sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IMEM tripwire (poison broke stack)

Browse Source
This commit is contained in:
lumia-emu
2026-09-14 00:15:36 +00:00
parent 2a3bdcd72d
commit 503c334b2e
3 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/sbl_uni.py
+6 -5
View File
@@ -474,11 +474,12 @@ def main():
"60474af20007c0f2730747f2797cc0f6000c6047"))
# stack zone fill (STUBV odd)
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
# IMEM poison [0x8600000,0x8600F00): drift-sink trap. Fill/IMEM-zero
# sleds (fall-through ldr/movs/andeq) drift silently to IMEM-top
# fault; poison faults LOUDLY at drift-entry (UDF in both modes).
# IMEM stack [0x8600F00,0x8610000) left intact.
mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * (0xF00 // 4))
# IMEM tripwire [0x8600000,0x8600010): drift-sink trap (UDF).
# Fill-drift falls through here sequentially; faults LOUDLY at
# entry instead of sledding silently to IMEM-top. Rest of IMEM
# stays zeros (SBL IMEM-stack reads data there; full poison
# corrupts counters (0xFFFFFFFF vs fresh 0)!).
mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * 4)
# pop-site slots (sp values from traces)
for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
(0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),