saimaa: direct sbl_main start, SMEM, null-page trap; sbl analysis tools; sbl_main=0x802f63e

2026-09-07 11:40:31 +00:00
parent c7dcda0200
commit 11facdfb45
4 changed files with 446 additions and 0 deletions
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""sbl_mains.py — кандидаты в sbl_main: плотность BL + близость строк boot-лога.
+Использование: ./tools/sbl_mains.py fw/sbl/img0.elf
+"""
+import struct
+import sys
+
+d = open(sys.argv[1], "rb").read()
+phoff = struct.unpack("<I", d[28:32])[0]
+phnum = struct.unpack("<H", d[44:46])[0]
+segs = []
+for k in range(phnum):
+    p = d[phoff + k * 32:phoff + (k + 1) * 32]
+    t, off, v, pa, fsz, msz, fl, al = struct.unpack("<IIIIIIII", p)
+    if t == 1 and fsz:
+        segs.append((off, v, fsz))
+
+# prologues: STMDB sp!,{...,lr} (bit11 set)
+cands = []
+for off, v, sz in segs:
+    code = d[off:off + sz]
+    for j in range(0, len(code) - 4, 4):
+        x = struct.unpack("<I", code[j:j + 4])[0]
+        if (x & 0xFFFF0000) == 0xE92D0000:  # push ... r11?/lr frame
+            # count BLs in next 2KB
+            bls = 0
+            for q in range(j, min(j + 2048, len(code) - 4), 4):
+                y = struct.unpack("<I", code[q:q + 4])[0]
+                if (y >> 25) == 0b101 and (y & 0x01000000):
+                    bls += 1
+            if bls >= 8:
+                cands.append((bls, v + j))
+cands.sort(reverse=True)
+print("top candidates (bl-count, addr):")
+for bls, a in cands[:15]:
+    print(f"  {bls:3d}  {a:#x}")