SashegDev
1226 lines
27 KiB
Python
1226 lines
27 KiB
Python
#!/usr/bin/env python3
|
|
|
|
"""sbl_patch.py — reproduce all WIP file patches for SBL1 bring-up.
|
|
|
|
Usage: ./tools/sbl_patch.py fw/sbl/img0.elf out-dir/
|
|
|
|
Produces img0_bl.elf, img0_b2..b8.elf (cumulative variants, see STEPS).
|
|
|
|
Each step is documented with WHY (all WIP, to be replaced by real PBL).
|
|
|
|
"""
|
|
|
|
import os
|
|
|
|
import sys
|
|
|
|
|
|
|
|
SEG_OFF, SEG_VA = 0x3000, 0x8005800
|
|
|
|
|
|
|
|
BLX2BL = { # blx-imm -> bl (stay Thumb): set bit12 of 2nd halfword
|
|
|
|
0x802F658: ('d8f7c2ed', 'd8f7c2fd'),
|
|
|
|
0x802F660: ('d8f702ec', 'd8f702fc'),
|
|
|
|
}
|
|
|
|
NOPS = { # call -> NOP NOP (skip unmodellable init/assert; r0/r5 ignored)
|
|
|
|
0x802F664: 'e4f77efc', # bl walker (result ignored by caller)
|
|
|
|
0x802F672: 'e6f7bbfa', # bl 0x8015bec (assert-hang)
|
|
|
|
0x802F678: None, # bl 0x8018a78, see REDIRECT (installer runs!)
|
|
|
|
0x801B71E: '9847fee7', # blx r3 + b.n self (terminal assert, 4B)
|
|
|
|
0x8016184: 'fdf790fc', # bl 0x8013aa8 (subtree nopped, see b8)
|
|
|
|
}
|
|
|
|
REDIRECT = {
|
|
|
|
# bl target off-by-N fixes (verified by disasm + QEMU traces):
|
|
|
|
0x8013AA8: ('07f026be', '07f027be'), # jump-table case0: +2
|
|
|
|
0x802F678: ('e9f7fef9', 'e9f700fa'), # bl 0x8018a78 -> 0x8018a7c (+4)
|
|
|
|
}
|
|
|
|
POOLS = {
|
|
|
|
# literal pool words redirected to owned scratch (orig struct garbage):
|
|
|
|
0x801B76C: ('280b0508', '00000708'), # -> 0x08070000
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
def off(va):
|
|
|
|
return SEG_OFF + (va - SEG_VA)
|
|
|
|
|
|
|
|
|
|
|
|
def hx(d, va, n=4):
|
|
|
|
return d[off(va):off(va) + n].hex()
|
|
|
|
|
|
|
|
|
|
|
|
def set4(d, va, hexbytes):
|
|
|
|
d[off(va):off(va) + 4] = bytes.fromhex(hexbytes)
|
|
|
|
|
|
|
|
|
|
|
|
def main():
|
|
|
|
src, outdir = sys.argv[1], sys.argv[2]
|
|
|
|
os.makedirs(outdir, exist_ok=True)
|
|
|
|
base = bytearray(open(src, 'rb').read())
|
|
|
|
|
|
|
|
def save(d, name):
|
|
|
|
p = os.path.join(outdir, name)
|
|
|
|
open(p, 'wb').write(bytes(d))
|
|
|
|
print('wrote', p, len(d))
|
|
|
|
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
assert hx(d, va) == a, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, b)
|
|
|
|
save(d, 'img0_bl.elf')
|
|
|
|
|
|
|
|
# b2 = bl + walker NOP
|
|
|
|
o = off(0x802F664)
|
|
|
|
assert d[o:o + 4].hex() == 'e4f77efc'
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b2.elf')
|
|
|
|
# b3 = b2 + 0x8015bec NOP
|
|
|
|
o = off(0x802F672)
|
|
|
|
assert d[o:o + 4].hex() == 'e6f7bbfa', hx(d, 0x802F672)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b3.elf')
|
|
|
|
# b4 = b3 + 0x8018a78 NOP
|
|
|
|
o = off(0x802F678)
|
|
|
|
assert d[o:o + 4].hex() == 'e9f7fef9', hx(d, 0x802F678)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b4.elf')
|
|
|
|
# b5 = b4 + jump-table +2
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be'
|
|
|
|
d[o:o + 4] = bytes.fromhex('07f027be')
|
|
|
|
save(d, 'img0_b5.elf')
|
|
|
|
# b6 = b5 + terminal assert NOP (4B)
|
|
|
|
o = off(0x801B71E)
|
|
|
|
assert d[o:o + 4].hex() == '9847fee7'
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b6.elf')
|
|
|
|
# b7 = b6 + redirect bl to installer entry (undoes b4 NOP)
|
|
|
|
o = off(0x802F678)
|
|
|
|
assert d[o:o + 4].hex() == 'c046c046'
|
|
|
|
d[o:o + 4] = bytes.fromhex('e9f700fa')
|
|
|
|
save(d, 'img0_b7.elf')
|
|
|
|
# b8 = b7 + subtree NOP + pool redirect
|
|
|
|
o = off(0x8016184)
|
|
|
|
assert d[o:o + 4].hex() == 'fdf790fc', hx(d, 0x8016184)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x801B76C)
|
|
|
|
assert d[o:o + 4].hex() == '280b0508'
|
|
|
|
d[o:o + 4] = bytes.fromhex('00000708')
|
|
|
|
save(d, 'img0_b8.elf')
|
|
|
|
# b9 = b8 + hole-call NOP (EDL-dead padding slide at 0x80068FC)
|
|
|
|
o = off(0x8008396)
|
|
|
|
assert d[o:o + 4].hex() == 'fef780f9', hx(d, 0x8008396)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b9.elf')
|
|
|
|
# b10 = b9 with installer-bl reverted to NOP (S2 lands mid-NOPs safely,
|
|
|
|
# falls into the 0x8013b7c call; installer skipped, structs via maze)
|
|
|
|
o = off(0x802F678)
|
|
|
|
assert d[o:o + 4].hex() == 'e9f700fa', hx(d, 0x802F678)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b10.elf')
|
|
|
|
# b11 = b10 with installer-bl restored (redirect, installer runs again)
|
|
|
|
o = off(0x802F678)
|
|
|
|
assert d[o:o + 4].hex() == 'c046c046'
|
|
|
|
d[o:o + 4] = bytes.fromhex('e9f700fa')
|
|
|
|
save(d, 'img0_b11.elf')
|
|
|
|
# b12: b10-variant with jump-table entry0 NOP (fall into entry1/case-1);
|
|
|
|
# rebuilt from b10 base (installer stays skipped)
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b12.elf')
|
|
|
|
# b15 = b14 + force table-loop count (0x8013ba6 ldrh r0,[r7,#4] ->
|
|
|
|
# movs r0,#0xff): exit pop reads clobbered slot (->0); looping builds
|
|
|
|
# tables via helpers instead. 2-byte patch.
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
save(d, 'img0_b15.elf')
|
|
|
|
# b16 = b15 + banner call redirect (0x802f690 blx r3 -> bl banner stub
|
|
|
|
# at 0x08062150; table[0] is garbage 0x690ce0ee). Stub prints r0 string
|
|
|
|
# via UARTDM, returns 0 -> falls into cbz path (banner done).
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'd7f7ba8c'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
save(d, 'img0_b16.elf')
|
|
|
|
# b14 = b13 + redirect S6 pop (0x8017afc ldmia.w sp!,{r2-r9,sl,pc})
|
|
|
|
# to S6 stublet at 0x08062140 (pc slot clobbered to 0 at runtime)
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b14.elf')
|
|
|
|
# b13 = b12 + NOP strb.w fp,[r1,#-7]! at 0x8006684 (helper stores
|
|
|
|
# fp into struct r1, but r1 arrives NULL from 0x8007e82 chain;
|
|
|
|
# store to [0-7]=0xfffffff9 faults; struct unrecoverable here)
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
save(d, 'img0_b13.elf')
|
|
|
|
# b17 = b16 with banner call NOPed (blx r3 + b.n self -> NOP NOP):
|
|
|
|
# logger is non-essential; banner stub tail gets heap-clobbered and
|
|
|
|
# the 4B bl return lands mid-insn. Fall through to 0x802f694.
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
save(d, 'img0_b17.elf')
|
|
|
|
|
|
|
|
|
|
|
|
# b18 = b17 + S7 exit router (delay-epilogue leak fix):
|
|
# 0x8013BAC pop{r3-r7,pc} pops 0x18 with no matching push; S3-slot
|
|
# restarts (0x8013BA5) multiply it into a stack-eating cycle
|
|
# (slots->fill->zeros->null-loop->IMEM overflow). Route the epilogue
|
|
# to S7 (0x08006C10, scaffold stublet): r4<=0xff -> restart loop,
|
|
# else restore r4/r5/sl/fp and return to sbl_main (0x802f681).
|
|
# NOTE: overwrites BAE-path head (ldr r2,[pc,#0x28], only used when
|
|
# [r7]==2 — never in our flow, r7=0).
|
|
# Also NOPs the FULL bl idiom at 0x8006682 (b17 NOPed only its 2nd
|
|
# half, leaving a dangling prefix that fused with the NOP into a
|
|
# bogus odd-address store -> alignment fault in QEMU).
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs. (b17 NOPed only
|
|
# its 2nd half, leaving a dangling prefix that fused with the NOP
|
|
# into a bogus odd-address store -> alignment fault in QEMU.)
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
save(d, 'img0_b18.elf')
|
|
|
|
|
|
|
|
|
|
|
|
# b19 = b17 + 0x80065d6 ldrb r0,[r1] -> movs r0,#2 (NULL table entry:
|
|
|
|
# type 2 takes exit-ish path instead of faulting on bx lr=0)
|
|
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8006684, '01f807bd', '46c046c0'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
o = off(0x80065D6)
|
|
|
|
assert d[o:o + 2].hex() == '0878', (hex(0x80065D6), d[o:o+2].hex())
|
|
|
|
d[o:o + 2] = bytes.fromhex('0220')
|
|
|
|
save(d, 'img0_b19.elf')
|
|
|
|
# b20 = b19 with 0x80065d6 movs#2 -> movs#1 (helper returns 1:
|
|
# caller cmp/beq falls through to cmp #0x25 path instead of skip)
|
|
|
|
o = off(0x80065D6)
|
|
|
|
assert d[o:o + 2].hex() == '0220'
|
|
|
|
d[o:o + 2] = bytes.fromhex('0120')
|
|
|
|
save(d, 'img0_b20.elf')
|
|
|
|
# b21 = b18 + logger S8 (0x8034810 pop.w -> bx lr):
|
|
# the logger is a naked pop.w {r2-r8,sb,sl,pc} (0x28) with no push;
|
|
# called via bl from scaffold-frame workers, it eats 0x28 of live
|
|
# stack per call (slots->fill->zeros->null-loop->IMEM overflow).
|
|
# S8 turns it into a no-op return (bx lr, 2B; tail bytes unreachable):
|
|
# return value ignored (callers set r0=0 after), workers unwind via
|
|
# their own epilogue pops. Logging already empty (UART stubs).
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Logger S8: pop.w entry (4B bde8fc87) -> bx lr (first 2B).
|
|
o = off(0x8034810)
|
|
|
|
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b21.elf')
|
|
|
|
# b22 = b21 + rollback assert NOP (0x801671C blx + b.n self):
|
|
# boot_rollback_version.c:580 (code 0x302E) fires (versions zeroed);
|
|
# caller (sbl_main) ignores r0 (movs r0,#0 after), so fall-through
|
|
# to the success pop is safe. Same idiom as banner site.
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Logger S8 (see b21).
|
|
o = off(0x8034810)
|
|
|
|
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b22.elf')
|
|
|
|
# b23 = b22 + S10 (rollback sideways-exit fix):
|
|
# 0x8016720 pop{r4,pc} has no matching push; it exits sideways to
|
|
# helper-mid (0x8005BBA) instead of sbl_main (0x802f6a3), closing a
|
|
# ping-pong cycle (S9->rollback->query->helper->assert->labyrinth).
|
|
# Route to S10 (0x08006C88, scaffold): movw/movt ip + bx ip to
|
|
# 0x802f6a3. Eats the following NOP (movs r0,r0).
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Logger S8 (see b21).
|
|
o = off(0x8034810)
|
|
|
|
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b23.elf')
|
|
|
|
# b24 = b23 + S11 (clock-fn naked-exit fix):
|
|
# 0x800E988 pop{r4,pc} has no matching push (naked tail-chain worker:
|
|
# bl 0x8006684-idiom tail-jumps to the clock fn, abandoning lr).
|
|
# Each dispatcher pass eats 0x8+ ([sp] -> wild 0x902FC506).
|
|
# S11 turns the exit into bx lr (lr = abandoned-but-valid resumption
|
|
# 0x80076CD/0x80076D3 in the caller). 2B patch, like S8.
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Logger S8 (see b21).
|
|
o = off(0x8034810)
|
|
|
|
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
# Clock S11: pop{r4,pc} (2B 10bd) -> bx lr (2B 7047).
|
|
o = off(0x800E988)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b24.elf')
|
|
|
|
# b25 = b24 + helper-pop S16 chain (0x8007B66 pop{r4,pc} -> bx ip):
|
|
# the pop reads scratch ([sp+4] = counters 0..4, frames marched by
|
|
# null-cycles) instead of pushed lr. bx ip uses ip preset by S12
|
|
# (ARM stub at 0x8006964) to S16 (0x08006CC0, scaffold): restore r7
|
|
# (peripheral base) and jump to poll-loop resumption 0x8007779.
|
|
# 2B patch, no eating (bx ip = 0x47c0 fits the pop slot).
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Logger S8 (see b21).
|
|
o = off(0x8034810)
|
|
|
|
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
# Clock S11 (see b24).
|
|
o = off(0x800E988)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
# Helper-pop S16 chain: pop{r4,pc} (2B 10bd) -> bx ip (2B 4760;
|
|
# ip preset by S12 to S16). 0x47c0 would be bx lr (wrong reg!).
|
|
o = off(0x8007B66)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('6047')
|
|
|
|
save(d, 'img0_b25.elf')
|
|
|
|
# b26 = b25 + S17 safe-logger (0x8034810 pop.w -> b.w S17):
|
|
# S8 (bx lr) silenced all init logging (UART empty by design).
|
|
# S17 (50B @0x08006CF0, scaffold): print r1-string via UARTDM-TF
|
|
# only if r1 in rodata [0x804B800,0x8058000) (wild pointers skip),
|
|
# then pop-return (no leak, return value ignored by callers).
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
|
|
|
(0x8034810, 'bde8fc87', 'd2f76eba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Helper-pop S16 chain (see b25).
|
|
o = off(0x8007B66)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('6047')
|
|
|
|
# Clock S11 (see b24).
|
|
o = off(0x800E988)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b26.elf')
|
|
|
|
# b27 = b26 + poll re-init skip (0x8007748 cbz r6 -> b):
|
|
# r6 (table mode, caller-passed constant 2) never 0, so the poll-fn
|
|
# re-inits (movs r4,#0) and re-runs its table loop forever instead of
|
|
# proceeding to poll#2-direct + epilogue. Force direct (2B->2B).
|
|
# Bits 0,1,2 of [0x73A100] pre-set (scaffold), so polls exit.
|
|
d = bytearray(base)
|
|
|
|
for va, (a, b) in BLX2BL.items():
|
|
|
|
set4(d, va, b)
|
|
|
|
for va, exp, new in [
|
|
|
|
(0x802F664, 'e4f77efc', 'c046c046'),
|
|
|
|
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
|
|
|
(0x802F678, 'e9f7fef9', 'c046c046'),
|
|
|
|
(0x801B71E, '9847fee7', 'c046c046'),
|
|
|
|
(0x8008396, 'fef780f9', 'c046c046'),
|
|
|
|
(0x8016184, 'fdf790fc', 'c046c046'),
|
|
|
|
(0x801B76C, '280b0508', '00000708'),
|
|
|
|
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
|
|
|
(0x802F690, '9847fee7', 'c046c046'),
|
|
|
|
(0x801671C, '9847fee7', 'c046c046'),
|
|
|
|
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
|
|
|
(0x801B6BE, 'bde8f081', 'ebf7c3ba'),
|
|
|
|
(0x8016720, '10bd0000', 'f0f7b2ba'),
|
|
|
|
(0x8034810, 'bde8fc87', 'd2f76eba'),
|
|
|
|
]:
|
|
|
|
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
|
|
|
set4(d, va, new)
|
|
|
|
# Poll re-init skip (b27): cbz r6 (2B 96b1) -> b (2B 14e0).
|
|
o = off(0x8007748)
|
|
|
|
assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('14e0')
|
|
|
|
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
|
o = off(0x8006682)
|
|
|
|
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
|
|
|
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
|
|
|
o = off(0x8013AA8)
|
|
|
|
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
|
|
|
d[o:o + 4] = bytes.fromhex('c046c046')
|
|
|
|
o = off(0x8013BA6)
|
|
|
|
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
|
|
|
d[o:o + 2] = bytes.fromhex('ff20')
|
|
|
|
# Helper-pop S16 chain (see b25).
|
|
o = off(0x8007B66)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('6047')
|
|
|
|
# Clock S11 (see b24).
|
|
o = off(0x800E988)
|
|
|
|
assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
|
|
|
|
d[o:o + 2] = bytes.fromhex('7047')
|
|
|
|
save(d, 'img0_b27.elf')
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
main()
|
|
|