Ejemplo n.º 1
0
# Firmware Infos
# Evaluation Kit CYW927035
FW_NAME = "CYW27035B1"

# Device Infos
DEVICE_NAME = 0x280CD0  # rm_deviceLocalName, FIXME has no longer a length byte prepended
BD_ADDR = 0x280CA4  # rm_deviceBDAddr

#Heap
BLOC_HEAD = 0x200474  # g_dynamic_memory_GeneralUsePools
BLOC_NG = True  # Next Generation Bloc Buffer

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x001fffff, True, False),  # Internal ROM
    MemorySection(0x00200000, 0x0024ffff, False,
                  True),  # Internal Memory Cortex M3
    MemorySection(0x00270000, 0x0027ffff, False,
                  True),  # Internal Memory Patchram Contents
    MemorySection(0x00280000, 0x00283fff, False, True),  # ToRam
    MemorySection(0x00300000, 0x00307fff, False,
                  True),  # HW Regs Cortex M3 (readable)
    MemorySection(0x00310000, 0x00321fff, False,
                  True),  # HW Regs Cortex M3 (readable)
    MemorySection(0x00326000, 0x0032ffff, False,
                  True),  # HW Regs Cortex M3 (readable)
    MemorySection(0x00338000, 0x00367fff, False,
                  True),  # HW Regs Cortex M3 (readable) + Pka Top
    MemorySection(0x00370000, 0x0037ffff, False, True),  # RTX FIFO
    MemorySection(0x00390000, 0x00397fff, False, True),  # Power WD
Ejemplo n.º 2
0
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# Samsung Galaxy S8
FW_NAME = "BCM4347B0"

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x00100000, True, False),  # Internal ROM
    MemorySection(0x00130000, 0x00150000, False,
                  True),  # Internal Memory Patchram Contents
    MemorySection(0x00200000, 0x0023ffff, False,
                  True),  # Internal Memory Cortex M3
]

# Patchram
PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
PATCHRAM_VALUE_TABLE_ADDRESS = 0x130000
PATCHRAM_NUMBER_OF_SLOTS = 256
PATCHRAM_ALIGNED = False

# Heap
BLOC_HEAD = 0x20067C  # g_dynamic_memory_GeneralUsePools
Ejemplo n.º 3
0
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# Evaluation Kit CYW20706
FW_NAME = "CYW20706"

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x000c7fff, True, False),  # Internal ROM
    MemorySection(0x000d0000, 0x000dffff, False, True),
    MemorySection(0x00200000, 0x00247fff, False,
                  True),  # Internal Memory Cortex M3
]

# Patchram
#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
#PATCHRAM_VALUE_TABLE_ADDRESS    = 0x0d0000
#PATCHRAM_NUMBER_OF_SLOTS        = 256
PATCHRAM_ALIGNED = True
# only seems to work 4-byte aligned here ...
Ejemplo n.º 4
0
# the Software without restriction, including without limitation the rights to
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
# the Software, and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
# - The above copyright notice and this permission notice shall be included in
#   all copies or substantial portions of the Software.
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
FW_NAME = "BCM20702A1 (USB Bluetooth dongle)"

# Device Infos
#DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
#BD_ADDR = 0x280CA4                      # rm_deviceBDAddr

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x5ffff, True, False),  # Internal ROM
    MemorySection(0x80000, 0x9bfff, False, True),  # Internal RAM
]
BLOC_HEAD = 0x3166c
Ejemplo n.º 5
0
# Copyright (c) 2019 Jiska Classen. (MIT License)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of
# this software and associated documentation files (the "Software"), to deal in
# the Software without restriction, including without limitation the rights to
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
# the Software, and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
# - The above copyright notice and this permission notice shall be included in
#   all copies or substantial portions of the Software.
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
FW_NAME = "default (unknown firmware)"

# Memory Sections
#                          start,    end,      is_rom? is_ram?
SECTIONS = [
    MemorySection(0x0, 0x90000, True, False),
    MemorySection(0xd0000, 0xd8000, False, True),
    MemorySection(0x200000, 0x228000, False, True)
]
Ejemplo n.º 6
0
# Firmware Infos
# Evaluation Kit CYW920719
FW_NAME = "CYW20739B1 (NOT iPhone X/XR!)"
# TODO this is not the iPhone firmware, we need to add a switch in fw.py

# Device Infos
DEVICE_NAME = 0x280CD0                  # rm_deviceLocalName, FIXME has no longer a length byte prepended
BD_ADDR = 0x280CA4                      # rm_deviceBDAddr

#Heap
BLOC_HEAD = 0x0200c7c                   # g_dynamic_memory_GeneralUsePools
BLOC_NG = True                          # Next Generation Bloc Buffer

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [ MemorySection(0x00000000, 0x001fffff,  True,  False),  # Internal ROM
             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
             MemorySection(0x00270000, 0x0027ffff,  False, True),   # Internal Memory Patchram Contents
             MemorySection(0x00280000, 0x00283fff,  False, True),   # ToRam
            ]

# Patchram
PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
PATCHRAM_VALUE_TABLE_ADDRESS    = 0x270000
PATCHRAM_NUMBER_OF_SLOTS        = 256
PATCHRAM_ALIGNED                = False
# only seems to work 4-byte aligned here ...


# Assembler snippet for tracepoints
Ejemplo n.º 7
0
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# This runs on an iPhone 7
FW_NAME = "BCM4355C0"

# Device Infos
DEVICE_NAME = 0x204c60

# Memory Sections
#                          start,    end,      is_rom? is_ram?
SECTIONS = [
    MemorySection(0x0, 0x90000, True, False),
    MemorySection(0xd0000, 0xd8000, False, True),
    #MemorySection(0xe0000,  0x1f0000, True , False),
    MemorySection(0x200000, 0x228000, False, True),
    MemorySection(0x260000, 0x268000, True, False),
    #MemorySection(0x280000, 0x2a0000, True , False),
    MemorySection(0x318000, 0x320000, False, False),
    MemorySection(0x324000, 0x360000, False, False),
    MemorySection(0x362000, 0x362100, False, False),
    MemorySection(0x363000, 0x363100, False, False),
    MemorySection(0x600000, 0x600800, False, False),
    MemorySection(0x640000, 0x640800, False, False),
    MemorySection(0x650000, 0x650800, False, False),
    #MemorySection(0x680000, 0x800000, False, False)
]
Ejemplo n.º 8
0
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# Evaluation Kit CYW920819
FW_NAME = "CYW20819"

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x001fffff, True, False),  # Internal ROM
    MemorySection(0x00200000, 0x0024ffff, False,
                  True),  # Internal Memory Cortex M3
    MemorySection(0x00270000, 0x0027ffff, False,
                  True),  # Internal Memory Patchram Contents
    MemorySection(0x00310000, 0x00321fff, False,
                  True),  # HW Regs Cortex M3 (readable)
]

# Patchram
PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
PATCHRAM_VALUE_TABLE_ADDRESS = 0x270000
PATCHRAM_NUMBER_OF_SLOTS = 256
PATCHRAM_ALIGNED = False
# only seems to work 4-byte aligned here ...
Ejemplo n.º 9
0
#   Software.

from fw import MemorySection

# Firmware Infos
# This runs on Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge
FW_NAME = "BCM4358A3"

# Device Infos
DEVICE_NAME = 0x213994  # [type: 1byte] [len: 1byte] [name: len byte] #works
BD_ADDR = 0x201C48 #works


# Memory Sections
#                          start,    end,      is_rom? is_ram?
SECTIONS = [ MemorySection(0x0,      0x9ef00,  True , False),
             MemorySection(0xd0000,  0xd8000,  False, True ), # Patchram values with actual code / hooks
            #MemorySection(0xe0000,  0x1e0000, True , False), # all zero
             MemorySection(0x200000, 0x22a000, False, True ),
             MemorySection(0x260000, 0x268000, True , False),
            #MemorySection(0x280000, 0x2a0000, True , False), # all zero
             MemorySection(0x300000, 0x301000, False, False),
             MemorySection(0x310000, 0x318000, False, True ), # Patchram addresses
             MemorySection(0x318000, 0x322000, False, False),
             MemorySection(0x324000, 0x368000, False, False),
             MemorySection(0x600000, 0x600800, False, False),
             MemorySection(0x640000, 0x640800, False, False),
             MemorySection(0x650000, 0x650800, False, False),
            #MemorySection(0x680000, 0x800000, False, False)
             #MemorySection(0x770000, 0x78ffff, False, False), #TODO maybe more, but all zero
            ]
Ejemplo n.º 10
0
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
FW_NAME = "BCM20703A2 (MacBook Pro 2016)"

# Symbols contained in:
#   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/BLD_ROM/A_20703A2/20703.symdefs
#   ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/tier2/brcm/wiced_uart/bld/A_20703A2/20703_ram_ext.lst

# Memory Sections
#                          start,    end,      is_rom? is_ram?
SECTIONS = [
    MemorySection(0x0, 0xc7fff, True, False),  #0x000c0a97
    MemorySection(0xd0000, 0xe0000, False, False),  #0x000dd78c
    MemorySection(0x200000, 0x240000, False, True),  #0x00217a38
    MemorySection(0x260000, 0x268fff, True, False),  #0x0026841d
    MemorySection(0x318000, 0x320000, False, False),
    MemorySection(0x324000, 0x338000, False, False),
    MemorySection(0x362000, 0x362100, False, False),
    MemorySection(0x363000, 0x363100, False, False),
    MemorySection(0x600000, 0x600800, False, False),
    MemorySection(0x640000, 0x640800, False, False),
    MemorySection(0x650000, 0x650800, False, False)
]
Ejemplo n.º 11
0
# subject to the following conditions:
# - The above copyright notice and this permission notice shall be included in
#   all copies or substantial portions of the Software.
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# iPhone 8/X/XR
FW_NAME = "BCM4347B1"

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [ MemorySection(0x00000000, 0x00103fff,  True,  False),  # Internal ROM
             MemorySection(0x00130000, 0x0014ffff,  False, True),   # Internal Memory Patchram Contents
             MemorySection(0x00200000, 0x0024ffff,  False, True),   # Internal Memory Cortex M3
            ]

# Patchram
PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000
PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
PATCHRAM_VALUE_TABLE_ADDRESS    = 0x130000
PATCHRAM_NUMBER_OF_SLOTS        = 256
PATCHRAM_ALIGNED                = False
Ejemplo n.º 12
0
# Copyright (c) 2019 Jiska Classen. (MIT License)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of
# this software and associated documentation files (the "Software"), to deal in
# the Software without restriction, including without limitation the rights to
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
# the Software, and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
# - The above copyright notice and this permission notice shall be included in
#   all copies or substantial portions of the Software.
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
FW_NAME = "BCM2070B0 (MacBook Pro 2011)"
# Build date: Jul 9 2008

# Memory Sections
#                          start,    end,      is_rom? is_ram?
SECTIONS = [
    MemorySection(0x0, 0x58000, True, False),
    MemorySection(0x80000, 0x9b000, False, True),
]
Ejemplo n.º 13
0
#   all copies or substantial portions of the Software.
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# iPhone 6
FW_NAME = "BCM4345B0"


# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [ #MemorySection(0x00000000, 0x000c07ff,  True,  False),  # Internal ROM
             MemorySection(0x000d0000, 0x000dffff,  False, True),   # Internal Memory Patchram Contents
             #MemorySection(0x00200400, 0x00201cff,  False, True),   # Internal Memory Cortex M3
             ]

# Patchram
#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
#PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
#PATCHRAM_NUMBER_OF_SLOTS        = 128
#PATCHRAM_ALIGNED                = True
# only seems to work 4-byte aligned here ...
Ejemplo n.º 14
0
# - The Software is provided "as is", without warranty of any kind, express or
#   implied, including but not limited to the warranties of merchantability,
#   fitness for a particular purpose and noninfringement. In no event shall the
#   authors or copyright holders be liable for any claim, damages or other
#   liability, whether in an action of contract, tort or otherwise, arising from,
#   out of or in connection with the Software or the use or other dealings in the
#   Software.

from fw import MemorySection

# Firmware Infos
# iPhone 6
FW_NAME = "BCM4345B0"

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x000c07ff, True, False),  # Internal ROM
    MemorySection(0x000d0000, 0x000dffff, False,
                  True),  # Internal Memory Patchram Contents
    MemorySection(0x00200400, 0x00201cff, False,
                  True),  # Internal Memory Cortex M3
]

# Patchram
#PATCHRAM_TARGET_TABLE_ADDRESS   = 0x310000 #TODO needs to be aligned read
#PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204
#PATCHRAM_VALUE_TABLE_ADDRESS    = 0xd0000
#PATCHRAM_NUMBER_OF_SLOTS        = 128
#PATCHRAM_ALIGNED                = True
# only seems to work 4-byte aligned here ...
Ejemplo n.º 15
0
#   Software.

from fw import MemorySection

# Firmware Infos
# Samsung S10/S10e/S10+
FW_NAME = "BCM4375B1"

# Device Infos
DEVICE_NAME = 0x207f2a
BD_ADDR = 0x2026e2

# Memory Sections
#                          start,    end,           is_rom? is_ram?
SECTIONS = [
    MemorySection(0x00000000, 0x0013ffff, True, False),  # Internal ROM
    MemorySection(0x00160000, 0x0017ffff, False, True),  # Patches
    MemorySection(0x00200000, 0x00288000, False,
                  True),  # Internal Memory Cortex M3
    MemorySection(0x00300000, 0x0037ffff, False, True),
]

# Patchram
PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000
PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404
PATCHRAM_VALUE_TABLE_ADDRESS = 0x160000
PATCHRAM_NUMBER_OF_SLOTS = 256
PATCHRAM_ALIGNED = False

BLOC_HEAD = 0x20075c
BLOC_NG = True