Rhinoceros mukati mekati - mhanyisa iyo firmware muKopycat emulator

Sechikamu chemusangano 0x0A DC7831 DEF CON Nizhny Novgorod Musi waKukadzi 16, takapa mushumo pamusoro pemisimboti yebhinari kodhi emulation uye budiriro yedu pachedu - hardware platform emulator. Copycat.

Muchikamu chino tichatsanangura nzira yekumhanyisa iyo firmware yemudziyo muemulator, kuratidza kudyidzana nedebugger, uye kuita diki diki ongororo yeiyo firmware.

prehistory

Kare kare mune rimwe galaxy kure kure

Makore akati wandei apfuura murabhoritari yedu paive nechido chekuongorora firmware yechigadzirwa. Iyo firmware yakamanikidzwa uye isina kurongedzerwa nebootloader. Akaita izvi nenzira yakaoma kwazvo, achichinja data mundangariro kakawanda. Uye iyo firmware pachayo yakabva yanyatsopindirana nemaperipherals. Uye zvese izvi paMIPS musimboti.

Nezvikonzero zvechinangwa, ma emulators aivepo haana kuenderana nesu, asi isu takanga tichiri kuda kumhanya kodhi. Ipapo takasarudza kugadzira yedu emulator, iyo yaizoita zvishoma uye inotibvumira kusunungura iyo huru firmware. Takaiedza ikashanda. Isu takafunga, ko kana tikawedzera peripherals kuitawo main firmware. Izvo hazvina kurwadza zvakanyanya - uye zvakashanda zvakare. Takafunga zvakare uye takasarudza kuita yakazara-emulator.

Mhedzisiro yaive yekombuta masisitimu emulator Copycat.

Sei Kopycat?

Kune kutamba pamashoko.

1. Copcat (ChiRungu, zita [ˈkɒpɪkæt]) - mutevedzeri, mutevedzeri
2. katsi (ChiRungu, zita [ˈkæt]) - katsi, katsi - mhuka inofarira yemumwe wevagadziri vechirongwa
3. Tsamba "K" inobva kumutauro weKotlin programming

Copycat

Pakugadzira emulator, zvinangwa chaizvo zvakaiswa:

• kugona kukurumidza kugadzira maperipherals matsva, modules, processor cores;
• kugona kuunganidza chigadziriso kubva kune akasiyana ma module;
• kukwanisa kutakura chero bhinari data (firmware) muchirangaridzo chechigadzirwa chechidimbu;
• kukwanisa kushanda ne snapshots (snapshots of the system state);
• kugona kupindirana neiyo emulator kuburikidza neyakavakwa-mukati debugger;
• mutauro wazvino uno wakanaka webudiriro.

Somugumisiro, Kotlin yakasarudzwa kuti ishandiswe, chivakwa chebhazi (iyi ndiyo apo ma modules anotaurirana mumwe nomumwe kuburikidza nemabhasi e data data), JSON sechimiro chekutsanangurwa kwechigadzirwa, uye GDB RSP seprotocol yekudyidzana nedebugger.

Budiriro yanga ichienderera kweanopfuura makore maviri uye ichiri kuenderera mberi. Munguva iyi, MIPS, x86, V850ES, ARM, uye PowerPC processor cores yakaitwa.

Chirongwa ichi chiri kukura uye yave nguva yekuchipa kune veruzhinji. Tichaita tsananguro yakadzama yeprojekiti gare gare, asi ikozvino tichatarisa pakushandisa Kopycat.

Kune vasina moyo murefu, shanduro yekusimudzira ye emulator inogona kutorwa kubva batanidzo.

Rhino mune emulator

Ngatiyeukei kuti pamberi pemusangano we SMARTRHINO-2018, mudziyo wekuyedza "Rhinoceros" wakagadzirirwa kudzidzisa reverse engineering hunyanzvi. Maitiro eiyo static firmware yekuongorora yakatsanangurwa mukati ichi chinyorwa.

Iye zvino ngatiedzei kuwedzera "vatauri" uye shandisa firmware mune emulator.

Tichada:
1) Java 1.8
2) Python uye module jep kushandisa Python mukati meemulator. Unogona kuvaka iyo WHL module Jep yeWindows download pano.

ZveWindows:
1) com0com
2) putty

Pamusoro peLinux:
1) socat

Unogona kushandisa Eclipse, IDA Pro kana radare2 semutengi weGDB.

Sei kushanda?

Kuti uite firmware mune emulator, zvinodikanwa "kuunganidza" mudziyo chaiwo, inova analogue yechinhu chaicho.

Iyo chaiyo mudziyo ("chipembere") inogona kuratidzwa mudhizaini yebhuroka:

Iyo emulator ine modular chimiro uye yekupedzisira virtual mudziyo inogona kutsanangurwa muJSON faira.

JSON 105 mitsetse

{
  "top": true,

  // Plugin name should be the same as file name (or full path from library start)
  "plugin": "rhino",

  // Directory where plugin places
  "library": "user",

  // Plugin parameters (constructor parameters if jar-plugin version)
  "params": [
    { "name": "tty_dbg", "type": "String"},
    { "name": "tty_bt", "type": "String"},
    { "name": "firmware", "type": "String", "default": "NUL"}
  ],

  // Plugin outer ports
  "ports": [  ],

  // Plugin internal buses
  "buses": [
    { "name": "mem", "size": "BUS30" },
    { "name": "nand", "size": "4" },
    { "name": "gpio", "size": "BUS32" }
  ],

  // Plugin internal components
  "modules": [
    {
      "name": "u1_stm32",
      "plugin": "STM32F042",
      "library": "mcu",
      "params": {
        "firmware:String": "params.firmware"
      }
    },
    {
      "name": "usart_debug",
      "plugin": "UartSerialTerminal",
      "library": "terminals",
      "params": {
        "tty": "params.tty_dbg"
      }
    },
    {
      "name": "term_bt",
      "plugin": "UartSerialTerminal",
      "library": "terminals",
      "params": {
        "tty": "params.tty_bt"
      }
    },
    {
      "name": "bluetooth",
      "plugin": "BT",
      "library": "mcu"
    },

    { "name": "led_0",  "plugin": "LED", "library": "mcu" },
    { "name": "led_1",  "plugin": "LED", "library": "mcu" },
    { "name": "led_2",  "plugin": "LED", "library": "mcu" },
    { "name": "led_3",  "plugin": "LED", "library": "mcu" },
    { "name": "led_4",  "plugin": "LED", "library": "mcu" },
    { "name": "led_5",  "plugin": "LED", "library": "mcu" },
    { "name": "led_6",  "plugin": "LED", "library": "mcu" },
    { "name": "led_7",  "plugin": "LED", "library": "mcu" },
    { "name": "led_8",  "plugin": "LED", "library": "mcu" },
    { "name": "led_9",  "plugin": "LED", "library": "mcu" },
    { "name": "led_10", "plugin": "LED", "library": "mcu" },
    { "name": "led_11", "plugin": "LED", "library": "mcu" },
    { "name": "led_12", "plugin": "LED", "library": "mcu" },
    { "name": "led_13", "plugin": "LED", "library": "mcu" },
    { "name": "led_14", "plugin": "LED", "library": "mcu" },
    { "name": "led_15", "plugin": "LED", "library": "mcu" }
  ],

  // Plugin connection between components
  "connections": [
    [ "u1_stm32.ports.usart1_m", "usart_debug.ports.term_s"],
    [ "u1_stm32.ports.usart1_s", "usart_debug.ports.term_m"],

    [ "u1_stm32.ports.usart2_m", "bluetooth.ports.usart_m"],
    [ "u1_stm32.ports.usart2_s", "bluetooth.ports.usart_s"],

    [ "bluetooth.ports.bt_s", "term_bt.ports.term_m"],
    [ "bluetooth.ports.bt_m", "term_bt.ports.term_s"],

    [ "led_0.ports.pin",  "u1_stm32.buses.pin_output_a", "0x00"],
    [ "led_1.ports.pin",  "u1_stm32.buses.pin_output_a", "0x01"],
    [ "led_2.ports.pin",  "u1_stm32.buses.pin_output_a", "0x02"],
    [ "led_3.ports.pin",  "u1_stm32.buses.pin_output_a", "0x03"],
    [ "led_4.ports.pin",  "u1_stm32.buses.pin_output_a", "0x04"],
    [ "led_5.ports.pin",  "u1_stm32.buses.pin_output_a", "0x05"],
    [ "led_6.ports.pin",  "u1_stm32.buses.pin_output_a", "0x06"],
    [ "led_7.ports.pin",  "u1_stm32.buses.pin_output_a", "0x07"],
    [ "led_8.ports.pin",  "u1_stm32.buses.pin_output_a", "0x08"],
    [ "led_9.ports.pin",  "u1_stm32.buses.pin_output_a", "0x09"],
    [ "led_10.ports.pin", "u1_stm32.buses.pin_output_a", "0x0A"],
    [ "led_11.ports.pin", "u1_stm32.buses.pin_output_a", "0x0B"],
    [ "led_12.ports.pin", "u1_stm32.buses.pin_output_a", "0x0C"],
    [ "led_13.ports.pin", "u1_stm32.buses.pin_output_a", "0x0D"],
    [ "led_14.ports.pin", "u1_stm32.buses.pin_output_a", "0x0E"],
    [ "led_15.ports.pin", "u1_stm32.buses.pin_output_a", "0x0F"]
  ]
}

Teerera kune parameter firmware muchikamu params izita refaira rinogona kutakurwa mune chaiyo mudziyo se firmware.

Iyo chaiyo mudziyo uye kudyidzana kwayo neiyo huru inoshanda sisitimu inogona kumiririrwa neinotevera dhayagiramu:

Iyo yazvino bvunzo muenzaniso weemulator unosanganisira kudyidzana neCOM zviteshi zveiyo huru OS (debug UART uye UART yeBluetooth module). Aya anogona kunge ari madoko chaiwo kune ayo maturusi akabatana kana chaiwo COM ports (zveizvi iwe unongoda com0com/socat).

Parizvino pane nzira mbiri huru dzekudyidzana neiyo emulator kubva kunze:

• GDB RSP protocol (sezvo, zvishandiso zvinotsigira iyi protocol Eclipse / IDA / radare2);
• yemukati emulator yekuraira mutsara (Argparse kana Python).

Virtual COM ports

Kuti uwirirane neUART yechinhu chaicho pamushini wemuno kuburikidza neterminal, iwe unofanirwa kugadzira peya yakabatana chaiyo COM ports. Kwatiri, imwe chiteshi inoshandiswa neemulator, uye yechipiri inoshandiswa nechirongwa chekupedzisira (PuTTY kana skrini):

Kushandisa com0com

Virtual COM ports inogadziriswa uchishandisa setup utility kubva ku com0com kit (console version - C: Mafaira eChirongwa (x86) com0comsetupс.exe, kana GUI shanduro - C: Mafaira eChirongwa (x86) com0comsetupg.exe):

Tarisa mabhokisi ita kuti buffer iwedzere kune ese akagadzirwa chaiwo madoko, zvikasadaro emulator inomirira mhinduro kubva kuCOM port.

Kushandisa socat

PaUNIX masisitimu, chaiwo COM ports anogadzirwa otomatiki emulator achishandisa socat utility; kuti uite izvi, ingo tsanangura prefix muzita rechiteshi paunotanga emulator. socat:.

Yemukati yekuraira mutsara interface (Argparse kana Python)

Sezvo Kopycat iri console application, emulator inopa maviri ekuraira mutsara sarudzo yekudyidzana nezvinhu zvayo uye zvinosiyana: Argparse uye Python.

Argparse iCLI yakavakirwa muKopycat uye inogara iripo kune wese munhu.

Imwe CLI ndiye muturikiri wePython. Kuti uishandise, unofanirwa kuisa iyo Jep Python module uye gadzirisa emulator kuti ishande nePython (muturikiri wePython akaiswa pane main system yemushandisi achashandiswa).

Kuisa iyo Python module Jep

Pasi peLinux Jep inogona kuiswa kuburikidza nepip:

pip install jep

Kuisa Jep paWindows, unofanira kutanga waisa Windows SDK uye inowirirana neMicrosoft Visual Studio. Isu takaita kuti zvive nyore kwauri uye WHL inovaka JEP yeazvino mavhezheni ePython yeWindows, saka module inogona kuiswa kubva mufaira:

pip install jep-3.8.2-cp27-cp27m-win_amd64.whl

Kuti utarise kuiswa kweJep, unofanirwa kumhanya pamutsara wekuraira:

python -c "import jep"

Iyi meseji inofanirwa kugamuchirwa mukupindura:

ImportError: Jep is not supported in standalone Python, it must be embedded in Java.

Mune emulator batch faira kune yako system (copycat.bat - yeWindows, copycat - yeLinux) kune runyorwa rwema paramita DEFAULT_JVM_OPTS wedzera imwe parameter Djava.library.path - inofanira kunge iine nzira inoenda kune yakaiswa Jep module.

Mhedzisiro yeWindows inofanirwa kunge iri mutsara seuyu:

set DEFAULT_JVM_OPTS="-XX:MaxMetaspaceSize=256m" "-XX:+UseParallelGC" "-XX:SurvivorRatio=6" "-XX:-UseGCOverheadLimit" "-Djava.library.path=C:/Python27/Lib/site-packages/jep"

Kutanga Kopycat

Iyo emulator ndeye console JVM application. Kuvhurwa kunoitwa kuburikidza neiyo yekushandisa system command line script (sh/cmd).

Raira kumhanya pasi peWindows:

binkopycat -g 23946 -n rhino -l user -y library -p firmware=firmwarerhino_pass.bin,tty_dbg=COM26,tty_bt=COM28

Raira kumhanya pasi peLinux uchishandisa socat utility:

./bin/kopycat -g 23946 -n rhino -l user -y library -p firmware=./firmware/rhino_pass.bin, tty_dbg=socat:./COM26,tty_bt=socat:./COM28

• -g 23646 - TCP chiteshi iyo ichave yakavhurika yekuwana iyo GDB server;
• -n rhino - zita reiyo main system module (yakaunganidzwa mudziyo);
• -l user - zita reraibhurari yekutsvaga iyo huru module;
• -y library - nzira yekutsvaga mamodule akabatanidzwa muchishandiso;
• firmwarerhino_pass.bin - nzira kune firmware file;
• COM26 uye COM28 ndeyechokwadi COM ports.

Nekuda kweizvozvo, kukurumidza kucharatidzwa Python > (kana Argparse >):

18:07:59 INFO [eFactoryBuilder.create ]: Module top successfully created as top
18:07:59 INFO [ Module.initializeAndRes]: Setup core to top.u1_stm32.cortexm0.arm for top
18:07:59 INFO [ Module.initializeAndRes]: Setup debugger to top.u1_stm32.dbg for top
18:07:59 WARN [ Module.initializeAndRes]: Tracer wasn't found in top...
18:07:59 INFO [ Module.initializeAndRes]: Initializing ports and buses...
18:07:59 WARN [ Module.initializePortsA]: ATTENTION: Some ports has warning use printModulesPortsWarnings to see it...
18:07:59 FINE [ ARMv6CPU.reset ]: Set entry point address to 08006A75
18:07:59 INFO [ Module.initializeAndRes]: Module top is successfully initialized and reset as a top cell!
18:07:59 INFO [ Kopycat.open ]: Starting virtualization of board top[rhino] with arm[ARMv6Core]
18:07:59 INFO [ GDBServer.debuggerModule ]: Set new debugger module top.u1_stm32.dbg for GDB_SERVER(port=23946,alive=true)
Python >

Kudyidzana neIDA Pro

Kurerutsa kuyedzwa, isu tinoshandisa iyo Rhino firmware seyosiyo faira rekuongorora muIDA mune fomu ELF faira (meta ruzivo rwakachengetwa ipapo).

Iwe unogona zvakare kushandisa iyo huru firmware pasina meta ruzivo.

Mushure mekutangisa Kopycat muIDA Pro, muDebugger menyu enda kuchinhu "Chinja debugger..."uye sarudza"Remote GDB debugger". Tevere, gadzira chinongedzo: menyu Debugger - Maitiro esarudzo…

Seta zvakakosha:

• Kushandisa - chero kukosha
• Zita remugamuchiri: 127.0.0.1 (kana IP kero yemuchina uri kure uko Kopycat iri kushanda)
• Port: 23946

Iye zvino bhatani rekugadzirisa rinowanikwa (F9 kiyi):

Dzvanya iyo kuti ubatanidze kune debugger module mune emulator. IDA inopinda mudebugging mode, mamwe windows anowanikwa: ruzivo nezve marejista, nezve stack.

Iye zvino tinogona kushandisa ese akajairwa maficha e debugger:

• nhanho-ne-nhanho kuita mirairo (Pinda mukati и Endai mhiri - makiyi F7 uye F8, zvichiteerana);
• kutanga uye kumbomira kuuraya;
• kugadzira mabreakpoint eese ari maviri kodhi uye data (F2 kiyi).

Kubatanidza kune debugger hazvirevi kumhanyisa firmware code. Ikozvino nzvimbo yekuuraya inofanira kunge iri kero 0x08006A74 - kutanga kwebasa Reset_Handler. Kana iwe ukakanda pasi rondedzero, iwe unogona kuona iyo basa rekufona kuru. Unogona kuisa chitubu pamutsetse uyu (address 0x08006ABE) uye kuita oparesheni Mhanyai kusvika cursor (kiyi F4).

Tevere, unogona kudzvanya F7 kuti upinde basa kuru.

Kana iwe uchimhanya murairo Enderera mberi (F9 kiyi), ipapo iyo "Ndapota mira" hwindo richaonekwa nebhatani rimwechete Mira:

Paunodzvanya Mira Kuitwa kweiyo firmware code yakamiswa uye inogona kuenderera kubva kune imwechete kero mukodhi iyo yakakanganiswa.

Kana iwe ukaramba uchiita iyo kodhi, iwe uchaona inotevera mitsara mumaterminal akabatana kune chaiwo COM ports:

Kuvapo kwe "state bypass" mutsara kunoratidza kuti chaiyo Bluetooth module yachinja kune nzira yekugamuchira data kubva kumushandisi weCOM port.

Iye zvino muBluetooth terminal (COM29 pamufananidzo) unogona kuisa mirairo maererano neRhino protocol. Semuenzaniso, iyo "MEOW" yekuraira inodzosa tambo "mur-mur" kune iyo Bluetooth terminal:

Nditevedzere kwete zvachose

Paunenge uchivaka emulator, unogona kusarudza iyo nhanho yeruzivo / kutevedzera yeimwe mudziyo. Semuenzaniso, iyo Bluetooth module inogona kutevedzerwa nenzira dzakasiyana:

• mudziyo wacho wakanyatso kutevedzerwa neseti yakazara yemirairo;
• AT mirairo inoteedzerwa, uye dhata dhata inogamuchirwa kubva kuCOM chiteshi cheiyo huru system;
• iyo chaiyo mudziyo inopa yakakwana data redirection kune chaiyo mudziyo;
• seyakareruka stub inogara ichidzoka "OK".

Iyo yazvino vhezheni yeemulator inoshandisa yechipiri maitiro - iyo chaiyo Bluetooth module inoita zvigadziriso, mushure mezvo ichichinjira kune "proxying" data kubva kuCOM port yeiyo main system kuenda kuUART chiteshi cheemulator.

Ngatitarisei mukana wekushandisa zviri nyore kodhi kana chimwe chikamu cheperiphery chikasaitwa. Semuenzaniso, kana timer inotarisira kudzora kuendesa data kuDMA isati yagadzirwa (cheki inoitwa mubasa racho. w2812b_waitiri pa 0x08006840), ipapo iyo firmware inogara yakamirira kuti mureza ugadzirwe zvakare takabatikanairi pa 0x200004C4iyo inoratidza kugara kweiyo DMA data line:

Tinogona kutenderera nemamiriro ezvinhu aya nekuisa patsva mureza takabatikana pakarepo mushure mekuiisa. MuIDA Pro, unogona kugadzira basa rePython uye woridaidza mubreakpoint, woisa iyo breakpoint pachayo mukodhi mushure mekunyora kukosha 1 kumureza. takabatikana.

Breakpoint handler

Kutanga, ngatigadzire basa rePython muIDA. Menu Faira - Script command...

Wedzera snippet nyowani mune runyorwa kuruboshwe, ipe zita (semuenzaniso, CPM),
Mundima yemavara kurudyi, isa kodhi yebasa:

def skip_dma():
    print "Skipping wait ws2812..."
    value = Byte(0x200004C4)
    if value == 1:
        PatchDbgByte(0x200004C4, 0)
return False

Mushure mezvo tinodzvanya manya uye vhara script hwindo.

Zvino ngatiendei kune kodhi pa 0x0800688A, isa nzvimbo yekutyora (F2 kiyi), igadzirise (menu yemukati Rongedza breakpoint...), usakanganwa kuseta iyo script mhando kuPython:

Kana kukosha kwemureza ikozvino takabatikana yakaenzana ne1, saka iwe unofanirwa kuita basa racho skip_dma mumutsara wescript:

Kana iwe uchimhanyisa iyo firmware yekuurayiwa, kukonzeresa kweiyo breakpoint handler kodhi inogona kuoneka pahwindo reIDA. goho nemutsara Skipping wait ws2812.... Iye zvino iyo firmware haizomirira kuti mureza ugadzirwe zvakare takabatikana.

Kudyidzana ne emulator

Emulation nekuda kwekuteedzera kashoma kukonzeresa mufaro uye mufaro. Zvinonyanya kunakidza kana emulator ichibatsira muongorori kuti aone iyo data mundangariro kana kumisa kusangana kwetambo.

Isu tinokuratidza maitiro ekusimbisa kudyidzana pakati peRTOS mabasa. Iwe unofanirwa kutanga wambomira kuita kwekodhi kana iri kushanda. Kana ukaenda kubasa bluetooth_task_entry kubazi rekugadzirisa re "LED" murairo (kero 0x080057B8), ipapo iwe unogona kuona izvo zvinotanga kugadzirwa uye zvino kutumirwa kune system queue ledControlQueueHandle imwe meseji.

Iwe unofanirwa kuseta breakpoint kuti uwane iyo inoshanduka ledControlQueueHandleiri pa 0x20000624 uye ramba uchiita kodhi:

Nekuda kweizvozvo, kumira kunotanga kuitika pakero 0x080057CA usati wafonera basa osMailAlloc, ipapo pakero 0x08005806 usati wafonera basa osMailPut, zvino mushure mechinguva - kune kero 0x08005BD4 (usati wafonera basa osMailGet), inova yebasa racho leds_task_entry (LED-task), kureva, mabasa akachinjwa, uye ikozvino LED-basa rakagamuchira kutonga.

Nenzira iyi iri nyore iwe unogona kuona kuti mabasa eRTOS anopindirana sei.

Ehe, muchokwadi, kupindirana kwemabasa kunogona kuve kwakaomarara, asi kushandisa emulator, kuronda kupindirana uku kunove kushoma.

pano Unogona kuona vhidhiyo ipfupi yekutangisa emulator uye kufambidzana neIDA Pro.

Tanga neRadare2

Iwe haugone kufuratira chishandiso chepasirese chakadai seRadare2.

Kuti ubatanidze kune emulator uchishandisa r2, iwo murairo waizotaridzika seizvi:

radare2 -A -a arm -b 16 -d gdb://localhost:23946 rhino_fw42k6.elf

Kutanga kunowanikwa ikozvino (dc) uye kumbomira kuuraya (Ctrl+C).

Nehurombo, panguva ino, r2 ine matambudziko kana uchishanda neiyo hardware gdb server uye ndangariro dhizaini; nekuda kweizvi, breakpoints uye Matanho haashande (kuraira. ds) Tinovimba kuti izvi zvichagadziriswa nekukurumidza.

Kumhanya neEclipse

Imwe yesarudzo dzekushandisa emulator ndeyekugadzirisa firmware yemudziyo uri kugadzirwa. Kuti zvive pachena, tichashandisawo Rhino firmware. Unogona kudhawunirodha zvinyorwa zve firmware kubva pano.

Isu tichashandisa Eclipse kubva pane yakatarwa seIDE System Workbench yeSTM32.

Kuti emulator itakure firmware yakanyatso kuunganidzwa muEclipse, unofanirwa kuwedzera iyo parameter firmware=null kune emulator yekutanga kuraira:

binkopycat -g 23946 -n rhino -l user -y modules -p firmware=null,tty_dbg=COM26,tty_bt=COM28

Kugadzira debug configuration

MuEclipse, sarudza menyu Mhanya - Debug Configurations... Mufafitera rinovhurwa, muchikamu GDB Hardware Debugging iwe unofanirwa kuwedzera gadziriso nyowani, ipapo pane "Main" tebhu tsanangura iyo yazvino purojekiti uye application yekugadzirisa:

Pa "Debugger" tab iwe unofanirwa kutsanangura murairo weGDB:
${openstm32_compiler_path}arm-none-eabi-gdb

Uye zvakare pinda maparamendi ekubatanidza kune iyo GDB server (host uye port):

Pa "Startup" tab, unofanira kutsanangura zvinotevera parameters:

• gonesa checkbox Rodha mufananidzo (kuitira kuti iyo yakaunganidzwa firmware mufananidzo unotakurwa mune emulator);
• gonesa checkbox Rodha zviratidzo;
• wedzera murairo wekutanga: set $pc = *0x08000004 (seta PC rejista kune kukosha kubva mundangariro kukero 0x08000004 - kero inochengetwa ipapo ResetHandler).

Ngwarira, kana iwe usingade kurodha firmware faira kubva Eclipse, ipapo sarudzo Rodha mufananidzo и Mhanyai mirairo hapana chikonzero chekuratidza.

Mushure mekudzvanya Debug, unogona kushanda mudebugger mode:

• nhanho nhanho kodhi kuuraya
  
• kusangana nemabreakpoints
  

taura pfungwa. Eclipse ine, hmm ... zvimwe quirks ... uye iwe unofanirwa kugara navo. Semuenzaniso, kana paunotanga debugger meseji "Hapana kwainowanika ye"0x0″" ikaonekwa, wobva waita Danho rekuraira (F5)

Pane mhedziso

Emulating native code chinhu chinonakidza kwazvo. Zvinoita kuti mugadziri wemudziyo agadzirise firmware pasina mudziyo chaiwo. Kune muongorori, iwo mukana wekuita dynamic code analysis, iyo isingagoneki nguva dzose kunyange nechigadzirwa.

Tinoda kupa nyanzvi chishandiso chiri nyore, chiri pakati nepakati uye chisingatore simba rakawanda uye nguva yekumisa uye kumhanya.

Nyora mune zvakataurwa nezve chiitiko chako uchishandisa hardware emulators. Tinokukumbira kuti ukurukure uye uchafara kupindura mibvunzo.

Vashandisi vakanyoresa chete ndivo vanogona kutora chikamu muongororo. Nyorera mu, Munogamuchirwa.

Chii chauri kushandisa emulator?

• Ini ndinogadzira (debug) firmware

• Ndiri kuongorora firmware

• Ini ndinotanga mitambo (Dendi, Sega, PSP)

• chimwe chinhu (nyora mumashoko)

7 vashandisi vakavhota. 2 vashandisi vakaramba.

Ndeipi software yaunoshandisa kutevedzera native code?

• QEMU

• Unicorn injini

• Proteus

• chimwe chinhu (nyora mumashoko)

6 vashandisi vakavhota. 2 vashandisi vakaramba.

Chii chaungade kuvandudza mune emulator yauri kushandisa?

• Ndinoda speed

• Ini ndinoda kuve nyore kuseta / kutanga

• Ini ndinoda dzimwe sarudzo dzekudyidzana ne emulator (API, hoko)

• Ndinofara nezvose

• chimwe chinhu (nyora mumashoko)

8 vashandisi vakavhota. 1 mushandisi haana.

Source: www.habr.com