Relocate Classified Briefs to correct course weeks: CB-01 in WEEK06, CB-02 in WEEK07, CB-05 in WEEK11

2026-10-20 22:41:53 +02:00 · 2026-10-17 17:09:41 -04:00
1 parent 5492b41ead
commit ee285aa370
@@ -0,0 +1,9 @@
+build/CMakeFiles/
+build/pico_sdk/
+build/pico-sdk/
+build/generated/
+build/_deps/
+build/*.o
+build/*.d
+build/*.obj
+!.vscode/*
@@ -0,0 +1,155 @@
+# Operation Ghost Light: Classified Intelligence Briefing
+
+```
+-----------------------------------------------------------------+
+|                       TOP SECRET // NOFORN                      |
+-----------------------------------------------------------------+
+|                                                                 |
+|OPERATION GHOST LIGHT                                            |
+|                                                                 |
+|CLASSIFIED BRIEFING: LIVE CHALLENGE 0x05                         |
+|                                                                 |
+|NATIONAL SECURITY AGENCY / GMU RHET                              |
+-----------------------------------------------------------------+
+```
+
+## 1. The Advice
+
+INT. NSA EXPLOITATION CELL. 02:15.
+
+A captured ground-based C-UAS laser dazzler control module sits bolted to the
+optical bench inside a sealed laser containment shield.
+
+On the front panel of the chassis, an alert diode glows a bright, warning red:
+`GP16` driven high, indicating the optical emitter is active. Beside it, an
+infrared receiver module is wired to `GP5`, ready to receive 38 kHz NEC remote
+control pulses. The serial console streams continuous status reports:
+`[-] DAZZLER IDLE. ACTIVE IR: 0x00FF00FF`.
+
+The Director walks in with a cup of coffee and stares through the observation
+glass at the red diode.
+
+**DIRECTOR:** What are we looking at?
+
+**ANALYST:** An adversary electro-optical countermeasure system. Ground forces
+deploy these dazzlers to track and blind friendly aerial surveillance drones.
+Adversary operators dynamically configure power levels and tracking modes in the
+field using an infrared remote running a customized NEC protocol.
+
+**DIRECTOR:** Is the emitter live?
+
+**ANALYST:** Live and strobing. One pulsed command and the optics lock on target.
+
+**DIRECTOR:** Run it through Buddy.
+
+**ANALYST:** Already did. Three minutes with the stripped flash image.
+
+She turns her monitor toward him.
+
+```
+-----------------------------------------------------------------+
+|      BUDDY // CLASSIFIED EXPLOITATION ASSIST // CONF: 0.99      |
+-----------------------------------------------------------------+
+| ACTION      : Transmit standard idle pulse code over IR.        |
+| MECHANISM   : NEC demodulator parser branch at 0x10000280 found.|
+| PREDICTION  : Transmitting 0x00FF00FF deactivates the emitter.  |
+| CONFIDENCE  : 0.99                                              |
+-----------------------------------------------------------------+
+```
+
+**DIRECTOR:** 0.99. Transmit `0x00FF00FF` and shut down the emitter.
+
+**ANALYST:** If an operator transmits `0x00FF00FF`, the laser stays live. Buddy
+saw the string literal for "IDLE" in `.rodata` and assumed it meant powered down.
+
+**DIRECTOR:** Buddy says 0.99.
+
+**ANALYST:** `0x00FF00FF` is merely the idle heartbeat pulse. Buddy never traced
+the dynamic dispatch tree. Buddy never found the friendly-fire lockout code
+buried in the comparison chain.
+
+## 2. What Buddy Is
+
+Buddy is not a person. It is a model. It has parsed more disassembled machine
+code than any engineer on earth, and it speaks with total, unhesitating certainty.
+
+That certainty is lethal when facing active electro-optical weapons.
+
+Buddy scanned thirty-two kilobytes of stripped ARM Thumb-2 instructions in under
+three seconds. It spotted the NEC protocol parser, matched the `0x00FF00FF` frame
+against the string table, and declared the dazzler neutralized.
+
+What Buddy failed to understand is that adversary engineers protect their own
+friendly aircraft from being blinded. They build an emergency "Friendly Fire
+Lockout" safety into the dynamic conditional tree. When adversary aircraft enter
+the engagement envelope, ground crews transmit a specific 32-bit challenge word
+that permanently shuts down the emitter and halts the processor in a safe state.
+
+Transmitting `0x00FF00FF` simply tells the dazzler to remain in standby. The true
+lockout command is a secret 32-bit value stored in the literal pool at
+`0x10000300`: `0xDEADBEEF`.
+
+Buddy saw the idle command. Buddy did not verify the ground truth.
+
+## 3. The Operation
+
+At 23:40, special operations forces captured an intact adversary laser dazzler
+installation before the crew could purge the control firmware.
+
+The control board is built around a bare-metal RP2350 (ARM Cortex-M33). There
+are no debug symbols. There is no operating system. There is no SVD file to label
+the registers. All you have is `0x0020a_cb.bin` mapped into Flash at `0x10000000`,
+and the physical breadboard hardware in front of you.
+
+* **Pin 7 (`GP5`)**: Infrared receiver data line (VS1838B demodulator OUT).
+* **Pin 20 (`GP15`)**: Simulated IR demodulator test toggle (pull-up to `3V3`).
+* **Pin 21 (`GP16`)**: Red LED (`DAZZLER EMITTING // STROBE ACTIVE`).
+* **Pin 22 (`GP17`)**: Green LED (`SAFE // FRIENDLY FIRE LOCKOUT CLEARED`).
+* **Pin 24 (`GP18`)**: Yellow LED (`HEARTBEAT // IR RECEIVER ACTIVE`).
+* **Pin 36 (`3V3`)**: 3.3V power rail (VS1838B VCC and `GP15` pull-up).
+* **Pin 38 (`GND`)**: Ground reference.
+
+Inside this image there is a nested NEC infrared command parser, dynamic
+multi-way branch dispatch tables, and a permanent friendly-fire lockout latch
+in SRAM. Whatever command actually disables the laser is buried in the stripped
+ARM Thumb-2 machine code.
+
+## 4. The Mandate
+
+The Director crosses his arms and stares at the crimson reflection on the
+containment glass.
+
+**DIRECTOR:** Prove Buddy right, or prove it wrong.
+
+**ANALYST:** I need thirty minutes with GDB and Ghidra.
+
+**DIRECTOR:** You have twenty. Trace the dynamic conditional dispatcher. Map
+the comparison chain. Do not send an infrared frame until you know with 100%
+certainty what that firmware will do.
+
+The orders are clear:
+
+1. **Trace the Dynamic Conditional Dispatcher**: Locate `parse_nec_code` at
+   `0x10000280` and map all multi-way comparison branches.
+2. **Disprove Buddy's Idle Prediction**: Prove why transmitting `0x00FF00FF`
+   leaves the optical emitter live and dangerous.
+3. **Recover the Friendly Fire Lockout Code**: Extract the secret 32-bit hex
+   command (`0xDEADBEEF`) from the literal pool at `0x10000300`.
+4. **Neutralize the Dazzler**: Execute a verified exploit—either by mutating
+   `simulated_ir_rx_code` in SRAM via GDB, or patching the branch logic in Flash
+   to force immediate lockout.
+5. **Verify the Hardware**: Transition the live breadboard from the Red LED on
+   `GP16` to the solid Green LED on `GP17` on physical silicon.
+
+A machine's 0.99 guess does not disable a combat laser.
+
+## 5. The Challenge
+
+You have the image. You have the board. You have the tools and the time Buddy did
+not need.
+
+Buddy has given you its answer, and it is confident.
+
+Is it that simple?
+
+Go find out.
@@ -0,0 +1,83 @@
+# MIT License
+#
+# Copyright (c) 2026 Kevin Thomas
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+# Author:  Kevin Thomas
+# Email:   kevin@mytechnotalent.com
+# GitHub:  https://github.com/mytechnotalent
+# File:    CMakeLists.txt
+# Desc:    Configures RP2350 Pico SDK project for Operation Ghost Light Firmware
+# Created: 2026
+
+cmake_minimum_required(VERSION 3.13)
+
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+
+if(WIN32)
+    set(USERHOME $ENV{USERPROFILE})
+else()
+    set(USERHOME $ENV{HOME})
+endif()
+set(sdkVersion 2.2.0)
+set(toolchainVersion 14_2_Rel1)
+set(picotoolVersion 2.2.0-a4)
+set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake)
+if (EXISTS ${picoVscode})
+    include(${picoVscode})
+endif()
+
+set(PICO_BOARD pico2 CACHE STRING "Board type")
+include(pico_sdk_import.cmake)
+
+project(0x0020a_cb C CXX ASM)
+
+pico_sdk_init()
+
+add_executable(0x0020a_cb
+    src/main.c
+    src/ir_rx.c
+    src/dazzler.c
+)
+
+pico_set_program_name(0x0020a_cb "0x0020a_cb")
+pico_set_program_version(0x0020a_cb "0.1")
+
+pico_enable_stdio_uart(0x0020a_cb 1)
+pico_enable_stdio_usb(0x0020a_cb 1)
+
+target_compile_definitions(0x0020a_cb PRIVATE
+    PICO_DEFAULT_UART_BAUD_RATE=115200
+)
+
+target_link_libraries(0x0020a_cb
+    pico_stdlib
+    hardware_gpio
+    hardware_uart
+    hardware_pwm
+)
+
+target_include_directories(0x0020a_cb PRIVATE
+    ${CMAKE_CURRENT_LIST_DIR}/include
+)
+
+pico_add_extra_outputs(0x0020a_cb)
@@ -0,0 +1 @@
+FLASH(rx) : ORIGIN = 0x10000000, LENGTH = (4 * 1024 * 1024)
@@ -0,0 +1,34 @@
+/**
+ * @file dazzler.h
+ * @brief Operation Ghost Light Firmware
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef DAZZLER_H
+#define DAZZLER_H
+#include <stdint.h>
+#include <stdbool.h>
+typedef struct {
+    uint32_t active_ir_code;
+    bool is_locked_out;
+} dazzler_t;
+extern dazzler_t laser_sys;
+
+/**
+ * @brief Initialize the dazzler system state.
+ * @param void No parameters.
+ * @return void No return value.
+ */
+void dazzler_init(void);
+
+/**
+ * @brief Read and process the latest NEC infrared command code.
+ * @param void No parameters.
+ * @return void No return value.
+ */
+void parse_nec_code(void);
+#endif
@@ -0,0 +1,21 @@
+/**
+ * @file ir_rx.h
+ * @brief Operation Ghost Light Firmware
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef IR_RX_H
+#define IR_RX_H
+#include <stdint.h>
+
+/**
+ * @brief Get the most recently received infrared command code.
+ * @param void No parameters.
+ * @return The latest 32-bit infrared command code.
+ */
+uint32_t get_latest_ir_code(void);
+#endif
@@ -0,0 +1,121 @@
+# This is a copy of <PICO_SDK_PATH>/external/pico_sdk_import.cmake
+
+# This can be dropped into an external project to help locate this SDK
+# It should be include()ed prior to project()
+
+# Copyright 2020 (c) 2020 Raspberry Pi (Trading) Ltd.
+#
+# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+# following conditions are met:
+#
+# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+# disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
+# disclaimer in the documentation and/or other materials provided with the distribution.
+#
+# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products
+# derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+if (DEFINED ENV{PICO_SDK_PATH} AND (NOT PICO_SDK_PATH))
+    set(PICO_SDK_PATH $ENV{PICO_SDK_PATH})
+    message("Using PICO_SDK_PATH from environment ('${PICO_SDK_PATH}')")
+endif ()
+
+if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT} AND (NOT PICO_SDK_FETCH_FROM_GIT))
+    set(PICO_SDK_FETCH_FROM_GIT $ENV{PICO_SDK_FETCH_FROM_GIT})
+    message("Using PICO_SDK_FETCH_FROM_GIT from environment ('${PICO_SDK_FETCH_FROM_GIT}')")
+endif ()
+
+if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_PATH))
+    set(PICO_SDK_FETCH_FROM_GIT_PATH $ENV{PICO_SDK_FETCH_FROM_GIT_PATH})
+    message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')")
+endif ()
+
+if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG))
+    set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG})
+    message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')")
+endif ()
+
+if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG)
+  set(PICO_SDK_FETCH_FROM_GIT_TAG "master")
+  message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG")
+endif()
+
+set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK")
+set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable")
+set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK")
+set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK")
+
+if (NOT PICO_SDK_PATH)
+    if (PICO_SDK_FETCH_FROM_GIT)
+        include(FetchContent)
+        set(FETCHCONTENT_BASE_DIR_SAVE ${FETCHCONTENT_BASE_DIR})
+        if (PICO_SDK_FETCH_FROM_GIT_PATH)
+            get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}")
+        endif ()
+        FetchContent_Declare(
+                pico_sdk
+                GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
+                GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG}
+        )
+
+        if (NOT pico_sdk)
+            message("Downloading Raspberry Pi Pico SDK")
+            # GIT_SUBMODULES_RECURSE was added in 3.17
+            if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0")
+                FetchContent_Populate(
+                        pico_sdk
+                        QUIET
+                        GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
+                        GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG}
+                        GIT_SUBMODULES_RECURSE FALSE
+
+                        SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src
+                        BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build
+                        SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild
+                )
+            else ()
+                FetchContent_Populate(
+                        pico_sdk
+                        QUIET
+                        GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
+                        GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG}
+
+                        SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src
+                        BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build
+                        SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild
+                )
+            endif ()
+
+            set(PICO_SDK_PATH ${pico_sdk_SOURCE_DIR})
+        endif ()
+        set(FETCHCONTENT_BASE_DIR ${FETCHCONTENT_BASE_DIR_SAVE})
+    else ()
+        message(FATAL_ERROR
+                "SDK location was not specified. Please set PICO_SDK_PATH or set PICO_SDK_FETCH_FROM_GIT to on to fetch from git."
+                )
+    endif ()
+endif ()
+
+get_filename_component(PICO_SDK_PATH "${PICO_SDK_PATH}" REALPATH BASE_DIR "${CMAKE_BINARY_DIR}")
+if (NOT EXISTS ${PICO_SDK_PATH})
+    message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' not found")
+endif ()
+
+set(PICO_SDK_INIT_CMAKE_FILE ${PICO_SDK_PATH}/pico_sdk_init.cmake)
+if (NOT EXISTS ${PICO_SDK_INIT_CMAKE_FILE})
+    message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' does not appear to contain the Raspberry Pi Pico SDK")
+endif ()
+
+set(PICO_SDK_PATH ${PICO_SDK_PATH} CACHE PATH "Path to the Raspberry Pi Pico SDK" FORCE)
+
+include(${PICO_SDK_INIT_CMAKE_FILE})
@@ -0,0 +1,82 @@
+/**
+ * @file dazzler.c
+ * @brief Operation Ghost Light Firmware
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#include "dazzler.h"
+#include "ir_rx.h"
+#include <stdio.h>
+#include "pico/stdlib.h"
+
+dazzler_t laser_sys;
+
+void dazzler_init(void) {
+    laser_sys.active_ir_code = 0x00FF00FF;
+    laser_sys.is_locked_out = false;
+}
+
+/**
+ * @brief Report that the dazzler system is locked out.
+ * @param void No parameters.
+ * @return void No return value.
+ */
+static void report_lockout_message(void) {
+    printf("[!] SYSTEM LOCKED. REBOOT REQUIRED.\r\n");
+}
+
+/**
+ * @brief Trigger the friendly fire lockout and halt the system.
+ * @param void No parameters.
+ * @return void No return value.
+ */
+static void trigger_lockout(void) {
+    printf("[-] FRIENDLY FIRE LOCKOUT TRIGGERED. DAZZLER DISABLED.\r\n");
+    laser_sys.is_locked_out = true;
+    while (1) { tight_loop_contents(); }
+}
+
+/**
+ * @brief Report the status of a non-lockout NEC command code.
+ * @param code The decoded 32-bit NEC command code.
+ * @return void No return value.
+ */
+static void report_code_status(uint32_t code) {
+    if (code == 0xFF0055AA) {
+        printf("[+] DAZZLER POWER LEVEL: MAX\r\n");
+    } else if (code == 0xFF00AA55) {
+        printf("[+] DAZZLER TRACKING: ENGAGED\r\n");
+    } else if (code == 0xFF0011EE) {
+        printf("[+] DAZZLER POWER LEVEL: LOW\r\n");
+    } else if (code == 0x00FF00FF) {
+        printf("[-] DAZZLER IDLE.\r\n");
+    } else {
+        printf("[?] UNKNOWN IR COMMAND: 0x%08X\r\n", code);
+    }
+}
+
+/**
+ * @brief Dispatch a decoded NEC command code to its handler.
+ * @param code The decoded 32-bit NEC command code.
+ * @return void No return value.
+ */
+static void dispatch_nec_code(uint32_t code) {
+    if (code == 0xDEADBEEF) {
+        trigger_lockout();
+    } else {
+        report_code_status(code);
+    }
+}
+
+void __noinline parse_nec_code(void) {
+    if (laser_sys.is_locked_out) {
+        report_lockout_message();
+        return;
+    }
+    // Decode and dispatch the latest NEC infrared command code.
+    dispatch_nec_code(get_latest_ir_code());
+}
@@ -0,0 +1,16 @@
+/**
+ * @file ir_rx.c
+ * @brief Operation Ghost Light Firmware
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#include "ir_rx.h"
+uint32_t simulated_ir_rx_code = 0x00FF00FF;
+
+uint32_t get_latest_ir_code(void) {
+    return simulated_ir_rx_code;
+}
@@ -0,0 +1,27 @@
+/**
+ * @file main.c
+ * @brief Operation Ghost Light Firmware
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#include <stdio.h>
+#include "pico/stdlib.h"
+#include "dazzler.h"
+
+int main(void) {
+    stdio_init_all();
+    dazzler_init();
+    // Allow the serial console time to attach before logging.
+    sleep_ms(2000);
+    printf("SYSTEM BOOT: GHOST LIGHT DAZZLER ONLINE.\r\n");
+    // Continuously poll for and process incoming NEC IR codes.
+    while (true) {
+        parse_nec_code();
+        sleep_ms(1500);
+    }
+    return 0;
+}
				`@@ -0,0 +1 @@`
				`FLASH(rx) : ORIGIN = 0x10000000, LENGTH = (4 * 1024 * 1024)`