b25: S12v2-full + B66-ELF + S16 baked
This commit is contained in:
SashegDev
+63
-7
@@ -104,6 +104,12 @@ def main():
|
||||
calls = [] if "--calltrace" in sys.argv else None
|
||||
rets = [] if "--retrace" in sys.argv else None
|
||||
qlog = [] if "--querylog" in sys.argv else None
|
||||
_traps = []
|
||||
_trap_n = [0]
|
||||
if "--trap" in sys.argv:
|
||||
_traps = [int(x, 0) for x in sys.argv[sys.argv.index("--trap") + 1].split(",")]
|
||||
if "--trapn" in sys.argv:
|
||||
_trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])]
|
||||
_spmax = [0x085FFF00]
|
||||
_splog = [] if "--spytrack" in sys.argv else None
|
||||
elog = [] if "--entrylog" in sys.argv else None
|
||||
@@ -145,6 +151,23 @@ def main():
|
||||
except Exception:
|
||||
thumb = 1
|
||||
hist.append((addr, thumb))
|
||||
if _traps and addr in _traps:
|
||||
try:
|
||||
vals = [mu.reg_read(_REGS[i]) for i in range(8)]
|
||||
except Exception:
|
||||
vals = []
|
||||
print(f"TRAP {addr:#x} insn#{count[0]} r0-r7={[hex(x) for x in vals]} sp={mu.reg_read(UC_ARM_REG_SP):#x} lr={mu.reg_read(_LR):#x}")
|
||||
try:
|
||||
print(f" [73A100]={bytes(mu.mem_read(0x073A100, 4)).hex()}")
|
||||
except Exception as e:
|
||||
print(f" [73A100] unreadable: {e}")
|
||||
_trap_n[0] -= 1
|
||||
if _trap_n[0] <= 0 and "--trapn" in sys.argv:
|
||||
mu.emu_stop()
|
||||
return
|
||||
if "--trapn" not in sys.argv:
|
||||
mu.emu_stop()
|
||||
return
|
||||
if qlog is not None and addr in (0x8017EA4, 0x8017C60):
|
||||
try:
|
||||
vals = [mu.reg_read(_REGS[i]) for i in range(8)]
|
||||
@@ -163,6 +186,9 @@ def main():
|
||||
except Exception:
|
||||
_th = -1
|
||||
elog.append((count[0], _prev[0], addr, _th))
|
||||
if not inside and _inrng[_i]:
|
||||
if len(elog) < 20000:
|
||||
elog.append((count[0], _prev[0], -addr, 2))
|
||||
_inrng[_i] = inside
|
||||
_prev[0] = addr
|
||||
if calls is not None and size in (2, 4):
|
||||
@@ -186,6 +212,15 @@ def main():
|
||||
bxt = -1
|
||||
if len(calls) < 8000:
|
||||
calls.append((addr, 100 + bxrm, bxt))
|
||||
# pop {..,pc} (0xBD00+): log stacked target
|
||||
if calls is not None and (h & 0xFF00) == 0xBD00:
|
||||
try:
|
||||
_sp = mu.reg_read(UC_ARM_REG_SP)
|
||||
_tgt = struct.unpack("<I", mu.mem_read(_sp, 4))[0]
|
||||
except Exception:
|
||||
_tgt = -1
|
||||
if len(calls) < 12000:
|
||||
calls.append((addr, 300, _tgt))
|
||||
if rets is not None and 0x8017E00 <= addr < 0x8018000:
|
||||
# pop {..,pc} (0xBD00+) or bx lr (0x4770)
|
||||
if h == 0x4770 or (h & 0xFF00) == 0xBD00:
|
||||
@@ -345,10 +380,19 @@ def main():
|
||||
# to the dispatcher via stale lr (TZ bringup deferred).
|
||||
# NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
|
||||
mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
|
||||
# S12-stub (b25): blx #0x8006964 lands in file-zero padding (PBL
|
||||
# would place an ARM helper there at runtime). Caller ignores r0
|
||||
# (movs r0,#0 after), so bx lr no-op return is safe.
|
||||
mu.mem_write(0x08006964, bytes([0x70, 0x47]))
|
||||
# S12-stub (b25): blx #0x8006964 (BLX-imm to even => ARM mode!) lands
|
||||
# in file-zero padding (PBL would place an ARM helper). ARM version:
|
||||
# movw/movt ip (=S16 addr, for the pop-site chain); ldr r3,[pc,#12]
|
||||
# (literal [0x8006980] = 0x073A100); ACK peripheral bit1 (the real
|
||||
# helper's side effect that poll#2 waits for); bx lr.
|
||||
mu.mem_write(0x08006964, bytes.fromhex(
|
||||
"c1cc06e300c840e30c309fe5002093e5022082e3002083e5"
|
||||
"1eff2fe100a17300"))
|
||||
# S16-stublet (b25, 18B @0x08006CC0): helper-pop chain exit.
|
||||
# restore r7 (=0x73A000 peripheral base, trashed by labyrinth pops);
|
||||
# jump to poll-loop resumption 0x8007779 via ip.
|
||||
mu.mem_write(0x08006CC0, bytes.fromhex(
|
||||
"4af20007c0f2730747f2797cc0f6000c6047"))
|
||||
# stack zone fill (STUBV odd)
|
||||
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
|
||||
# pop-site slots (sp values from traces)
|
||||
@@ -385,7 +429,7 @@ def main():
|
||||
# --- end parity ---
|
||||
# stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
|
||||
# keep maze/stublets intact (restore-on-write with reentrancy guard)
|
||||
STUB_LO, STUB_HI = 0x080068C0, 0x08006CA0 # +S7/S9/S10 + banner
|
||||
STUB_LO, STUB_HI = 0x080068C0, 0x08006CE0 # +S7/S9/S10/S16 + banner
|
||||
stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
|
||||
_inww = [False]
|
||||
_swn = [0]
|
||||
@@ -498,9 +542,15 @@ def main():
|
||||
if elog is not None:
|
||||
print(f"entries: {len(elog)}")
|
||||
for n, prev, cur, th in elog[:10]:
|
||||
print(f" FIRST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
|
||||
if cur < 0:
|
||||
print(f" FIRST EXIT insn#{n} {prev:#x} -> {(-cur):#x}")
|
||||
else:
|
||||
print(f" FIRST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
|
||||
for n, prev, cur, th in elog[-10:]:
|
||||
print(f" LAST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
|
||||
if cur < 0:
|
||||
print(f" LAST EXIT insn#{n} {prev:#x} -> {(-cur):#x}")
|
||||
else:
|
||||
print(f" LAST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
|
||||
if _splog is not None:
|
||||
print(f"sp-highs: {len(_splog)}")
|
||||
for n, pc, sp in _splog:
|
||||
@@ -523,6 +573,12 @@ def main():
|
||||
print(f"bl-immed: {len(bls)}")
|
||||
for pc, tgt in bls[-30:]:
|
||||
print(f" {pc:#x}: bl #{tgt:#x}")
|
||||
pops = [(pc, tgt) for pc, rm, tgt in calls if rm == 300]
|
||||
print(f"pop-pc: {len(pops)}")
|
||||
for pc, tgt in pops[:15]:
|
||||
print(f" FIRST {pc:#x}: pop-> {tgt:#x}" if tgt >= 0 else f" FIRST {pc:#x}: pop-> ?")
|
||||
for pc, tgt in pops[-15:]:
|
||||
print(f" LAST {pc:#x}: pop-> {tgt:#x}" if tgt >= 0 else f" LAST {pc:#x}: pop-> ?")
|
||||
for pc, rm, tgt in calls[-12:]:
|
||||
if rm == 200:
|
||||
continue
|
||||
|
||||
Reference in New Issue
Block a user