sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

S12v6: add-sp un-leak in-stub

Browse Source
This commit is contained in:
lumia-emu
2026-09-14 00:01:45 +00:00
parent dcfdeef917
commit 8cd7c85771
2 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/sbl_uni.py
+10 -9
View File
@@ -444,17 +444,18 @@ def main():
# to the dispatcher via stale lr (TZ bringup deferred).
# NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
# S12-stub (b27, 92B @0x08006964, ARM): blx-to-padding becomes
# S12-stub (b27, 108B @0x08006964, ARM): blx-to-padding becomes
# smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
# non-code => ip=poll resumption 0x8007779; else keep pushed-lr;
# restore r7 (peripheral base, S16 dormant); ACK peripheral bit1
# ([literal 0x073A100]); bx lr. PBL would place the real helper.
# non-code => ip=poll resumption 0x8007779; else keep pushed-lr
# AND add sp,#8 (pop the helper frame B66 skips! un-leak!);
# restore r7; ACK peripheral bit1 ([literal]); bx lr.
# PBL would place the real ARM helper here.
mu.mem_write(0x08006964, bytes.fromhex(
"04c09de58d3b06e3003840e303005ce10700000a0100"
"1ce30500000a2c3ca0e1080053e30400000a2c3ea0e1"
"080053e30100000a79c707e300c840e300700ae37370"
"40e30c309fe5002093e5022082e3002083e51eff2fe1"
"00a17300"))
"04c09de58d3b06e3003840e303005ce10b00000a0100"
"1ce30900000a2c3ca0e1080053e30100001a08d08de2"
"060000ea2c3ea0e1080053e30100001a08d08de20100"
"00ea79c707e300c840e300700ae3737040e30c309fe5"
"002093e5022082e3002083e51eff2fe100a17300"))
# S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
# ip==STUBV (fill/maze, never a legit return) => default;
# ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66