Skip to content
KitploitKITPLOIT
OutilsBlog
Soumettre
OutilsBlog
Soumettre

Outils de Hacking, PenTest et Cybersécurité pour votre Arsenal de Sécurité !

Kitploit est un répertoire d'outils de hacking, de cybersécurité et de pentesting. Découvrez les dernières mises à jour des projets pour trouver des vulnérabilités, analyser des systèmes, automatiser les tests et renforcer votre sécurité.

··Flux·Contact·Confidentialité·© 2026 Kitploit

Répertoire d'outils

Catégories

Voir toutes les catégories
Loading categories
Quantum-Silicon-Core-Loader — Executes at the silicon boundary | Kitploit
Outils/GitHubGitHub/sharif-bot-cmd/quantum-silicon-core-loader
Embedded Systems SecurityPrivilege EscalationMemory ForensicsExploitationReverse EngineeringDebuggersFuzzingPenetration TestingHardware Security

Populaires

Voir tout →

Découvrez les outils les plus utilisés par notre communauté.

Explorer tous les outils

Parcourez notre collection d'outils

Voir tous les outils →
Binary Analysis
Firmware Analysis
GitHubsharif-bot-cmd/quantum-silicon-core-loader

Quantum-Silicon-Core-Loader

Executes at the silicon boundary

Voir le dépôt
299il y a 1 moisVérifié par Kitploit
Partager
Contenu non disponible dans la langue demandée. Affichage de la version anglaise.

Quantum Silicon Core Loader

Primary Core: qslcl.asm (v0.0.2) (under development)

Assistant Module: qslcl.bin (v0.7.4)

Universal Controller: qslcl.py (v2.2.2)

Legally Protected Research - This project operates under established legal frameworks for security research, right to repair, and academic freedom. Learn more


Overview

Quantum Silicon Core Loader (QSLCL) is a post-bootloader, post-vendor, post-os layer operating directly at the silicon boundary.

It executes beyond traditional security models and is capable of surviving firmware transitions, negotiating trust, and interpreting device state without CVEs or patches.

QSLCL runs in:

  • Qualcomm EDL / Firehose
  • MediaTek BROM / Preloader
  • Apple DFU (Dynamic detection - no hardcoded PIDs)
  • Engineering / META / Diagnostic Modes
  • Any USB/Serial exposed interface

"You don't run QSLCL — silicon interprets it."


What's New in v2.2.2

Slowm8 GETINFO Integration

  • After successful code injection, Slowm8 automatically calls GETINFO to verify device state
  • Confirms injection didn't crash the device
  • Detects and reports abnormal device behavior
  • Adds device_info field to bug reports with status, code, and error details

Enhanced Bug Confirmation

  • Device state verification after every successful injection
  • Abnormal state detection - flags if device shows errors post-injection
  • Rich output in final results showing device status for each confirmed bug

Improved Error Handling

  • Better handling of unresponsive devices after injection
  • Clearer error messages when GETINFO fails
  • Graceful fallback when device doesn't respond to verification

Example output:

root@kitploit:~
[*] Injection confirmed! Fetching device info...
[*] GETINFO response: SUCCESS - OK

[CONFIRMED BUGS]
  1. memory_corruption (conf: 80%)
      Unexpected large response: 2048 bytes
      Device state after injection: SUCCESS - OK
  2. memory_corruption (conf: 75%)
      Unexpected large response: 4096 bytes
      Device state after injection: SUCCESS - OK

root@kitploit:~
QSLCL Binary Layout (v0.7.4):
┌─────────────────────────────────────────────┐
│ 0x000000  QSLCLBIN (Main Header + Ptrs)     │
│ 0x000200+ QSLCLCMD (28 Commands)            │
│ 0x004000+ QSLCLDIS (Dispatch Table)         │
│ 0x005000+ QSLCLUSB (USB Micro-Engine)       │
│ 0x006000+ QSLCLBLK (64 Endpoints)           │
│ 0x007000+ QSLCLBST (Bootstrap Engine)       │
│ 0x008000+ QSLCLVM5 (Nano-Kernel)            │
│ 0x009000+ QSLCLSPT (USB Setup Packets)      │
│ 0x00A000+ QSLCLRTF (Runtime Fault Table)    │
│ 0x00B000+ QSLCLENC (Encryption Layer)       │
│ 0x00C000+ QSLCLDAT (Data Protocol)          │
│ 0x00D000+ QSLCLSYN (Sync Block)             │
│ 0x00E000+ QSLCLHDR (Certificate)            │
│ 0x00F000+ QSLCLINT (Integrity Footer)       │
│ 0x010000+ USB4V2MC (USB4 v2.0 80Gbps)      │
└─────────────────────────────────────────────┘

Total Size: ~72KB (44% reduction from 128KB)
Commands: 28 (added TEST, FUZZ)

How it works (automatic):

root@kitploit:~
# Build with quantum architecture (recommended)
python build.py qslcl.bin --arch quantum --encrypt --usb4-v2

# Or generic build
python build.py qslcl.bin

# Just run normally - watchdog disables automatically!
python qslcl.py hello --loader=qslcl.bin

# Expected output:
# [+] Loader uploaded.
# [*] Auto-disabling watchdog...
# [*] Detected SoC type: APPLE
# [*] Checking 10 candidate offsets...
# [*] Watchdog detected at 0x20E00000 = 0x00000001
# [+] Watchdog disabled at offset 0x20E00000
# [*] Exposing QSLCL in USB configuration...

Complete Command List (v2.2.1)

Core Memory Operations:

Device Interaction:

CommandDescription
helloDevice handshake and capability detection
pingRound-trip latency testing
getinfoShows device, DFU mode, watchdog, loader features

System Control:

CommandDescription
resetSystem reset
powerPower management
configConfiguration management

Voltage & Hardware:

CommandDescription
voltageVoltage read/set/monitor/scale with safety ranges
rawstateLow-level hardware state inspection and manipulation

Security & Analysis:

CommandDescription
rawmodePrivilege escalation with session audit logging
bypass

Diagnostic & Testing:

CommandDescription
crashControlled crash injection with recovery monitoring
glitch

Manufacturing & ODM:

CommandDescription
oemOEM operations
odmODM operations

Installation & Quick Start

Requirements

root@kitploit:~
pip install pyserial pyusb
pip install pycryptodome   # optional, for crypto operations
pip install capstone        # optional, for disassembly

Basic Usage

root@kitploit:~
# Build with quantum architecture (recommended)
python build.py qslcl.bin --arch quantum --usb4-v2 --encrypt --debug

# Or standard generic build
python build.py qslcl.bin

# Get detailed device information
python qslcl.py getinfo --loader=qslcl.bin

# Expected output:
# ==================================================
# QSLCL DEVICE INFORMATION
# ==================================================
# [DEVICE]
#   Transport: USB
#   VID:PID: 05AC:1281
#   Product: iPhone 15 Pro
#   USB Class: 0xFE (Application Specific)
# 
# [DFU MODE]
#   Status: ACTIVE
#   Generation: A12 or newer (ARM64e, PAC enabled)
# 
# [WATCHDOG]
#   Detected SoC: Apple A-series
#   Typical offset: 0x20E00000
# 
# [QSLCL LOADER]
#   Architecture: quantum
#   Binary size: 73728 bytes (72 KB)
#   Features: Encryption, USB4 v2.0 80Gbps
# ==================================================

# Auto-DFU boot + Loader + Hello (All-in-One)
python qslcl.py hello --loader=qslcl.bin --dfu-boot

# Just boot into DFU mode (like palera1n)
python qslcl.py --dfu-boot

# Test basic functionality
python qslcl.py hello --loader=qslcl.bin --usb4
python qslcl.py ping --loader=qslcl.bin

Slowm8 - USB Stress Tester (v2.2.2)

Enhanced with GETINFO verification! After confirming a bug, Slowm8 automatically fetches device state to verify injection success.

root@kitploit:~
# Basic stress test with device verification
python qslcl.py slowm8 --loader=qslcl.bin

# Expected output with GETINFO:
# [*] Injection confirmed! Fetching device info...
# [*] GETINFO response: SUCCESS - OK
# [+] Bug confirmed! Device state: healthy

Slowm8 Auto-Detection Features

Slowm8 Options


Jitter Support (v2.1.9+)

Add random timing variation during USB upload:

root@kitploit:~
# Simple random jitter (5-25ms)
python qslcl.py hello --loader=qslcl.bin --jitter simple

# Progressive jitter (slows down as upload progresses)
python qslcl.py hello --loader=qslcl.bin --jitter progressive

# Burst pattern (fast bursts with pauses)
python qslcl.py hello --loader=qslcl.bin --jitter burst

# Custom range (1ms to 50ms random)
python qslcl.py hello --loader=qslcl.bin --jitter 0.001-0.05

Slowm8 - USB Stress Tester (v2.2.2)

Enhanced with GETINFO verification! After confirming a bug, Slowm8 automatically fetches device state to verify injection success.

root@kitploit:~
# Basic stress test with device verification
python qslcl.py slowm8 --loader=qslcl.bin

# Expected output with GETINFO:
# [*] Injection confirmed! Fetching device info...
# [*] GETINFO response: SUCCESS - OK
# [+] Bug confirmed! Device state: healthy

Device Compatibility


Version History


Slowm8 Technical Details

Auto-Detection Flow

root@kitploit:~
1. Device connected
   ↓
2. Auto-detect mode (DFU/EDL/BROM/USB)
   ↓
3. Measure response time
   ↓
4. Detect encryption (A19+)
   ↓
5. Auto-adjust timing (min/max delays)
   ↓
6. Run stress test
   ↓
7. Detect anomalies
   ↓
8. Analyze for bugs (confidence scoring)
   ↓
9. If threshold reached → Inject test code
   ↓
10. Confirm bug and report

Bug Types Detected


Important: RAM-Only Execution (A12+)

On Apple A12+ devices, QSLCL executes entirely from RAM. No modifications are permanent.

After reboot:

  • Device returns to stock condition
  • All bypasses/resets/rawmode states are cleared
  • No persistent changes to flash

Commands like bypass, rawmode, crash, glitch, test, fuzz, slowm8 are TEMPORARY on A12+.


CRITICAL WARNING

QSLCL CAN PERMANENTLY BRICK (DESTROY) YOUR DEVICE IF USED INCORRECTLY.

YOU HAVE BEEN WARNED. THE AUTHOR IS NOT RESPONSIBLE FOR BRICKED DEVICES.


Legal & Ethical Framework

Quantum Silicon Core Loader (QSLCL) operates within established legal and ethical boundaries:

Permitted Uses:

  • Device Owners: Modifying hardware you legally own
  • Researchers: Security analysis and academic study
  • Repair Technicians: Right to Repair implementations
  • Students: Learning hardware architecture and security
  • Developers: Creating interoperable software and tools

Prohibited Uses:

  • Unauthorized access to others' devices
  • Circumventing security on non-owned hardware
  • Malicious or destructive applications
  • Violation of applicable laws and regulations

Use responsibly. With great power comes great responsibility.


Support & Troubleshooting

Common Issues

Slowm8 not detecting device:

root@kitploit:~
# Make sure device is in DFU/EDL/BROM mode
python qslcl.py getinfo --loader=qslcl.bin

# Run with debug
python qslcl.py slowm8 --loader=qslcl.bin --debug

Bug injection not working:

root@kitploit:~
# Increase timeout
python qslcl.py slowm8 --loader=qslcl.bin --duration 60 --debug

# Disable injection to see if bugs are detected
python qslcl.py slowm8 --loader=qslcl.bin --no-injection --debug

QSLCLRESP errors:

root@kitploit:~
# Rebuild with latest
python build.py qslcl.bin --arch quantum --debug

# Check response parsing
python qslcl.py hello --loader=qslcl.bin --debug

Final Words

"Quantum Silicon Core Loader represents the pinnacle of universal device communication where every memory operation, every privilege escalation, every hardware interaction, every binary patch, every bootstrap execution, every USB4 v2.0 80Gbps tunnel, every PAM4-encoded transaction, every one-click DFU boot, every automatic watchdog disabler, every quantum-optimized byte, every diagnostic test, every fuzzing iteration, every USB stress test with slowm8, every jitter-timed upload, every malformed packet, every timing attack, every auto-detected device, every adaptive delay, every bug confirmation with code injection, and now a lean 72KB binary with 28 commands becomes an extension of silicon consciousness through our perfected micro-VM architecture with dynamic bootstrapping, quantum-resistant encryption, structured data protocols, automatic USB self-identification, USB4 v2.0 80Gbps support, palera1n-like DFU automation, zero-configuration watchdog bypass, enhanced device information, the new quantum architecture for advanced entropy and opcode randomization, and now experimental USB stress testing with slowm8 that auto-detects and confirms bugs on ANY SoC."

YouTube: https://www.youtube.com/@QSLCL-creator


Legal & Support

  • LEGAL_NOTICE.md - Legal positioning and protections

Mirrors

  • GitHub: https://github.com/Sharif-bot-cmd/Quantum-Silicon-Core-Loader
  • Codeberg: https://codeberg.org/Sharif_Muhaymin/Quantum-Silicon-Core-Loader
  • SourceForge: https://sourceforge.net/p/quantum-silicon-core-loader/code/ci/main/tree/
Télécharger l’outil
CommandDescription
readPartitions Reading
writePartitions Writing
erasePartitions Erasing
peekMemory inspection with type interpretation and pointer analysis
pokePrecision memory writes with bit operations (AND/OR/XOR)
patchBinary patching with backup, verification, and dry-run support
dumpBulk memory dumping with compression, verification, and metadata
Security bypass with auto-detection and enforcement analysis
verifySystem verification
footerFooter analysis with validation and security assessment
Hardware fault injection with parameter scanning
bruteforceAutomated testing
slowm8USB stress tester with auto-detection and bug injection
FeatureWhat It Does
Device mode detectionAuto-detects DFU, EDL, BROM, or standard USB
Timing auto-calibrationMeasures device response time and adjusts delays
A19+ encryption detectionDetects encrypted DFU and adapts timing
Bug thresholdInjects test code after N anomalies (default: 3)
Custom injection payloadsDifferent payloads for different bug types
JSON outputSave detailed results for analysis
OptionDescriptionDefault
--min-delayMinimum delay between packets (ms)Auto-detected
--max-delayMaximum delay between packets (ms)Auto-detected
--durationTest duration in seconds30
--packetsNumber of packets to send100
--burst-sizePackets per burst (0=disable)10
--progressiveProgressively slow downFalse
--no-randomDisable random delaysFalse
--fuzzNumber of fuzz mutations per packet0
--corruptCorrupt specific fieldsNone
--no-injectionDisable automatic code injectionFalse
--injection-sizeMax injection payload size512
--bug-thresholdBugs before injection3
--outputSave results to JSONNone
VendorModeDetection MethodUSB ExposureUSB4 v2.0Auto-DFUWatchdogEncryptionSlowm8Status
QualcommEDLSahara + Firehose handshake✅ Auto✅ 80GbpsN/A✅ AutoOptional✅✅
MediaTekBROM / Preloader0xA0 preloader ping✅ Auto✅ 80GbpsN/A✅ AutoOptional✅✅
AppleDFU (A12-A17)Dynamic USB DFU Class✅ Auto⚠️ 40Gbps✅ Auto✅ AutoNo✅✅
AppleDFU (A18+)Dynamic USB DFU Class✅ Auto✅ 80Gbps✅ Auto✅ AutoRequired✅✅
AppleNormal Mode iOSUSB Class + Product StringN/AN/A✅ AutoN/AN/AN/A✅
GoogleDFUDynamic USB DFU Class✅ Auto✅ 80GbpsN/A✅ AutoOptional✅✅
SamsungEUBDynamic USB DFU Class✅ Auto✅ 80GbpsN/A✅ AutoOptional✅✅
BroadcomBCM BootVID detection✅ Auto❌ NoN/A✅ AutoOptional✅✅
RockchipMask ROMVID detection✅ Auto❌ NoN/A✅ AutoOptional✅✅
IntelUSB4 v2.0 HostNative USB4 detection✅ Auto✅ 80GbpsN/AN/AOptional✅✅
AMDUSB4 v2.0 HostNative USB4 detection✅ Auto✅ 80GbpsN/AN/AOptional✅✅
GenericUSB CDC/BulkEndpoint auto-discovery⚠️ Limited❌ NoN/A⚠️ LimitedOptional✅✅
AnySerial COMUART auto syncN/AN/AN/AN/ANoN/A✅
VersionDateKey Changes
v2.2.22026Slowm8 GETINFO integration - Auto-verifies device state after injection, detects abnormal behavior, richer bug reports
v0.7.4 / v2.2.12026QSLCLRESP improvements - Better error handling, faster responses, extended status codes. Slowm8 auto-detection - No PIDs, adaptive timing, A19+ support, bug confirmation with code injection, JSON output
v0.7.3 / v2.2.02026slowm8 command - USB stress tester with fuzzing, --jitter flag - timing randomization
v0.7.2 / v2.1.92026TEST & FUZZ commands - Diagnostic self-test and fuzzing engine, Enhanced getinfo
v0.7.1 / v2.1.82026Quantum Architecture - --arch quantum, opcode randomization, 72KB binary
v0.7.0 / v2.1.72026oem panic - Emergency recovery subcommand
v0.6.9 / v2.1.62026Command removal - Removed mode command, 26 total commands
v0.6.8 / v2.1.52026Size optimization - 128KB → 80KB, 37.5% smaller
v0.6.7 / v2.1.42026Auto-DFU Boot - Like palera1n, one-click DFU entry
v0.6.7 / v2.1.32026USB4 v2.0 80Gbps - PAM4 encoding, 4-lane aggregation
v0.6.6 / v2.1.22026USB QSLCL Exposure - Auto-identifies in USB descriptors
v0.6.6 / v2.1.12026Code cleanup - 40% reduction, QSLCLDATA/SYNC blocks
v0.6.5 / v2.1.02026QSLCLENC encryption layer - ChaCha20/AES for A18+
v0.6.4 / v2.0.22026Dynamic DFU detection, QSLCLRESP fixes
v0.6.3 / v2.0.12026Complete module rewrite
v0.5.x / v1.x2025Legacy versions
Bug TypeDetection MethodInjection Payload
Memory corruptionUnexpected large responseRead/write/verify test
CrashDevice reset detectedCrash test + recovery
Timeout vulnerabilityRepeated timeoutsTimeout test + ping
Timing anomalySlow responsesTiming sensitivity test
Parsing bugMalformed responseNested structure test
Safety LevelOperationsRisk
SAFEEDL mode, DFU mode, BROM mode, Serial boot modes, TEST, FUZZ, slowm8Minimal
CAUTIONWriting to user partitions, voltage changesModerate
DANGEROUSWriting to iROM, BootROM, NOR flash boot sectorsHigh
BRICK RISKOverwriting protected bootloaders (iBoot, SBL, U-Boot SPL)Critical