Low Severity
Published: Oct 25, 2026
Wake and Break: a PSP exploit for AMD navi31 (RX 7900) that makes the card accept unsigned IP firmware. Not persistent: a cold power cycle restores stock.
<p align="center">
<img src="logo.jpg" alt="Wake and Break" width="720">
</p>
# Wake and Break
A PSP (Platform Security Processor) exploit for AMD **navi31** cards (RX 7900 series).
Likely adaptable to other adjacent product families as well.
It turns off the PSP's firmware signature check, so the card will load
**unsigned IP firmware** (SMU, SDMA, MEC, IMU, RLC) that it would otherwise
refuse. Think custom power management, clock limits, or anything else that
lives in firmware the vendor signs and you don't.
Nothing is flashed. The patch lives in PSP memory and is applied during a warm
boot; **a cold power cycle wipes it and the card is stock again**. That warm
boot is the "Wake and Break": the card wakes up, we convince it to get **really
high** right away and coerce it into neutering signature checks. :-)
Card-tested on a RX 7900 XTX. See [Status](#status).
## What you get
```sh
python3 wakebreak.py 25=/path/to/firmware.bin
```
That plants the patch, warm-boots the card, and submits your image as firmware
type 25. If it prints `accepted`, the PSP took an image it would normally have
rejected.
Need something to try it with? `ipfw_images.py` lists the firmware your driver
actually loads and writes a test pair — a genuine image and a copy with one bit
flipped in its signature, so the firmware itself is byte-for-byte identical:
```sh
python3 ipfw_images.py # what does this card load?
python3 ipfw_images.py 25 # -> /tmp/fw_25_{ok,bad}.bin
python3 wakebreak.py 25=/tmp/fw_25_bad.bin
```
Stock firmware rejects `fw_25_bad.bin`. With the patch in place it is accepted.
That is the whole demonstration.
## Setup
```sh
python3 -m venv venv
venv/bin/pip install -r requirements.txt
make verify # are the shipped artifacts intact?
make selftest # offline sanity checks, no card touched
```
You need a Linux host with the card reachable through
[tinygrad](https://github.com/tinygrad/tinygrad)'s AMD driver (PCIe or its USB
bridge).