }, { "start": 856.43, "end": 856.57, "word": " the", "probability": 0.80224609375 }, { "start": 856.57, "end": 857.05, "word": " DSP", "probability": 0.899169921875 }, { "start": 857.05, "end": 857.41, "word": ",", "probability": 0.65478515625 }, { "start": 857.41, "end": 857.53, "word": " we", "probability": 0.84521484375 }, { "start": 857.53, "end": 857.75, "word": " can", "probability": 0.89697265625 }, { "start": 857.75, "end": 858.13, "word": " hide", "probability": 0.71875 }, { "start": 858.13, "end": 858.55, "word": " malicious", "probability": 0.84814453125 }, { "start": 858.55, "end": 858.99, "word": " code", "probability": 0.80126953125 }, { "start": 858.99, "end": 859.37, "word": ",", "probability": 0.82861328125 }, { "start": 859.37, "end": 859.49, "word": " we", "probability": 0.87939453125 }, { "start": 859.49, "end": 859.65, "word": " can", "probability": 0.89306640625 }, { "start": 859.65, "end": 859.97, "word": " try", "probability": 0.8037109375 }, { "start": 859.97, "end": 860.23, "word": " to", "probability": 0.8994140625 }, { "start": 860.23, "end": 860.73, "word": " access", "probability": 0.7783203125 }, { "start": 860.73, "end": 861.21, "word": " camera", "probability": 0.78125 }, { "start": 861.21, "end": 861.83, "word": " sensors", "probability": 0.76025390625 }, { "start": 861.83, "end": 862.27, "word": " and", "probability": 0.708984375 }, { "start": 862.27, "end": 862.67, "word": " more", "probability": 0.87744140625 }, { "start": 862.67, "end": 863.47, "word": ".", "probability": 0.919921875 } ] }, { "id": 154, "seek": 85967, "start": 863.59, "end": 868.37, "text": " Besides, now we can communicate with secured drivers.", "tokens": [ 51514, 13212, 11, 586, 321, 393, 7890, 365, 22905, 11590, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.23622532424173856, "compression_ratio": 1.495, "no_speech_prob": 0.0008625984191894531, "words": [ { "start": 863.59, "end": 864.05, "word": " Besides", "probability": 0.8935546875 }, { "start": 864.05, "end": 864.45, "word": ",", "probability": 0.9228515625 }, { "start": 864.45, "end": 864.79, "word": " now", "probability": 0.87060546875 }, { "start": 864.79, "end": 865.01, "word": " we", "probability": 0.88623046875 }, { "start": 865.01, "end": 865.23, "word": " can", "probability": 0.896484375 }, { "start": 865.23, "end": 865.89, "word": " communicate", "probability": 0.703125 }, { "start": 865.89, "end": 866.43, "word": " with", "probability": 0.8095703125 }, { "start": 866.43, "end": 866.97, "word": " secured", "probability": 0.195068359375 }, { "start": 866.97, "end": 867.57, "word": " drivers", "probability": 0.60400390625 }, { "start": 867.57, "end": 868.37, "word": ".", "probability": 0.96630859375 } ] }, { "id": 155, "seek": 88473, "start": 869.49, "end": 878.43, "text": " The next step of the research is to attack the Qt-privileged domains from the user protection domain.", "tokens": [ 50414, 440, 958, 1823, 295, 264, 2132, 307, 281, 2690, 264, 1249, 83, 12, 79, 29994, 794, 3004, 25514, 490, 264, 4195, 6334, 9274, 13, 50814 ], "temperature": 0.0, "avg_logprob": -0.23137019230769232, "compression_ratio": 1.4267515923566878, "no_speech_prob": 0.006938934326171875, "words": [ { "start": 869.49, "end": 870.39, "word": " The", "probability": 0.7451171875 }, { "start": 870.39, "end": 870.69, "word": " next", "probability": 0.8486328125 }, { "start": 870.69, "end": 871.05, "word": " step", "probability": 0.8212890625 }, { "start": 871.05, "end": 871.51, "word": " of", "probability": 0.8828125 }, { "start": 871.51, "end": 871.67, "word": " the", "probability": 0.7978515625 }, { "start": 871.67, "end": 872.07, "word": " research", "probability": 0.7998046875 }, { "start": 872.07, "end": 872.37, "word": " is", "probability": 0.8857421875 }, { "start": 872.37, "end": 872.55, "word": " to", "probability": 0.904296875 }, { "start": 872.55, "end": 873.07, "word": " attack", "probability": 0.7685546875 }, { "start": 873.07, "end": 873.87, "word": " the", "probability": 0.7548828125 }, { "start": 873.87, "end": 874.19, "word": " Qt", "probability": 0.782958984375 }, { "start": 874.19, "end": 874.97, "word": "-privileged", "probability": 0.752197265625 }, { "start": 874.97, "end": 875.75, "word": " domains", "probability": 0.82080078125 }, { "start": 875.75, "end": 876.09, "word": " from", "probability": 0.69873046875 }, { "start": 876.09, "end": 876.33, "word": " the", "probability": 0.796875 }, { "start": 876.33, "end": 876.59, "word": " user", "probability": 0.6689453125 }, { "start": 876.59, "end": 877.11, "word": " protection", "probability": 0.65234375 }, { "start": 877.11, "end": 877.55, "word": " domain", "probability": 0.83251953125 }, { "start": 877.55, "end": 878.43, "word": ".", "probability": 0.64990234375 } ] }, { "id": 156, "seek": 88473, "start": 878.43, "end": 883.33, "text": " And Qt drivers are the entry points for this.", "tokens": [ 50864, 400, 1249, 83, 11590, 366, 264, 8729, 2793, 337, 341, 13, 51064 ], "temperature": 0.0, "avg_logprob": -0.23137019230769232, "compression_ratio": 1.4267515923566878, "no_speech_prob": 0.006938934326171875, "words": [ { "start": 878.43, "end": 878.63, "word": " And", "probability": 0.7197265625 }, { "start": 878.63, "end": 879.01, "word": " Qt", "probability": 0.967529296875 }, { "start": 879.01, "end": 879.55, "word": " drivers", "probability": 0.6796875 }, { "start": 879.55, "end": 880.19, "word": " are", "probability": 0.8955078125 }, { "start": 880.19, "end": 880.55, "word": " the", "probability": 0.80029296875 }, { "start": 880.55, "end": 880.89, "word": " entry", "probability": 0.73779296875 }, { "start": 880.89, "end": 881.47, "word": " points", "probability": 0.418212890625 }, { "start": 881.47, "end": 882.11, "word": " for", "probability": 0.86865234375 }, { "start": 882.11, "end": 882.43, "word": " this", "probability": 0.86083984375 }, { "start": 882.43, "end": 883.33, "word": ".", "probability": 0.95654296875 } ] }, { "id": 157, "seek": 88473, "start": 885.23, "end": 893.43, "text": " QtOS implements its own device driver model, named Qt Driver Invocation, QD.", "tokens": [ 51164, 1249, 83, 4367, 704, 17988, 1080, 1065, 4302, 6787, 2316, 11, 4926, 1249, 83, 36048, 682, 20836, 399, 11, 1249, 35, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.23137019230769232, "compression_ratio": 1.4267515923566878, "no_speech_prob": 0.006938934326171875, "words": [ { "start": 885.23, "end": 886.07, "word": " QtOS", "probability": 0.84619140625 }, { "start": 886.07, "end": 886.91, "word": " implements", "probability": 0.84228515625 }, { "start": 886.91, "end": 887.91, "word": " its", "probability": 0.77294921875 }, { "start": 887.91, "end": 888.29, "word": " own", "probability": 0.77685546875 }, { "start": 888.29, "end": 888.87, "word": " device", "probability": 0.873046875 }, { "start": 888.87, "end": 889.31, "word": " driver", "probability": 0.68603515625 }, { "start": 889.31, "end": 889.79, "word": " model", "probability": 0.841796875 }, { "start": 889.79, "end": 889.97, "word": ",", "probability": 0.306884765625 }, { "start": 889.97, "end": 890.41, "word": " named", "probability": 0.80322265625 }, { "start": 890.41, "end": 891.05, "word": " Qt", "probability": 0.918701171875 }, { "start": 891.05, "end": 891.57, "word": " Driver", "probability": 0.5244140625 }, { "start": 891.57, "end": 892.29, "word": " Invocation", "probability": 0.8990885416666666 }, { "start": 892.29, "end": 892.59, "word": ",", "probability": 0.62646484375 }, { "start": 892.59, "end": 892.91, "word": " QD", "probability": 0.8046875 }, { "start": 892.91, "end": 893.43, "word": ".", "probability": 0.984375 } ] }, { "id": 158, "seek": 91101, "start": 893.43, "end": 900.73, "text": " Like POSIX, Qt device drivers operate with higher privileges than user code.", "tokens": [ 50364, 1743, 430, 4367, 21124, 11, 1249, 83, 4302, 11590, 9651, 365, 2946, 32588, 813, 4195, 3089, 13, 50664 ], "temperature": 0.0, "avg_logprob": -0.22149492538458593, "compression_ratio": 1.3756613756613756, "no_speech_prob": 0.00457000732421875, "words": [ { "start": 893.43, "end": 893.91, "word": " Like", "probability": 0.638671875 }, { "start": 893.91, "end": 894.53, "word": " POSIX", "probability": 0.9129231770833334 }, { "start": 894.53, "end": 895.17, "word": ",", "probability": 0.84716796875 }, { "start": 895.17, "end": 895.27, "word": " Qt", "probability": 0.5218505859375 }, { "start": 895.27, "end": 895.71, "word": " device", "probability": 0.7109375 }, { "start": 895.71, "end": 896.19, "word": " drivers", "probability": 0.7900390625 }, { "start": 896.19, "end": 896.71, "word": " operate", "probability": 0.73828125 }, { "start": 896.71, "end": 897.63, "word": " with", "probability": 0.78515625 }, { "start": 897.63, "end": 898.09, "word": " higher", "probability": 0.76318359375 }, { "start": 898.09, "end": 898.67, "word": " privileges", "probability": 0.65234375 }, { "start": 898.67, "end": 899.21, "word": " than", "probability": 0.875 }, { "start": 899.21, "end": 899.53, "word": " user", "probability": 0.472900390625 }, { "start": 899.53, "end": 899.87, "word": " code", "probability": 0.75537109375 }, { "start": 899.87, "end": 900.73, "word": ".", "probability": 0.91162109375 } ] }, { "id": 159, "seek": 91101, "start": 900.73, "end": 906.65, "text": " Dozens of Qt drivers can be found in the Qt binary.", "tokens": [ 50714, 1144, 16515, 295, 1249, 83, 11590, 393, 312, 1352, 294, 264, 1249, 83, 17434, 13, 50964 ], "temperature": 0.0, "avg_logprob": -0.22149492538458593, "compression_ratio": 1.3756613756613756, "no_speech_prob": 0.00457000732421875, "words": [ { "start": 900.73, "end": 901.19, "word": " Dozens", "probability": 0.876220703125 }, { "start": 901.19, "end": 901.53, "word": " of", "probability": 0.90478515625 }, { "start": 901.53, "end": 901.83, "word": " Qt", "probability": 0.95947265625 }, { "start": 901.83, "end": 902.45, "word": " drivers", "probability": 0.69677734375 }, { "start": 902.45, "end": 903.37, "word": " can", "probability": 0.880859375 }, { "start": 903.37, "end": 903.53, "word": " be", "probability": 0.90771484375 }, { "start": 903.53, "end": 903.95, "word": " found", "probability": 0.87939453125 }, { "start": 903.95, "end": 904.57, "word": " in", "probability": 0.8994140625 }, { "start": 904.57, "end": 904.79, "word": " the", "probability": 0.79443359375 }, { "start": 904.79, "end": 905.17, "word": " Qt", "probability": 0.871337890625 }, { "start": 905.17, "end": 905.69, "word": " binary", "probability": 0.505859375 }, { "start": 905.69, "end": 906.65, "word": ".", "probability": 0.9443359375 } ] }, { "id": 160, "seek": 91101, "start": 907.67, "end": 915.31, "text": " libQtA library, which is part of Hexagon SDK, contains the Qt infrastructure.", "tokens": [ 51064, 22854, 48, 83, 32, 6405, 11, 597, 307, 644, 295, 634, 87, 6709, 37135, 11, 8306, 264, 1249, 83, 6896, 13, 51414 ], "temperature": 0.0, "avg_logprob": -0.22149492538458593, "compression_ratio": 1.3756613756613756, "no_speech_prob": 0.00457000732421875, "words": [ { "start": 907.67, "end": 908.63, "word": " libQtA", "probability": 0.647216796875 }, { "start": 908.63, "end": 909.27, "word": " library", "probability": 0.7783203125 }, { "start": 909.27, "end": 909.53, "word": ",", "probability": 0.767578125 }, { "start": 909.53, "end": 909.73, "word": " which", "probability": 0.92626953125 }, { "start": 909.73, "end": 909.89, "word": " is", "probability": 0.9052734375 }, { "start": 909.89, "end": 910.25, "word": " part", "probability": 0.8349609375 }, { "start": 910.25, "end": 910.47, "word": " of", "probability": 0.89794921875 }, { "start": 910.47, "end": 910.95, "word": " Hexagon", "probability": 0.81494140625 }, { "start": 910.95, "end": 911.35, "word": " SDK", "probability": 0.8740234375 }, { "start": 911.35, "end": 912.05, "word": ",", "probability": 0.79345703125 }, { "start": 912.05, "end": 912.63, "word": " contains", "probability": 0.869140625 }, { "start": 912.63, "end": 913.21, "word": " the", "probability": 0.75732421875 }, { "start": 913.21, "end": 913.57, "word": " Qt", "probability": 0.943603515625 }, { "start": 913.57, "end": 914.49, "word": " infrastructure", "probability": 0.85400390625 }, { "start": 914.49, "end": 915.31, "word": ".", "probability": 0.9814453125 } ] }, { "id": 161, "seek": 91101, "start": 915.31, "end": 919.71, "text": " FasterPC shell is linked statically with the library.", "tokens": [ 51464, 46665, 12986, 8720, 307, 9408, 2219, 984, 365, 264, 6405, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.22149492538458593, "compression_ratio": 1.3756613756613756, "no_speech_prob": 0.00457000732421875, "words": [ { "start": 915.31, "end": 915.89, "word": " FasterPC", "probability": 0.511962890625 }, { "start": 915.89, "end": 916.31, "word": " shell", "probability": 0.58251953125 }, { "start": 916.31, "end": 916.57, "word": " is", "probability": 0.904296875 }, { "start": 916.57, "end": 916.99, "word": " linked", "probability": 0.71044921875 }, { "start": 916.99, "end": 918.07, "word": " statically", "probability": 0.91845703125 }, { "start": 918.07, "end": 918.73, "word": " with", "probability": 0.74462890625 }, { "start": 918.73, "end": 918.91, "word": " the", "probability": 0.80810546875 }, { "start": 918.91, "end": 919.23, "word": " library", "probability": 0.82958984375 }, { "start": 919.23, "end": 919.71, "word": ".", "probability": 0.9873046875 } ] }, { "id": 162, "seek": 94101, "start": 922.37, "end": 932.43, "text": " QD provides a simple driver invocation API with the ability to access a device driver based only on the driver name.", "tokens": [ 50414, 1249, 35, 6417, 257, 2199, 6787, 1048, 27943, 9362, 365, 264, 3485, 281, 2105, 257, 4302, 6787, 2361, 787, 322, 264, 6787, 1315, 13, 50864 ], "temperature": 0.0, "avg_logprob": -0.23986486124025808, "compression_ratio": 1.5076142131979695, "no_speech_prob": 0.004650115966796875, "words": [ { "start": 922.37, "end": 922.91, "word": " QD", "probability": 0.52642822265625 }, { "start": 922.91, "end": 923.61, "word": " provides", "probability": 0.787109375 }, { "start": 924.35, "end": 924.69, "word": " a simple", "probability": 0.89111328125 }, { "start": 924.69, "end": 925.09, "word": " driver", "probability": 0.71923828125 }, { "start": 925.09, "end": 925.61, "word": " invocation", "probability": 0.783203125 }, { "start": 925.61, "end": 926.19, "word": " API", "probability": 0.76220703125 }, { "start": 926.19, "end": 926.81, "word": " with", "probability": 0.29833984375 }, { "start": 926.81, "end": 927.03, "word": " the", "probability": 0.73486328125 }, { "start": 927.03, "end": 927.49, "word": " ability", "probability": 0.86279296875 }, { "start": 927.49, "end": 927.81, "word": " to", "probability": 0.90576171875 }, { "start": 927.81, "end": 928.19, "word": " access", "probability": 0.77490234375 }, { "start": 928.41, "end": 928.71, "word": " a device", "probability": 0.9072265625 }, { "start": 928.71, "end": 929.21, "word": " driver", "probability": 0.7333984375 }, { "start": 929.21, "end": 930.01, "word": " based", "probability": 0.74072265625 }, { "start": 930.01, "end": 930.41, "word": " only", "probability": 0.74365234375 }, { "start": 930.41, "end": 930.57, "word": " on", "probability": 0.29931640625 }, { "start": 930.57, "end": 930.67, "word": " the", "probability": 0.7802734375 }, { "start": 930.67, "end": 931.11, "word": " driver", "probability": 0.755859375 }, { "start": 931.11, "end": 931.55, "word": " name", "probability": 0.7978515625 }, { "start": 931.55, "end": 932.43, "word": ".", "probability": 0.9404296875 } ] }, { "id": 163, "seek": 94101, "start": 932.61, "end": 941.25, "text": " Actually, only Qt QD handle invoke macro is the necessary user visible API.", "tokens": [ 50914, 5135, 11, 787, 1249, 83, 1249, 35, 4813, 41117, 18887, 307, 264, 4818, 4195, 8974, 9362, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.23986486124025808, "compression_ratio": 1.5076142131979695, "no_speech_prob": 0.004650115966796875, "words": [ { "start": 932.61, "end": 933.21, "word": " Actually", "probability": 0.8173828125 }, { "start": 933.21, "end": 933.65, "word": ",", "probability": 0.76123046875 }, { "start": 933.65, "end": 933.93, "word": " only", "probability": 0.79150390625 }, { "start": 933.93, "end": 934.95, "word": " Qt", "probability": 0.6944580078125 }, { "start": 934.95, "end": 935.39, "word": " QD", "probability": 0.681640625 }, { "start": 935.39, "end": 935.77, "word": " handle", "probability": 0.61767578125 }, { "start": 935.77, "end": 936.27, "word": " invoke", "probability": 0.484619140625 }, { "start": 936.27, "end": 936.73, "word": " macro", "probability": 0.91162109375 }, { "start": 936.73, "end": 937.97, "word": " is", "probability": 0.86328125 }, { "start": 937.97, "end": 938.37, "word": " the", "probability": 0.79248046875 }, { "start": 938.37, "end": 938.99, "word": " necessary", "probability": 0.90185546875 }, { "start": 938.99, "end": 939.43, "word": " user", "probability": 0.77783203125 }, { "start": 939.43, "end": 939.87, "word": " visible", "probability": 0.47705078125 }, { "start": 939.87, "end": 940.37, "word": " API", "probability": 0.83154296875 }, { "start": 940.37, "end": 941.25, "word": ".", "probability": 0.9462890625 } ] }, { "id": 164, "seek": 94101, "start": 941.29, "end": 945.57, "text": " It's responsible for all generic driver operations.", "tokens": [ 51364, 467, 311, 6250, 337, 439, 19577, 6787, 7705, 13, 51514 ], "temperature": 0.0, "avg_logprob": -0.23986486124025808, "compression_ratio": 1.5076142131979695, "no_speech_prob": 0.004650115966796875, "words": [ { "start": 941.29, "end": 941.85, "word": " It's", "probability": 0.898193359375 }, { "start": 941.85, "end": 942.35, "word": " responsible", "probability": 0.81005859375 }, { "start": 942.35, "end": 942.77, "word": " for", "probability": 0.8974609375 }, { "start": 942.77, "end": 943.15, "word": " all", "probability": 0.89794921875 }, { "start": 943.15, "end": 943.61, "word": " generic", "probability": 0.89892578125 }, { "start": 943.61, "end": 944.01, "word": " driver", "probability": 0.77392578125 }, { "start": 944.01, "end": 944.69, "word": " operations", "probability": 0.87060546875 }, { "start": 944.69, "end": 945.57, "word": ".", "probability": 0.98583984375 } ] }, { "id": 165, "seek": 94101, "start": 945.91, "end": 950.09, "text": " The Qt QD open is just a special case of this macro.", "tokens": [ 51564, 440, 1249, 83, 1249, 35, 1269, 307, 445, 257, 2121, 1389, 295, 341, 18887, 13, 51764 ], "temperature": 0.0, "avg_logprob": -0.23986486124025808, "compression_ratio": 1.5076142131979695, "no_speech_prob": 0.004650115966796875, "words": [ { "start": 945.91, "end": 946.05, "word": " The", "probability": 0.78857421875 }, { "start": 946.05, "end": 946.33, "word": " Qt", "probability": 0.936279296875 }, { "start": 946.33, "end": 946.65, "word": " QD", "probability": 0.92578125 }, { "start": 946.65, "end": 947.01, "word": " open", "probability": 0.6953125 }, { "start": 947.01, "end": 947.35, "word": " is", "probability": 0.8984375 }, { "start": 947.35, "end": 947.71, "word": " just", "probability": 0.884765625 }, { "start": 947.99, "end": 948.39, "word": " a special", "probability": 0.921875 }, { "start": 948.39, "end": 948.95, "word": " case", "probability": 0.80712890625 }, { "start": 948.95, "end": 949.25, "word": " of", "probability": 0.8916015625 }, { "start": 949.25, "end": 949.47, "word": " this", "probability": 0.86328125 }, { "start": 949.47, "end": 949.77, "word": " macro", "probability": 0.83203125 }, { "start": 949.77, "end": 950.09, "word": ".", "probability": 0.99072265625 } ] }, { "id": 166, "seek": 96745, "start": 953.89, "end": 965.1, "text": " To fuzz Qt drivers on Ubuntu PC, we use the same combination of Hexagon QMU and AFM, as for fuzzing of user-mode DSP libraries.", "tokens": [ 50364, 1407, 283, 16740, 1249, 83, 11590, 322, 30230, 45605, 6465, 11, 321, 764, 264, 912, 6562, 295, 634, 87, 6709, 1249, 44, 52, 293, 20389, 44, 11, 382, 337, 283, 3334, 8781, 295, 4195, 12, 76, 1429, 15816, 47, 15148, 13, 50914 ], "temperature": 0.0, "avg_logprob": -0.28242608808702035, "compression_ratio": 1.398936170212766, "no_speech_prob": 0.003509521484375, "words": [ { "start": 953.89, "end": 954.27, "word": " To", "probability": 0.818359375 }, { "start": 954.27, "end": 954.47, "word": " fuzz", "probability": 0.81494140625 }, { "start": 954.47, "end": 954.75, "word": " Qt", "probability": 0.5126953125 }, { "start": 954.75, "end": 955.27, "word": " drivers", "probability": 0.52294921875 }, { "start": 955.27, "end": 955.53, "word": " on", "probability": 0.876953125 }, { "start": 955.53, "end": 955.91, "word": " Ubuntu", "probability": 0.88818359375 }, { "start": 955.91, "end": 956.27, "word": " PC", "probability": 0.81005859375 }, { "start": 956.27, "end": 956.45, "word": ",", "probability": 0.5302734375 }, { "start": 956.45, "end": 956.57, "word": " we", "probability": 0.8984375 }, { "start": 956.57, "end": 956.79, "word": " use", "probability": 0.1817626953125 }, { "start": 956.79, "end": 956.95, "word": " the", "probability": 0.7724609375 }, { "start": 956.95, "end": 957.27, "word": " same", "probability": 0.8251953125 }, { "start": 957.27, "end": 957.97, "word": " combination", "probability": 0.8603515625 }, { "start": 957.97, "end": 958.39, "word": " of", "probability": 0.890625 }, { "start": 958.39, "end": 958.95, "word": " Hexagon", "probability": 0.6991373697916666 }, { "start": 958.95, "end": 959.47, "word": " QMU", "probability": 0.6905110677083334 }, { "start": 959.47, "end": 959.85, "word": " and", "probability": 0.87841796875 }, { "start": 959.85, "end": 960.71, "word": " AFM", "probability": 0.418212890625 }, { "start": 960.71, "end": 960.93, "word": ",", "probability": 0.3623046875 }, { "start": 960.93, "end": 961.11, "word": " as", "probability": 0.90625 }, { "start": 961.11, "end": 961.29, "word": " for", "probability": 0.8740234375 }, { "start": 961.29, "end": 961.69, "word": " fuzzing", "probability": 0.88525390625 }, { "start": 961.69, "end": 962.45, "word": " of", "probability": 0.83056640625 }, { "start": 962.45, "end": 963.07, "word": " user", "probability": 0.572265625 }, { "start": 963.07, "end": 963.81, "word": "-mode", "probability": 0.5526529947916666 }, { "start": 963.81, "end": 964.17, "word": " DSP", "probability": 0.6983642578125 }, { "start": 964.17, "end": 964.73, "word": " libraries", "probability": 0.86474609375 }, { "start": 964.73, "end": 965.1, "word": ".", "probability": 0.94921875 } ] }, { "id": 167, "seek": 96745, "start": 966.39, "end": 973.85, "text": " Qt drivers were not included by Qualcomm in the run.elf.pdn version of Qt.", "tokens": [ 50964, 1249, 83, 11590, 645, 406, 5556, 538, 13616, 13278, 294, 264, 1190, 13, 338, 69, 13, 79, 67, 77, 3037, 295, 1249, 83, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.28242608808702035, "compression_ratio": 1.398936170212766, "no_speech_prob": 0.003509521484375, "words": [ { "start": 966.39, "end": 966.67, "word": " Qt", "probability": 0.96240234375 }, { "start": 966.67, "end": 967.35, "word": " drivers", "probability": 0.654296875 }, { "start": 967.35, "end": 968.53, "word": " were", "probability": 0.85791015625 }, { "start": 968.53, "end": 968.71, "word": " not", "probability": 0.89794921875 }, { "start": 968.71, "end": 969.13, "word": " included", "probability": 0.77783203125 }, { "start": 969.13, "end": 969.41, "word": " by", "probability": 0.87744140625 }, { "start": 969.41, "end": 969.87, "word": " Qualcomm", "probability": 0.903076171875 }, { "start": 969.87, "end": 970.13, "word": " in", "probability": 0.89501953125 }, { "start": 970.13, "end": 970.49, "word": " the", "probability": 0.80859375 }, { "start": 970.49, "end": 971.01, "word": " run", "probability": 0.45751953125 }, { "start": 971.01, "end": 971.51, "word": ".elf", "probability": 0.5128580729166666 }, { "start": 971.51, "end": 972.07, "word": ".pdn", "probability": 0.65106201171875 }, { "start": 972.07, "end": 972.91, "word": " version", "probability": 0.67822265625 }, { "start": 972.91, "end": 973.35, "word": " of", "probability": 0.88330078125 }, { "start": 973.35, "end": 973.63, "word": " Qt", "probability": 0.777099609375 }, { "start": 973.63, "end": 973.85, "word": ".", "probability": 0.32763671875 } ] }, { "id": 168, "seek": 96745, "start": 973.85, "end": 978.11, "text": " Therefore, we had to patch the run.elf file.", "tokens": [ 51364, 7504, 11, 321, 632, 281, 9972, 264, 1190, 13, 338, 69, 3991, 13, 51514 ], "temperature": 0.0, "avg_logprob": -0.28242608808702035, "compression_ratio": 1.398936170212766, "no_speech_prob": 0.003509521484375, "words": [ { "start": 973.85, "end": 974.53, "word": " Therefore", "probability": 0.71142578125 }, { "start": 974.53, "end": 974.85, "word": ",", "probability": 0.80615234375 }, { "start": 974.85, "end": 974.99, "word": " we", "probability": 0.90234375 }, { "start": 974.99, "end": 975.29, "word": " had", "probability": 0.79443359375 }, { "start": 975.29, "end": 975.53, "word": " to", "probability": 0.900390625 }, { "start": 975.53, "end": 975.87, "word": " patch", "probability": 0.399658203125 }, { "start": 975.87, "end": 976.47, "word": " the", "probability": 0.80419921875 }, { "start": 976.47, "end": 976.69, "word": " run", "probability": 0.87939453125 }, { "start": 976.69, "end": 977.11, "word": ".elf", "probability": 0.9230143229166666 }, { "start": 977.11, "end": 977.39, "word": " file", "probability": 0.66748046875 }, { "start": 977.39, "end": 978.11, "word": ".", "probability": 0.9833984375 } ] }, { "id": 169, "seek": 96745, "start": 978.11, "end": 980.33, "text": " What did we do?", "tokens": [ 51564, 708, 630, 321, 360, 30, 51664 ], "temperature": 0.0, "avg_logprob": -0.28242608808702035, "compression_ratio": 1.398936170212766, "no_speech_prob": 0.003509521484375, "words": [ { "start": 978.11, "end": 978.33, "word": " What", "probability": 0.7919921875 }, { "start": 978.33, "end": 979.31, "word": " did", "probability": 0.86865234375 }, { "start": 979.31, "end": 979.45, "word": " we", "probability": 0.8974609375 }, { "start": 979.45, "end": 979.71, "word": " do", "probability": 0.8994140625 }, { "start": 979.71, "end": 980.33, "word": "?", "probability": 0.98486328125 } ] }, { "id": 170, "seek": 99385, "start": 980.33, "end": 996.55, "text": " We appended program segments of Qt.elf from a real device and redirected malloc and memcpy kernel functions used by Qt drivers to their user-mode implementation.", "tokens": [ 50364, 492, 724, 3502, 1461, 19904, 295, 1249, 83, 13, 338, 69, 490, 257, 957, 4302, 293, 29066, 292, 16026, 905, 293, 1334, 66, 8200, 28256, 6828, 1143, 538, 1249, 83, 11590, 281, 641, 4195, 12, 76, 1429, 11420, 13, 51164 ], "temperature": 0.0, "avg_logprob": -0.23278809268958867, "compression_ratio": 1.497142857142857, "no_speech_prob": 0.003452301025390625, "words": [ { "start": 980.33, "end": 980.65, "word": " We", "probability": 0.6494140625 }, { "start": 980.65, "end": 981.19, "word": " appended", "probability": 0.8388671875 }, { "start": 981.19, "end": 981.75, "word": " program", "probability": 0.6630859375 }, { "start": 981.75, "end": 982.47, "word": " segments", "probability": 0.7314453125 }, { "start": 982.47, "end": 983.07, "word": " of", "probability": 0.87255859375 }, { "start": 983.07, "end": 983.75, "word": " Qt", "probability": 0.6080322265625 }, { "start": 983.75, "end": 984.39, "word": ".elf", "probability": 0.3090413411458333 }, { "start": 984.39, "end": 984.81, "word": " from", "probability": 0.802734375 }, { "start": 985.13, "end": 985.43, "word": " a real", "probability": 0.87353515625 }, { "start": 985.43, "end": 986.13, "word": " device", "probability": 0.8896484375 }, { "start": 986.13, "end": 987.01, "word": " and", "probability": 0.5927734375 }, { "start": 987.01, "end": 988.51, "word": " redirected", "probability": 0.876953125 }, { "start": 988.51, "end": 989.03, "word": " malloc", "probability": 0.7578125 }, { "start": 989.03, "end": 989.51, "word": " and", "probability": 0.86376953125 }, { "start": 989.51, "end": 990.61, "word": " memcpy", "probability": 0.8577473958333334 }, { "start": 990.61, "end": 990.99, "word": " kernel", "probability": 0.64208984375 }, { "start": 990.99, "end": 991.69, "word": " functions", "probability": 0.82763671875 }, { "start": 991.69, "end": 992.35, "word": " used", "probability": 0.7705078125 }, { "start": 992.35, "end": 992.65, "word": " by", "probability": 0.8994140625 }, { "start": 992.65, "end": 992.95, "word": " Qt", "probability": 0.839111328125 }, { "start": 992.95, "end": 993.51, "word": " drivers", "probability": 0.673828125 }, { "start": 993.51, "end": 993.95, "word": " to", "probability": 0.900390625 }, { "start": 993.95, "end": 994.71, "word": " their", "probability": 0.8896484375 }, { "start": 994.71, "end": 995.09, "word": " user", "probability": 0.63623046875 }, { "start": 995.09, "end": 995.33, "word": "-mode", "probability": 0.5769449869791666 }, { "start": 995.33, "end": 996.03, "word": " implementation", "probability": 0.64306640625 }, { "start": 996.03, "end": 996.55, "word": ".", "probability": 0.92919921875 } ] }, { "id": 171, "seek": 99385, "start": 997.61, "end": 1006.73, "text": " Our simple QD exec program is responsible for calling the driver invocation function by its address.", "tokens": [ 51214, 2621, 2199, 1249, 35, 4454, 1461, 307, 6250, 337, 5141, 264, 6787, 1048, 27943, 2445, 538, 1080, 2985, 13, 51664 ], "temperature": 0.0, "avg_logprob": -0.23278809268958867, "compression_ratio": 1.497142857142857, "no_speech_prob": 0.003452301025390625, "words": [ { "start": 997.61, "end": 998.65, "word": " Our", "probability": 0.90771484375 }, { "start": 998.65, "end": 999.17, "word": " simple", "probability": 0.9072265625 }, { "start": 999.17, "end": 999.57, "word": " QD", "probability": 0.3985328674316406 }, { "start": 999.57, "end": 999.89, "word": " exec", "probability": 0.1964111328125 }, { "start": 999.89, "end": 1000.41, "word": " program", "probability": 0.7578125 }, { "start": 1000.41, "end": 1000.67, "word": " is", "probability": 0.904296875 }, { "start": 1000.67, "end": 1001.21, "word": " responsible", "probability": 0.81298828125 }, { "start": 1001.21, "end": 1001.61, "word": " for", "probability": 0.89501953125 }, { "start": 1001.61, "end": 1002.01, "word": " calling", "probability": 0.720703125 }, { "start": 1002.01, "end": 1003.47, "word": " the", "probability": 0.7294921875 }, { "start": 1003.47, "end": 1003.83, "word": " driver", "probability": 0.771484375 }, { "start": 1003.83, "end": 1004.35, "word": " invocation", "probability": 0.826904296875 }, { "start": 1004.35, "end": 1004.93, "word": " function", "probability": 0.85888671875 }, { "start": 1004.93, "end": 1005.37, "word": " by", "probability": 0.8916015625 }, { "start": 1005.37, "end": 1005.71, "word": " its", "probability": 0.76416015625 }, { "start": 1005.71, "end": 1006.21, "word": " address", "probability": 0.7470703125 }, { "start": 1006.21, "end": 1006.73, "word": ".", "probability": 0.9912109375 } ] }, { "id": 172, "seek": 101409, "start": 1008.83, "end": 1015.73, "text": " First of all, any failure in Qt drivers can be used to reboot the mobile device.", "tokens": [ 50414, 2386, 295, 439, 11, 604, 7763, 294, 1249, 83, 11590, 393, 312, 1143, 281, 33818, 264, 6013, 4302, 13, 50764 ], "temperature": 0.0, "avg_logprob": -0.195880680734461, "compression_ratio": 1.4206896551724137, "no_speech_prob": 0.00897216796875, "words": [ { "start": 1008.83, "end": 1009.57, "word": " First", "probability": 0.771484375 }, { "start": 1009.57, "end": 1009.75, "word": " of", "probability": 0.90576171875 }, { "start": 1009.75, "end": 1010.07, "word": " all", "probability": 0.8984375 }, { "start": 1010.07, "end": 1010.21, "word": ",", "probability": 0.85302734375 }, { "start": 1010.21, "end": 1010.45, "word": " any", "probability": 0.82470703125 }, { "start": 1010.45, "end": 1011.07, "word": " failure", "probability": 0.67529296875 }, { "start": 1011.07, "end": 1011.59, "word": " in", "probability": 0.88623046875 }, { "start": 1011.59, "end": 1012.17, "word": " Qt", "probability": 0.635009765625 }, { "start": 1012.17, "end": 1012.63, "word": " drivers", "probability": 0.54150390625 }, { "start": 1012.63, "end": 1012.97, "word": " can", "probability": 0.88427734375 }, { "start": 1012.97, "end": 1013.17, "word": " be", "probability": 0.90966796875 }, { "start": 1013.17, "end": 1013.41, "word": " used", "probability": 0.826171875 }, { "start": 1013.41, "end": 1013.61, "word": " to", "probability": 0.908203125 }, { "start": 1013.61, "end": 1013.99, "word": " reboot", "probability": 0.8515625 }, { "start": 1013.99, "end": 1014.29, "word": " the", "probability": 0.81298828125 }, { "start": 1014.29, "end": 1014.55, "word": " mobile", "probability": 0.78955078125 }, { "start": 1014.55, "end": 1014.99, "word": " device", "probability": 0.89404296875 }, { "start": 1014.99, "end": 1015.73, "word": ".", "probability": 0.896484375 } ] }, { "id": 173, "seek": 101409, "start": 1015.85, "end": 1026.97, "text": " For example, each of the lines of this code will cause a DSP panic and can be used for a denial-service attack on the device.", "tokens": [ 50814, 1171, 1365, 11, 1184, 295, 264, 3876, 295, 341, 3089, 486, 3082, 257, 15816, 47, 14783, 293, 393, 312, 1143, 337, 257, 28754, 12, 39279, 2690, 322, 264, 4302, 13, 51314 ], "temperature": 0.0, "avg_logprob": -0.195880680734461, "compression_ratio": 1.4206896551724137, "no_speech_prob": 0.00897216796875, "words": [ { "start": 1015.85, "end": 1015.99, "word": " For", "probability": 0.876953125 }, { "start": 1015.99, "end": 1016.41, "word": " example", "probability": 0.93603515625 }, { "start": 1016.41, "end": 1016.65, "word": ",", "probability": 0.94189453125 }, { "start": 1016.65, "end": 1016.99, "word": " each", "probability": 0.84619140625 }, { "start": 1016.99, "end": 1017.43, "word": " of", "probability": 0.875 }, { "start": 1017.43, "end": 1017.69, "word": " the", "probability": 0.80859375 }, { "start": 1017.69, "end": 1018.15, "word": " lines", "probability": 0.90673828125 }, { "start": 1018.15, "end": 1018.67, "word": " of", "probability": 0.87548828125 }, { "start": 1018.67, "end": 1019.47, "word": " this", "probability": 0.8291015625 }, { "start": 1019.47, "end": 1019.81, "word": " code", "probability": 0.7353515625 }, { "start": 1019.81, "end": 1020.33, "word": " will", "probability": 0.67236328125 }, { "start": 1020.33, "end": 1020.87, "word": " cause", "probability": 0.8203125 }, { "start": 1021.31, "end": 1021.57, "word": " a DSP", "probability": 0.785400390625 }, { "start": 1021.57, "end": 1022.03, "word": " panic", "probability": 0.8974609375 }, { "start": 1022.03, "end": 1022.79, "word": " and", "probability": 0.73828125 }, { "start": 1022.79, "end": 1023.05, "word": " can", "probability": 0.88916015625 }, { "start": 1023.05, "end": 1023.27, "word": " be", "probability": 0.90478515625 }, { "start": 1023.27, "end": 1023.65, "word": " used", "probability": 0.8115234375 }, { "start": 1023.65, "end": 1024.05, "word": " for", "probability": 0.88818359375 }, { "start": 1024.29, "end": 1024.53, "word": " a denial", "probability": 0.4775390625 }, { "start": 1024.53, "end": 1024.97, "word": "-service", "probability": 0.445556640625 }, { "start": 1024.97, "end": 1025.47, "word": " attack", "probability": 0.81494140625 }, { "start": 1025.47, "end": 1025.75, "word": " on", "probability": 0.89501953125 }, { "start": 1025.75, "end": 1025.87, "word": " the", "probability": 0.73876953125 }, { "start": 1025.87, "end": 1026.23, "word": " device", "probability": 0.91064453125 }, { "start": 1026.23, "end": 1026.97, "word": ".", "probability": 0.982421875 } ] }, { "id": 174, "seek": 103927, "start": 1026.97, "end": 1034.81, "text": " For research purposes, we exploited one of the discovered vulnerabilities in glink-qt-driver.", "tokens": [ 50364, 1171, 2132, 9932, 11, 321, 40918, 472, 295, 264, 6941, 37633, 294, 1563, 475, 12, 80, 83, 12, 23609, 13, 50714 ], "temperature": 0.0, "avg_logprob": -0.28370535927159446, "compression_ratio": 1.4083769633507854, "no_speech_prob": 0.032989501953125, "words": [ { "start": 1026.97, "end": 1028.21, "word": " For", "probability": 0.85302734375 }, { "start": 1028.21, "end": 1028.59, "word": " research", "probability": 0.7744140625 }, { "start": 1028.59, "end": 1029.07, "word": " purposes", "probability": 0.8642578125 }, { "start": 1029.07, "end": 1029.43, "word": ",", "probability": 0.80078125 }, { "start": 1029.43, "end": 1029.53, "word": " we", "probability": 0.89892578125 }, { "start": 1029.53, "end": 1030.11, "word": " exploited", "probability": 0.74365234375 }, { "start": 1030.11, "end": 1030.63, "word": " one", "probability": 0.81640625 }, { "start": 1030.63, "end": 1030.99, "word": " of", "probability": 0.90234375 }, { "start": 1030.99, "end": 1031.09, "word": " the", "probability": 0.24267578125 }, { "start": 1031.09, "end": 1031.45, "word": " discovered", "probability": 0.55859375 }, { "start": 1031.45, "end": 1032.21, "word": " vulnerabilities", "probability": 0.79931640625 }, { "start": 1032.21, "end": 1032.67, "word": " in", "probability": 0.87744140625 }, { "start": 1032.67, "end": 1033.33, "word": " glink", "probability": 0.447418212890625 }, { "start": 1033.33, "end": 1033.67, "word": "-qt", "probability": 0.3623453776041667 }, { "start": 1033.67, "end": 1034.05, "word": "-driver", "probability": 0.715087890625 }, { "start": 1034.05, "end": 1034.81, "word": ".", "probability": 0.82666015625 } ] }, { "id": 175, "seek": 103927, "start": 1034.87, "end": 1045.17, "text": " Along with the user-pd exploit, it allows us to run a custom code in the context of the guest OS protection memory.", "tokens": [ 50764, 17457, 365, 264, 4195, 12, 79, 67, 25924, 11, 309, 4045, 505, 281, 1190, 257, 2375, 3089, 294, 264, 4319, 295, 264, 8341, 12731, 1742, 10183, 4675, 13, 51264 ], "temperature": 0.0, "avg_logprob": -0.28370535927159446, "compression_ratio": 1.4083769633507854, "no_speech_prob": 0.032989501953125, "words": [ { "start": 1034.87, "end": 1035.45, "word": " Along", "probability": 0.8212890625 }, { "start": 1035.45, "end": 1035.85, "word": " with", "probability": 0.8056640625 }, { "start": 1035.85, "end": 1036.43, "word": " the", "probability": 0.64404296875 }, { "start": 1036.43, "end": 1036.73, "word": " user", "probability": 0.46875 }, { "start": 1036.73, "end": 1037.07, "word": "-pd", "probability": 0.5555826822916666 }, { "start": 1037.07, "end": 1037.71, "word": " exploit", "probability": 0.7734375 }, { "start": 1037.71, "end": 1038.23, "word": ",", "probability": 0.92236328125 }, { "start": 1038.23, "end": 1038.47, "word": " it", "probability": 0.88671875 }, { "start": 1038.47, "end": 1039.07, "word": " allows", "probability": 0.77294921875 }, { "start": 1039.07, "end": 1039.49, "word": " us", "probability": 0.89208984375 }, { "start": 1039.49, "end": 1039.71, "word": " to", "probability": 0.90234375 }, { "start": 1039.71, "end": 1039.97, "word": " run", "probability": 0.89697265625 }, { "start": 1040.23, "end": 1040.65, "word": " a custom", "probability": 0.75244140625 }, { "start": 1040.65, "end": 1041.15, "word": " code", "probability": 0.73828125 }, { "start": 1041.15, "end": 1041.41, "word": " in", "probability": 0.875 }, { "start": 1041.41, "end": 1041.61, "word": " the", "probability": 0.8125 }, { "start": 1041.61, "end": 1042.09, "word": " context", "probability": 0.77685546875 }, { "start": 1042.09, "end": 1042.47, "word": " of", "probability": 0.90966796875 }, { "start": 1042.47, "end": 1042.71, "word": " the", "probability": 0.78369140625 }, { "start": 1042.71, "end": 1043.03, "word": " guest", "probability": 0.80615234375 }, { "start": 1043.03, "end": 1043.47, "word": " OS", "probability": 0.69677734375 }, { "start": 1043.47, "end": 1044.11, "word": " protection", "probability": 0.6494140625 }, { "start": 1044.11, "end": 1044.41, "word": " memory", "probability": 0.260986328125 }, { "start": 1044.41, "end": 1045.17, "word": ".", "probability": 0.9892578125 } ] }, { "id": 176, "seek": 103927, "start": 1047.19, "end": 1052.15, "text": " Now I'll show a simple demo to prove the full attack chain.", "tokens": [ 51314, 823, 286, 603, 855, 257, 2199, 10723, 281, 7081, 264, 1577, 2690, 5021, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.28370535927159446, "compression_ratio": 1.4083769633507854, "no_speech_prob": 0.032989501953125, "words": [ { "start": 1047.19, "end": 1047.95, "word": " Now", "probability": 0.80126953125 }, { "start": 1047.95, "end": 1048.31, "word": " I'll", "probability": 0.698974609375 }, { "start": 1048.31, "end": 1048.57, "word": " show", "probability": 0.865234375 }, { "start": 1048.75, "end": 1049.01, "word": " a simple", "probability": 0.89453125 }, { "start": 1049.01, "end": 1049.45, "word": " demo", "probability": 0.7275390625 }, { "start": 1049.45, "end": 1049.85, "word": " to", "probability": 0.88232421875 }, { "start": 1049.85, "end": 1050.23, "word": " prove", "probability": 0.802734375 }, { "start": 1050.23, "end": 1050.43, "word": " the", "probability": 0.79541015625 }, { "start": 1050.43, "end": 1050.65, "word": " full", "probability": 0.8291015625 }, { "start": 1050.65, "end": 1051.03, "word": " attack", "probability": 0.7001953125 }, { "start": 1051.03, "end": 1051.39, "word": " chain", "probability": 0.83740234375 }, { "start": 1051.39, "end": 1052.15, "word": ".", "probability": 0.951171875 } ] }, { "id": 177, "seek": 106451, "start": 1052.15, "end": 1060.37, "text": " The payload will return a DSP internal data inaccessible from application processor.", "tokens": [ 50364, 440, 30918, 486, 2736, 257, 15816, 47, 6920, 1412, 33230, 780, 964, 490, 3861, 15321, 13, 50714 ], "temperature": 0.0, "avg_logprob": -0.268181819265539, "compression_ratio": 1.3272727272727274, "no_speech_prob": 0.0162506103515625, "words": [ { "start": 1052.15, "end": 1052.67, "word": " The", "probability": 0.5615234375 }, { "start": 1052.67, "end": 1053.27, "word": " payload", "probability": 0.88720703125 }, { "start": 1053.27, "end": 1053.77, "word": " will", "probability": 0.8017578125 }, { "start": 1053.77, "end": 1054.27, "word": " return", "probability": 0.71875 }, { "start": 1054.93, "end": 1055.35, "word": " a DSP", "probability": 0.6741943359375 }, { "start": 1055.35, "end": 1056.07, "word": " internal", "probability": 0.74853515625 }, { "start": 1056.07, "end": 1057.05, "word": " data", "probability": 0.81396484375 }, { "start": 1057.05, "end": 1057.97, "word": " inaccessible", "probability": 0.9064127604166666 }, { "start": 1057.97, "end": 1058.41, "word": " from", "probability": 0.7880859375 }, { "start": 1058.41, "end": 1059.03, "word": " application", "probability": 0.5439453125 }, { "start": 1059.03, "end": 1059.59, "word": " processor", "probability": 0.5908203125 }, { "start": 1059.59, "end": 1060.37, "word": ".", "probability": 0.75048828125 } ] }, { "id": 178, "seek": 106451, "start": 1060.37, "end": 1063.51, "text": " The device is a Pixel 4.", "tokens": [ 50764, 440, 4302, 307, 257, 28323, 1017, 13, 50914 ], "temperature": 0.0, "avg_logprob": -0.268181819265539, "compression_ratio": 1.3272727272727274, "no_speech_prob": 0.0162506103515625, "words": [ { "start": 1060.37, "end": 1060.51, "word": " The", "probability": 0.79931640625 }, { "start": 1060.51, "end": 1060.99, "word": " device", "probability": 0.9140625 }, { "start": 1060.99, "end": 1061.29, "word": " is", "probability": 0.8984375 }, { "start": 1061.57, "end": 1061.97, "word": " a Pixel", "probability": 0.6103515625 }, { "start": 1061.97, "end": 1062.51, "word": " 4", "probability": 0.9228515625 }, { "start": 1062.51, "end": 1063.51, "word": ".", "probability": 0.9072265625 } ] }, { "id": 179, "seek": 106451, "start": 1076.51, "end": 1089.79, "text": " Here you can see that using a DB shell, I'm executing some tool which can be used by any Android application.", "tokens": [ 50964, 1692, 291, 393, 536, 300, 1228, 257, 26754, 8720, 11, 286, 478, 32368, 512, 2290, 597, 393, 312, 1143, 538, 604, 8853, 3861, 13, 51564 ], "temperature": 0.0, "avg_logprob": -0.268181819265539, "compression_ratio": 1.3272727272727274, "no_speech_prob": 0.0162506103515625, "words": [ { "start": 1076.51, "end": 1076.93, "word": " Here", "probability": 0.7392578125 }, { "start": 1076.93, "end": 1077.07, "word": " you", "probability": 0.8046875 }, { "start": 1077.07, "end": 1077.25, "word": " can", "probability": 0.8916015625 }, { "start": 1077.25, "end": 1077.49, "word": " see", "probability": 0.81005859375 }, { "start": 1077.49, "end": 1077.83, "word": " that", "probability": 0.82470703125 }, { "start": 1077.83, "end": 1078.49, "word": " using", "probability": 0.7607421875 }, { "start": 1078.69, "end": 1078.87, "word": " a DB", "probability": 0.62353515625 }, { "start": 1078.87, "end": 1079.35, "word": " shell", "probability": 0.405517578125 }, { "start": 1079.35, "end": 1080.53, "word": ",", "probability": 0.5126953125 }, { "start": 1080.53, "end": 1081.25, "word": " I'm", "probability": 0.875732421875 }, { "start": 1081.25, "end": 1082.11, "word": " executing", "probability": 0.59228515625 }, { "start": 1082.11, "end": 1082.67, "word": " some", "probability": 0.794921875 }, { "start": 1082.67, "end": 1083.11, "word": " tool", "probability": 0.8076171875 }, { "start": 1083.11, "end": 1086.09, "word": " which", "probability": 0.494384765625 }, { "start": 1086.09, "end": 1086.29, "word": " can", "probability": 0.89501953125 }, { "start": 1086.29, "end": 1086.45, "word": " be", "probability": 0.9111328125 }, { "start": 1086.45, "end": 1086.67, "word": " used", "probability": 0.82470703125 }, { "start": 1086.67, "end": 1086.99, "word": " by", "probability": 0.89697265625 }, { "start": 1086.99, "end": 1087.93, "word": " any", "probability": 0.81640625 }, { "start": 1087.93, "end": 1088.35, "word": " Android", "probability": 0.86767578125 }, { "start": 1088.35, "end": 1089.01, "word": " application", "probability": 0.77685546875 }, { "start": 1089.01, "end": 1089.79, "word": ".", "probability": 0.4619140625 } ] }, { "id": 180, "seek": 108469, "start": 1089.79, "end": 1100.59, "text": " This tool will trigger chain of vulnerabilities and return some inaccessible from application processor data.", "tokens": [ 50364, 639, 2290, 486, 7875, 5021, 295, 37633, 293, 2736, 512, 33230, 780, 964, 490, 3861, 15321, 1412, 13, 50864 ], "temperature": 0.0, "avg_logprob": -0.3356481586341505, "compression_ratio": 1.3312883435582823, "no_speech_prob": 0.0090179443359375, "words": [ { "start": 1089.79, "end": 1090.83, "word": " This", "probability": 0.10723876953125 }, { "start": 1090.83, "end": 1091.17, "word": " tool", "probability": 0.845703125 }, { "start": 1091.17, "end": 1091.39, "word": " will", "probability": 0.74755859375 }, { "start": 1091.39, "end": 1091.77, "word": " trigger", "probability": 0.5068359375 }, { "start": 1091.77, "end": 1092.33, "word": " chain", "probability": 0.277587890625 }, { "start": 1092.33, "end": 1092.51, "word": " of", "probability": 0.25341796875 }, { "start": 1092.51, "end": 1093.07, "word": " vulnerabilities", "probability": 0.80419921875 }, { "start": 1093.07, "end": 1093.67, "word": " and", "probability": 0.7734375 }, { "start": 1093.67, "end": 1094.93, "word": " return", "probability": 0.337158203125 }, { "start": 1094.93, "end": 1096.59, "word": " some", "probability": 0.78564453125 }, { "start": 1096.59, "end": 1097.55, "word": " inaccessible", "probability": 0.9396158854166666 }, { "start": 1097.55, "end": 1098.49, "word": " from", "probability": 0.4619140625 }, { "start": 1098.49, "end": 1099.05, "word": " application", "probability": 0.72900390625 }, { "start": 1099.05, "end": 1099.51, "word": " processor", "probability": 0.38671875 }, { "start": 1099.51, "end": 1099.99, "word": " data", "probability": 0.7900390625 }, { "start": 1099.99, "end": 1100.59, "word": ".", "probability": 0.2137451171875 } ] }, { "id": 181, "seek": 108469, "start": 1100.59, "end": 1104.15, "text": " For example, Qt OS data signal.", "tokens": [ 50914, 1171, 1365, 11, 1249, 83, 12731, 1412, 6358, 13, 51064 ], "temperature": 0.0, "avg_logprob": -0.3356481586341505, "compression_ratio": 1.3312883435582823, "no_speech_prob": 0.0090179443359375, "words": [ { "start": 1100.59, "end": 1101.29, "word": " For", "probability": 0.63232421875 }, { "start": 1101.29, "end": 1101.79, "word": " example", "probability": 0.92626953125 }, { "start": 1101.79, "end": 1102.55, "word": ",", "probability": 0.80322265625 }, { "start": 1102.55, "end": 1102.91, "word": " Qt", "probability": 0.4278564453125 }, { "start": 1102.91, "end": 1103.13, "word": " OS", "probability": 0.1610107421875 }, { "start": 1103.13, "end": 1103.39, "word": " data", "probability": 0.669921875 }, { "start": 1103.39, "end": 1103.75, "word": " signal", "probability": 0.316650390625 }, { "start": 1103.75, "end": 1104.15, "word": ".", "probability": 0.88916015625 } ] }, { "id": 182, "seek": 108469, "start": 1104.33, "end": 1109.97, "text": " After that, I'm going to control the phone and, for example, I just reboot.", "tokens": [ 51114, 2381, 300, 11, 286, 478, 516, 281, 1969, 264, 2593, 293, 11, 337, 1365, 11, 286, 445, 33818, 13, 51364 ], "temperature": 0.0, "avg_logprob": -0.3356481586341505, "compression_ratio": 1.3312883435582823, "no_speech_prob": 0.0090179443359375, "words": [ { "start": 1104.33, "end": 1104.75, "word": " After", "probability": 0.372314453125 }, { "start": 1104.75, "end": 1105.05, "word": " that", "probability": 0.87451171875 }, { "start": 1105.05, "end": 1105.13, "word": ",", "probability": 0.60498046875 }, { "start": 1105.13, "end": 1105.43, "word": " I'm", "probability": 0.7310791015625 }, { "start": 1105.43, "end": 1105.63, "word": " going", "probability": 0.85986328125 }, { "start": 1105.63, "end": 1105.85, "word": " to", "probability": 0.90283203125 }, { "start": 1105.85, "end": 1106.25, "word": " control", "probability": 0.64599609375 }, { "start": 1106.25, "end": 1107.05, "word": " the", "probability": 0.8046875 }, { "start": 1107.05, "end": 1107.35, "word": " phone", "probability": 0.86083984375 }, { "start": 1107.35, "end": 1107.67, "word": " and", "probability": 0.368408203125 }, { "start": 1107.67, "end": 1107.83, "word": ",", "probability": 0.29638671875 }, { "start": 1107.83, "end": 1107.89, "word": " for", "probability": 0.88623046875 }, { "start": 1107.89, "end": 1108.19, "word": " example", "probability": 0.93017578125 }, { "start": 1108.19, "end": 1108.37, "word": ",", "probability": 0.98486328125 }, { "start": 1108.37, "end": 1108.57, "word": " I", "probability": 0.974609375 }, { "start": 1108.57, "end": 1108.97, "word": " just", "probability": 0.8662109375 }, { "start": 1108.97, "end": 1109.57, "word": " reboot", "probability": 0.880859375 }, { "start": 1109.57, "end": 1109.97, "word": ".", "probability": 0.912109375 } ] }, { "id": 183, "seek": 111223, "start": 1119.64, "end": 1131.58, "text": " Instead of a conclusion, I just want to note that hexagon ADSP and CDSP subsystem are very promising areas for security research.", "tokens": [ 50414, 7156, 295, 257, 10063, 11, 286, 445, 528, 281, 3637, 300, 23291, 6709, 9135, 27921, 293, 6743, 27921, 2090, 9321, 366, 588, 20257, 3179, 337, 3825, 2132, 13, 50964 ], "temperature": 0.0, "avg_logprob": -0.2247596153846154, "compression_ratio": 1.4921465968586387, "no_speech_prob": 0.00640106201171875, "words": [ { "start": 1119.64, "end": 1120.22, "word": " Instead", "probability": 0.1864013671875 }, { "start": 1120.22, "end": 1121.38, "word": " of", "probability": 0.89990234375 }, { "start": 1121.5, "end": 1121.98, "word": " a conclusion", "probability": 0.8427734375 }, { "start": 1121.98, "end": 1122.32, "word": ",", "probability": 0.73828125 }, { "start": 1122.32, "end": 1122.42, "word": " I", "probability": 0.990234375 }, { "start": 1122.42, "end": 1122.74, "word": " just", "probability": 0.8671875 }, { "start": 1122.74, "end": 1123.06, "word": " want", "probability": 0.81396484375 }, { "start": 1123.06, "end": 1123.22, "word": " to", "probability": 0.8984375 }, { "start": 1123.22, "end": 1123.6, "word": " note", "probability": 0.6767578125 }, { "start": 1123.6, "end": 1123.96, "word": " that", "probability": 0.84033203125 }, { "start": 1123.96, "end": 1124.74, "word": " hexagon", "probability": 0.588134765625 }, { "start": 1124.74, "end": 1125.48, "word": " ADSP", "probability": 0.783447265625 }, { "start": 1125.48, "end": 1125.92, "word": " and", "probability": 0.88037109375 }, { "start": 1125.92, "end": 1126.46, "word": " CDSP", "probability": 0.86376953125 }, { "start": 1126.46, "end": 1127.16, "word": " subsystem", "probability": 0.927001953125 }, { "start": 1127.16, "end": 1127.5, "word": " are", "probability": 0.56982421875 }, { "start": 1127.5, "end": 1127.94, "word": " very", "probability": 0.732421875 }, { "start": 1127.94, "end": 1128.5, "word": " promising", "probability": 0.85302734375 }, { "start": 1128.5, "end": 1129.14, "word": " areas", "probability": 0.88330078125 }, { "start": 1129.14, "end": 1129.8, "word": " for", "probability": 0.8876953125 }, { "start": 1129.8, "end": 1130.3, "word": " security", "probability": 0.91357421875 }, { "start": 1130.3, "end": 1130.78, "word": " research", "probability": 0.66552734375 }, { "start": 1130.78, "end": 1131.58, "word": ".", "probability": 0.935546875 } ] }, { "id": 184, "seek": 111223, "start": 1131.58, "end": 1141.9, "text": " The DSP is accessible from Android application, has access to interesting data for an attacker, and has many security issues.", "tokens": [ 51014, 440, 15816, 47, 307, 9515, 490, 8853, 3861, 11, 575, 2105, 281, 1880, 1412, 337, 364, 35871, 11, 293, 575, 867, 3825, 2663, 13, 51514 ], "temperature": 0.0, "avg_logprob": -0.2247596153846154, "compression_ratio": 1.4921465968586387, "no_speech_prob": 0.00640106201171875, "words": [ { "start": 1131.58, "end": 1131.72, "word": " The", "probability": 0.81884765625 }, { "start": 1131.72, "end": 1132.12, "word": " DSP", "probability": 0.884033203125 }, { "start": 1132.12, "end": 1132.5, "word": " is", "probability": 0.90283203125 }, { "start": 1132.5, "end": 1133.4, "word": " accessible", "probability": 0.87060546875 }, { "start": 1133.4, "end": 1133.76, "word": " from", "probability": 0.81005859375 }, { "start": 1133.76, "end": 1134.14, "word": " Android", "probability": 0.75 }, { "start": 1134.14, "end": 1134.78, "word": " application", "probability": 0.57958984375 }, { "start": 1134.78, "end": 1135.42, "word": ",", "probability": 0.875 }, { "start": 1135.42, "end": 1135.62, "word": " has", "probability": 0.89453125 }, { "start": 1135.62, "end": 1136.22, "word": " access", "probability": 0.75390625 }, { "start": 1136.22, "end": 1136.58, "word": " to", "probability": 0.9033203125 }, { "start": 1136.58, "end": 1137.3, "word": " interesting", "probability": 0.65478515625 }, { "start": 1137.3, "end": 1137.84, "word": " data", "probability": 0.8330078125 }, { "start": 1137.84, "end": 1138.12, "word": " for", "probability": 0.86865234375 }, { "start": 1138.12, "end": 1138.26, "word": " an", "probability": 0.88671875 }, { "start": 1138.26, "end": 1138.62, "word": " attacker", "probability": 0.7919921875 }, { "start": 1138.62, "end": 1139.1, "word": ",", "probability": 0.5341796875 }, { "start": 1139.1, "end": 1139.24, "word": " and", "probability": 0.89794921875 }, { "start": 1139.24, "end": 1139.56, "word": " has", "probability": 0.89208984375 }, { "start": 1139.56, "end": 1140.18, "word": " many", "probability": 0.81396484375 }, { "start": 1140.18, "end": 1140.84, "word": " security", "probability": 0.908203125 }, { "start": 1140.84, "end": 1141.46, "word": " issues", "probability": 0.6318359375 }, { "start": 1141.46, "end": 1141.9, "word": ".", "probability": 0.98095703125 } ] }, { "id": 185, "seek": 111223, "start": 1143.5, "end": 1145.56, "text": " Thank you for your attention.", "tokens": [ 51564, 1044, 291, 337, 428, 3202, 13, 51714 ], "temperature": 0.0, "avg_logprob": -0.2247596153846154, "compression_ratio": 1.4921465968586387, "no_speech_prob": 0.00640106201171875, "words": [ { "start": 1143.5, "end": 1144.38, "word": " Thank", "probability": 0.88134765625 }, { "start": 1144.38, "end": 1144.48, "word": " you", "probability": 0.892578125 }, { "start": 1144.48, "end": 1144.6, "word": " for", "probability": 0.89501953125 }, { "start": 1144.6, "end": 1144.78, "word": " your", "probability": 0.81005859375 }, { "start": 1144.78, "end": 1145.16, "word": " attention", "probability": 0.8759765625 }, { "start": 1145.16, "end": 1145.56, "word": ".", "probability": 0.8388671875 } ] } ], "text": " Hello everyone. Thank you for attending this talk. I'm Slava. I'm a security researcher at CheckPoint. Security research is my daily work. Today I'm going to show how an Android application can attack the digital signal processor of a mobile device and thereby gain privileges and denial-of-service capabilities. Let's begin with a question. Do you know how many processors are on your mobile phone? The answer is many. As a single Snapdragon system on a chip embedded in Pixel, Samsung, Xiaomi, LG, OnePlus, Sony and other devices may include multiple CPU cores, an Adreno graphic processor unit, a Snapdragon wireless module, a Hexagon digital signal processor, and Spectro image signal processor. Snapdragon product tiers are differentiated by scalable computing resources for the CPU, GPU and DSP. The lowest tiers might contain only a single Hexagon DSP, whereas the premium tier contains up to four Hexagon DSP processors dedicated for specific use cases. These are modem DSP, known as baseband audio DSP, compute DSP, and sensor DSP. In this research, I turned my attention to ADSP and CDSP subsystems. ADSP and CDSP processors are intended for such cool tasks as processing of audio and voice data, computer vision, machine learning calculations, camera streaming, artificial intelligence, etc. On some devices, such as the Sony Xperia XZ, only the ADSP processor is responsible for all these tasks. But on other devices, such as the Pixel 4, these tasks are shared between ADSP and CDSP. Let's take a look at the communication scheme between an Android application and a DSP running library. FasterPC is a Qualcomm proprietary RPC mechanism used to enable remote code function calls between application processor, where Android is run, and DSP. On Android side, user mode process initiates the remote invocation. In our case, an Android application calls one of the stub functions in its native code. Stub is auto-generated code that converts the function call to an RPC message. Generally, the stub code is compiled as a separate native library. The stub code loads libADSP-RPCSO and libCDSP-RPCSO built-in libraries to invoke Android drivers. DSP-RPC drivers send the queued message to the DSP side through the shared memory channel, and then wait for the response. On DSP side, a framework presented by the FasterPC shell binary dequeues the messages and dispatches them for processing by a skeleton. And again, skeleton is auto-generated library that unmashes parameters and calls the target method in the object library. The object library is some logic provided by Qualcomm or OEMs and designed to run on a DSP. Who can run their own code on DSP? Any third-party developer can implement its own DSP library. Because the Hexagon SDK, which is responsible for compiling C++ code into Hexagon bytecode, is publicly available. But it's impossible to run a third-party library on DSP. For security reasons, DSP is licensed for programming by OEMs and code running on the DSP is signed by Qualcomm. Who manages the DSP? It's Qt, a Qualcomm proprietary multi-threaded real-time operating system. Integrity of the Qt is trusted by the trust zone. Qt executable binary, different for ADSP and CDSP, is assigned and split into several files in the same way as any other trusted application on Qualcomm devices. For each Android process initiating the remote invocation, Qt creates a separate faster PC shell process on the DSP. The DSP architecture provides different protection domains, PD. Kernel PD has access to all memory of all domains. Guest OS PD has access to the memory of its own PD and memory of the user PD and some system registers. User PD has access only to its own memory. Skeleton and object libraries, as well as the fast RPC shell, are running in the user PD. The stub code provided by Qualcomm or OEMs can be skipped from the fast RPC chain. As was mentioned, libADSP-RPC and libCDSP-RPC libraries are responsible for communication with DSP-RPC drivers. Each library exports two major functions. Remote handle open function opens a remote session between the client on application processor and new fast RPC shell process on the DSP. The skeleton library name is provided as the first argument. Remote handle invoke function is able to invoke methods exported by the skeleton library. Using these two functions, an Android application can request to execute any skeleton method without using a stub code. Now we have enough information to state the downgrade vulnerability. DSP libraries are signed and cannot be patched. However, any Android application can bring a signed by Qualcomm skeleton library in its assets and then open a remote session. The library will be successfully loaded on the DSP because its signature is correct. The fact that there is no version check of loading skeleton libraries opens the possibility to run a very old skeleton lib with known one-day vulnerabilities on the DSP. Even if the patched skeleton library already exists on the device, it is possible to load the old version of this library. Any DSP code fix can be simply bypassed by an attacker. Due to the lack of leads of the skeleton libraries permitted for the device, it is possible to run a library intended for one device, for example, Chinese Xiaomi, on any other device, for example, Samsung. This means that a vulnerability discovered in one of OEM libraries compromises all Snapdragon-based Android devices. The major goal of the research was to find a way to execute custom code on a DSP bypassing Qualcomm's signature. To do so, we had to discover and exploit a vulnerability in a DSP-running library. DSP libraries are proprietary hexagon ELFs. The easiest way to instrument a hexagon executable is to use the open-source QUIC emulator, QEMU. Hexagon instruction set support was added in QEMU only in the end of 2019. We fixed a lot of bugs to be able to run real DSP libraries in the user mode of the emulator. To fast leaps on Ubuntu PC, we used American Fuzzy Loop, AFL, in combination with QEMU. A skeleton library is primarily a library, and we had to prepare a simple program, a scale loader, that loads and invokes the one. Moreover, most skeleton libraries widely use DSP framework and system calls. Our simple program cannot handle such requests. Therefore, we had to load the cured OS on the emulator before execution of the REST call. The easiest way to do so is not to use a real cured OS, but its light version, Run-ELF-PBM, adopted by Qualcomm for execution on a hexagon simulator, and included in the hexagon SDK. That's it. The IFR permutates the content of a data file and triggers execution of Run-ELF-PBM on the emulator. QEMU returns the code coverage matrix to the AFL after execution of the test case. On this slide, you can see the data format that we used to fuzz skeleton libraries. The first word is the second argument of the remote handle invoke function. The index on the invoked method, number of input and number of output arguments are encoded there. Next several words we take as the size of arguments, then we expect to see a value of input arguments. We were surprised by the fuzzing result. Crashes were found in all DSP libraries that we choose to fuzz. Besides, most issues were discovered exactly in skeleton libraries. This means that hexagon SDK reduces vulnerable code. Hexagon SDK automatically generates stub and scale code for marshalling and unmarshalling of function arguments. Let's take a look at an example of such code. Stub and scale code based on interface definition language modus, IDL modus, prepared by the developer. Here you can see an example of the IDL declaration of two functions in the neural network library, HexagonNN. A vulnerable code will be generated for both of them. HexagonNN SMP print function passes an input-output buffer argument to the DSP. In the stub code this buffer will be split into two separate buffers, the input and the output. The value of the buffer length will also be duplicated and therefore serialized twice. The scale function copies the input of the output buffer before calling an objects function. The size of data to be copied is one of the transmitted buffer lengths. An attacker controls this value. All verification checks can simply be bypassed by using a negative input buffer length. Typecasting to the signed int type on checking buffer boundaries is a bug leading to heap overflow. To summarize, the automatically generated code injects vulnerabilities into the libraries of Qualcomm, OEMs and all other third-party developers who use the Hexagon SDK. Dozens of DSP skeleton libraries pre-installed on Android smartphones are vulnerable due to serious bugs in the SDK. So, we discovered many vulnerabilities. Let's exploit one of them. LibFastCV, a DSP-scale SO library, can be found on most Android devices. In this example, I used the lib extracted from the Sony Xperia XZ Premium device. A malicious Android application can cause this lib to crash by providing crafted arguments to the remote handling function. The 3F method allows us to read and write everything that we want within the other space of the DSP process. It's enough to implement an exploit and execute an unsigned payload in the user protection domain. Ok, we got code execution. What can we do with it? We can crash the DSP, we can hide malicious code, we can try to access camera sensors and more. Besides, now we can communicate with secured drivers. The next step of the research is to attack the Qt-privileged domains from the user protection domain. And Qt drivers are the entry points for this. QtOS implements its own device driver model, named Qt Driver Invocation, QD. Like POSIX, Qt device drivers operate with higher privileges than user code. Dozens of Qt drivers can be found in the Qt binary. libQtA library, which is part of Hexagon SDK, contains the Qt infrastructure. FasterPC shell is linked statically with the library. QD provides a simple driver invocation API with the ability to access a device driver based only on the driver name. Actually, only Qt QD handle invoke macro is the necessary user visible API. It's responsible for all generic driver operations. The Qt QD open is just a special case of this macro. To fuzz Qt drivers on Ubuntu PC, we use the same combination of Hexagon QMU and AFM, as for fuzzing of user-mode DSP libraries. Qt drivers were not included by Qualcomm in the run.elf.pdn version of Qt. Therefore, we had to patch the run.elf file. What did we do? We appended program segments of Qt.elf from a real device and redirected malloc and memcpy kernel functions used by Qt drivers to their user-mode implementation. Our simple QD exec program is responsible for calling the driver invocation function by its address. First of all, any failure in Qt drivers can be used to reboot the mobile device. For example, each of the lines of this code will cause a DSP panic and can be used for a denial-service attack on the device. For research purposes, we exploited one of the discovered vulnerabilities in glink-qt-driver. Along with the user-pd exploit, it allows us to run a custom code in the context of the guest OS protection memory. Now I'll show a simple demo to prove the full attack chain. The payload will return a DSP internal data inaccessible from application processor. The device is a Pixel 4. Here you can see that using a DB shell, I'm executing some tool which can be used by any Android application. This tool will trigger chain of vulnerabilities and return some inaccessible from application processor data. For example, Qt OS data signal. After that, I'm going to control the phone and, for example, I just reboot. Instead of a conclusion, I just want to note that hexagon ADSP and CDSP subsystem are very promising areas for security research. The DSP is accessible from Android application, has access to interesting data for an attacker, and has many security issues. Thank you for your attention." }