def handleNexus5StackDump(self, hcipkt):
checksum_correct = self.verifyChecksum(hcipkt.data[5:])
packet_type = u8(hcipkt.data[4])
if packet_type == 0x2C:
data = hcipkt.data[6:]
values = [u32(data[i:i + 4]) for i in range(0, 64, 4)]
log.debug("Stack Dump (%s):\n%s" % (
"checksum correct"
if checksum_correct else "checksum NOT correct",
"\n".join([hex(x) for x in values]),
))
if data[0] == "\x02":
# This is the second stack dump event (contains register values)
log.warn("Received Stack-Dump Event (contains %d registers):" %
(u8(data[1])))
registers = (
"pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n"
% (values[2], values[3], values[1], values[4], values[5]))
registers += (
"r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n"
% tuple(values[6:11]))
log.warn(registers)
return True
elif packet_type == 0xF0: # RAM dump
self.handleRamDump(hcipkt.data[10:])
elif packet_type == 0x4C: # RAM dump (last frame)
self.handleRamDump(hcipkt.data[10:])
# This is the last pkt ouput:
self.finishStackDump()
return True
return False
def from_connection_buffer(connection):
# Possible TODO: Convert this to a Katai Struct parser with a proper .ksy grammar.
return ConnectionInformation(
u32(connection[:4]),
connection[0x28:0x2E][::-1],
u32(connection[0x4C:0x50]),
u32(connection[0x1C:0x20]) & 1 << 15 == 0,
u16(connection[0x64:0x66]),
connection[0x78:0x88],
u8(connection[0xA7:0xA8]),
connection[0x68:0x68 + u8(connection[0xA7:0xA8])],
u8(connection[0x9C:0x9D]) - 127,
connection[0x30:0x38],
connection[0x38:0x40],
connection[0x0C:0x0D],
)
def handleS10StackDump(self, hcipkt):
"""
Packets in stack dump:
1b 03 90: contains pc and r0
1b 03 9c
1b 03 00 (x3)
1b 03 f0 (whole ram)
"""
checksum_correct = self.verifyChecksum(hcipkt.data[3:])
packet_type = u8(hcipkt.data[2])
if packet_type == 0x90:
data = hcipkt.data[4:]
values = [u32(data[i:i + 4]) for i in range(0, 64 * 2, 4)]
log.debug("Stack Dump (%s):\n%s" % (
"checksum correct"
if checksum_correct else "checksum NOT correct",
"\n".join([hex(x) for x in values]),
))
# Values different than in other stack dump formats, experimental output!
log.warn("Received S10 Stack-Dump Event (contains %d registers):" %
(u8(data[1])))
registers = (
"pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n"
% (values[16], values[17], values[23], values[19], values[20]))
registers += (
"r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n"
% (values[21], values[22], values[23], values[24], values[25]))
log.warn(registers)
return True
# log.info("%x" % u32(hcipkt.data[8:12]))
# no last packet for S10e, just the size counts here... also is sometimes longer and sometimes shorter
if packet_type == 0xF0 and u32(hcipkt.data[8:12]) == 0x230080:
# This is the last pkt ouput:
self.finishStackDump()
return True
return False
def lereceiveStatusCallback(record):
"""
RXDN Callback Function
Depends on the raspi3_rxdn.py or eval_rxdn.py script,
which patches the _connTaskRxDone() function and copies
info from the LE connection struct to HCI.
"""
hcipkt = record[0] # get HCI Event packet
if not issubclass(hcipkt.__class__, hci.HCI_Event):
return
if hcipkt.data[0:4] == "RXDN":
data = hcipkt.data[4:]
# Raspi 3 gets errors
if len(data) < 239:
return
#if raspi or s8:
packet_curr_nesn_sn = u8(data[0xa0])
#elif eval:
# packet_curr_nesn_sn = u8(data[0xa4])
packet_channel_map = data[0x54:0x7b]
packet_channel = data[0x83]
packet_event_ctr = u16(data[0x8e:0x90])
packet_rssi = data[0]
if internalblue.last_nesn_sn and ((internalblue.last_nesn_sn ^ packet_curr_nesn_sn) & 0b1100) != 0b1100:
log.info(" ^----------------------------- ERROR --------------------------------")
# currently only supported by eval board: check if we also went into the process payload routine,
# which probably corresponds to a correct CRC
# if self.last_success_event and (self.last_success_event + 1) != packet_event_ctr:
# log.debug(" ^----------------------------- MISSED -------------------------------")
# TODO example for setting the channel map
# timeout needs to be zero, because we are already in an event reception routine!
# self.sendHciCommand(0x2014, '\x00\x00\xff\x00\x00', timeout=0)
internalblue.last_nesn_sn = packet_curr_nesn_sn
# draw channel with rssi color
color = '\033[92m' # green
if 0xc8 > packet_rssi >= 0xc0:
color = '\033[93m' # yellow
elif packet_rssi < 0xc0:
color = '\033[91m' # red
channels_total = packet_channel_map[37]
channel_map = 0x0000000000
if channels_total <= 37: # raspi 3 messes up with this during blacklisting
for channel in range(0, channels_total):
channel_map |= (0b1 << 39) >> packet_channel_map[channel]
log.info("LE event %5d, map %10x, RSSI %d: %s%s*\033[0m " % (packet_event_ctr, channel_map,
(packet_rssi & 0x7f) - (128 * (packet_rssi >> 7)),
color, ' ' * packet_channel))
def from_data(data):
return HCI_Diag(u8(data[0:1]), data[1:])
def from_data(data):
handle = u16(unbits(bits_str(data[0:2])[0:12].rjust(16, "0")))
ps = u8(unbits(bits_str(data[1:2])[4:6].rjust(8, "0")))
return HCI_Sco(handle, ps, u8(data[2]), data[3:])
def from_data(data):
handle = u16(unbits(bits_str(data[0:2])[0:12].rjust(16, "0")))
bp = u8(unbits(bits_str(data[1:2])[4:6].rjust(8, "0")))
bc = u8(unbits(bits_str(data[1:2])[6:8].rjust(8, "0")))
return HCI_Acl(handle, bp, bc, u16(data[2:4]), data[4:])
def handleEvalStackDump(self, hcipkt):
"""
Handles a core dump from the evaluation board. To trigger a dump execute:
sendhcicmd 0xfc4e e81e2000
This executes some memory set to ffff which is an invalid command.
Many events like executing address 0x0 will only crash the chip but not
trigger a proper stack dump.
The evaluation board has quite a lot of memory, RAM dump takes ages...
dbfw_coredump_exception_cm3() generates the following dumps:
2c: CoreDumpInfo
2c: CoreDumpCPURegs
90: CoreDumpCPURegsExtend
f0: CoreDumpRAMImage
78: CoreDumpRAMImage EOF
9c: CoreDumpHWRegs
01: CoreDumpEnd
:param hcipkt: stack dump packet
:return: returns True if dump could be decoded.
"""
checksum_correct = self.verifyChecksum(hcipkt.data[3:])
packet_type = u8(hcipkt.data[2])
log.debug("packet type %x", packet_type)
# TODO CoreDumpInfo (shows LMP/HCI version, memory dumps)
# CoreDumpCPURegs
if packet_type == 0x2C:
data = hcipkt.data[4:]
values = [u32(data[i:i + 4]) for i in range(0, 64, 4)]
log.debug("Stack Dump (%s):\n%s" % (
"checksum correct"
if checksum_correct else "checksum NOT correct",
"\n".join([hex(x) for x in values]),
))
if data[0] == "\x02":
# This is the second stack dump event (contains register values)
log.warn(
"Received Evaluation Stack-Dump Event (contains %d registers):"
% (u8(data[1])))
registers = (
"pc: 0x%08x lr: 0x%08x sp: 0x%08x r0: 0x%08x r1: 0x%08x\n"
% (values[2], values[3], values[1], values[4], values[5]))
registers += (
"r2: 0x%08x r3: 0x%08x r4: 0x%08x r5: 0x%08x r6: 0x%08x\n"
% tuple(values[6:11]))
log.warn(registers)
return True
# CoreDumpRAMImage
# TODO: Eval board produces this twice:
# for 0x200000+0x50000 and 0x270000+0x10000
elif packet_type == 0xF0:
self.handleRamDump(hcipkt.data[8:])
return True
# Last packet produced by CoreDumpRAMImage
elif packet_type == 0x78: # RAM dump (last frame), TODO not sure if this works
# This is the last pkt ouput:
log.info("End of stackdump block...")
self.finishStackDump()
return True
# On a Raspberry Pi 3, the last packet of a stack dump is '1b0340df0338'.... so it's 0x40
elif packet_type == 0xE8:
# FIXME Raspi memdump is divided in two parts!
# address change from 0001fe38 to packet type e8 and then it's computing addr -0130000
# negative addr does not work with finishStackDump()
# so even though the last packet is 0x40, let's just finish on 0xe8
log.info(
"End of first stackdump block, writing to file and skipping second..."
)
self.finishStackDump()
return True
return False