示例#1
0
文件: simplefuzz.py 项目: ufwt/icfuzz
def run(cnc_host, dry, width, height, fnout, step, samples=1, force=False):
    hal = None

    try:
        print
        print 'Initializing LCNC'
        hal = lcnc_ar.LcncPyHalAr(host=cnc_host, dry=dry, log=None)

        print
        print 'Initializing programmer'
        bp = startup.get()

        fout = None
        if not force and os.path.exists(fnout):
            raise Exception("Refusing to overwrite")
        if not dry:
            fout = open(fnout, 'w')

        print
        print 'Running'
        do_run(hal=hal,
               bp=bp,
               width=width,
               height=height,
               dry=dry,
               fout=fout,
               xstep=step,
               ystep=step,
               samples=samples)
    finally:
        print 'Shutting down hal'
        if hal:
            hal.ar_stop()
示例#2
0
def run(cnc_host, dry, width, height, fnout, step, samples=1, force=False):
    hal = None

    try:
        print
        print 'Initializing LCNC'
        hal = lcnc_ar.LcncPyHalAr(host=cnc_host, dry=dry, log=None)

        print
        print 'Initializing programmer'
        bp = startup.get()

        fout = None
        if not force and os.path.exists(fnout):
            raise Exception("Refusing to overwrite")
        if not dry:
            fout = open(fnout, 'w')

        print
        print 'Running'
        do_run(hal=hal, bp=bp, width=width, height=height, dry=dry, fout=fout, xstep=step, ystep=step, samples=samples)
    finally:
        print 'Shutting down hal'
        if hal:
            hal.ar_stop()
示例#3
0
    buff = bulk2(dev, "\x02", target=6)
    validate_read("\x84\x00\x50\x01\x09\x00", buff, "packet 1228/1229")

    # Generated from packet 1230/1231
    buff = bulk2(dev, "\x57\x83\x00", target=2)
    validate_read("\x00\x00", buff, "packet 1232/1233")


if __name__ == "__main__":
    import argparse

    parser = argparse.ArgumentParser(description='Replay captured USB packets')
    util.add_bool_arg(parser, '--loop', default=False, help='')
    args = parser.parse_args()

    bp = startup.get()

    print()
    print()
    # didn't fix 17/18 issue
    #time.sleep(5)
    print()

    if 1:
        import os

        try:
            while True:
                os.system('clear')
                read_adcs(bp.dev)
                if not args.loop:
示例#4
0
def main():
    import argparse

    parser = argparse.ArgumentParser(description='Replay captured USB packets')
    add_bool_arg(parser, '--cycle', default=False, help='')
    add_bool_arg(parser, '--cont', default=True, help='Continuity check')
    parser.add_argument('device')
    parser.add_argument('out_dir', nargs='?')
    args = parser.parse_args()

    verbose = True
    bp = startup.get()
    device = devices.get(bp, args.device, verbose=verbose)

    if args.out_dir and not os.path.exists(args.out_dir):
        os.mkdir(args.out_dir)

    itern = 0
    while True:
        itern += 1
        prefix = os.path.join(args.out_dir, "%03u" % itern)
        print("")
        print("")
        print("")
        try:
            devcfg = device.read({'cont': args.cont})
        except cmd.BusError:
            print('WARNING: bus error')
            continue
        except cmd.Overcurrent:
            print('WARNING: overcurrent')
            continue
        except cmd.ContFail:
            print('WARNING: continuity fail')
            continue

        print("")
        hexdump(devcfg['code'], indent='  ', label='Code')
        hexdump(devcfg['code'][0:0x40], indent='  ', label='Code start')
        print((buff2hash8(devcfg['code'])))
        if args.out_dir:
            open(prefix + "_code.bin", "wb").write(devcfg['code'])

        if 'data' in devcfg:
            print("")
            hexdump(devcfg['data'], indent='  ', label='EEPROM')
            if args.out_dir:
                open(prefix + "_data.bin", "wb").write(devcfg['data'])

        if 'config' in devcfg:
            print("")
            print('Fuses')
            config = devcfg['config']
            for i in range(0, 4):
                print(('  user_id%d:  0x%04X' % (i, config['user_id%d' % i])))
            #print '  conf_word: 0x%04X' % (config['conf_word'])
            print(('  secure: %s' % (config['secure'])))
            if args.out_dir:
                open(prefix + "_config.json", "w").write(
                    json.dumps(devcfg['config'],
                               sort_keys=True,
                               indent=4,
                               separators=(',', ': ')))
示例#5
0
    # The single packet below can be omitted
    # but anything else causes USB timeout when trying to read
    # Might indicate above is some sort of critical firmware
    # return

    # Generated from packet 237/238
    cmd_02(dev, "\x86\x00\xC0\x41\x09\x00", "packet W: 237/238, R: 239/240")


if __name__ == "__main__":
    import argparse

    parser = argparse.ArgumentParser(description='Replay captured USB packets')
    args = parser.parse_args()

    dev, usbcontext = startup.get()
    _bulkRead, bulkWrite, controlRead, controlWrite = usb_wraps(dev)

    replay(dev)

    #cmd.bulk86_dbg = 1

    buffs = set()
    i = 0
    while True:
        subprocess.check_call('clear', shell=True)
        # Generated from packet 241/242
        buff = cmd_57s(dev, "\x85", None, "cmd_57")
        buffs.add(buff)
        i += 1
        if i % 3 == 0:
示例#6
0
def run(operation,
        device,
        code_fn,
        data_fn,
        config_fn,
        cont,
        erase,
        verify,
        verbose,
        dir_,
        init=True):
    device_str = device
    '''
    Device: chip model
    '''
    bp = None
    device = None
    if operation != 'list_device':
        bp = startup.get(verbose=verbose, init=init)
        if operation != 'nop':
            device = devices.get(bp, device_str, verbose=verbose)

    opts = {
        'cont': cont,
        'erase': erase,
        'verify': verify,
        'verbose': verbose,
    }

    if operation == 'list_device':
        print('Devices:')
        for device in sorted(devices.class_s2c.keys()):
            print(device)
    elif operation == 'nop':
        pass
    elif operation == 'program':
        devcfg = {}
        devcfg['code'] = open(code_fn, 'r').read()
        if data_fn:
            devcfg['data'] = open(data_fn, 'r').read()
        if config_fn:
            devcfg['config'] = open(config_fn, 'r').read()
        device.program(devcfg, opts)
    elif operation == 'verify':
        raise Exception('FIXME')
    elif operation == 'compare':
        raise Exception('FIXME')
    elif operation == 'read':
        devcfg = device.read(opts)
        code = devcfg['code']
        data = devcfg.get('data', None)
        config = devcfg.get('config', None)
        if not code_fn:
            print("")
            hexdump(code, indent='  ', label='Code')

            if data:
                print("")
                hexdump(data, indent='  ', label='Data')

            if config:
                print("")
                print('Configuration')
                device.print_config(config)
        else:
            if dir_:
                if not os.path.exists(code_fn):
                    os.mkdir(code_fn)
                open(os.path.join(code_fn, 'code.bin'), 'w').write(code)
                open(os.path.join(code_fn, 'data.bin'), 'w').write(data)
                open(os.path.join(code_fn, 'config.json'),
                     'w').write(json.dumps(config))
            else:
                print(('Writing to %s' % code_fn))
                open(code_fn, 'w').write(code)

        print('Complete')
    elif operation == 'sum':
        raise Exception('FIXME')
    elif operation == 'blank':
        raise Exception('FIXME')
    elif operation == 'erase':
        raise Exception('FIXME')
    elif operation == 'secure':
        raise Exception('FIXME')
    else:
        raise Exception("Bad operation %s" % operation)