{"id":17921530,"url":"https://github.com/theopolis/smc-fuzzer","last_synced_at":"2026-02-28T09:32:32.643Z","repository":{"id":55523175,"uuid":"48020159","full_name":"theopolis/smc-fuzzer","owner":"theopolis","description":"Apple SMC (System Management Controller) API fuzzer","archived":false,"fork":false,"pushed_at":"2024-08-19T19:31:37.000Z","size":30,"stargazers_count":68,"open_issues_count":3,"forks_count":15,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-08T06:17:15.279Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/theopolis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-12-15T04:46:28.000Z","updated_at":"2024-08-19T19:31:43.000Z","dependencies_parsed_at":"2024-10-28T20:47:47.600Z","dependency_job_id":null,"html_url":"https://github.com/theopolis/smc-fuzzer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/theopolis/smc-fuzzer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fsmc-fuzzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fsmc-fuzzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fsmc-fuzzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fsmc-fuzzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/theopolis","download_url":"https://codeload.github.com/theopolis/smc-fuzzer/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fsmc-fuzzer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29929350,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-27T19:37:42.220Z","status":"online","status_checked_at":"2026-02-28T02:00:07.010Z","response_time":90,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T20:34:36.092Z","updated_at":"2026-02-28T09:32:32.609Z","avatar_url":"https://github.com/theopolis.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"## SMC Fuzzer\n\n*devnull*'s SMC read/write code, along with simple fuzz options.\n\nThis `smc` tool uses the `AppleSMC` IOKit interface and a userland API\nfor interacting with the System Management Controller (Mac embedded controllers).\nThe tool focuses on the SMC key/value API, but could be expanded to more API methods.\n\n### Help / Usage\n\n```\n$ ./smc -h\nApple System Management Control (SMC) tool 1.01\nUsage:\n./smc [options]\n    -c \u003cspell\u003e : cast a spell\n    -q         : attempt to discover 'hidden' keys\n    -z         : fuzz all possible keys (or one key using -k)\n    -f         : fan info decoded\n    -h         : help\n    -k \u003ckey\u003e   : key to manipulate\n    -l         : list all keys and values\n    -r         : read the value of a key\n    -w \u003cvalue\u003e : write the specified value to a key\n    -v         : version\n ```\n\n### Discover unreported keys\n\nUse the `-q` switch to brute force discover ((125-33)^4) readable keys.\n\n#### Results\n\nOn a few Mac Pros this has found:\n\n```\n  CRDP  [flag]  (bytes 00)\n  FPOR  [ch8*]  (bytes 00 00 00 00 00 00 00 00)\n  KPPW  [ch8*]  (bytes 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)\n  KPST  [ui8 ]  0 (bytes 00)\n  MOJO  [ch8*]  (bytes 00)\n  MSSN  [ui16]  5 (bytes 05)\n  OSK0  [ch8*]\n  OSK1  [ch8*]\n  zCRS  [ui8 ]  (bytes 00)\n```\n\n`OSK0` and `OSK1` are the 64-byte [binary protection key](http://osxbook.com/book/bonus/chapter7/tpmdrmmyth/).\n\n`KPPW` and `KPST` are protection inputs and status keys.\nRefer to Alex Ionescu's RECON 2014 talk and use the `-c` switch.\nSetting the correct key allows enumerating 'hidden' keys and mutating their values.\n\n### A bad time\n\nChanging simple values as the super user will halt your machine.\nExample: if you set `DUSR` to `1` your machine will instant-halt.\n\n```\n$ make\n$ sudo ./smc -z\n```\n\n### A disappointing time\n\nNo value should be writable as a non-privileged user.\n\n```\n$ make\n$ ./smc -z\n```\n\n### Resources\n\n- [@jBot-42](https://github.com/Jbot-42) - [A complete guide to SMC](http://jbot-42.github.io/Articles/smc.html) for programmers\n- Alex Ionescu - [Apple SMC The place to be definitely, for an implant](https://www.youtube.com/watch?v=nSqpinjjgmg) (RECon 2014 video)\n- Alex Ionescu - [\"Spell\"unking in Apple SMC Land](http://www.nosuchcon.org/talks/2013/D1_02_Alex_Ninjas_and_Harry_Potter.pdf) NoSuchCon 2013\n- InversePath (Andrea Barisani, Daniele Bianco) - [Embedded systems exploitation](https://dev.inversepath.com/download/public/embedded_systems_exploitation.pdf), includes several slides on SMC\n- Trammell Hudson - [Thunderstrike 31C3](https://trmm.net/Thunderstrike_31c3), a class of EFI/firmware attacks\n- Apple - [HT201518](https://support.apple.com/en-us/HT201518) downloads for several SMC versions\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fsmc-fuzzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheopolis%2Fsmc-fuzzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fsmc-fuzzer/lists"}