We started looking at the RCM code.

我们开始查看 RCM 代码。

And it turns out the bug is actually in the RCM code.

事实证明，该错误实际上存在于 RCM 代码中。

And it directly goes into the RCM path.

它直接进入 RCM 路径。

This is what one of these RCM messages looks like.

这是其中一条 RCM 消息的样子。

RCM itself is a relatively simple USB protocol using so-called bulk transfers.

RCM 本身是一个相对简单的 USB 协议，使用所谓的批量传输。

And this will most likely be done by code that's being downloaded by RCM.

这很可能是由 RCM 下载的代码完成的。

Of course, we can't just use this because RCM as well enforces security.

当然，我们不能只使用它，因为 RCM 也会强制执行安全性。

Then it determines what to do, either boot into RCM or do a warm boot or where to load the boot loader from.

然后它确定要做什么，引导进入 RCM 或进行热引导或从何处加载引导加载程序。

Then we jump into this RCM thing.

然后我们跳进这个 RCM 的事情。

You hold plus, turn it on, and you're in RCM, and you can launch the exploit.

你按住加号，打开它，你就在 RCM 中，你可以启动漏洞利用。