def handleNexus5StackDump(self, hcipkt): checksum_correct = self.verifyChecksum(hcipkt.data[5:]) packet_type = u8(hcipkt.data[4]) if packet_type == 0x2C: data = hcipkt.data[6:] values = [u32(data[i:i + 4]) for i in range(0, 64, 4)] log.debug("Stack Dump (%s):\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", "\n".join([hex(x) for x in values]), )) if data[0] == "\x02": # This is the second stack dump event (contains register values) log.warn("Received Stack-Dump Event (contains %d registers):" % (u8(data[1]))) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[2], values[3], values[1], values[4], values[5])) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % tuple(values[6:11])) log.warn(registers) return True elif packet_type == 0xF0: # RAM dump self.handleRamDump(hcipkt.data[10:]) elif packet_type == 0x4C: # RAM dump (last frame) self.handleRamDump(hcipkt.data[10:]) # This is the last pkt ouput: self.finishStackDump() return True return False
def from_connection_buffer(connection): # Possible TODO: Convert this to a Katai Struct parser with a proper .ksy grammar. return ConnectionInformation( u32(connection[:4]), connection[0x28:0x2E][::-1], u32(connection[0x4C:0x50]), u32(connection[0x1C:0x20]) & 1 << 15 == 0, u16(connection[0x64:0x66]), connection[0x78:0x88], u8(connection[0xA7:0xA8]), connection[0x68:0x68 + u8(connection[0xA7:0xA8])], u8(connection[0x9C:0x9D]) - 127, connection[0x30:0x38], connection[0x38:0x40], connection[0x0C:0x0D], )
def handleS10StackDump(self, hcipkt): """ Packets in stack dump: 1b 03 90: contains pc and r0 1b 03 9c 1b 03 00 (x3) 1b 03 f0 (whole ram) """ checksum_correct = self.verifyChecksum(hcipkt.data[3:]) packet_type = u8(hcipkt.data[2]) if packet_type == 0x90: data = hcipkt.data[4:] values = [u32(data[i:i + 4]) for i in range(0, 64 * 2, 4)] log.debug("Stack Dump (%s):\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", "\n".join([hex(x) for x in values]), )) # Values different than in other stack dump formats, experimental output! log.warn("Received S10 Stack-Dump Event (contains %d registers):" % (u8(data[1]))) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[16], values[17], values[23], values[19], values[20])) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % (values[21], values[22], values[23], values[24], values[25])) log.warn(registers) return True # log.info("%x" % u32(hcipkt.data[8:12])) # no last packet for S10e, just the size counts here... also is sometimes longer and sometimes shorter if packet_type == 0xF0 and u32(hcipkt.data[8:12]) == 0x230080: # This is the last pkt ouput: self.finishStackDump() return True return False
def lereceiveStatusCallback(record): """ RXDN Callback Function Depends on the raspi3_rxdn.py or eval_rxdn.py script, which patches the _connTaskRxDone() function and copies info from the LE connection struct to HCI. """ hcipkt = record[0] # get HCI Event packet if not issubclass(hcipkt.__class__, hci.HCI_Event): return if hcipkt.data[0:4] == "RXDN": data = hcipkt.data[4:] # Raspi 3 gets errors if len(data) < 239: return #if raspi or s8: packet_curr_nesn_sn = u8(data[0xa0]) #elif eval: # packet_curr_nesn_sn = u8(data[0xa4]) packet_channel_map = data[0x54:0x7b] packet_channel = data[0x83] packet_event_ctr = u16(data[0x8e:0x90]) packet_rssi = data[0] if internalblue.last_nesn_sn and ((internalblue.last_nesn_sn ^ packet_curr_nesn_sn) & 0b1100) != 0b1100: log.info(" ^----------------------------- ERROR --------------------------------") # currently only supported by eval board: check if we also went into the process payload routine, # which probably corresponds to a correct CRC # if self.last_success_event and (self.last_success_event + 1) != packet_event_ctr: # log.debug(" ^----------------------------- MISSED -------------------------------") # TODO example for setting the channel map # timeout needs to be zero, because we are already in an event reception routine! # self.sendHciCommand(0x2014, '\x00\x00\xff\x00\x00', timeout=0) internalblue.last_nesn_sn = packet_curr_nesn_sn # draw channel with rssi color color = '\033[92m' # green if 0xc8 > packet_rssi >= 0xc0: color = '\033[93m' # yellow elif packet_rssi < 0xc0: color = '\033[91m' # red channels_total = packet_channel_map[37] channel_map = 0x0000000000 if channels_total <= 37: # raspi 3 messes up with this during blacklisting for channel in range(0, channels_total): channel_map |= (0b1 << 39) >> packet_channel_map[channel] log.info("LE event %5d, map %10x, RSSI %d: %s%s*\033[0m " % (packet_event_ctr, channel_map, (packet_rssi & 0x7f) - (128 * (packet_rssi >> 7)), color, ' ' * packet_channel))
def from_data(data): return HCI_Diag(u8(data[0:1]), data[1:])
def from_data(data): handle = u16(unbits(bits_str(data[0:2])[0:12].rjust(16, "0"))) ps = u8(unbits(bits_str(data[1:2])[4:6].rjust(8, "0"))) return HCI_Sco(handle, ps, u8(data[2]), data[3:])
def from_data(data): handle = u16(unbits(bits_str(data[0:2])[0:12].rjust(16, "0"))) bp = u8(unbits(bits_str(data[1:2])[4:6].rjust(8, "0"))) bc = u8(unbits(bits_str(data[1:2])[6:8].rjust(8, "0"))) return HCI_Acl(handle, bp, bc, u16(data[2:4]), data[4:])
def handleEvalStackDump(self, hcipkt): """ Handles a core dump from the evaluation board. To trigger a dump execute: sendhcicmd 0xfc4e e81e2000 This executes some memory set to ffff which is an invalid command. Many events like executing address 0x0 will only crash the chip but not trigger a proper stack dump. The evaluation board has quite a lot of memory, RAM dump takes ages... dbfw_coredump_exception_cm3() generates the following dumps: 2c: CoreDumpInfo 2c: CoreDumpCPURegs 90: CoreDumpCPURegsExtend f0: CoreDumpRAMImage 78: CoreDumpRAMImage EOF 9c: CoreDumpHWRegs 01: CoreDumpEnd :param hcipkt: stack dump packet :return: returns True if dump could be decoded. """ checksum_correct = self.verifyChecksum(hcipkt.data[3:]) packet_type = u8(hcipkt.data[2]) log.debug("packet type %x", packet_type) # TODO CoreDumpInfo (shows LMP/HCI version, memory dumps) # CoreDumpCPURegs if packet_type == 0x2C: data = hcipkt.data[4:] values = [u32(data[i:i + 4]) for i in range(0, 64, 4)] log.debug("Stack Dump (%s):\n%s" % ( "checksum correct" if checksum_correct else "checksum NOT correct", "\n".join([hex(x) for x in values]), )) if data[0] == "\x02": # This is the second stack dump event (contains register values) log.warn( "Received Evaluation Stack-Dump Event (contains %d registers):" % (u8(data[1]))) registers = ( "pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n" % (values[2], values[3], values[1], values[4], values[5])) registers += ( "r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n" % tuple(values[6:11])) log.warn(registers) return True # CoreDumpRAMImage # TODO: Eval board produces this twice: # for 0x200000+0x50000 and 0x270000+0x10000 elif packet_type == 0xF0: self.handleRamDump(hcipkt.data[8:]) return True # Last packet produced by CoreDumpRAMImage elif packet_type == 0x78: # RAM dump (last frame), TODO not sure if this works # This is the last pkt ouput: log.info("End of stackdump block...") self.finishStackDump() return True # On a Raspberry Pi 3, the last packet of a stack dump is '1b0340df0338'.... so it's 0x40 elif packet_type == 0xE8: # FIXME Raspi memdump is divided in two parts! # address change from 0001fe38 to packet type e8 and then it's computing addr -0130000 # negative addr does not work with finishStackDump() # so even though the last packet is 0x40, let's just finish on 0xe8 log.info( "End of first stackdump block, writing to file and skipping second..." ) self.finishStackDump() return True return False