def from_connection_buffer(connection): # Possible TODO: Convert this to a Katai Struct parser with a proper .ksy grammar. return ConnectionInformation( u32(connection[:4]), connection[0x28:0x2E][::-1], u32(connection[0x4C:0x50]), u32(connection[0x1C:0x20]) & 1 << 15 == 0, u16(connection[0x64:0x66]), connection[0x78:0x88], u8(connection[0xA7:0xA8]), connection[0x68:0x68 + u8(connection[0xA7:0xA8])], u8(connection[0x9C:0x9D]) - 127, connection[0x30:0x38], connection[0x38:0x40], connection[0x0C:0x0D], )
def handleS10StackDump(self, hcipkt): """ Packets in stack dump: 1b 03 90: contains pc and r0 1b 03 9c 1b 03 00 (x3) 1b 03 f0 (whole ram) """ checksum_correct = self.verifyChecksum(hcipkt.data[3:]) packet_type = hcipkt.data[2] if packet_type == 0x90: data = hcipkt.data[4:] values = [u32(data[i : i + 4]) for i in range(0, 64 * 2, 4)] self.logger.debug( "Stack Dump (%s):\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", "\n".join([hex(x) for x in values]), ) ) # Values different than in other stack dump formats, experimental output! self.logger.warn( "Received S10 Stack-Dump Event (contains %d registers):" % (data[1]) ) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[16], values[17], values[23], values[19], values[20]) ) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % (values[21], values[22], values[23], values[24], values[25]) ) self.logger.warn(registers) return True # self.logger.info("%x" % u32(hcipkt.data[8:12])) # no last packet for S10e, just the size counts here... also is sometimes longer and sometimes shorter if packet_type == 0xF0 and u32(hcipkt.data[8:12]) == 0x230080: # This is the last pkt ouput: self.finishStackDump() return True return False
def handleRamDump(self, data): """ Data should be a byte string containing the address (4 byte) followed by the actual ram dump (at this address) """ addr = u32(data[:4]) if self.memdump_addr is None: self.memdump_addr = addr self.memdumps[addr - self.memdump_addr] = bytes(data[4:]) # convert from bytearray to bytes self.logger.debug("Stack dump handling addr %08x", addr - self.memdump_addr)
def handleNexus6pStackDump(self, hcipkt): checksum_correct = self.verifyChecksum(hcipkt.data[8:]) packet_nr = hcipkt.data[2] packet_type = hcipkt.data[7] if packet_type in [0x2C, 0x4C]: data = hcipkt.data[9:] values = [u32(data[i : i + 4]) for i in range(0, 64, 4)] self.logger.debug( "Stack Dump (%s) [packet_type=0x%x]:\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", packet_type, "\n".join([hex(x) for x in values]), ) ) if packet_type == 0x2C and data[0] == 0x02: # This is the second stack dump event (contains register values) self.logger.warn( "Received Stack-Dump Event (contains %d registers):" % (data[1]) ) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[2], values[3], values[1], values[4], values[5]) ) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % tuple(values[6:11]) ) self.logger.warn(registers) return True elif packet_type == 0xF0: # RAM dump self.handleRamDump(hcipkt.data[13:]) if packet_nr == 0x84: # This is the last pkt ouput: self.finishStackDump() return True return False
def handleEvalStackDump(self, hcipkt): """ Handles a core dump from the evaluation board. To trigger a dump execute: sendhcicmd 0xfc4e e81e2000 This executes some memory set to ffff which is an invalid command. Many events like executing address 0x0 will only crash the chip but not trigger a proper stack dump. The evaluation board has quite a lot of memory, RAM dump takes ages... dbfw_coredump_exception_cm3() generates the following dumps: 2c: CoreDumpInfo 2c: CoreDumpCPURegs 90: CoreDumpCPURegsExtend f0: CoreDumpRAMImage 78: CoreDumpRAMImage EOF 9c: CoreDumpHWRegs 01: CoreDumpEnd :param hcipkt: stack dump packet :return: returns True if dump could be decoded. """ checksum_correct = self.verifyChecksum(hcipkt.data[3:]) packet_type = hcipkt.data[2] self.logger.debug("packet type %x", packet_type) # TODO CoreDumpInfo (shows LMP/HCI version, memory dumps) # CoreDumpCPURegs if packet_type == 0x2C: data = hcipkt.data[4:] values = [u32(data[i : i + 4]) for i in range(0, 64, 4)] self.logger.debug( "Stack Dump (%s):\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", "\n".join([hex(x) for x in values]), ) ) if data[0] == 0x02: # This is the second stack dump event (contains register values) self.logger.warn( "Received Evaluation Stack-Dump Event (contains %d registers):" % (data[1]) ) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[2], values[3], values[1], values[4], values[5]) ) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % tuple(values[6:11]) ) self.logger.warn(registers) return True # CoreDumpRAMImage # TODO: Eval board produces this twice: # for 0x200000+0x50000 and 0x270000+0x10000 elif packet_type == 0xF0: self.handleRamDump(hcipkt.data[8:]) return True # Last packet produced by CoreDumpRAMImage elif packet_type == 0x78: # RAM dump (last frame), TODO not sure if this works # This is the last pkt ouput: self.logger.info("End of stackdump block...") self.finishStackDump() return True # On a Raspberry Pi 3, the last packet of a stack dump is '1b0340df0338'.... so it's 0x40 elif packet_type == 0xE8: # FIXME Raspi memdump is divided in two parts! # address change from 0001fe38 to packet type e8 and then it's computing addr -0130000 # negative addr does not work with finishStackDump() # so even though the last packet is 0x40, let's just finish on 0xe8 self.logger.info( "End of first stackdump block, writing to file and skipping second..." ) self.finishStackDump() return True return False