Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Hei wahanga o te hui 0x0A DC7831 DEF CON Nizhny Novgorod I te Hui-tanguru 16, i tukuna e matou he purongo e pa ana ki nga maataapono taketake o te whakahiato waehere rua me o maatau ake whanaketanga - he emulator papaahiko taputapu. Te kape.

I roto i tenei tuhinga ka whakaahuahia me pehea te whakahaere i te firmware o te taputapu i roto i te emulator, te whakaatu i te taunekeneke me te patuiro, me te mahi i tetahi tātaritanga hihiri iti o te firmware.

prehistory

He wa roa i mua i roto i te tupuni tawhiti tawhiti

I nga tau e rua ki muri i roto i ta maatau taiwhanga he hiahia ki te tirotiro i te firmware o tetahi taputapu. I kōpeketia te mārō me te wetewete ki te utauta. I mahia e ia tenei i roto i te huarahi tino uaua, te huri i nga raraunga i roto i te mahara i nga wa maha. Na ko te firmware tonu ka kaha te taunekeneke me nga peripheral. Na enei mea katoa i runga i te kaupapa MIPS.

Mo nga take whaitake, kaore nga emulators e waatea ana i te pai ki a matou, engari i hiahia tonu matou ki te whakahaere i te waehere. Na ka whakatau matou ki te hanga i a maatau ake emulator, ka iti ake te mahi ka taea e matou te wetewete i te miihini matua. I whakamatauria e matou ka whai hua. I whakaaro matou, he aha mena ka taapirihia e matou nga peripheral ki te mahi i te firmware matua. Kaore i tino mamae - a ka pai ano. I whakaaro ano matou ka whakatau ki te hanga i tetahi emulator tino.

Ko te hua ko te emulator punaha rorohiko Te kape.

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat
He aha a Kopycat?

He whakaari mo nga kupu.

  1. copycat (Ingarihi, noun [ˈkɒpɪkæt]) - he tauira, he tauira
  2. ngeru (Ingarihi, noun [ˈkæt]) - ngeru, ngeru - te kararehe tino pai a tetahi o nga kaihanga o te kaupapa
  3. Ko te reta "K" no te reo hootaka Kotlin

Te kape

I te wa e hanga ana i te emulator, i whakaritea nga whaainga motuhake:

  • te kaha ki te hanga tere i nga peripheral hou, i nga waahanga, i nga waahanga tukatuka;
  • te kaha ki te kohikohi i tetahi taputapu mariko mai i nga momo waahanga;
  • te kaha ki te uta i nga raraunga rua (taumau) ki te mahara o tetahi taputapu mariko;
  • te kaha ki te mahi me nga whakaahua (nga whakaahua o te ahua o te punaha);
  • te kaha ki te taunekeneke me te emulator na roto i te patuiro-i roto;
  • pai te reo hou mo te whanaketanga.

Ko te hua o tenei, ko Kotlin i whiriwhiria mo te whakatinanatanga, te hoahoanga pahi (koinei te wa e korero ai nga waahanga ki a raatau ano ma nga pahi raraunga mariko), ko JSON te whakatakotoranga whakaahuatanga taputapu, me te GDB RSP hei kawa mo te taunekeneke me te kaipatu.

Kua neke atu i te rua tau te whakawhanaketanga, a kei te kaha haere tonu. I tenei wa, i whakatinanahia nga MIPS, x86, V850ES, ARM, me nga punaha tukatuka PowerPC.

Kei te tipu haere te kaupapa, kua tae ki te wa ki te whakaatu ki te iwi whanui. Ka mahia e matou he whakamaarama taipitopito mo te kaupapa i muri mai, engari mo tenei wa ka arotahi matou ki te whakamahi i te Kopycat.

Mo te hunga tino pukuriri, ka taea te tango i tetahi putanga whakatairanga o te emulator mai hono.

Rhino i roto i te emulator

Kia maumahara tatou i mua mo te huihuinga SMARTHINO-2018, i hangaia he taputapu whakamatautau "Rhinoceros" hei whakaako i nga pukenga miihini whakamuri. Ko te tukanga o te tātari firmware pateko i whakaahuatia i roto i tenei tuhinga.

Inaianei me ngana ki te taapiri i nga "kaikorero" ka whakahaere i te firmware i roto i te emulator.

Ka hiahia matou:
1) Java 1.8
2) Python me te kōwae Iep ki te whakamahi i te Python i roto i te emulator. Ka taea e koe te hanga i te kōwae WHL Jep mo Windows tiki i konei.

Mo te Matapihi:
1) com0com
2) PuTTY

Mo Linux:
1) toka

Ka taea e koe te whakamahi i te Eclipse, IDA Pro, radare2 ranei hei kaihoko GDB.

Ka pēhea te mahi i te reira?

Hei mahi i te firmware i roto i te emulator, he mea tika ki te "huihui" i tetahi taputapu mariko, he ahua o te taputapu tuuturu.

Ko te taputapu tūturu (“rhino”) ka taea te whakaatu ki te hoahoa paraka:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ko te emulator he hanganga modular me te taputapu mariko whakamutunga ka taea te whakaahua i roto i te konae JSON.

JSON 105 raina

{
  "top": true,

  // Plugin name should be the same as file name (or full path from library start)
  "plugin": "rhino",

  // Directory where plugin places
  "library": "user",

  // Plugin parameters (constructor parameters if jar-plugin version)
  "params": [
    { "name": "tty_dbg", "type": "String"},
    { "name": "tty_bt", "type": "String"},
    { "name": "firmware", "type": "String", "default": "NUL"}
  ],

  // Plugin outer ports
  "ports": [  ],

  // Plugin internal buses
  "buses": [
    { "name": "mem", "size": "BUS30" },
    { "name": "nand", "size": "4" },
    { "name": "gpio", "size": "BUS32" }
  ],

  // Plugin internal components
  "modules": [
    {
      "name": "u1_stm32",
      "plugin": "STM32F042",
      "library": "mcu",
      "params": {
        "firmware:String": "params.firmware"
      }
    },
    {
      "name": "usart_debug",
      "plugin": "UartSerialTerminal",
      "library": "terminals",
      "params": {
        "tty": "params.tty_dbg"
      }
    },
    {
      "name": "term_bt",
      "plugin": "UartSerialTerminal",
      "library": "terminals",
      "params": {
        "tty": "params.tty_bt"
      }
    },
    {
      "name": "bluetooth",
      "plugin": "BT",
      "library": "mcu"
    },

    { "name": "led_0",  "plugin": "LED", "library": "mcu" },
    { "name": "led_1",  "plugin": "LED", "library": "mcu" },
    { "name": "led_2",  "plugin": "LED", "library": "mcu" },
    { "name": "led_3",  "plugin": "LED", "library": "mcu" },
    { "name": "led_4",  "plugin": "LED", "library": "mcu" },
    { "name": "led_5",  "plugin": "LED", "library": "mcu" },
    { "name": "led_6",  "plugin": "LED", "library": "mcu" },
    { "name": "led_7",  "plugin": "LED", "library": "mcu" },
    { "name": "led_8",  "plugin": "LED", "library": "mcu" },
    { "name": "led_9",  "plugin": "LED", "library": "mcu" },
    { "name": "led_10", "plugin": "LED", "library": "mcu" },
    { "name": "led_11", "plugin": "LED", "library": "mcu" },
    { "name": "led_12", "plugin": "LED", "library": "mcu" },
    { "name": "led_13", "plugin": "LED", "library": "mcu" },
    { "name": "led_14", "plugin": "LED", "library": "mcu" },
    { "name": "led_15", "plugin": "LED", "library": "mcu" }
  ],

  // Plugin connection between components
  "connections": [
    [ "u1_stm32.ports.usart1_m", "usart_debug.ports.term_s"],
    [ "u1_stm32.ports.usart1_s", "usart_debug.ports.term_m"],

    [ "u1_stm32.ports.usart2_m", "bluetooth.ports.usart_m"],
    [ "u1_stm32.ports.usart2_s", "bluetooth.ports.usart_s"],

    [ "bluetooth.ports.bt_s", "term_bt.ports.term_m"],
    [ "bluetooth.ports.bt_m", "term_bt.ports.term_s"],

    [ "led_0.ports.pin",  "u1_stm32.buses.pin_output_a", "0x00"],
    [ "led_1.ports.pin",  "u1_stm32.buses.pin_output_a", "0x01"],
    [ "led_2.ports.pin",  "u1_stm32.buses.pin_output_a", "0x02"],
    [ "led_3.ports.pin",  "u1_stm32.buses.pin_output_a", "0x03"],
    [ "led_4.ports.pin",  "u1_stm32.buses.pin_output_a", "0x04"],
    [ "led_5.ports.pin",  "u1_stm32.buses.pin_output_a", "0x05"],
    [ "led_6.ports.pin",  "u1_stm32.buses.pin_output_a", "0x06"],
    [ "led_7.ports.pin",  "u1_stm32.buses.pin_output_a", "0x07"],
    [ "led_8.ports.pin",  "u1_stm32.buses.pin_output_a", "0x08"],
    [ "led_9.ports.pin",  "u1_stm32.buses.pin_output_a", "0x09"],
    [ "led_10.ports.pin", "u1_stm32.buses.pin_output_a", "0x0A"],
    [ "led_11.ports.pin", "u1_stm32.buses.pin_output_a", "0x0B"],
    [ "led_12.ports.pin", "u1_stm32.buses.pin_output_a", "0x0C"],
    [ "led_13.ports.pin", "u1_stm32.buses.pin_output_a", "0x0D"],
    [ "led_14.ports.pin", "u1_stm32.buses.pin_output_a", "0x0E"],
    [ "led_15.ports.pin", "u1_stm32.buses.pin_output_a", "0x0F"]
  ]
}

Kia tupato ki te tawhā mārō wāhanga maeko Ko te ingoa o te konae ka taea te uta ki roto i te taputapu mariko hei firmware.

Ko te taputapu mariko me tana taunekeneke ki te punaha whakahaere matua ka taea te whakaatu e te hoahoa e whai ake nei:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ko te tauira whakamatautau o naianei o te emulator ka uru ki te taunekeneke me nga tauranga COM o te OS matua (debug UART me UART mo te waahanga Nihokikorangi). Ka taea e enei he tauranga tuuturu e hono ana nga taputapu, nga tauranga COM mariko ranei (mo tenei ka hiahia koe com0com/socat).

I tenei wa e rua nga huarahi matua ki te taunekeneke me te emulator mai i waho:

  • Kawa GDB RSP (e ai ki nga taputapu e tautoko ana i tenei kawa ko Eclipse / IDA / radare2);
  • raina whakahau emulator roto (Argparse, Python ranei).

Tauranga COM mariko

Hei taunekeneke ki te UART o tetahi taputapu mariko i runga i te miihini o te rohe ma te tauranga, me hanga e koe etahi tauranga COM mariko e hono ana. I roto i to maatau, kotahi te tauranga e whakamahia ana e te emulator, ko te tuarua ma te kaupapa kapeka (PuTTY, mata ranei):

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ma te whakamahi i te com0com

Kua whirihorahia nga tauranga COM mariko ma te whakamahi i te taputapu tatūnga mai i te kete com0com (putanga papatohu - C:Kōnae Papatono (x86)com0comsetupс.exe, putanga GUI ranei - C:Kōnae Papatono (x86)com0comsetupg.exe):

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Tirohia nga pouaka Whakahohehia te putere overrun mo nga tauranga mariko katoa i hanga, ki te kore ka tatari te emulator mo te whakautu mai i te tauranga COM.

Te whakamahi i te socat

I runga i nga punaha UNIX, ko nga tauranga COM mariko ka hangaia e te emulator ma te whakamahi i te taputapu socat ki te mahi i tenei, tohua te tohu tuatahi i te ingoa tauranga ina timata te emulator socat:.

Atanga raina whakahau o roto (Argparse, Python ranei)

I te mea he tono papatohu a Kopycat, ka whakaratohia e te emulator nga whiringa atanga raina whakahau e rua mo te taunekeneke me ona taonga me ona taurangi: Argparse me Python.

Ko Argparse he CLI i hangaia ki roto i te Kopycat ka waatea tonu ki te katoa.

Ko tetahi atu CLI ko te kaiwhakamaori Python. Hei whakamahi, me whakauru koe i te waahanga Jep Python me te whirihora i te emulator kia mahi tahi me Python (ka whakamahia te kaiwhakamaori Python ki te punaha matua o te kaiwhakamahi).

Te tāuta i te kōwae Python Jep

I raro i te Linux Jep ka taea te whakauru ma te pip:

pip install jep

Hei whakauru i a Jep ki Windows, me whakauru tuatahi koe i te SDK Windows me te Microsoft Visual Studio e rite ana. Kua whakangwari ake matou mo koe me WHL hanga JEP mo nga putanga o naianei o Python mo Windows, no reira ka taea te whakauru i te waahanga mai i te konae:

pip install jep-3.8.2-cp27-cp27m-win_amd64.whl

Hei tirotiro i te whakaurunga o Jep, me rere koe i runga i te raina whakahau:

python -c "import jep"

Me tae mai te karere e whai ake nei hei whakautu:

ImportError: Jep is not supported in standalone Python, it must be embedded in Java.

I roto i te konae puranga emulator mo to punaha (copycat.bat - mo Windows, kape kape - mo Linux) ki te rarangi o nga tawhā DEFAULT_JVM_OPTS tāpirihia he tawhā atu Djava.library.path — me whakauru te ara ki te kōwae Jep kua oti te whakauru.

Ko te hua mo Windows me penei te rarangi:

set DEFAULT_JVM_OPTS="-XX:MaxMetaspaceSize=256m" "-XX:+UseParallelGC" "-XX:SurvivorRatio=6" "-XX:-UseGCOverheadLimit" "-Djava.library.path=C:/Python27/Lib/site-packages/jep"

Whakarewa Kopycat

Ko te emulator he tono JVM papatohu. Ko te whakarewatanga ka mahia ma roto i te tuhinga raina whakahau a te punaha whakahaere (sh/cmd).

Tono kia rere i raro i te Matapihi:

binkopycat -g 23946 -n rhino -l user -y library -p firmware=firmwarerhino_pass.bin,tty_dbg=COM26,tty_bt=COM28

Whakahau kia rere i raro i te Linux ma te whakamahi i te taputapu socat:

./bin/kopycat -g 23946 -n rhino -l user -y library -p firmware=./firmware/rhino_pass.bin, tty_dbg=socat:./COM26,tty_bt=socat:./COM28

  • -g 23646 — Tauranga TCP ka tuwhera mo te uru ki te tūmau GDB;
  • -n rhino — ingoa o te kōwae pūnaha matua (taputapu huihui);
  • -l user — te ingoa o te whare pukapuka hei rapu i te waahanga matua;
  • -y library — ara ki te rapu mo nga waahanga kei roto i te taputapu;
  • firmwarerhino_pass.bin — ara ki te konae firmware;
  • Ko COM26 me COM28 he tauranga COM mariko.

Ko te mutunga, ka whakaatuhia he tohu Python > (ranei Argparse >):

18:07:59 INFO [eFactoryBuilder.create ]: Module top successfully created as top
18:07:59 INFO [ Module.initializeAndRes]: Setup core to top.u1_stm32.cortexm0.arm for top
18:07:59 INFO [ Module.initializeAndRes]: Setup debugger to top.u1_stm32.dbg for top
18:07:59 WARN [ Module.initializeAndRes]: Tracer wasn't found in top...
18:07:59 INFO [ Module.initializeAndRes]: Initializing ports and buses...
18:07:59 WARN [ Module.initializePortsA]: ATTENTION: Some ports has warning use printModulesPortsWarnings to see it...
18:07:59 FINE [ ARMv6CPU.reset ]: Set entry point address to 08006A75
18:07:59 INFO [ Module.initializeAndRes]: Module top is successfully initialized and reset as a top cell!
18:07:59 INFO [ Kopycat.open ]: Starting virtualization of board top[rhino] with arm[ARMv6Core]
18:07:59 INFO [ GDBServer.debuggerModule ]: Set new debugger module top.u1_stm32.dbg for GDB_SERVER(port=23946,alive=true)
Python >

Te taunekeneke me te IDA Pro

Hei whakamaarama i nga whakamatautau, ka whakamahia e matou te Rhino firmware hei puna puna mo te tātari i roto i te IDA i roto i te ahua Kōnae ELF (Kei te rongoa nga korero meta ki reira).

Ka taea hoki e koe te whakamahi i te firmware matua kaore he korero meta.

I muri i te whakarewatanga o Kopycat i roto i te IDA Pro, i roto i te tahua Debugger haere ki te mea "Whakawhiti patuiro…"ka kowhiria"Kaitautoko GDB Mamao". Whai muri, whakaritea te hononga: tahua Patuiro - Kōwhiringa Tukanga…

Tautuhia nga uara:

  • Tono - ahakoa he uara
  • Ingoa Kaihautū: 127.0.0.1 (te wāhitau IP ranei o te miihini mamao kei te rere a Kopycat)
  • Port: 23946

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Inaianei kua waatea te paatene patuiro (Kī F9):

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Patohia hei hono ki te kōwae patuiro i te emulator. Ka uru te IDA ki te aratau patuiro, ka waatea etahi atu matapihi: nga korero mo nga rehita, mo te puranga.

Inaianei ka taea e taatau te whakamahi i nga ahuatanga paerewa katoa o te patuiro:

  • taahiraa-i-te-taahiraa o nga tohutohu (Whakatika ki roto и Takahia atu — taviri F7 me F8, ia;
  • timata me te whakamutu i te mahi;
  • te hanga i nga wehenga mo te waehere me te raraunga (Kī F2).

Ko te hono ki te patuiro ehara i te mea ko te whakahaere i te waehere firmware. Ko te waahi mahi o naianei ko te wahitau 0x08006A74 — te timatanga o te mahi Tautuhi_Kaiwhakahaere. Mena ka panuku koe ki raro i te raarangi, ka kite koe i te waea mahi matua. Ka taea e koe te whakanoho i te pehu ki runga i tenei raina (whitau 0x08006ABE) me te mahi i te mahi Rere tae noa ki te pehu (pātuhi F4).

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

I muri mai, ka taea e koe te pehi F7 ki te whakauru i te mahi matua.

Mena ka whakahaere koe i te whakahau Haere tonu te tukanga (Kī F9), ka puta mai te matapihi "Tatari koa" me te paatene kotahi Whakamutua:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ka pehi koe Whakamutua ka whakatārewahia te whakatinanatanga o te waehere mārō ka taea te haere tonu mai i te wāhitau kotahi i roto i te waehere i haukotia ai.

Mena kei te mahi tonu koe i te waehere, ka kite koe i nga rarangi e whai ake nei i nga pito e hono ana ki nga tauranga COM mariko:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ko te aroaro o te raina "whakawhitinga whenua" e tohu ana kua huri te kōwae Bluetooth mariko ki te ahua o te whiwhi raraunga mai i te tauranga COM o te kaiwhakamahi.

Inaianei kei te tauranga Nihokikorangi (COM29 i te pikitia) ka taea e koe te whakauru i nga whakahau kia rite ki te kawa Rhino. Hei tauira, ko te whakahau "MEOW" ka whakahokia te aho "mur-mur" ki te tauranga Nihokikorangi:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

kaua e tino rite ki ahau

I te wa e hanga ana he emulator, ka taea e koe te kowhiri i te taumata o te taipitopito/whakarite o tetahi taputapu. Hei tauira, ka taea te whai i te kōwae Nihokikorangi i roto i nga huarahi rereke:

  • kua tino peehia te taputapu me te huinga katoa o nga whakahau;
  • Ka whaihia nga whakahau AT, ka riro mai te awa raraunga mai i te tauranga COM o te punaha matua;
  • Ko te taputapu mariko e whakarato ana i te whakahokinga raraunga katoa ki te taputapu tuuturu;
  • hei stub ngawari e hoki mai ana "OK".

Ko te putanga o naianei o te emulator e whakamahi ana i te huarahi tuarua - ko te waahanga Nihokikorangi mariko e mahi ana i te whirihoranga, muri iho ka huri ki te aratau "whakapae" raraunga mai i te tauranga COM o te punaha matua ki te tauranga UART o te emulator.

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Kia whai whakaaro tatou ki te taea te whakamahi i nga taputapu ngawari o te waehere mena kaare etahi waahanga o te taha taha e whakatinanahia. Hei tauira, mena karekau i hangaia he matawā hei whakahaere i te whakawhiti raraunga ki te DMA (ka mahia te haki i roto i te mahi ws2812b_tatarikei te 0x08006840), ka tatari tonu te firmware mo te haki ki te tautuhi ano pukumahikei te 0x200004C4e whakaatu ana i te noho o te raina raraunga DMA:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ka taea e tatou te huri i tenei ahuatanga ma te tautuhi-a-ringa i te haki pukumahi i muri tonu i te tāutanga. I roto i te IDA Pro, ka taea e koe te hanga i tetahi mahi Python ka karangahia i roto i te waahi pakaru, ka waiho i te waahi pakaru ki roto i te waehere i muri i te tuhi i te uara 1 ki te haki. pukumahi.

Kaihautu wehenga

Tuatahi, me hanga he mahi Python i roto i te IDA. Tahua Kōnae - Tono Hōtuhi...

Tāpirihia he snippet hōu ki te rārangi kei te taha mauī, hoatu he ingoa (hei tauira, CPM),
I roto i te mara kuputuhi kei te taha matau, whakauruhia te waehere mahi:

def skip_dma():
    print "Skipping wait ws2812..."
    value = Byte(0x200004C4)
    if value == 1:
        PatchDbgByte(0x200004C4, 0)
return False

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

I muri i tera, pawhiria Whakahaere katia te matapihi tuhinga.

Na kia haere ki te waehere i 0x0800688A, tautuhia he waahi pakaru (kihi F2), whakatikahia (tuhinga horopaki Whakatikaina te waahi wehenga...), kaua e wareware ki te tautuhi i te momo tuhinga ki te Python:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat
Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Mena ko te uara haki o naianei pukumahi he rite ki te 1, katahi ka mahia e koe te mahi peke_dma i te rarangi tuhi:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Mena kei te whakahaere koe i te firmware mo te mahi, ka taea e koe te kite i te whakaoho o te waehere kaihautu wehenga i te matapihi IDA huaputa ma te raina Skipping wait ws2812.... Inaianei ka kore te firmware e tatari mo te haki ki te tautuhi ano pukumahi.

Te taunekeneke me te emulator

Ko te peehi mo te whai i te tauira kare pea e puta te koa me te koa. He pai ake mena ka awhina te emulator i te kairangahau ki te kite i nga raraunga i roto i te mahara ki te whakatuu ranei i te taunekeneke o nga miro.

Ma matou e whakaatu ki a koe me pehea te whakapumau i te taunekeneke i waenga i nga mahi RTOS. I te tuatahi me whakataa te mahi o te waehere mena kei te rere. Mena ka haere koe ki te mahi bluetooth_task_entry ki te peka tukatuka o te whakahau "LED" (wāhitau 0x080057B8), ka kite koe i te mea i hanga tuatahi ka tukuna ki te rarangi punaha ledControlQueueHandle etahi karere.

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Me whakarite e koe he waahi wehenga kia uru atu ki te taurangi ledControlQueueHandlekei te 0x20000624 me te mahi tonu i te waehere:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ko te mutunga mai, ka tu tuatahi ki te waahi noho 0x080057CA i mua i te karanga i te mahi osMailAlloc, katahi ki te wahi noho 0x08005806 i mua i te karanga i te mahi osMailPut, ka muri i etahi wa - ki te wahitau 0x08005BD4 (i mua i te karanga i te mahi osMailGet), no te mahi leds_task_entry (LED-task), ara, kua huri nga mahi, a inaianei kua riro i te LED-mahi te mana whakahaere.

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Ma tenei huarahi ngawari ka taea e koe te whakarite me pehea te taunekeneke a nga mahi RTOS ki a raatau ano.

Ae ra, i roto i te mooni, ko te taunekeneke o nga mahi ka nui ake te uaua, engari ma te whakamahi i te emulator, ka iti ake te mahi ki te whai i tenei taunekeneke.

konei Ka taea e koe te maataki i tetahi ataata poto o te whakarewatanga o te emulator me te taunekeneke me te IDA Pro.

Whakarewa me Radare2

Kaore e taea e koe te wareware i tetahi taputapu ao rite Radare2.

Hei hono atu ki te emulator ma te whakamahi r2, ka penei te ahua o te whakahau:

radare2 -A -a arm -b 16 -d gdb://localhost:23946 rhino_fw42k6.elf

Kei te waatea te whakarewatanga inaianei (dc) me te okioki i te mahi (Ctrl+C).

Engari, i tenei wa, he raruraru a r2 i te wa e mahi ana me te tūmau gdb taputapu me te whakatakotoranga mahara na tenei, kaore i te mahi nga waahanga me nga Hipanga (whakahau ds). Ko te tumanako ka whakatikahia tenei.

Rere me te Eclipse

Ko tetahi o nga whiringa mo te whakamahi i te emulator ko te patuiro i te firmware o te taputapu e whakawhanakehia ana. Mo te whakamarama, ka whakamahia ano e matou te Rhino firmware. Ka taea e koe te tango mai i nga punaha firmware mai i konei.

Ka whakamahia e matou te Eclipse mai i te huinga hei IDE Paemahi Pūnaha mo STM32.

Kia taea ai e te emulator te utaina te firmware i whakaemihia ki Eclipse, me taapiri koe i te tawhā firmware=null ki te whakahau whakarewa emulator:

binkopycat -g 23946 -n rhino -l user -y modules -p firmware=null,tty_dbg=COM26,tty_bt=COM28

Te whakarite whirihoranga patuiro

I roto i te Eclipse, tohua te tahua Whakahaere - Patuiro Whirihoranga... I te matapihi e tuwhera ana, i te waahanga GDB Pūmārō patuiro Me taapiri koe i tetahi whirihoranga hou, katahi ki te ripa "Main" tohua te kaupapa o naianei me te tono mo te patuiro:

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

I runga i te ripa "Debugger" me tohu e koe te whakahau GDB:
${openstm32_compiler_path}arm-none-eabi-gdb

Me whakauru ano hoki nga tawhā mo te hono ki te tūmau GDB (kaiwhakahaere me te tauranga):

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

I te ripa "Whakaoho", me tohu e koe nga tawhā e whai ake nei:

  • taea te pouakataki Utaina te ahua (kia utaina te ahua o te firmware kua kohia ki te emulator);
  • taea te pouakataki Nga tohu utaina;
  • tāpirihia te whakahau whakarewa: set $pc = *0x08000004 (whakaturia te rehita PC ki te uara mai i te mahara ki te wahitau 0x08000004 - kei reira te wahitau e rongoa ana TautuhiKaiwhakahaere).

Kia tupato, ki te kore koe e hiahia ki te tango i te konae firmware mai i Eclipse, katahi ko nga whiringa Utaina te ahua и Whakahaerehia nga whakahau kahore he take ki te tohu.

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

I muri i te panui i te Patuiro, ka taea e koe te mahi i roto i te aratau patuiro:

  • taahiraa i te mahi waehere taahiraa
    Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat
  • te taunekeneke me nga waahi pakaru
    Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

parau. Kei a Eclipse, hmm... etahi ahuatanga... me noho koe ki a ratou. Hei tauira, mena ka tiimata te patuiro ka puta te panui "Kaore he puna mo te "0x0″", katahi ka mahia te whakahau Hipanga (F5)

Rhinoceros i roto i te ngeru - whakahaere te firmware i te emulator Kopycat

Engari o te mutunga

Ko te whai i te waehere taketake he mea tino pai. Ka taea e te kaiwhakawhanake taputapu te patuiro i te firmware me te kore he taputapu pono. Mo te kairangahau, he whai waahi ki te whakahaere i te wetewete waehere hihiri, kaore e taea i nga wa katoa ahakoa he taputapu.

E hiahia ana matou ki te whakarato ki nga tohunga he taputapu he watea, he ngawari noa, kaore e nui te whakapau kaha me te wa ki te whakarite me te whakahaere.

Tuhia ki nga korero mo to wheako ki te whakamahi i nga emulator taputapu. Ka tono matou ki a koe ki te korerorero, ka koa koe ki te whakautu i nga patai.

Ko nga kaiwhakamahi kua rehita anake ka uru ki te rangahau. Waitohu maitēnā.

He aha koe e whakamahi ana i te emulator?

  • Ka whakawhanakehia e ahau (debug) firmware

  • Kei te rangahau ahau i te firmware

  • Ka whakarewa au i nga keemu (Dendi, Sega, PSP)

  • tetahi atu mea (tuhia ki nga korero)

7 nga kaiwhakamahi i pooti. 2 nga kaiwhakamahi i aukati.

He aha te rorohiko e whakamahia ana e koe ki te whai i te waehere taketake?

  • Tuhinga

  • miihini Unicorn

  • Proteus

  • tetahi atu mea (tuhia ki nga korero)

6 nga kaiwhakamahi i pooti. 2 nga kaiwhakamahi i aukati.

He aha e hiahia ana koe ki te whakapai ake i te emulator e whakamahia ana e koe?

  • E hiahia ana ahau ki te tere

  • Kei te pirangi au ki te ngawari o te tatūnga/whakarewa

  • Kei te pirangi au ki etahi atu whiringa mo te taunekeneke me te emulator (API, matau)

  • Kei te harikoa ahau ki nga mea katoa

  • tetahi atu mea (tuhia ki nga korero)

8 nga kaiwhakamahi i pooti. 1 te kaiwhakamahi i aukati.

Source: will.com

Tāpiri i te kōrero