b43: revert frameless (hang), S12 keep/divert split (PBL contract), sphist+tpop diag
This commit is contained in:
SashegDev
+1
-1
@@ -5,7 +5,7 @@
|
||||
set -e
|
||||
cd "$(dirname "$0")/.."
|
||||
QEMU=~/qemu-src/qemu-8.2.2/build/qemu-system-arm
|
||||
B=${1:-b40}
|
||||
B=${1:-b43}
|
||||
IMG=fw/img/emmc-real.img
|
||||
if [ ! -f "$IMG" ]; then
|
||||
echo "no $IMG — сначала: python3 tools/ffu_extract.py fw/dl/RM1127_059X5R5_orig.ffu --emmc-user fw/img/user-real.bin"
|
||||
|
||||
+12
-8
@@ -788,11 +788,12 @@ static void saimaa_machine_init(MachineState *machine)
|
||||
uint32_t v = 0x47702000;
|
||||
cpu_physical_memory_write(0x00221EF8, &v, 4);
|
||||
}
|
||||
/* S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding
|
||||
/* S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
|
||||
* becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
|
||||
* ip==STUBV/even/non-code => ip=poll resumption 0x8007779;
|
||||
* else keep pushed-lr (NO add-sp!); restore r7;
|
||||
* ACK peripheral bit1 ([literal 0x073A100]); bx lr.
|
||||
* keep (odd code): appended tail restores r7, ACKs bit1,
|
||||
* ([literal2 0x073A100]) and bx lr to wrapper tail (paired
|
||||
* pop, balanced). default: shared restore/ACK then bx ip to
|
||||
* poll resumption (no tail visit, no creep).
|
||||
* PBL would place the real ARM helper here. */
|
||||
{
|
||||
static const uint8_t s12[] = {
|
||||
@@ -801,15 +802,18 @@ static void saimaa_machine_init(MachineState *machine)
|
||||
0x09, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
|
||||
0x07, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
|
||||
0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
|
||||
0x05, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
|
||||
0x0d, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
|
||||
0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
|
||||
0x01, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
|
||||
0x09, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
|
||||
0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3,
|
||||
0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
|
||||
0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
|
||||
0x00, 0x20, 0x83, 0xe5, 0x1c, 0xff, 0x2f, 0xe1,
|
||||
0x00, 0xa1, 0x73, 0x00, 0x00, 0x70, 0x0a, 0xe3,
|
||||
0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
|
||||
0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
|
||||
0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
|
||||
0x00, 0xa1, 0x73, 0x00,
|
||||
};
|
||||
0x00, 0xa1, 0x73, 0x00,};
|
||||
size_t k;
|
||||
for (k = 0; k < sizeof(s12); k += 4) {
|
||||
uint32_t word = 0;
|
||||
|
||||
@@ -2843,6 +2843,357 @@ def main():
|
||||
|
||||
save(d, 'img0_b41.elf')
|
||||
|
||||
# b42 = b41 + frameless S12-wrapper (push/pop removed):
|
||||
# tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
|
||||
# S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
|
||||
# untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
|
||||
# b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
|
||||
# mid-function entry skipped the 48B prologue push; epilogue pop.w
|
||||
# then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
|
||||
# Via prologue the frame balances and S20-pop returns to the caller.
|
||||
# b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
|
||||
# b25 chained the wrapper pop to bx ip; with S12 preserving sp the
|
||||
# frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
|
||||
# Content below = b39 body with the 0x8007B66 hunk reverted to pop.
|
||||
# naked clock leaf never sets r3 (stale stacked return addr,
|
||||
# observed 0x8007975); the store writes 0xffff over live code,
|
||||
# faulting the next fetch there. Peripheral write, nothing in emu
|
||||
# reads it back (polls use scaffolded [0x73A100]). Same rationale
|
||||
# as the b17 stm NOP. 2B->2B, no eating.
|
||||
d = bytearray(base)
|
||||
|
||||
for va, (a, b) in BLX2BL.items():
|
||||
|
||||
set4(d, va, b)
|
||||
|
||||
for va, exp, new in [
|
||||
|
||||
(0x802F664, 'e4f77efc', 'c046c046'),
|
||||
|
||||
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
||||
|
||||
(0x802F678, 'e9f7fef9', 'c046c046'),
|
||||
|
||||
(0x801B71E, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8008396, 'fef780f9', 'c046c046'),
|
||||
|
||||
(0x8016184, 'fdf790fc', 'c046c046'),
|
||||
|
||||
(0x801B76C, '280b0508', '00000708'),
|
||||
|
||||
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
||||
|
||||
(0x802F690, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x801671C, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
||||
|
||||
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
||||
|
||||
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
||||
|
||||
(0x8034810, 'bde8fc87', 'd2f76eba'),
|
||||
|
||||
(0x8007798, 'bde8f08f', 'fff7c3ba'),
|
||||
|
||||
(0x8016334, 'f0f7a4ff', 'c046c046'),
|
||||
|
||||
(0x8016342, 'f0f79eef', 'f0f79dbf'),
|
||||
|
||||
(0x802F9A0, 'ffe70648', 'd7f7c4b9'),
|
||||
|
||||
(0x802F9B2, 'fee78817', 'd7f7bbb9'),
|
||||
|
||||
(0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
|
||||
|
||||
(0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
|
||||
|
||||
(0x8007916, 'bde8f09f', 'fff720ba'),
|
||||
|
||||
]:
|
||||
|
||||
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
||||
|
||||
set4(d, va, new)
|
||||
|
||||
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
||||
o = off(0x8006682)
|
||||
|
||||
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
||||
|
||||
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
||||
|
||||
o = off(0x8013AA8)
|
||||
|
||||
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
||||
|
||||
d[o:o + 4] = bytes.fromhex('c046c046')
|
||||
|
||||
o = off(0x8013BA6)
|
||||
|
||||
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('ff20')
|
||||
|
||||
# b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
|
||||
# b25 sent pop to bx ip because the pop read scratch; with S12
|
||||
# preserving sp the frame is intact, while bx ip orphaned 8B per
|
||||
# call and smashed sp into text at 105M. S16 keeps serving B66.
|
||||
o = off(0x8007B66)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
||||
|
||||
# Clock S11 (see b24).
|
||||
o = off(0x800E988)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('7047')
|
||||
|
||||
# Poll re-init skip (see b27).
|
||||
o = off(0x8007748)
|
||||
|
||||
assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('14e0')
|
||||
|
||||
# Poll-epilogue add NOP (see b28).
|
||||
o = off(0x8007794)
|
||||
|
||||
assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
# Partition wrap-check (see b33).
|
||||
o = off(0x801844E)
|
||||
|
||||
assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('04e0')
|
||||
|
||||
# Hang-site neutralize (see b34).
|
||||
o = off(0x8018458)
|
||||
|
||||
assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('ffe7')
|
||||
|
||||
# Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
|
||||
o = off(0x800E986)
|
||||
|
||||
assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
# b41 retarget.
|
||||
o = off(0x8007790)
|
||||
|
||||
assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
|
||||
|
||||
d[o:o + 4] = bytes.fromhex('07f0bbfb')
|
||||
|
||||
# b42 frameless wrapper.
|
||||
o = off(0x8007B5E)
|
||||
|
||||
assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
o = off(0x8007B66)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('7047')
|
||||
|
||||
save(d, 'img0_b42.elf')
|
||||
|
||||
# b43 = b42 revert (frameless hangs: tail bx lr loops on
|
||||
# stale lr). The push is load-bearing (saves caller return for S12
|
||||
# keep-path). PBL contract instead: keep returns to tail, default
|
||||
# diverts (S12 scaffold change, no image bytes for that part).
|
||||
# b42 = b41 + frameless S12-wrapper (push/pop removed):
|
||||
# tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
|
||||
# S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
|
||||
# untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
|
||||
# b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
|
||||
# mid-function entry skipped the 48B prologue push; epilogue pop.w
|
||||
# then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
|
||||
# Via prologue the frame balances and S20-pop returns to the caller.
|
||||
# b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
|
||||
# b25 chained the wrapper pop to bx ip; with S12 preserving sp the
|
||||
# frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
|
||||
# Content below = b39 body with the 0x8007B66 hunk reverted to pop.
|
||||
# naked clock leaf never sets r3 (stale stacked return addr,
|
||||
# observed 0x8007975); the store writes 0xffff over live code,
|
||||
# faulting the next fetch there. Peripheral write, nothing in emu
|
||||
# reads it back (polls use scaffolded [0x73A100]). Same rationale
|
||||
# as the b17 stm NOP. 2B->2B, no eating.
|
||||
d = bytearray(base)
|
||||
|
||||
for va, (a, b) in BLX2BL.items():
|
||||
|
||||
set4(d, va, b)
|
||||
|
||||
for va, exp, new in [
|
||||
|
||||
(0x802F664, 'e4f77efc', 'c046c046'),
|
||||
|
||||
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
||||
|
||||
(0x802F678, 'e9f7fef9', 'c046c046'),
|
||||
|
||||
(0x801B71E, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8008396, 'fef780f9', 'c046c046'),
|
||||
|
||||
(0x8016184, 'fdf790fc', 'c046c046'),
|
||||
|
||||
(0x801B76C, '280b0508', '00000708'),
|
||||
|
||||
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
||||
|
||||
(0x802F690, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x801671C, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
||||
|
||||
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
||||
|
||||
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
||||
|
||||
(0x8034810, 'bde8fc87', 'd2f76eba'),
|
||||
|
||||
(0x8007798, 'bde8f08f', 'fff7c3ba'),
|
||||
|
||||
(0x8016334, 'f0f7a4ff', 'c046c046'),
|
||||
|
||||
(0x8016342, 'f0f79eef', 'f0f79dbf'),
|
||||
|
||||
(0x802F9A0, 'ffe70648', 'd7f7c4b9'),
|
||||
|
||||
(0x802F9B2, 'fee78817', 'd7f7bbb9'),
|
||||
|
||||
(0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
|
||||
|
||||
(0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
|
||||
|
||||
(0x8007916, 'bde8f09f', 'fff720ba'),
|
||||
|
||||
]:
|
||||
|
||||
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
||||
|
||||
set4(d, va, new)
|
||||
|
||||
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
||||
o = off(0x8006682)
|
||||
|
||||
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
||||
|
||||
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
||||
|
||||
o = off(0x8013AA8)
|
||||
|
||||
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
||||
|
||||
d[o:o + 4] = bytes.fromhex('c046c046')
|
||||
|
||||
o = off(0x8013BA6)
|
||||
|
||||
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('ff20')
|
||||
|
||||
# b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
|
||||
# b25 sent pop to bx ip because the pop read scratch; with S12
|
||||
# preserving sp the frame is intact, while bx ip orphaned 8B per
|
||||
# call and smashed sp into text at 105M. S16 keeps serving B66.
|
||||
o = off(0x8007B66)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
||||
|
||||
# Clock S11 (see b24).
|
||||
o = off(0x800E988)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('7047')
|
||||
|
||||
# Poll re-init skip (see b27).
|
||||
o = off(0x8007748)
|
||||
|
||||
assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('14e0')
|
||||
|
||||
# Poll-epilogue add NOP (see b28).
|
||||
o = off(0x8007794)
|
||||
|
||||
assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
# Partition wrap-check (see b33).
|
||||
o = off(0x801844E)
|
||||
|
||||
assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('04e0')
|
||||
|
||||
# Hang-site neutralize (see b34).
|
||||
o = off(0x8018458)
|
||||
|
||||
assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('ffe7')
|
||||
|
||||
# Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
|
||||
o = off(0x800E986)
|
||||
|
||||
assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
# b41 retarget.
|
||||
o = off(0x8007790)
|
||||
|
||||
assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
|
||||
|
||||
d[o:o + 4] = bytes.fromhex('07f0bbfb')
|
||||
|
||||
# b42 frameless wrapper.
|
||||
o = off(0x8007B5E)
|
||||
|
||||
assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('c046')
|
||||
|
||||
o = off(0x8007B66)
|
||||
|
||||
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('7047')
|
||||
|
||||
# b43 revert frameless.
|
||||
o = off(0x8007B5E)
|
||||
|
||||
assert d[o:o + 2].hex() == 'c046', hx(d, 0x8007B5E, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('10b5')
|
||||
|
||||
o = off(0x8007B66)
|
||||
|
||||
assert d[o:o + 2].hex() == '7047', hx(d, 0x8007B66, 2)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('10bd')
|
||||
|
||||
save(d, 'img0_b43.elf')
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+53
-11
@@ -136,6 +136,9 @@ def main():
|
||||
if "--trapn" in sys.argv:
|
||||
_trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])]
|
||||
_spmax = [0x085FFF00]
|
||||
_spd = [None]
|
||||
_spb = {} if '--sphist' in sys.argv else None
|
||||
_tpop = [] if '--tpop' in sys.argv else None
|
||||
_splog = [] if "--spytrack" in sys.argv else None
|
||||
elog = [] if "--entrylog" in sys.argv else None
|
||||
_prev = [0]
|
||||
@@ -152,9 +155,35 @@ def main():
|
||||
def hook_code(mu, addr, size, data):
|
||||
count[0] += 1
|
||||
last[0] = addr
|
||||
if _spb is not None:
|
||||
try:
|
||||
_spn = mu.reg_read(UC_ARM_REG_SP)
|
||||
except Exception:
|
||||
_spn = None
|
||||
if _spn is not None and _spd[0] is not None and _spn != _spd[0]:
|
||||
_e = _spb.get(_prev[0])
|
||||
if _e is None:
|
||||
_spb[_prev[0]] = [_spn - _spd[0], 1]
|
||||
else:
|
||||
_e[0] += _spn - _spd[0]
|
||||
_e[1] += 1
|
||||
_spd[0] = _spn
|
||||
if _tpop is not None and _prev[0] == 0x8007B66 and len(_tpop) < 3000:
|
||||
_tpop.append((count[0], addr))
|
||||
if count[0] % 200000 == 0:
|
||||
from unicorn.arm_const import UC_ARM_REG_SP as _SX
|
||||
print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), flush=True)
|
||||
_RR = mu.reg_read
|
||||
from unicorn.arm_const import UC_ARM_REG_R4 as _R4
|
||||
from unicorn.arm_const import UC_ARM_REG_R5 as _R5
|
||||
from unicorn.arm_const import UC_ARM_REG_R6 as _R6
|
||||
from unicorn.arm_const import UC_ARM_REG_R7 as _R7
|
||||
from unicorn.arm_const import UC_ARM_REG_R8 as _R8
|
||||
from unicorn.arm_const import UC_ARM_REG_R9 as _R9
|
||||
from unicorn.arm_const import UC_ARM_REG_R10 as _RA
|
||||
from unicorn.arm_const import UC_ARM_REG_R11 as _RB
|
||||
print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)),
|
||||
hex(_RR(_R4)), hex(_RR(_R5)), hex(_RR(_R6)), hex(_RR(_R7)),
|
||||
hex(_RR(_R8)), hex(_RR(_R9)), hex(_RR(_RA)), hex(_RR(_RB)), flush=True)
|
||||
_pp = _prev[0]
|
||||
_prev[0] = addr
|
||||
if addr == _pp + 2 or addr == _pp + 4:
|
||||
@@ -505,17 +534,20 @@ def main():
|
||||
# to the dispatcher via stale lr (TZ bringup deferred).
|
||||
# NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
|
||||
mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
|
||||
# S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes
|
||||
# smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
|
||||
# non-code => ip=poll resumption 0x8007779; else keep pushed-lr
|
||||
# (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak
|
||||
# down is harmless); restore r7; ACK peripheral bit1; bx lr.
|
||||
# PBL would place the real ARM helper here.
|
||||
# S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
|
||||
# smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
|
||||
# keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
|
||||
# wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
|
||||
# i.e. unpaired entry): shared restore/ACK then bx ip to poll
|
||||
# resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
|
||||
# place the real ARM helper here.
|
||||
mu.mem_write(0x08006964, bytes.fromhex(
|
||||
"04c09de58d3b06e3003840e303005ce10900000a0100"
|
||||
"1ce30700000a2c3ca0e1080053e30000001a050000ea"
|
||||
"2c3ea0e1080053e30000001a010000ea79c707e300c8"
|
||||
"40e300700ae3737040e30c309fe5002093e5022082e3"
|
||||
"04c09de58d3b06e3003840e303005ce10900000a"
|
||||
"01001ce30700000a2c3ca0e1080053e30000001a"
|
||||
"0d0000ea2c3ea0e1080053e30000001a090000ea"
|
||||
"79c707e300c840e300700ae3737040e30c309fe5"
|
||||
"002093e5022082e3002083e51cff2fe100a17300"
|
||||
"00700ae3737040e30c309fe5002093e5022082e3"
|
||||
"002083e51eff2fe100a17300"))
|
||||
# S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
|
||||
# ip==STUBV (fill/maze, never a legit return) => default;
|
||||
@@ -736,6 +768,16 @@ def main():
|
||||
a, sz = int(a, 0), int(sz, 0)
|
||||
print(f"mem[{a:#x}+{sz:#x}]:")
|
||||
print(bytes(mu.mem_read(a, sz)).hex())
|
||||
if _tpop is not None:
|
||||
print('tpop:', len(_tpop))
|
||||
from collections import Counter as _C
|
||||
_cc = _C((a >> 12) << 12 for _, a in _tpop)
|
||||
print(sorted(_cc.items(), key=lambda kv: -kv[1])[:12])
|
||||
if _spb is not None:
|
||||
print('sphist:')
|
||||
_sk = sorted(_spb, key=lambda k: -_spb[k][0])[:25]
|
||||
for _k in _sk:
|
||||
print(hex(_k), 'total=', _spb[_k][0], 'n=', _spb[_k][1])
|
||||
print("UART:", "".join(uart_out)[:160])
|
||||
print(f"stubguard-hits: {_swn[0]}")
|
||||
for _pc, _a, _s in _swlog:
|
||||
|
||||
Reference in New Issue
Block a user