mirror of
https://github.com/ALLFATHER-BV/wadamesh.git
synced 2026-09-23 11:26:16 +00:00
Kaj SchittecatandClaude Opus 5
6868911f59
Some ThinkNode M9 cards shipped with a dormant Windows worm (Elecrow security advisory, September 2026). An infected card seen since carries autorun.inf in the root, launching xlfqf.pif on open, explore and autoplay with random-junk comment lines in between: the Sality autorun pattern. - SD Scan store app (deploy/apps/sdscan/1.0, requires "sd", not seeded): walks the card a small page per tick, lists what it finds and why, and removes it after a confirmation screen with Cancel first. It says on every screen that it only removes files it recognises and that formatting the card is the safe fix. On older firmware it still finds threats by name but cannot remove them. - Firmware: wada.sd.check(path) and wada.sd.remove(path), plus paging for wada.sd.list(path, start, max) and caps().sd_clean. What counts as a threat lives in SdThreat.h: autorun.inf, Windows program, script and shortcut extensions, or a real MZ+PE header under any name. remove() classifies again in firmware and refuses anything else, so no app can use it to delete tiles, backups or chat history. It clears read-only, hidden and system first, because FAT refuses to delete a read-only file. - A warning when a card with Windows malware in its top folder is mounted, at boot or on insert, offering SD Scan (or the Store). - Tests: test/test_sd_threat.cpp, and SD Scan harness scenarios including the real infected card's root. Removal checked on a T-Deck. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>