1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
import sys, os, importlib.util
sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
import unicorn
from unicorn import UC_HOOK_MEM_WRITE, UC_HOOK_CODE
from unicorn.arm_const import UC_ARM_REG_PC
_s = importlib.util.spec_from_file_location("tasmod", os.path.join(os.path.dirname(__file__),"boot_sos_and_tas.py"))
T = importlib.util.module_from_spec(_s); _s.loader.exec_module(T)
c, ccp, exc_log = T.build()
T.stage_all(c, verbose=False)
uc = c.uc
GPTR = 0x81B8
hits = [] # (order, pc, addr, value)
order = [0]
loads = []
def gnow():
try: return int.from_bytes(uc.mem_read(GPTR,4),"little")
except Exception: return 0
def on_write(uc_, access, addr, size, value, ud):
order[0]+=1
g = gnow()
if g and g+0xC <= addr < g+0x10:
pc = uc_.reg_read(UC_ARM_REG_PC)
hits.append((order[0], pc, addr, value, g))
# also watch writes to GPTR itself (when G gets set) + loads
def on_code(uc_, a, sz, u):
if a in T.LOAD_RETS:
loads.append((order[0], T.LOAD_RETS[a]))
uc.hook_add(UC_HOOK_MEM_WRITE, on_write)
uc.hook_add(UC_HOOK_CODE, on_code, begin=0x204000, end=0x205000)
def done():
return len([1 for _ in loads])>=4 and len(hits)>=1
T.run_system(c, seconds=float(os.environ.get("RUN_SECONDS","90")), done=done, verbose=False)
print("G (=*0x81B8) final = %#x" % gnow())
print("loads seen:", loads[:6])
print("writes to G+0xC: %d" % len(hits))
for o,pc,addr,val,g in hits[:30]:
print(" order=%d PC=%#010x addr=%#x value=%#010x (G=%#x)"%(o,pc,addr,val,g))
|
