1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
#!/usr/bin/env python3
"""Signed .54 0x102F fixed 128KiB mapping-copy path; no real source map.
"""
from pathlib import Path
import sys
from unicorn import UC_HOOK_CODE
sys.path.insert(0,str(Path(__file__).resolve().parents[1]))
from pspemu import sysdrv_env
SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'
def main():
sd=sysdrv_env.make()
assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes()
r,f,_=sysdrv_env.run_init(sd)
assert r==0 and not f and sysdrv_env.init_flag(sd)==1
req,cfg,out=sd.alloc(0x100),sd.alloc(0x400),sd.alloc(0x20010)
sd.write(cfg,bytes(0x400))
counts={x:0 for x in (0xE06314,0xE06328,0xE06338)}
for ea in counts:
sd.uc.hook_add(UC_HOOK_CODE,lambda uc,pc,size,data:counts.__setitem__(pc,counts[pc]+1),begin=ea,end=ea+1)
def run(size):
sd.write(req,bytes(0x100));sd.write(out,b'\xA5'*0x20010)
for i,v in ((0,0x102F),(1,2),(2,out),(3,size),
(sysdrv_env.REQ_CONFIG_DWORD,cfg)):
sd.wr32(req+4*i,v)
rv=sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000)
assert not sd.faults
return rv,sd.read(out,0x20010)
short,untouched=run(0x1FFFF)
assert short==0xFFFF0010 and untouched==b'\xA5'*0x20010 and not any(counts.values())
full,still=run(0x20000)
assert counts[0xE06314]==1 and counts[0xE06328]==counts[0xE06338]==32,(counts,full)
assert full==0 and still[:0x20000]!=b'\xA5'*0x20000 and still[0x20000:]==b'\xA5'*16
print(f'signed 0x102F: short gate={short:#x}, modeled fixed-map completion={full:#x}, page_copies=32; output bytes redacted')
if __name__=='__main__':main()
|
