From 432e84bc9538970f64d8f1ac021cdf833f36eb85 Mon Sep 17 00:00:00 2001 From: SashegDev Date: Tue, 15 Sep 2026 08:05:33 +0000 Subject: [PATCH] b43: revert frameless (hang), S12 keep/divert split (PBL contract), sphist+tpop diag --- qemu/run-sbl.sh | 2 +- qemu/saimaa.c | 20 +-- tools/sbl_patch.py | 351 +++++++++++++++++++++++++++++++++++++++++++++ tools/sbl_uni.py | 64 +++++++-- 4 files changed, 417 insertions(+), 20 deletions(-) diff --git a/qemu/run-sbl.sh b/qemu/run-sbl.sh index 8faa75f..9437ce3 100755 --- a/qemu/run-sbl.sh +++ b/qemu/run-sbl.sh @@ -5,7 +5,7 @@ set -e cd "$(dirname "$0")/.." QEMU=~/qemu-src/qemu-8.2.2/build/qemu-system-arm -B=${1:-b40} +B=${1:-b43} IMG=fw/img/emmc-real.img if [ ! -f "$IMG" ]; then echo "no $IMG — сначала: python3 tools/ffu_extract.py fw/dl/RM1127_059X5R5_orig.ffu --emmc-user fw/img/user-real.bin" diff --git a/qemu/saimaa.c b/qemu/saimaa.c index e54a41d..3455764 100644 --- a/qemu/saimaa.c +++ b/qemu/saimaa.c @@ -788,11 +788,12 @@ static void saimaa_machine_init(MachineState *machine) uint32_t v = 0x47702000; cpu_physical_memory_write(0x00221EF8, &v, 4); } - /* S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding + /* S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr); - * ip==STUBV/even/non-code => ip=poll resumption 0x8007779; - * else keep pushed-lr (NO add-sp!); restore r7; - * ACK peripheral bit1 ([literal 0x073A100]); bx lr. + * keep (odd code): appended tail restores r7, ACKs bit1, + * ([literal2 0x073A100]) and bx lr to wrapper tail (paired + * pop, balanced). default: shared restore/ACK then bx ip to + * poll resumption (no tail visit, no creep). * PBL would place the real ARM helper here. */ { static const uint8_t s12[] = { @@ -801,15 +802,18 @@ static void saimaa_machine_init(MachineState *machine) 0x09, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3, 0x07, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1, 0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a, - 0x05, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1, + 0x0d, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1, 0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a, - 0x01, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3, + 0x09, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3, 0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3, 0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5, 0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3, + 0x00, 0x20, 0x83, 0xe5, 0x1c, 0xff, 0x2f, 0xe1, + 0x00, 0xa1, 0x73, 0x00, 0x00, 0x70, 0x0a, 0xe3, + 0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5, + 0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3, 0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1, - 0x00, 0xa1, 0x73, 0x00, - }; + 0x00, 0xa1, 0x73, 0x00,}; size_t k; for (k = 0; k < sizeof(s12); k += 4) { uint32_t word = 0; diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py index d1df582..82666d9 100644 --- a/tools/sbl_patch.py +++ b/tools/sbl_patch.py @@ -2843,6 +2843,357 @@ def main(): save(d, 'img0_b41.elf') + # b42 = b41 + frameless S12-wrapper (push/pop removed): + # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K. + # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4 + # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral. + # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A): + # mid-function entry skipped the 48B prologue push; epilogue pop.w + # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap). + # Via prologue the frame balances and S20-pop returns to the caller. + # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop): + # b25 chained the wrapper pop to bx ip; with S12 preserving sp the + # frame is intact, while bx ip orphaned 8B per call (105M sp-smash). + # Content below = b39 body with the 0x8007B66 hunk reverted to pop. + # naked clock leaf never sets r3 (stale stacked return addr, + # observed 0x8007975); the store writes 0xffff over live code, + # faulting the next fetch there. Peripheral write, nothing in emu + # reads it back (polls use scaffolded [0x73A100]). Same rationale + # as the b17 stm NOP. 2B->2B, no eating. + d = bytearray(base) + + for va, (a, b) in BLX2BL.items(): + + set4(d, va, b) + + for va, exp, new in [ + + (0x802F664, 'e4f77efc', 'c046c046'), + + (0x802F672, 'e6f7bbfa', 'c046c046'), + + (0x802F678, 'e9f7fef9', 'c046c046'), + + (0x801B71E, '9847fee7', 'c046c046'), + + (0x8008396, 'fef780f9', 'c046c046'), + + (0x8016184, 'fdf790fc', 'c046c046'), + + (0x801B76C, '280b0508', '00000708'), + + (0x8017AFC, 'bde8fc87', 'eef74fb8'), + + (0x802F690, '9847fee7', 'c046c046'), + + (0x801671C, '9847fee7', 'c046c046'), + + (0x8013BAC, 'f8bd0a4a', 'f3f730b8'), + + (0x801B6BE, 'bde8f081', 'ebf7c3ba'), + + (0x8016720, '10bd0000', 'f0f7b2ba'), + + (0x8034810, 'bde8fc87', 'd2f76eba'), + + (0x8007798, 'bde8f08f', 'fff7c3ba'), + + (0x8016334, 'f0f7a4ff', 'c046c046'), + + (0x8016342, 'f0f79eef', 'f0f79dbf'), + + (0x802F9A0, 'ffe70648', 'd7f7c4b9'), + + (0x802F9B2, 'fee78817', 'd7f7bbb9'), + + (0x802F9A2, 'c4b943f2', 'd7f7c3b9'), + + (0x800EB96, 'bde8fe8f', 'f8f7cfb8'), + + (0x8007916, 'bde8f09f', 'fff720ba'), + + ]: + + assert hx(d, va) == exp, (hex(va), hx(d, va)) + + set4(d, va, new) + + # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18). + o = off(0x8006682) + + assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6) + + d[o:o + 6] = bytes.fromhex('c046c046c046') + + o = off(0x8013AA8) + + assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8) + + d[o:o + 4] = bytes.fromhex('c046c046') + + o = off(0x8013BA6) + + assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2)) + + d[o:o + 2] = bytes.fromhex('ff20') + + # b40: S12-wrapper pop RESTORED (revert b25 chain at this site). + # b25 sent pop to bx ip because the pop read scratch; with S12 + # preserving sp the frame is intact, while bx ip orphaned 8B per + # call and smashed sp into text at 105M. S16 keeps serving B66. + o = off(0x8007B66) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2) + + # Clock S11 (see b24). + o = off(0x800E988) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2) + + d[o:o + 2] = bytes.fromhex('7047') + + # Poll re-init skip (see b27). + o = off(0x8007748) + + assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2) + + d[o:o + 2] = bytes.fromhex('14e0') + + # Poll-epilogue add NOP (see b28). + o = off(0x8007794) + + assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + # Partition wrap-check (see b33). + o = off(0x801844E) + + assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2) + + d[o:o + 2] = bytes.fromhex('04e0') + + # Hang-site neutralize (see b34). + o = off(0x8018458) + + assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2) + + d[o:o + 2] = bytes.fromhex('ffe7') + + # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046). + o = off(0x800E986) + + assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + # b41 retarget. + o = off(0x8007790) + + assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790) + + d[o:o + 4] = bytes.fromhex('07f0bbfb') + + # b42 frameless wrapper. + o = off(0x8007B5E) + + assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + o = off(0x8007B66) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2) + + d[o:o + 2] = bytes.fromhex('7047') + + save(d, 'img0_b42.elf') + + # b43 = b42 revert (frameless hangs: tail bx lr loops on + # stale lr). The push is load-bearing (saves caller return for S12 + # keep-path). PBL contract instead: keep returns to tail, default + # diverts (S12 scaffold change, no image bytes for that part). + # b42 = b41 + frameless S12-wrapper (push/pop removed): + # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K. + # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4 + # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral. + # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A): + # mid-function entry skipped the 48B prologue push; epilogue pop.w + # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap). + # Via prologue the frame balances and S20-pop returns to the caller. + # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop): + # b25 chained the wrapper pop to bx ip; with S12 preserving sp the + # frame is intact, while bx ip orphaned 8B per call (105M sp-smash). + # Content below = b39 body with the 0x8007B66 hunk reverted to pop. + # naked clock leaf never sets r3 (stale stacked return addr, + # observed 0x8007975); the store writes 0xffff over live code, + # faulting the next fetch there. Peripheral write, nothing in emu + # reads it back (polls use scaffolded [0x73A100]). Same rationale + # as the b17 stm NOP. 2B->2B, no eating. + d = bytearray(base) + + for va, (a, b) in BLX2BL.items(): + + set4(d, va, b) + + for va, exp, new in [ + + (0x802F664, 'e4f77efc', 'c046c046'), + + (0x802F672, 'e6f7bbfa', 'c046c046'), + + (0x802F678, 'e9f7fef9', 'c046c046'), + + (0x801B71E, '9847fee7', 'c046c046'), + + (0x8008396, 'fef780f9', 'c046c046'), + + (0x8016184, 'fdf790fc', 'c046c046'), + + (0x801B76C, '280b0508', '00000708'), + + (0x8017AFC, 'bde8fc87', 'eef74fb8'), + + (0x802F690, '9847fee7', 'c046c046'), + + (0x801671C, '9847fee7', 'c046c046'), + + (0x8013BAC, 'f8bd0a4a', 'f3f730b8'), + + (0x801B6BE, 'bde8f081', 'ebf7c3ba'), + + (0x8016720, '10bd0000', 'f0f7b2ba'), + + (0x8034810, 'bde8fc87', 'd2f76eba'), + + (0x8007798, 'bde8f08f', 'fff7c3ba'), + + (0x8016334, 'f0f7a4ff', 'c046c046'), + + (0x8016342, 'f0f79eef', 'f0f79dbf'), + + (0x802F9A0, 'ffe70648', 'd7f7c4b9'), + + (0x802F9B2, 'fee78817', 'd7f7bbb9'), + + (0x802F9A2, 'c4b943f2', 'd7f7c3b9'), + + (0x800EB96, 'bde8fe8f', 'f8f7cfb8'), + + (0x8007916, 'bde8f09f', 'fff720ba'), + + ]: + + assert hx(d, va) == exp, (hex(va), hx(d, va)) + + set4(d, va, new) + + # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18). + o = off(0x8006682) + + assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6) + + d[o:o + 6] = bytes.fromhex('c046c046c046') + + o = off(0x8013AA8) + + assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8) + + d[o:o + 4] = bytes.fromhex('c046c046') + + o = off(0x8013BA6) + + assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2)) + + d[o:o + 2] = bytes.fromhex('ff20') + + # b40: S12-wrapper pop RESTORED (revert b25 chain at this site). + # b25 sent pop to bx ip because the pop read scratch; with S12 + # preserving sp the frame is intact, while bx ip orphaned 8B per + # call and smashed sp into text at 105M. S16 keeps serving B66. + o = off(0x8007B66) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2) + + # Clock S11 (see b24). + o = off(0x800E988) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2) + + d[o:o + 2] = bytes.fromhex('7047') + + # Poll re-init skip (see b27). + o = off(0x8007748) + + assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2) + + d[o:o + 2] = bytes.fromhex('14e0') + + # Poll-epilogue add NOP (see b28). + o = off(0x8007794) + + assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + # Partition wrap-check (see b33). + o = off(0x801844E) + + assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2) + + d[o:o + 2] = bytes.fromhex('04e0') + + # Hang-site neutralize (see b34). + o = off(0x8018458) + + assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2) + + d[o:o + 2] = bytes.fromhex('ffe7') + + # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046). + o = off(0x800E986) + + assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + # b41 retarget. + o = off(0x8007790) + + assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790) + + d[o:o + 4] = bytes.fromhex('07f0bbfb') + + # b42 frameless wrapper. + o = off(0x8007B5E) + + assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2) + + d[o:o + 2] = bytes.fromhex('c046') + + o = off(0x8007B66) + + assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2) + + d[o:o + 2] = bytes.fromhex('7047') + + # b43 revert frameless. + o = off(0x8007B5E) + + assert d[o:o + 2].hex() == 'c046', hx(d, 0x8007B5E, 2) + + d[o:o + 2] = bytes.fromhex('10b5') + + o = off(0x8007B66) + + assert d[o:o + 2].hex() == '7047', hx(d, 0x8007B66, 2) + + d[o:o + 2] = bytes.fromhex('10bd') + + save(d, 'img0_b43.elf') + + + diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py index 202b30c..3797d8b 100644 --- a/tools/sbl_uni.py +++ b/tools/sbl_uni.py @@ -136,6 +136,9 @@ def main(): if "--trapn" in sys.argv: _trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])] _spmax = [0x085FFF00] + _spd = [None] + _spb = {} if '--sphist' in sys.argv else None + _tpop = [] if '--tpop' in sys.argv else None _splog = [] if "--spytrack" in sys.argv else None elog = [] if "--entrylog" in sys.argv else None _prev = [0] @@ -152,9 +155,35 @@ def main(): def hook_code(mu, addr, size, data): count[0] += 1 last[0] = addr + if _spb is not None: + try: + _spn = mu.reg_read(UC_ARM_REG_SP) + except Exception: + _spn = None + if _spn is not None and _spd[0] is not None and _spn != _spd[0]: + _e = _spb.get(_prev[0]) + if _e is None: + _spb[_prev[0]] = [_spn - _spd[0], 1] + else: + _e[0] += _spn - _spd[0] + _e[1] += 1 + _spd[0] = _spn + if _tpop is not None and _prev[0] == 0x8007B66 and len(_tpop) < 3000: + _tpop.append((count[0], addr)) if count[0] % 200000 == 0: from unicorn.arm_const import UC_ARM_REG_SP as _SX - print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), flush=True) + _RR = mu.reg_read + from unicorn.arm_const import UC_ARM_REG_R4 as _R4 + from unicorn.arm_const import UC_ARM_REG_R5 as _R5 + from unicorn.arm_const import UC_ARM_REG_R6 as _R6 + from unicorn.arm_const import UC_ARM_REG_R7 as _R7 + from unicorn.arm_const import UC_ARM_REG_R8 as _R8 + from unicorn.arm_const import UC_ARM_REG_R9 as _R9 + from unicorn.arm_const import UC_ARM_REG_R10 as _RA + from unicorn.arm_const import UC_ARM_REG_R11 as _RB + print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), + hex(_RR(_R4)), hex(_RR(_R5)), hex(_RR(_R6)), hex(_RR(_R7)), + hex(_RR(_R8)), hex(_RR(_R9)), hex(_RR(_RA)), hex(_RR(_RB)), flush=True) _pp = _prev[0] _prev[0] = addr if addr == _pp + 2 or addr == _pp + 4: @@ -505,17 +534,20 @@ def main(): # to the dispatcher via stale lr (TZ bringup deferred). # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF). mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47])) - # S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes - # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/ - # non-code => ip=poll resumption 0x8007779; else keep pushed-lr - # (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak - # down is harmless); restore r7; ACK peripheral bit1; bx lr. - # PBL would place the real ARM helper here. + # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding + # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr). + # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to + # wrapper tail (paired pop, balanced). default (STUBV/even/non-code, + # i.e. unpaired entry): shared restore/ACK then bx ip to poll + # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would + # place the real ARM helper here. mu.mem_write(0x08006964, bytes.fromhex( - "04c09de58d3b06e3003840e303005ce10900000a0100" - "1ce30700000a2c3ca0e1080053e30000001a050000ea" - "2c3ea0e1080053e30000001a010000ea79c707e300c8" - "40e300700ae3737040e30c309fe5002093e5022082e3" + "04c09de58d3b06e3003840e303005ce10900000a" + "01001ce30700000a2c3ca0e1080053e30000001a" + "0d0000ea2c3ea0e1080053e30000001a090000ea" + "79c707e300c840e300700ae3737040e30c309fe5" + "002093e5022082e3002083e51cff2fe100a17300" + "00700ae3737040e30c309fe5002093e5022082e3" "002083e51eff2fe100a17300")) # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip. # ip==STUBV (fill/maze, never a legit return) => default; @@ -736,6 +768,16 @@ def main(): a, sz = int(a, 0), int(sz, 0) print(f"mem[{a:#x}+{sz:#x}]:") print(bytes(mu.mem_read(a, sz)).hex()) + if _tpop is not None: + print('tpop:', len(_tpop)) + from collections import Counter as _C + _cc = _C((a >> 12) << 12 for _, a in _tpop) + print(sorted(_cc.items(), key=lambda kv: -kv[1])[:12]) + if _spb is not None: + print('sphist:') + _sk = sorted(_spb, key=lambda k: -_spb[k][0])[:25] + for _k in _sk: + print(hex(_k), 'total=', _spb[_k][0], 'n=', _spb[_k][1]) print("UART:", "".join(uart_out)[:160]) print(f"stubguard-hits: {_swn[0]}") for _pc, _a, _s in _swlog: