IMEM poison drift-trap

2026-09-13 12:25:25 +00:00
parent b7de1d80e0
commit b5671fbbd7
2 changed files with 14 additions and 0 deletions
@@ -436,6 +436,11 @@ def main():
        "60474af20007c0f2730747f2797cc0f6000c6047"))
    # stack zone fill (STUBV odd)
    mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
+    # IMEM poison [0x8600000,0x8600F00): drift-sink trap. Fill/IMEM-zero
+    # sleds (fall-through ldr/movs/andeq) drift silently to IMEM-top
+    # fault; poison faults LOUDLY at drift-entry (UDF in both modes).
+    # IMEM stack [0x8600F00,0x8610000) left intact.
+    mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * (0xF00 // 4))
    # pop-site slots (sp values from traces)
    for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
                 (0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),