b43: revert frameless (hang), S12 keep/divert split (PBL contract), sphist+tpop diag

2026-09-15 08:05:33 +00:00
parent 0692c22bef
commit 432e84bc95
4 changed files with 417 additions and 20 deletions
@@ -2843,6 +2843,357 @@ def main():

    save(d, 'img0_b41.elf')

+    # b42 = b41 + frameless S12-wrapper (push/pop removed):
+    # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
+    # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
+    # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
+    # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
+    # mid-function entry skipped the 48B prologue push; epilogue pop.w
+    # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
+    # Via prologue the frame balances and S20-pop returns to the caller.
+    # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
+    # b25 chained the wrapper pop to bx ip; with S12 preserving sp the
+    # frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
+    # Content below = b39 body with the 0x8007B66 hunk reverted to pop.
+    # naked clock leaf never sets r3 (stale stacked return addr,
+    # observed 0x8007975); the store writes 0xffff over live code,
+    # faulting the next fetch there. Peripheral write, nothing in emu
+    # reads it back (polls use scaffolded [0x73A100]). Same rationale
+    # as the b17 stm NOP. 2B->2B, no eating.
+    d = bytearray(base)
+
+    for va, (a, b) in BLX2BL.items():
+
+        set4(d, va, b)
+
+    for va, exp, new in [
+
+        (0x802F664, 'e4f77efc', 'c046c046'),
+
+        (0x802F672, 'e6f7bbfa', 'c046c046'),
+
+        (0x802F678, 'e9f7fef9', 'c046c046'),
+
+        (0x801B71E, '9847fee7', 'c046c046'),
+
+        (0x8008396, 'fef780f9', 'c046c046'),
+
+        (0x8016184, 'fdf790fc', 'c046c046'),
+
+        (0x801B76C, '280b0508', '00000708'),
+
+        (0x8017AFC, 'bde8fc87', 'eef74fb8'),
+
+        (0x802F690, '9847fee7', 'c046c046'),
+
+        (0x801671C, '9847fee7', 'c046c046'),
+
+        (0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
+
+        (0x801B6BE, 'bde8f081', 'ebf7c3ba'),
+
+        (0x8016720, '10bd0000', 'f0f7b2ba'),
+
+        (0x8034810, 'bde8fc87', 'd2f76eba'),
+
+        (0x8007798, 'bde8f08f', 'fff7c3ba'),
+
+        (0x8016334, 'f0f7a4ff', 'c046c046'),
+
+        (0x8016342, 'f0f79eef', 'f0f79dbf'),
+
+        (0x802F9A0, 'ffe70648', 'd7f7c4b9'),
+
+        (0x802F9B2, 'fee78817', 'd7f7bbb9'),
+
+        (0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
+
+        (0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
+
+        (0x8007916, 'bde8f09f', 'fff720ba'),
+
+    ]:
+
+        assert hx(d, va) == exp, (hex(va), hx(d, va))
+
+        set4(d, va, new)
+
+    # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
+    o = off(0x8006682)
+
+    assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
+
+    d[o:o + 6] = bytes.fromhex('c046c046c046')
+
+    o = off(0x8013AA8)
+
+    assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
+
+    d[o:o + 4] = bytes.fromhex('c046c046')
+
+    o = off(0x8013BA6)
+
+    assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
+
+    d[o:o + 2] = bytes.fromhex('ff20')
+
+    # b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
+    # b25 sent pop to bx ip because the pop read scratch; with S12
+    # preserving sp the frame is intact, while bx ip orphaned 8B per
+    # call and smashed sp into text at 105M. S16 keeps serving B66.
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    # Clock S11 (see b24).
+    o = off(0x800E988)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # Poll re-init skip (see b27).
+    o = off(0x8007748)
+
+    assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
+
+    d[o:o + 2] = bytes.fromhex('14e0')
+
+    # Poll-epilogue add NOP (see b28).
+    o = off(0x8007794)
+
+    assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # Partition wrap-check (see b33).
+    o = off(0x801844E)
+
+    assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
+
+    d[o:o + 2] = bytes.fromhex('04e0')
+
+    # Hang-site neutralize (see b34).
+    o = off(0x8018458)
+
+    assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
+
+    d[o:o + 2] = bytes.fromhex('ffe7')
+
+    # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
+    o = off(0x800E986)
+
+    assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # b41 retarget.
+    o = off(0x8007790)
+
+    assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
+
+    d[o:o + 4] = bytes.fromhex('07f0bbfb')
+
+    # b42 frameless wrapper.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    save(d, 'img0_b42.elf')
+
+    # b43 = b42 revert (frameless hangs: tail bx lr loops on
+    # stale lr). The push is load-bearing (saves caller return for S12
+    # keep-path). PBL contract instead: keep returns to tail, default
+    # diverts (S12 scaffold change, no image bytes for that part).
+    # b42 = b41 + frameless S12-wrapper (push/pop removed):
+    # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
+    # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
+    # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
+    # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
+    # mid-function entry skipped the 48B prologue push; epilogue pop.w
+    # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
+    # Via prologue the frame balances and S20-pop returns to the caller.
+    # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
+    # b25 chained the wrapper pop to bx ip; with S12 preserving sp the
+    # frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
+    # Content below = b39 body with the 0x8007B66 hunk reverted to pop.
+    # naked clock leaf never sets r3 (stale stacked return addr,
+    # observed 0x8007975); the store writes 0xffff over live code,
+    # faulting the next fetch there. Peripheral write, nothing in emu
+    # reads it back (polls use scaffolded [0x73A100]). Same rationale
+    # as the b17 stm NOP. 2B->2B, no eating.
+    d = bytearray(base)
+
+    for va, (a, b) in BLX2BL.items():
+
+        set4(d, va, b)
+
+    for va, exp, new in [
+
+        (0x802F664, 'e4f77efc', 'c046c046'),
+
+        (0x802F672, 'e6f7bbfa', 'c046c046'),
+
+        (0x802F678, 'e9f7fef9', 'c046c046'),
+
+        (0x801B71E, '9847fee7', 'c046c046'),
+
+        (0x8008396, 'fef780f9', 'c046c046'),
+
+        (0x8016184, 'fdf790fc', 'c046c046'),
+
+        (0x801B76C, '280b0508', '00000708'),
+
+        (0x8017AFC, 'bde8fc87', 'eef74fb8'),
+
+        (0x802F690, '9847fee7', 'c046c046'),
+
+        (0x801671C, '9847fee7', 'c046c046'),
+
+        (0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
+
+        (0x801B6BE, 'bde8f081', 'ebf7c3ba'),
+
+        (0x8016720, '10bd0000', 'f0f7b2ba'),
+
+        (0x8034810, 'bde8fc87', 'd2f76eba'),
+
+        (0x8007798, 'bde8f08f', 'fff7c3ba'),
+
+        (0x8016334, 'f0f7a4ff', 'c046c046'),
+
+        (0x8016342, 'f0f79eef', 'f0f79dbf'),
+
+        (0x802F9A0, 'ffe70648', 'd7f7c4b9'),
+
+        (0x802F9B2, 'fee78817', 'd7f7bbb9'),
+
+        (0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
+
+        (0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
+
+        (0x8007916, 'bde8f09f', 'fff720ba'),
+
+    ]:
+
+        assert hx(d, va) == exp, (hex(va), hx(d, va))
+
+        set4(d, va, new)
+
+    # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
+    o = off(0x8006682)
+
+    assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
+
+    d[o:o + 6] = bytes.fromhex('c046c046c046')
+
+    o = off(0x8013AA8)
+
+    assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
+
+    d[o:o + 4] = bytes.fromhex('c046c046')
+
+    o = off(0x8013BA6)
+
+    assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
+
+    d[o:o + 2] = bytes.fromhex('ff20')
+
+    # b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
+    # b25 sent pop to bx ip because the pop read scratch; with S12
+    # preserving sp the frame is intact, while bx ip orphaned 8B per
+    # call and smashed sp into text at 105M. S16 keeps serving B66.
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    # Clock S11 (see b24).
+    o = off(0x800E988)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # Poll re-init skip (see b27).
+    o = off(0x8007748)
+
+    assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
+
+    d[o:o + 2] = bytes.fromhex('14e0')
+
+    # Poll-epilogue add NOP (see b28).
+    o = off(0x8007794)
+
+    assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # Partition wrap-check (see b33).
+    o = off(0x801844E)
+
+    assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
+
+    d[o:o + 2] = bytes.fromhex('04e0')
+
+    # Hang-site neutralize (see b34).
+    o = off(0x8018458)
+
+    assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
+
+    d[o:o + 2] = bytes.fromhex('ffe7')
+
+    # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
+    o = off(0x800E986)
+
+    assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # b41 retarget.
+    o = off(0x8007790)
+
+    assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
+
+    d[o:o + 4] = bytes.fromhex('07f0bbfb')
+
+    # b42 frameless wrapper.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # b43 revert frameless.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == 'c046', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('10b5')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '7047', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('10bd')
+
+    save(d, 'img0_b43.elf')
+
+
+



@@ -136,6 +136,9 @@ def main():
    if "--trapn" in sys.argv:
        _trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])]
    _spmax = [0x085FFF00]
+    _spd = [None]
+    _spb = {} if '--sphist' in sys.argv else None
+    _tpop = [] if '--tpop' in sys.argv else None
    _splog = [] if "--spytrack" in sys.argv else None
    elog = [] if "--entrylog" in sys.argv else None
    _prev = [0]
@@ -152,9 +155,35 @@ def main():
    def hook_code(mu, addr, size, data):
        count[0] += 1
        last[0] = addr
+        if _spb is not None:
+            try:
+                _spn = mu.reg_read(UC_ARM_REG_SP)
+            except Exception:
+                _spn = None
+            if _spn is not None and _spd[0] is not None and _spn != _spd[0]:
+                _e = _spb.get(_prev[0])
+                if _e is None:
+                    _spb[_prev[0]] = [_spn - _spd[0], 1]
+                else:
+                    _e[0] += _spn - _spd[0]
+                    _e[1] += 1
+            _spd[0] = _spn
+        if _tpop is not None and _prev[0] == 0x8007B66 and len(_tpop) < 3000:
+            _tpop.append((count[0], addr))
        if count[0] % 200000 == 0:
            from unicorn.arm_const import UC_ARM_REG_SP as _SX
-            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), flush=True)
+            _RR = mu.reg_read
+            from unicorn.arm_const import UC_ARM_REG_R4 as _R4
+            from unicorn.arm_const import UC_ARM_REG_R5 as _R5
+            from unicorn.arm_const import UC_ARM_REG_R6 as _R6
+            from unicorn.arm_const import UC_ARM_REG_R7 as _R7
+            from unicorn.arm_const import UC_ARM_REG_R8 as _R8
+            from unicorn.arm_const import UC_ARM_REG_R9 as _R9
+            from unicorn.arm_const import UC_ARM_REG_R10 as _RA
+            from unicorn.arm_const import UC_ARM_REG_R11 as _RB
+            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)),
+                  hex(_RR(_R4)), hex(_RR(_R5)), hex(_RR(_R6)), hex(_RR(_R7)),
+                  hex(_RR(_R8)), hex(_RR(_R9)), hex(_RR(_RA)), hex(_RR(_RB)), flush=True)
        _pp = _prev[0]
        _prev[0] = addr
        if addr == _pp + 2 or addr == _pp + 4:
@@ -505,17 +534,20 @@ def main():
    # to the dispatcher via stale lr (TZ bringup deferred).
    # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
    mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes
-    # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
-    # non-code => ip=poll resumption 0x8007779; else keep pushed-lr
-    # (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak
-    # down is harmless); restore r7; ACK peripheral bit1; bx lr.
-    # PBL would place the real ARM helper here.
+    # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
+    # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
+    # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
+    # wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
+    # i.e. unpaired entry): shared restore/ACK then bx ip to poll
+    # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
+    # place the real ARM helper here.
    mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10900000a0100"
-        "1ce30700000a2c3ca0e1080053e30000001a050000ea"
-        "2c3ea0e1080053e30000001a010000ea79c707e300c8"
-        "40e300700ae3737040e30c309fe5002093e5022082e3"
+        "04c09de58d3b06e3003840e303005ce10900000a"
+        "01001ce30700000a2c3ca0e1080053e30000001a"
+        "0d0000ea2c3ea0e1080053e30000001a090000ea"
+        "79c707e300c840e300700ae3737040e30c309fe5"
+        "002093e5022082e3002083e51cff2fe100a17300"
+        "00700ae3737040e30c309fe5002093e5022082e3"
        "002083e51eff2fe100a17300"))
    # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
    # ip==STUBV (fill/maze, never a legit return) => default;
@@ -736,6 +768,16 @@ def main():
            a, sz = int(a, 0), int(sz, 0)
            print(f"mem[{a:#x}+{sz:#x}]:")
            print(bytes(mu.mem_read(a, sz)).hex())
+    if _tpop is not None:
+        print('tpop:', len(_tpop))
+        from collections import Counter as _C
+        _cc = _C((a >> 12) << 12 for _, a in _tpop)
+        print(sorted(_cc.items(), key=lambda kv: -kv[1])[:12])
+    if _spb is not None:
+        print('sphist:')
+        _sk = sorted(_spb, key=lambda k: -_spb[k][0])[:25]
+        for _k in _sk:
+            print(hex(_k), 'total=', _spb[_k][0], 'n=', _spb[_k][1])
    print("UART:", "".join(uart_out)[:160])
    print(f"stubguard-hits: {_swn[0]}")
    for _pc, _a, _s in _swlog: