From 989c96ebda2bcdd67c2393f97571d86eda3e3ab5 Mon Sep 17 00:00:00 2001 From: SashegDev Date: Mon, 14 Sep 2026 12:33:30 +0000 Subject: [PATCH] sbl_uni: txt-write trap 802F664 + sp-range tripwire (105M fault hunt) --- tools/sbl_uni.py | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py index 3926f92..279a99f 100644 --- a/tools/sbl_uni.py +++ b/tools/sbl_uni.py @@ -338,6 +338,35 @@ def main(): return mu.hook_add(UC_HOOK_CODE, hook_code) + _txtlog = [] + def hook_txt(mu, access, addr, size, value, data): + if len(_txtlog) < 10: + try: + from unicorn.arm_const import UC_ARM_REG_PC as _P + _txtlog.append((count[0], mu.reg_read(_P), addr, size, value)) + except Exception: + pass + mu.hook_add(UC_HOOK_MEM_WRITE, hook_txt, begin=0x802F664, end=0x802F668) + _splog2 = [] + def hook_spck(mu, addr, size, data): + try: + from unicorn.arm_const import UC_ARM_REG_SP as _S + sp = mu.reg_read(_S) + except Exception: + return + if not (0x07800000 <= sp < 0x08610000) and not (0x80000000 <= sp < 0x8A000000): + if len(_splog2) < 5: + _splog2.append((count[0], addr, sp)) + mu.hook_add(UC_HOOK_CODE, hook_spck) + import atexit as _ax3 + def _dtx(): + print('txt-writes:', len(_txtlog)) + for n, pc, a, sz, v in _txtlog: + print(' insn', n, hex(pc), hex(a), sz, hex(v)) + print('sp-trips:', len(_splog2)) + for n, pc, sp in _splog2: + print(' insn', n, hex(pc), hex(sp)) + _ax3.register(_dtx) # null-fetch redirect: branch-to-0 lands in maze (movs r0,#0; bx lr), # immune to [0]-writes that clobber a static maze copy from unicorn.arm_const import UC_ARM_REG_PC as _PC