Further Reading

Further Reading

This wiki explains how the driver works. For the full reverse-engineering process behind it — every experiment tried, every dead end, every register dump — see the docs in the main repository:

In the main repo (docs/)

• GROUND_TRUTH.md — the canonical investigation journal, organized into numbered sections (§1–§20+). This is the primary source of truth for why things are the way they are, including dead ends that were ruled out and shouldn't be re-tried.
• NEXT_STEPS.md — current roadmap; starts with a short "what's still open" summary.
• SPI_REGISTERS.md — full AMD FCH SPI + PCI config register map.
• HIDSPI_PROTOCOL.md — the HID-over-SPI V0 protocol decoded in more depth than this wiki's Wire Protocol page.
• CSV_SEQUENCE.md — an annotated real Windows boot SPI trace.
• AMDSPI_DECOMP.md — index into the decompiled amdspi.sys (Windows AMD SPI controller driver).
• docs/decomp/ — decompiled Windows (hidspi.sys, HidSpiCx.sys, amdspi.sys) and UEFI (SurfaceTouchHidDxe, AmdSpiHc, MsTouchUnlockDxe) drivers, used throughout the investigation to cross-check this driver's behavior against the reference implementations.
• docs/verification/ — independent audit reports that corrected several early misunderstandings about the protocol (worth reading if something in this wiki seems to contradict old assumptions).

Tools used to produce that documentation

• tools/parse_spi.py — parses Windows ETW CSV captures (traces/*.csv) into structured SPI transactions with timing — the tool behind most of the protocol-level claims in this wiki and in GROUND_TRUTH.md.
• tools/ghidra/ — a local headless Ghidra decompilation pipeline (no Windows machine needed) used to decompile the Windows/UEFI driver binaries referenced above.

Why this wiki exists separately from docs/

docs/GROUND_TRUTH.md is deliberately chronological and exhaustive — a journal, not a reference manual. This wiki is the opposite: a from-scratch explanation of the driver as it stands today, for someone who wants to understand or modify the code without reading the entire investigation history first.