sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

S16v4: reject STUBV return

Browse Source
This commit is contained in:
lumia-emu
2026-09-13 12:15:25 +00:00
parent 7af645ef45
commit 751fb052d4
3 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sbl-bringup.md
+2
View File
@@ -127,3 +127,5 @@
Патч 2B→2B в `b`. Биты 0,1,2 `[0x73A100]` pref-set (scaffold). Патч 2B→2B в `b`. Биты 0,1,2 `[0x73A100]` pref-set (scaffold).
- S16v3: `add sp,#8` перед `bx ip` (снимает helper-фрейм, пропущенный - S16v3: `add sp,#8` перед `bx ip` (снимает helper-фрейм, пропущенный
B66 — un-leak стека вниз). B66 — un-leak стека вниз).
- S16v4: отбраковка `ip==STUBV` (fill/maze — никогда legit return) →
default вместо возврата в maze (разрыв maze-B66 петли).
qemu/saimaa.c
+14 -12
View File
@@ -751,20 +751,22 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x08006964 + k, &word, 4); cpu_physical_memory_write(0x08006964 + k, &word, 4);
} }
} }
/* S16-stublet (b27, 50B @0x08006CC0): smart return for the /* S16-stublet (b27, 64B @0x08006CC0): smart return for the
* B66 bx-ip chain. ip odd + top 8 => add sp,#8 (pop the * B66 bx-ip chain. ip==STUBV (fill/maze, never legit) =>
* helper frame B66 skipped!) + bx ip (legit pushed-lr, * default; ip odd + top 8 => add sp,#8 (pop the helper
* un-leaks the stack); else default (restore r7, jump poll * frame B66 skipped!) + bx ip (legit pushed-lr, un-leaks);
* resumption 0x8007779 via ip). */ * else default (restore r7, jump poll resumption 0x8007779
* via ip). */
{ {
static const uint8_t s16[] = { static const uint8_t s16[] = {
0xdd, 0xf8, 0x04, 0xc0, 0x1c, 0xf0, 0x01, 0x0f, 0xdd, 0xf8, 0x04, 0xc0, 0x46, 0xf6, 0x8d, 0x33,
0x0b, 0xd0, 0x5f, 0xea, 0x1c, 0x63, 0x08, 0x2b, 0xc0, 0xf6, 0x00, 0x03, 0x9c, 0x45, 0x0e, 0xd0,
0x00, 0xd1, 0x02, 0xb0, 0x60, 0x47, 0x5f, 0xea, 0x1c, 0xf0, 0x01, 0x0f, 0x0b, 0xd0, 0x5f, 0xea,
0x1c, 0x73, 0x08, 0x2b, 0x00, 0xd1, 0x60, 0x47, 0x1c, 0x63, 0x08, 0x2b, 0x01, 0xd1, 0x02, 0xb0,
0x4a, 0xf2, 0x00, 0x07, 0xc0, 0xf2, 0x73, 0x07, 0x60, 0x47, 0x5f, 0xea, 0x1c, 0x73, 0x08, 0x2b,
0x47, 0xf2, 0x79, 0x7c, 0xc0, 0xf6, 0x00, 0x0c, 0x01, 0xd1, 0x02, 0xb0, 0x60, 0x47, 0x4a, 0xf2,
0x60, 0x47, 0x00, 0x07, 0xc0, 0xf2, 0x73, 0x07, 0x47, 0xf2,
0x79, 0x7c, 0xc0, 0xf6, 0x00, 0x0c, 0x60, 0x47,
}; };
size_t k; size_t k;
for (k = 0; k < sizeof(s16); k += 4) { for (k = 0; k < sizeof(s16); k += 4) {
tools/sbl_uni.py
+6 -5
View File
@@ -393,14 +393,15 @@ def main():
mu.mem_write(0x08006964, bytes.fromhex( mu.mem_write(0x08006964, bytes.fromhex(
"04c09de50c309fe5002093e5022082e3002083e51eff2fe1" "04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
"00a17300")) "00a17300"))
# S16-stublet (b27, 50B @0x08006CC0): smart return for B66 bx ip. # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
# ip odd + top 8 (code) => add sp,#8 (pop the helper frame it # ip==STUBV (fill/maze, never a legit return) => default;
# ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66
# skipped!) + bx ip (legit pushed-lr return, un-leaks the stack); # skipped!) + bx ip (legit pushed-lr return, un-leaks the stack);
# else default (restore r7, jump poll resumption 0x8007779). # else default (restore r7, jump poll resumption 0x8007779).
mu.mem_write(0x08006CC0, bytes.fromhex( mu.mem_write(0x08006CC0, bytes.fromhex(
"ddf804c01cf0010f0bd05fea1c63082b00d102b06047" "ddf804c046f68d33c0f600039c450ed01cf0010f0bd0"
"5fea1c73082b00d160474af20007c0f2730747f2797c" "5fea1c63082b01d102b060475fea1c73082b01d102b0"
"c0f6000c6047")) "60474af20007c0f2730747f2797cc0f6000c6047"))
# stack zone fill (STUBV odd) # stack zone fill (STUBV odd)
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4)) mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
# pop-site slots (sp values from traces) # pop-site slots (sp values from traces)