1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
loaded ta_22-0-0-77_7c426e7f.bin, session slot 0, cmd_buf PA 0x8200000 len 0x8000
residue set: TA blocks=248 faults=0
=== snapshot at 0x402938 : sp=0x41bf70 ctx=0x41d030 (machine FROZEN before teardown) ===
freeze OK: translate(sp)=0x4257f70
DACR=0x00005401 -> accessible domains [0, 5, 6, 7]
--realwrites: stack paint capped at 0x41bfa5 (measured writable boundary)
attacker-writable regions (user-RW AND DACR-permitted in the TA's own TTBR0):
0x00407000-0x00417000 dom=6 magic prefix 0x50 (paint from 0x40707f)
0x00418000-0x0041bfa5 dom=6 magic prefix 0x51 (paint from 0x41807f)
0x0041d000-0x00421000 dom=6 magic prefix 0x52 (paint from 0x41d07f)
0x00422000-0x00423000 dom=6 magic prefix 0x53 (paint from 0x42207f)
0x04000000-0x04001000 dom=5 magic prefix 0x54 (paint from 0x400007f)
0x04002000-0x04003000 dom=5 magic prefix 0x55 (paint from 0x400207f)
painted 27 pages; pinned 3 uncontrollable words
vector base 0x0, abort hooks armed
HW-measured residue applied to 24/24 slots
=== POSITIVE CONTROLS (predicted outcomes) ===
0x00402425 CPTR_READ base=r5=0x510047e0 ptr<-CTRL 0x41c7e0 (=0x418000+0x47e0) | ldr.w r7, [r5, #0x844]
expected: add sp,#0x28 ; pop.w{..pc} -> pc from *(sp+0x44), PAINTED => PC_CONTROL
vec=0x10 lr_abt=0x404842 sp_usr=0x41bfb8
0x0040371d PREFETCH fetch=0x0 sp=0x41d054
expected: mov sp,r4 ; pop.w{..pc} -> pc from *(ctx+0x20), BELOW carve floor => not ctrl
vec=0xc lr_abt=0x4 sp_usr=0x41d054
0x0040157b DATA insn=0x40157a ctrl_regs=[]
expected: str r0,[r1] with r1=0 -> data abort at 0
vec=0x10 lr_abt=0x401582 sp_usr=0x41bf70
=== SWEEP: 24384 candidates, cap 200 insns ===
.. 250/24384 0s 3124.3/s eta 8s hits=0 {'RAN': 232, 'DATA': 14, 'CPTR_WRITE': 3, 'SVC': 1, 'PREFETCH': 1}
.. 500/24384 0s 3564.3/s eta 7s hits=0 {'RAN': 480, 'DATA': 14, 'CPTR_WRITE': 3, 'PREFETCH': 3, 'SVC': 1}
.. 750/24384 0s 3359.9/s eta 7s hits=0 {'RAN': 687, 'DATA': 54, 'PREFETCH': 6, 'CPTR_WRITE': 3, 'SVC': 1}
.. 1000/24384 0s 3437.9/s eta 7s hits=0 {'RAN': 687, 'DATA': 301, 'PREFETCH': 9, 'CPTR_WRITE': 3, 'SVC': 1}
.. 1250/24384 0s 3366.3/s eta 7s hits=0 {'RAN': 903, 'DATA': 331, 'PREFETCH': 13, 'CPTR_WRITE': 3, 'SVC': 1}
.. 1500/24384 0s 3489.6/s eta 7s hits=0 {'RAN': 1150, 'DATA': 331, 'PREFETCH': 16, 'CPTR_WRITE': 3, 'SVC': 1}
.. 1750/24384 1s 3436.6/s eta 7s hits=0 {'RAN': 1398, 'DATA': 331, 'PREFETCH': 18, 'CPTR_WRITE': 3, 'SVC': 1}
.. 2000/24384 1s 3479.1/s eta 6s hits=0 {'RAN': 1422, 'DATA': 354, 'SVC': 162, 'PREFETCH': 39, 'SP_IN_CTRL': 21}
.. 2250/24384 1s 3626.9/s eta 6s hits=0 {'RAN': 1434, 'DATA': 421, 'SVC': 208, 'PREFETCH': 115, 'SP_IN_CTRL': 38}
.. 2500/24384 1s 3738.3/s eta 6s hits=0 {'RAN': 1434, 'DATA': 473, 'SVC': 250, 'PREFETCH': 222, 'SP_IN_CTRL': 68}
.. 2750/24384 1s 3825.5/s eta 6s hits=0 {'RAN': 1434, 'DATA': 576, 'PREFETCH': 312, 'SVC': 272, 'SP_IN_CTRL': 90}
.. 3000/24384 1s 3875.1/s eta 6s hits=0 {'RAN': 1449, 'DATA': 645, 'PREFETCH': 446, 'SVC': 286, 'SP_IN_CTRL': 106}
HIT V=0x004018a5 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf5c (=0x418000+0x3f5c) | sp=0x41bf60 (in 0x418000)
.. 3250/24384 1s 3907.7/s eta 5s hits=1 {'RAN': 1478, 'DATA': 677, 'PREFETCH': 609, 'SVC': 288, 'SP_IN_CTRL': 110}
.. 3500/24384 1s 3947.2/s eta 5s hits=1 {'RAN': 1567, 'DATA': 727, 'PREFETCH': 686, 'SVC': 288, 'SP_IN_CTRL': 122}
.. 3750/24384 1s 3963.5/s eta 5s hits=1 {'RAN': 1616, 'PREFETCH': 805, 'DATA': 786, 'SVC': 288, 'SP_IN_CTRL': 140}
.. 4000/24384 1s 3994.5/s eta 5s hits=1 {'RAN': 1705, 'PREFETCH': 901, 'DATA': 835, 'SVC': 288, 'SP_IN_CTRL': 148}
.. 4250/24384 1s 4031.0/s eta 5s hits=1 {'RAN': 1705, 'DATA': 983, 'PREFETCH': 948, 'SVC': 298, 'SP_IN_CTRL': 149}
.. 4500/24384 1s 4047.3/s eta 5s hits=1 {'RAN': 1722, 'DATA': 1049, 'PREFETCH': 1043, 'SVC': 321, 'SP_IN_CTRL': 185}
.. 4750/24384 1s 4090.0/s eta 5s hits=1 {'RAN': 1727, 'DATA': 1160, 'PREFETCH': 1066, 'SVC': 374, 'SP_IN_CTRL': 212}
.. 5000/24384 1s 4111.0/s eta 5s hits=1 {'RAN': 1762, 'DATA': 1261, 'PREFETCH': 1128, 'SVC': 384, 'SP_IN_CTRL': 238}
.. 5250/24384 1s 4135.1/s eta 5s hits=1 {'RAN': 1786, 'DATA': 1351, 'PREFETCH': 1206, 'SVC': 399, 'SP_IN_CTRL': 263}
.. 5500/24384 1s 4150.7/s eta 5s hits=1 {'RAN': 1838, 'DATA': 1470, 'PREFETCH': 1247, 'SVC': 404, 'SP_IN_CTRL': 280}
.. 5750/24384 1s 4160.3/s eta 4s hits=1 {'RAN': 1897, 'DATA': 1560, 'PREFETCH': 1261, 'SVC': 447, 'SP_IN_CTRL': 307}
.. 6000/24384 1s 4170.6/s eta 4s hits=1 {'RAN': 1933, 'DATA': 1705, 'PREFETCH': 1277, 'SVC': 464, 'SP_IN_CTRL': 329}
.. 6250/24384 1s 4177.3/s eta 4s hits=1 {'RAN': 1961, 'DATA': 1850, 'PREFETCH': 1312, 'SVC': 469, 'SP_IN_CTRL': 351}
.. 6500/24384 2s 4194.5/s eta 4s hits=1 {'RAN': 2009, 'DATA': 1954, 'PREFETCH': 1342, 'SVC': 506, 'SP_IN_CTRL': 366}
.. 6750/24384 2s 4218.3/s eta 4s hits=1 {'DATA': 2084, 'RAN': 2020, 'PREFETCH': 1376, 'SVC': 549, 'SP_IN_CTRL': 382}
.. 7000/24384 2s 4233.1/s eta 4s hits=1 {'DATA': 2261, 'RAN': 2020, 'PREFETCH': 1400, 'SVC': 573, 'SP_IN_CTRL': 396}
.. 7250/24384 2s 4243.5/s eta 4s hits=1 {'DATA': 2373, 'RAN': 2034, 'PREFETCH': 1417, 'SVC': 600, 'SP_IN_CTRL': 453}
.. 7500/24384 2s 4264.3/s eta 4s hits=1 {'DATA': 2450, 'RAN': 2057, 'PREFETCH': 1449, 'SVC': 668, 'SP_IN_CTRL': 480}
.. 7750/24384 2s 4264.7/s eta 4s hits=1 {'DATA': 2555, 'RAN': 2107, 'PREFETCH': 1467, 'SVC': 669, 'SP_IN_CTRL': 534}
.. 8000/24384 2s 4272.1/s eta 4s hits=1 {'DATA': 2664, 'RAN': 2141, 'PREFETCH': 1483, 'SVC': 728, 'SP_IN_CTRL': 550}
.. 8250/24384 2s 4286.2/s eta 4s hits=1 {'DATA': 2742, 'RAN': 2177, 'PREFETCH': 1521, 'SVC': 793, 'SP_IN_CTRL': 572}
.. 8500/24384 2s 4298.4/s eta 4s hits=1 {'DATA': 2792, 'RAN': 2226, 'PREFETCH': 1554, 'SVC': 809, 'SP_IN_CTRL': 628}
.. 8750/24384 2s 4310.7/s eta 4s hits=1 {'DATA': 2841, 'RAN': 2306, 'PREFETCH': 1633, 'SVC': 822, 'SP_IN_CTRL': 639}
.. 9000/24384 2s 4314.9/s eta 4s hits=1 {'DATA': 2978, 'RAN': 2348, 'PREFETCH': 1657, 'SVC': 830, 'SP_IN_CTRL': 660}
.. 9250/24384 2s 4321.6/s eta 4s hits=1 {'DATA': 3076, 'RAN': 2398, 'PREFETCH': 1699, 'SVC': 858, 'SP_IN_CTRL': 680}
.. 9500/24384 2s 4327.0/s eta 3s hits=1 {'DATA': 3195, 'RAN': 2441, 'PREFETCH': 1726, 'SVC': 871, 'SP_IN_CTRL': 705}
HIT V=0x00404d13 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
HIT V=0x00404d15 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
.. 9750/24384 2s 4330.5/s eta 3s hits=3 {'DATA': 3284, 'RAN': 2484, 'PREFETCH': 1761, 'SVC': 896, 'SP_IN_CTRL': 747}
HIT V=0x00404d7b PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
HIT V=0x00404d7d PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
HIT V=0x00404d7f PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
.. 10000/24384 2s 4329.8/s eta 3s hits=6 {'DATA': 3386, 'RAN': 2532, 'PREFETCH': 1791, 'SVC': 913, 'SP_IN_CTRL': 783}
.. 10250/24384 2s 4337.1/s eta 3s hits=6 {'DATA': 3472, 'RAN': 2576, 'PREFETCH': 1839, 'SVC': 944, 'SP_IN_CTRL': 809}
.. 10500/24384 2s 4349.7/s eta 3s hits=6 {'DATA': 3571, 'RAN': 2595, 'PREFETCH': 1862, 'SVC': 1012, 'SP_IN_CTRL': 833}
.. 10750/24384 2s 4365.5/s eta 3s hits=6 {'DATA': 3652, 'RAN': 2603, 'PREFETCH': 1909, 'SVC': 1082, 'SP_IN_CTRL': 861}
.. 11000/24384 3s 4387.0/s eta 3s hits=6 {'DATA': 3720, 'RAN': 2603, 'PREFETCH': 1923, 'SVC': 1204, 'SP_IN_CTRL': 896}
.. 11250/24384 3s 4397.4/s eta 3s hits=6 {'DATA': 3801, 'RAN': 2626, 'PREFETCH': 1953, 'SVC': 1265, 'SP_IN_CTRL': 936}
.. 11500/24384 3s 4399.1/s eta 3s hits=6 {'DATA': 3821, 'RAN': 2627, 'PREFETCH': 2038, 'SVC': 1399, 'SP_IN_CTRL': 936}
.. 11750/24384 3s 4402.4/s eta 3s hits=6 {'DATA': 3834, 'RAN': 2627, 'PREFETCH': 2260, 'SVC': 1407, 'SP_IN_CTRL': 936}
.. 12000/24384 3s 4419.2/s eta 3s hits=6 {'DATA': 3879, 'RAN': 2627, 'PREFETCH': 2331, 'SVC': 1526, 'SP_IN_CTRL': 943}
.. 12250/24384 3s 4440.5/s eta 3s hits=6 {'DATA': 3879, 'RAN': 2627, 'PREFETCH': 2440, 'SVC': 1651, 'SP_IN_CTRL': 943}
HIT V=0x00406271 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
.. 12500/24384 3s 4445.1/s eta 3s hits=7 {'DATA': 3942, 'RAN': 2631, 'PREFETCH': 2485, 'SVC': 1764, 'SP_IN_CTRL': 943}
.. 12750/24384 3s 4335.9/s eta 3s hits=7 {'DATA': 4065, 'RAN': 2637, 'PREFETCH': 2512, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 13000/24384 3s 4332.3/s eta 3s hits=7 {'DATA': 4300, 'RAN': 2637, 'PREFETCH': 2515, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 13250/24384 3s 4318.3/s eta 3s hits=7 {'DATA': 4539, 'RAN': 2637, 'PREFETCH': 2515, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 13500/24384 3s 4315.6/s eta 3s hits=7 {'DATA': 4768, 'RAN': 2637, 'PREFETCH': 2523, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 13750/24384 3s 4314.0/s eta 2s hits=7 {'DATA': 4998, 'RAN': 2637, 'PREFETCH': 2529, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 14000/24384 3s 4285.4/s eta 2s hits=7 {'DATA': 5126, 'RAN': 2730, 'PREFETCH': 2532, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 14250/24384 3s 4274.1/s eta 2s hits=7 {'DATA': 5128, 'RAN': 2779, 'PREFETCH': 2731, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 14500/24384 3s 4274.2/s eta 2s hits=7 {'DATA': 5128, 'RAN': 2991, 'PREFETCH': 2731, 'SVC': 1807, 'SP_IN_CTRL': 963}
.. 14750/24384 3s 4290.5/s eta 2s hits=7 {'DATA': 5133, 'RAN': 3021, 'PREFETCH': 2739, 'SVC': 1815, 'UCERR': 1012}
.. 15000/24384 3s 4290.9/s eta 2s hits=7 {'DATA': 5133, 'RAN': 3240, 'PREFETCH': 2739, 'SVC': 1815, 'UCERR': 1043}
.. 15250/24384 4s 4310.7/s eta 2s hits=7 {'DATA': 5138, 'RAN': 3240, 'PREFETCH': 2758, 'SVC': 1824, 'UCERR': 1256}
.. 15500/24384 4s 4333.6/s eta 2s hits=7 {'DATA': 5181, 'RAN': 3240, 'PREFETCH': 2790, 'SVC': 1939, 'UCERR': 1316}
.. 15750/24384 4s 4361.1/s eta 2s hits=7 {'DATA': 5239, 'RAN': 3240, 'PREFETCH': 2828, 'SVC': 1951, 'UCERR': 1458}
.. 16000/24384 4s 4381.8/s eta 2s hits=7 {'DATA': 5290, 'RAN': 3240, 'PREFETCH': 2892, 'SVC': 1969, 'UCERR': 1575}
.. 16250/24384 4s 4406.2/s eta 2s hits=7 {'DATA': 5342, 'RAN': 3240, 'PREFETCH': 2949, 'SVC': 1977, 'UCERR': 1708}
.. 16500/24384 4s 4433.7/s eta 2s hits=7 {'DATA': 5379, 'RAN': 3240, 'PREFETCH': 2968, 'SVC': 2004, 'UCERR': 1858}
.. 16750/24384 4s 4461.2/s eta 2s hits=7 {'DATA': 5419, 'RAN': 3240, 'PREFETCH': 2995, 'SVC': 2038, 'UCERR': 2007}
.. 17000/24384 4s 4490.6/s eta 2s hits=7 {'DATA': 5451, 'RAN': 3240, 'PREFETCH': 3014, 'UCERR': 2167, 'SVC': 2077}
.. 17250/24384 4s 4515.2/s eta 2s hits=7 {'DATA': 5504, 'RAN': 3240, 'PREFETCH': 3056, 'UCERR': 2304, 'SVC': 2095}
.. 17500/24384 4s 4542.9/s eta 2s hits=7 {'DATA': 5543, 'RAN': 3240, 'PREFETCH': 3080, 'UCERR': 2470, 'SVC': 2116}
.. 17750/24384 4s 4572.4/s eta 1s hits=7 {'DATA': 5556, 'RAN': 3240, 'PREFETCH': 3131, 'UCERR': 2647, 'SVC': 2125}
.. 18000/24384 4s 4599.2/s eta 1s hits=7 {'DATA': 5593, 'RAN': 3240, 'PREFETCH': 3159, 'UCERR': 2808, 'SVC': 2149}
.. 18250/24384 4s 4622.1/s eta 1s hits=7 {'DATA': 5634, 'RAN': 3240, 'PREFETCH': 3212, 'UCERR': 2942, 'SVC': 2171}
.. 18500/24384 4s 4642.7/s eta 1s hits=7 {'DATA': 5688, 'PREFETCH': 3254, 'RAN': 3240, 'UCERR': 3095, 'SVC': 2172}
.. 18750/24384 4s 4671.0/s eta 1s hits=7 {'DATA': 5710, 'UCERR': 3283, 'PREFETCH': 3277, 'RAN': 3240, 'SVC': 2189}
.. 19000/24384 4s 4693.9/s eta 1s hits=7 {'DATA': 5756, 'UCERR': 3434, 'PREFETCH': 3314, 'RAN': 3240, 'SVC': 2205}
.. 19250/24384 4s 4716.2/s eta 1s hits=7 {'DATA': 5802, 'UCERR': 3576, 'PREFETCH': 3357, 'RAN': 3240, 'SVC': 2224}
.. 19500/24384 4s 4737.4/s eta 1s hits=7 {'DATA': 5854, 'UCERR': 3715, 'PREFETCH': 3399, 'RAN': 3240, 'SVC': 2241}
.. 19750/24384 4s 4755.9/s eta 1s hits=7 {'DATA': 5880, 'UCERR': 3854, 'PREFETCH': 3460, 'RAN': 3240, 'SVC': 2264}
.. 20000/24384 4s 4777.6/s eta 1s hits=7 {'DATA': 5915, 'UCERR': 3980, 'PREFETCH': 3523, 'RAN': 3240, 'SVC': 2289}
.. 20250/24384 4s 4796.8/s eta 1s hits=7 {'DATA': 5946, 'UCERR': 4093, 'PREFETCH': 3618, 'RAN': 3240, 'SVC': 2300}
.. 20500/24384 4s 4805.5/s eta 1s hits=7 {'DATA': 5965, 'UCERR': 4221, 'PREFETCH': 3669, 'RAN': 3254, 'SVC': 2332}
.. 20750/24384 4s 4824.1/s eta 1s hits=7 {'DATA': 6020, 'UCERR': 4360, 'PREFETCH': 3696, 'RAN': 3254, 'SVC': 2361}
.. 21000/24384 4s 4836.5/s eta 1s hits=7 {'DATA': 6106, 'UCERR': 4447, 'PREFETCH': 3728, 'RAN': 3254, 'SVC': 2406}
.. 21250/24384 4s 4834.6/s eta 1s hits=7 {'DATA': 6171, 'UCERR': 4524, 'PREFETCH': 3823, 'RAN': 3254, 'SVC': 2419}
.. 21500/24384 4s 4828.3/s eta 1s hits=7 {'DATA': 6318, 'UCERR': 4526, 'PREFETCH': 3915, 'RAN': 3256, 'SVC': 2424}
.. 21750/24384 4s 4839.9/s eta 1s hits=7 {'DATA': 6371, 'UCERR': 4568, 'PREFETCH': 3974, 'RAN': 3278, 'SVC': 2474}
.. 22000/24384 5s 4846.8/s eta 0s hits=7 {'DATA': 6535, 'UCERR': 4597, 'PREFETCH': 3989, 'RAN': 3306, 'SVC': 2479}
.. 22250/24384 5s 4851.9/s eta 0s hits=7 {'DATA': 6624, 'UCERR': 4628, 'PREFETCH': 4059, 'RAN': 3309, 'SVC': 2485}
.. 22500/24384 5s 4834.3/s eta 0s hits=7 {'DATA': 6643, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 3535, 'SVC': 2487}
.. 22750/24384 5s 4817.1/s eta 0s hits=7 {'DATA': 6643, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 3785, 'SVC': 2487}
.. 23000/24384 5s 4803.1/s eta 0s hits=7 {'DATA': 6643, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 4035, 'SVC': 2487}
.. 23250/24384 5s 4777.3/s eta 0s hits=7 {'DATA': 6643, 'UCERR': 4631, 'RAN': 4195, 'PREFETCH': 4149, 'SVC': 2487}
.. 23500/24384 5s 4777.9/s eta 0s hits=7 {'DATA': 6658, 'UCERR': 4646, 'PREFETCH': 4260, 'RAN': 4196, 'SVC': 2524}
.. 23750/24384 5s 4794.6/s eta 0s hits=7 {'DATA': 6709, 'UCERR': 4757, 'PREFETCH': 4304, 'RAN': 4196, 'SVC': 2566}
.. 24000/24384 5s 4794.2/s eta 0s hits=7 {'DATA': 6723, 'UCERR': 4822, 'RAN': 4356, 'PREFETCH': 4312, 'SVC': 2567}
.. 24250/24384 5s 4784.2/s eta 0s hits=7 {'DATA': 6723, 'UCERR': 4822, 'RAN': 4541, 'PREFETCH': 4377, 'SVC': 2567}
=== outcome histogram ===
DATA 6723 (27.6%)
UCERR 4822 (19.8%)
RAN 4541 (18.6%)
PREFETCH 4510 (18.5%)
SVC 2567 (10.5%)
SP_IN_CTRL 1152 (4.7%)
CPTR_READ 54 (0.2%)
CPTR_WRITE 8 (0.0%)
PC_CONTROL+SP_IN_CTRL 7 (0.0%)
=== CONTROL hits: 7 ===
V=0x004018a5 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf5c (=0x418000+0x3f5c) | sp=0x41bf60 (in 0x418000)
V=0x00404d13 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
V=0x00404d15 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
V=0x00404d7b PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
V=0x00404d7d PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
V=0x00404d7f PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
V=0x00406271 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000)
wrote /tmp/sweep_cptr3.json
|
