sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

S16v4: reject STUBV return

Browse Source
This commit is contained in:
lumia-emu
2026-09-13 12:15:25 +00:00
parent 7af645ef45
commit 751fb052d4
3 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/sbl_uni.py
+6 -5
View File
@@ -393,14 +393,15 @@ def main():
mu.mem_write(0x08006964, bytes.fromhex(
"04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
"00a17300"))
# S16-stublet (b27, 50B @0x08006CC0): smart return for B66 bx ip.
# ip odd + top 8 (code) => add sp,#8 (pop the helper frame it
# S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
# ip==STUBV (fill/maze, never a legit return) => default;
# ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66
# skipped!) + bx ip (legit pushed-lr return, un-leaks the stack);
# else default (restore r7, jump poll resumption 0x8007779).
mu.mem_write(0x08006CC0, bytes.fromhex(
"ddf804c01cf0010f0bd05fea1c63082b00d102b06047"
"5fea1c73082b00d160474af20007c0f2730747f2797c"
"c0f6000c6047"))
"ddf804c046f68d33c0f600039c450ed01cf0010f0bd0"
"5fea1c63082b01d102b060475fea1c73082b01d102b0"
"60474af20007c0f2730747f2797cc0f6000c6047"))
# stack zone fill (STUBV odd)
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
# pop-site slots (sp values from traces)