sbl_uni: txt-write trap 802F664 + sp-range tripwire (105M fault hunt)

tools/sbl_uni.py

@@ -338,6 +338,35 @@ def main():
                 return
 
     mu.hook_add(UC_HOOK_CODE, hook_code)
+    _txtlog = []
+    def hook_txt(mu, access, addr, size, value, data):
+        if len(_txtlog) < 10:
+            try:
+                from unicorn.arm_const import UC_ARM_REG_PC as _P
+                _txtlog.append((count[0], mu.reg_read(_P), addr, size, value))
+            except Exception:
+                pass
+    mu.hook_add(UC_HOOK_MEM_WRITE, hook_txt, begin=0x802F664, end=0x802F668)
+    _splog2 = []
+    def hook_spck(mu, addr, size, data):
+        try:
+            from unicorn.arm_const import UC_ARM_REG_SP as _S
+            sp = mu.reg_read(_S)
+        except Exception:
+            return
+        if not (0x07800000 <= sp < 0x08610000) and not (0x80000000 <= sp < 0x8A000000):
+            if len(_splog2) < 5:
+                _splog2.append((count[0], addr, sp))
+    mu.hook_add(UC_HOOK_CODE, hook_spck)
+    import atexit as _ax3
+    def _dtx():
+        print('txt-writes:', len(_txtlog))
+        for n, pc, a, sz, v in _txtlog:
+            print('  insn', n, hex(pc), hex(a), sz, hex(v))
+        print('sp-trips:', len(_splog2))
+        for n, pc, sp in _splog2:
+            print('  insn', n, hex(pc), hex(sp))
+    _ax3.register(_dtx)
     # null-fetch redirect: branch-to-0 lands in maze (movs r0,#0; bx lr),
     # immune to [0]-writes that clobber a static maze copy
     from unicorn.arm_const import UC_ARM_REG_PC as _PC