From 6d0fc4a81880abc2984552ccd23497d8832d00fe Mon Sep 17 00:00:00 2001 From: lazymio Date: Mon, 24 Jan 2022 15:15:34 +0100 Subject: [PATCH 01/66] Add fix and example for openat path traversion --- examples/rootfs | 2 +- examples/src/linux/path_traverse.c | 15 +++++++++++++++ qiling/os/mapper.py | 5 +---- qiling/os/path.py | 6 ++++-- qiling/os/posix/syscall/fcntl.py | 11 +++++++---- tests/test_elf.py | 9 +++++++++ 6 files changed, 37 insertions(+), 11 deletions(-) create mode 100644 examples/src/linux/path_traverse.c diff --git a/examples/rootfs b/examples/rootfs index a489ff51..149041a1 160000 --- a/examples/rootfs +++ b/examples/rootfs @@ -1 +1 @@ -Subproject commit a489ff519f570539249c34c7d1bd5abb3ec74488 +Subproject commit 149041a153ad8b5366b1b070afb20e2f6293aaf6 diff --git a/examples/src/linux/path_traverse.c b/examples/src/linux/path_traverse.c new file mode 100644 index 00000000..6d478e67 --- /dev/null +++ b/examples/src/linux/path_traverse.c @@ -0,0 +1,15 @@ +// gcc -static ~/qiling/examples/src/linux/path_traverse.c -g -O0 -o ~/qiling/examples/rootfs/x8664_linux/bin/path_traverse_static +// https://www.kalmarunionen.dk/writeups/2022/rwctf/qlaas/ +#include +#include + +int main(){ + char buf[4096]; + int fd = openat(1, "/etc/passwd", O_RDONLY); + ssize_t len = read(fd, buf, sizeof(buf)); + write(1, buf, len); + + fd = openat(1, "/etc/passwd_link", O_RDONLY); + len = read(fd, buf, sizeof(buf)); + write(1, buf, len); +} diff --git a/qiling/os/mapper.py b/qiling/os/mapper.py index e5e9382d..738e51d3 100644 --- a/qiling/os/mapper.py +++ b/qiling/os/mapper.py @@ -95,14 +95,11 @@ class QlFsMapper: def mapping_count(self): return len(self._mapping) - def open_ql_file(self, path, openflags, openmode, dir_fd=None): + def open_ql_file(self, path, openflags, openmode): if self.has_mapping(path): self.ql.log.info(f"mapping {path}") return self._open_mapping_ql_file(path, openflags, openmode) else: - if dir_fd: - return ql_file.open(path, openflags, openmode, dir_fd=dir_fd) - real_path = self.ql.os.path.transform_to_real_path(path) return ql_file.open(real_path, openflags, openmode) diff --git a/qiling/os/path.py b/qiling/os/path.py index 9872e4f3..e5827336 100644 --- a/qiling/os/path.py +++ b/qiling/os/path.py @@ -133,8 +133,10 @@ class QlPathManager: if os.path.islink(real_path): link_path = Path(os.readlink(real_path)) - if not link_path.is_absolute(): - real_path = Path(os.path.join(os.path.dirname(real_path), link_path)) + real_path = self.convert_path(self.ql.rootfs, os.path.dirname(real_path), link_path) + + if os.path.islink(real_path): + real_path = self.transform_to_real_path(real_path) # resolve multilevel symbolic link if not os.path.exists(real_path): diff --git a/qiling/os/posix/syscall/fcntl.py b/qiling/os/posix/syscall/fcntl.py index e7f51583..fe672ce9 100644 --- a/qiling/os/posix/syscall/fcntl.py +++ b/qiling/os/posix/syscall/fcntl.py @@ -4,6 +4,7 @@ # import os +from pathlib import Path from qiling import Qiling from qiling.const import QL_OS, QL_ARCH @@ -101,11 +102,13 @@ def ql_syscall_openat(ql: Qiling, fd: int, path: int, flags: int, mode: int): fd = ql.unpacks(ql.pack(fd)) if 0 <= fd < NR_OPEN: - dir_fd = ql.os.fd[fd].fileno() - else: - dir_fd = None + fobj = ql.os.fd[fd] + # ql_file object or QlFsMappedObject + if hasattr(fobj, "fileno") and hasattr(fobj, "name"): + if not Path.is_absolute(Path(file_path)): + file_path = Path(fobj.name) / Path(file_path) - ql.os.fd[idx] = ql.os.fs_mapper.open_ql_file(file_path, flags, mode, dir_fd) + ql.os.fd[idx] = ql.os.fs_mapper.open_ql_file(file_path, flags, mode) regreturn = idx except QlSyscallError as e: diff --git a/tests/test_elf.py b/tests/test_elf.py index 86a35a5f..e4f84378 100644 --- a/tests/test_elf.py +++ b/tests/test_elf.py @@ -1091,6 +1091,15 @@ class ELFTest(unittest.TestCase): self.assertEqual([0x1000 + 11, 0x2000 + 11, 0x3000 + 43], ql.mem.search(b"\x09\x53(\x0f|\x1a|\x04)[^\x0d]")) del ql + + def test_elf_linux_x8664_path_traversion(self): + mock_stdout = pipe.SimpleOutStream(sys.stdout.fileno()) + ql = Qiling(["../examples/rootfs/x8664_linux/bin/path_traverse_static"], "../examples/rootfs/x8664_linux", verbose=QL_VERBOSE.DEBUG, stdout=mock_stdout) + + ql.run() + self.assertTrue("root\n" not in ql.os.stdout.read().decode("utf-8")) + + del ql if __name__ == "__main__": unittest.main() From 2ad1e5a4d90d96e4fb421322c4b09538b33976d3 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Tue, 1 Feb 2022 20:10:01 +0800 Subject: [PATCH 02/66] add basic x86 support --- qiling/debugger/qdb/frontend.py | 105 +++++++++++++++++++++++--------- qiling/debugger/qdb/qdb.py | 8 ++- qiling/debugger/qdb/utils.py | 38 +++++++++++- 3 files changed, 120 insertions(+), 31 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index fb93e6e4..03f584d8 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -13,7 +13,7 @@ from qiling.const import QL_ARCH import unicorn -from .utils import dump_regs, get_arm_flags, disasm, _parse_int, handle_bnj +from .utils import dump_regs, get_x86_eflags, get_arm_flags, disasm, _parse_int, handle_bnj from .const import * @@ -192,8 +192,34 @@ def context_reg(ql: Qiling, saved_states: Optional[Mapping[str, int]] = None, /, print(lines.format(*_cur_regs.values())) - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): + elif ql.archtype == QL_ARCH.X86: + if saved_states is not None: + _saved_states = copy.deepcopy(saved_states) + _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] + + else: + _diff = None + + lines = "" + for idx, r in enumerate(_cur_regs, 1): + if len(r) == 2: + line = "{}{}: 0x{{:08x}} {}\t\t".format(_colors[(idx-1) // 4], r, color.END) + else: + line = "{}{}: 0x{{:08x}} {}\t".format(_colors[(idx-1) // 4], r, color.END) + + if _diff and r in _diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % 4 == 0 and idx != 32: + line += "\n" + + lines += line + + print(lines.format(*_cur_regs.values())) + print(color.GREEN, "EFLAGS: [CF: {flags[CF]}, PF: {flags[PF]}, AF: {flags[AF]}, ZF: {flags[ZF]}, SF: {flags[SF]}, OF: {flags[OF]}]".format(flags=get_x86_eflags(ql.reg.ef)), color.END, sep="") + + elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): _cur_regs.update({"sl": _cur_regs.pop("r10")}) _cur_regs.update({"ip": _cur_regs.pop("r12")}) @@ -265,7 +291,10 @@ def context_reg(ql: Qiling, saved_states: Optional[Mapping[str, int]] = None, /, def print_asm(ql: Qiling, insn: CsInsn, to_jump: Optional[bool] = None, address: int = None) -> None: opcode = "".join(f"{b:02x}" for b in insn.bytes) - trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" + if ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + trace_line = f"0x{insn.address:08x} │ {opcode:20s} {insn.mnemonic:10} {insn.op_str:35s}" + else: + trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" cursor = " " if ql.reg.arch_pc == insn.address: @@ -282,39 +311,59 @@ def context_asm(ql: Qiling, address: int) -> None: with context_printer(ql, field_name="[ DISASM ]"): - # assembly before current location + if ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + past_list = [] - past_list = [] + # assembly before current location - line = disasm(ql, address-0x10) + line = disasm(ql, address) + acc_size = line.size - while line: - if line.address == address: - break + while line and len(past_list) != 10: + past_list.append(line) + next_start = address + acc_size + line = disasm(ql, next_start) + acc_size += line.size - addr = line.address + line.size - line = disasm(ql, addr) + # print four insns before current location + for line in past_list[:-1]: + print_asm(ql, line) - if not line: - break + else: - past_list.append(line) + # assembly before current location - # print four insns before current location - for line in past_list[:-1][:4]: - print_asm(ql, line) + past_list = [] - # assembly for current location + line = disasm(ql, address-0x10) - cur_ins = disasm(ql, address) - to_jump, next_stop = handle_bnj(ql, address) - print_asm(ql, cur_ins, to_jump=to_jump) + while line: + if line.address == address: + break - # assembly after current location + addr = line.address + line.size + line = disasm(ql, addr) - forward_insn_size = cur_ins.size - for _ in range(5): - forward_insn = disasm(ql, address+forward_insn_size) - if forward_insn: - print_asm(ql, forward_insn) - forward_insn_size += forward_insn.size + if not line: + break + + past_list.append(line) + + # print four insns before current location + for line in past_list[:-1][:4]: + print_asm(ql, line) + + # assembly for current location + + cur_ins = disasm(ql, address) + to_jump, next_stop = handle_bnj(ql, address) + print_asm(ql, cur_ins, to_jump=to_jump) + + # assembly after current location + + forward_insn_size = cur_ins.size + for _ in range(5): + forward_insn = disasm(ql, address+forward_insn_size) + if forward_insn: + print_asm(ql, forward_insn) + forward_insn_size += forward_insn.size diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 819c04b5..3a0ef836 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -232,7 +232,11 @@ class QlQdb(cmd.Cmd, QlDebugger): self.ql.count -= 1 else: - count = 1 if next_stop == self.cur_addr + 4 else 2 + if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + count = 1 + else: + count = 1 if next_stop == self.cur_addr + 4 else 2 + self._run(count=count) self.do_context() @@ -323,7 +327,7 @@ class QlQdb(cmd.Cmd, QlDebugger): """ try: - context_asm(self.ql, _parse_int(address), self.ql.pointersize) + context_asm(self.ql, address) except: print(f"{color.RED}[!] something went wrong ...{color.END}") diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index f3200320..83bd5c93 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -36,6 +36,15 @@ def dump_regs(ql: Qiling) -> Mapping[str, int]: "r12", "sp", "lr", "pc", ) + elif ql.archtype == QL_ARCH.X86: + + _reg_order = ( + "eax", "ebx", "ecx", "edx", + "esp", "ebp", "esi", "edi", + "eip", "ss", "cs", "ds", "es", + "fs", "gs", "ef", + ) + elif ql.archtype == QL_ARCH.CORTEX_M: _reg_order = ( @@ -83,7 +92,7 @@ def _parse_int(s: str) -> int: # function dectorator for parse argument as integer def parse_int(func: Callable) -> Callable: - def wrap(qdb, s: str) -> int: + def wrap(qdb, s: str = "") -> int: assert type(s) is str try: ret = _parse_int(s) @@ -109,6 +118,7 @@ def handle_bnj(ql: Qiling, cur_addr: str) -> Callable[[Qiling, str], int]: QL_ARCH.ARM : handle_bnj_arm, QL_ARCH.ARM_THUMB: handle_bnj_arm, QL_ARCH.CORTEX_M : handle_bnj_arm, + QL_ARCH.X86 : handle_bnj_x86, }.get(ql.archtype)(ql, cur_addr) @@ -121,6 +131,17 @@ def get_cpsr(bits: int) -> (bool, bool, bool, bool): ) +def get_x86_eflags(bits: int) -> (bool, bool, bool, bool, bool, bool): + return { + "CF" : bits & 0x0001 != 0, # CF, carry flag + "PF" : bits & 0x0004 != 0, # PF, parity flag + "AF" : bits & 0x0010 != 0, # AF, adjust flag + "ZF" : bits & 0x0040 != 0, # ZF, zero flag + "SF" : bits & 0x0080 != 0, # SF, sign flag + "OF" : bits & 0x0800 != 0, # OF, overflow flag + } + + def is_thumb(bits: int) -> bool: return bits & 0x00000020 != 0 @@ -158,8 +179,23 @@ def _read_inst(ql: Qiling, addr: int) -> int: latter_two = ql.unpack16(ql.mem.read(addr+2, 2)) result += ql.pack16(latter_two) + elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + # due to the variadic lengh of x86 instructions ( 1~15 ) + # always assume the maxium size for disassembler to tell + # what is it exactly. + result = ql.mem.read(addr, 15) + return result +def handle_bnj_x86(ql: Qilng, cur_addr: str) -> int: + + # FIXME: NO HANDLE BRANCH AND JUMP FOR X86 FOR NOW + + to_jump = False + ret_addr = None + + return (to_jump, ret_addr) + def handle_bnj_arm(ql: Qiling, cur_addr: str) -> int: From afca5bbc540c7135d52a98052747d72230172d4c Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Sat, 5 Feb 2022 01:10:29 +0800 Subject: [PATCH 03/66] fix incorrect type annotation of get_x86_eflags --- qiling/debugger/qdb/utils.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index 83bd5c93..bd15ada9 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -131,7 +131,7 @@ def get_cpsr(bits: int) -> (bool, bool, bool, bool): ) -def get_x86_eflags(bits: int) -> (bool, bool, bool, bool, bool, bool): +def get_x86_eflags(bits: int) -> Dict[str, bool]: return { "CF" : bits & 0x0001 != 0, # CF, carry flag "PF" : bits & 0x0004 != 0, # PF, parity flag From 3421233afbe237d71a835f28f83c5e47c6ceb164 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 12:37:31 +0800 Subject: [PATCH 04/66] Format stm32f4 config --- qiling/extensions/mcu/stm32f4/stm32f401.py | 564 ++++++------ qiling/extensions/mcu/stm32f4/stm32f405.py | 740 ++++++++-------- qiling/extensions/mcu/stm32f4/stm32f407.py | 774 ++++++++--------- qiling/extensions/mcu/stm32f4/stm32f410.py | 500 +++++------ qiling/extensions/mcu/stm32f4/stm32f411.py | 574 ++++++------- qiling/extensions/mcu/stm32f4/stm32f412.py | 762 ++++++++--------- qiling/extensions/mcu/stm32f4/stm32f413.py | 916 ++++++++++---------- qiling/extensions/mcu/stm32f4/stm32f415.py | 770 ++++++++--------- qiling/extensions/mcu/stm32f4/stm32f417.py | 804 ++++++++--------- qiling/extensions/mcu/stm32f4/stm32f423.py | 932 ++++++++++---------- qiling/extensions/mcu/stm32f4/stm32f427.py | 874 +++++++++---------- qiling/extensions/mcu/stm32f4/stm32f429.py | 892 +++++++++---------- qiling/extensions/mcu/stm32f4/stm32f437.py | 906 ++++++++++---------- qiling/extensions/mcu/stm32f4/stm32f439.py | 924 ++++++++++---------- qiling/extensions/mcu/stm32f4/stm32f446.py | 784 ++++++++--------- qiling/extensions/mcu/stm32f4/stm32f469.py | 916 ++++++++++---------- qiling/extensions/mcu/stm32f4/stm32f479.py | 948 ++++++++++----------- 17 files changed, 6787 insertions(+), 6793 deletions(-) diff --git a/qiling/extensions/mcu/stm32f4/stm32f401.py b/qiling/extensions/mcu/stm32f4/stm32f401.py index ad6c63de..a030de27 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f401.py +++ b/qiling/extensions/mcu/stm32f4/stm32f401.py @@ -4,89 +4,264 @@ # stm32f401 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x10000, - "alias": 0x0, - "type": "remap" - }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x80000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c }, "type": "peripheral" }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, "GPIOA": { "base": 0x40020000, "struct": "STM32F4xxGpio", @@ -117,250 +292,69 @@ stm32f401 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 49 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 35 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f405.py b/qiling/extensions/mcu/stm32f4/stm32f405.py index 880feaa0..eb9d86b9 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f405.py +++ b/qiling/extensions/mcu/stm32f4/stm32f405.py @@ -4,6 +4,303 @@ # stm32f405 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,74 +316,25 @@ stm32f405 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -94,28 +342,19 @@ stm32f405 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -163,79 +402,54 @@ stm32f405 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -243,236 +457,22 @@ stm32f405 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f407.py b/qiling/extensions/mcu/stm32f4/stm32f407.py index 1f08ee1c..7ed14c4c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f407.py +++ b/qiling/extensions/mcu/stm32f4/stm32f407.py @@ -4,6 +4,303 @@ # stm32f407 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,91 +316,25 @@ stm32f407 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -111,28 +342,19 @@ stm32f407 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -180,79 +402,71 @@ stm32f407 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -260,236 +474,22 @@ stm32f407 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f410.py b/qiling/extensions/mcu/stm32f4/stm32f410.py index fe5ecc9f..70ada507 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f410.py +++ b/qiling/extensions/mcu/stm32f4/stm32f410.py @@ -4,85 +4,140 @@ # stm32f410 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x20000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x20000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 }, "type": "peripheral" }, @@ -90,8 +145,86 @@ stm32f410 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV2", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -115,68 +248,54 @@ stm32f410 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV4", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -184,141 +303,22 @@ stm32f410 = { "base": 0x40080000, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV2", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_intn": 25 - }, - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f411.py b/qiling/extensions/mcu/stm32f4/stm32f411.py index 830a6441..7b527ee0 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f411.py +++ b/qiling/extensions/mcu/stm32f4/stm32f411.py @@ -4,80 +4,269 @@ # stm32f411 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x80000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -111,258 +300,69 @@ stm32f411 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 49 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 35 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f412.py b/qiling/extensions/mcu/stm32f4/stm32f412.py index e45ff23a..39af8726 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f412.py +++ b/qiling/extensions/mcu/stm32f4/stm32f412.py @@ -4,102 +4,214 @@ # stm32f412 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" - }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" - }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" - }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x100000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -107,8 +219,135 @@ stm32f412 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV2", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -152,87 +391,54 @@ stm32f412 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -240,236 +446,30 @@ stm32f412 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 49 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV2", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f413.py b/qiling/extensions/mcu/stm32f4/stm32f413.py index 641685a6..477b68fe 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f413.py +++ b/qiling/extensions/mcu/stm32f4/stm32f413.py @@ -4,118 +4,238 @@ # stm32f413 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "CAN3": { - "base": 0x40006c00, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 75, - "rx1_intn": 76, - "sce_intn": 77, - "tx_intn": 74 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x180000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x180000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -123,8 +243,191 @@ stm32f413 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CAN3": { + "base": 0x40006c00, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x4b, + "rx1_intn": 0x4c, + "sce_intn": 0x4d, + "tx_intn": 0x4a + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART9": { + "base": 0x40011800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x58 + }, + "type": "peripheral" + }, + "UART10": { + "base": 0x40011c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x59 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV1", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -168,95 +471,54 @@ stm32f413 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -264,292 +526,30 @@ stm32f413 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV1", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART10": { - "base": 0x40011c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 89 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "UART9": { - "base": 0x40011800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 88 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x180000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f415.py b/qiling/extensions/mcu/stm32f4/stm32f415.py index 18922b4a..7c47e814 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f415.py +++ b/qiling/extensions/mcu/stm32f4/stm32f415.py @@ -4,6 +4,303 @@ # stm32f415 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,82 +316,25 @@ stm32f415 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -102,28 +342,19 @@ stm32f415 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -171,87 +402,70 @@ stm32f415 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -260,232 +474,18 @@ stm32f415 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f417.py b/qiling/extensions/mcu/stm32f4/stm32f417.py index 8111285a..22a25c06 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f417.py +++ b/qiling/extensions/mcu/stm32f4/stm32f417.py @@ -4,6 +4,303 @@ # stm32f417 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +316,25 @@ stm32f417 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,28 +342,19 @@ stm32f417 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -188,87 +402,87 @@ stm32f417 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -277,232 +491,18 @@ stm32f417 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f423.py b/qiling/extensions/mcu/stm32f4/stm32f423.py index e4ef4bb8..f6904cc5 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f423.py +++ b/qiling/extensions/mcu/stm32f4/stm32f423.py @@ -4,126 +4,238 @@ # stm32f423 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "AES": { - "base": 0x50060000, - "struct": "STM32F423Aes", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "CAN3": { - "base": 0x40006c00, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 75, - "rx1_intn": 76, - "sce_intn": 77, - "tx_intn": 74 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x180000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x180000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -131,8 +243,191 @@ stm32f423 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CAN3": { + "base": 0x40006c00, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x4b, + "rx1_intn": 0x4c, + "sce_intn": 0x4d, + "tx_intn": 0x4a + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART9": { + "base": 0x40011800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x58 + }, + "type": "peripheral" + }, + "UART10": { + "base": 0x40011c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x59 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV1", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -176,95 +471,62 @@ stm32f423 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "AES": { + "base": 0x50060000, + "struct": "STM32F423Aes", + "kwargs": { + "intn": 0x4f }, "type": "peripheral" }, @@ -272,292 +534,30 @@ stm32f423 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV1", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART10": { - "base": 0x40011c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 89 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "UART9": { - "base": 0x40011800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 88 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x180000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f427.py b/qiling/extensions/mcu/stm32f4/stm32f427.py index f16a8700..5bcd1f35 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f427.py +++ b/qiling/extensions/mcu/stm32f4/stm32f427.py @@ -4,6 +4,319 @@ # stm32f427 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +332,33 @@ stm32f427 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,27 +366,42 @@ stm32f427 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -198,79 +460,79 @@ stm32f427 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -279,280 +541,18 @@ stm32f427 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f429.py b/qiling/extensions/mcu/stm32f4/stm32f429.py index 2fe71f81..bf87d82c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f429.py +++ b/qiling/extensions/mcu/stm32f4/stm32f429.py @@ -4,6 +4,319 @@ # stm32f429 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +332,33 @@ stm32f429 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,27 +366,51 @@ stm32f429 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 }, "type": "peripheral" }, @@ -198,88 +469,79 @@ stm32f429 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -288,280 +550,18 @@ stm32f429 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f437.py b/qiling/extensions/mcu/stm32f4/stm32f437.py index 98500a2e..ebe5c80c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f437.py +++ b/qiling/extensions/mcu/stm32f4/stm32f437.py @@ -4,6 +4,319 @@ # stm32f437 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f437 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,42 @@ stm32f437 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -206,87 +460,95 @@ stm32f437 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -295,280 +557,18 @@ stm32f437 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f439.py b/qiling/extensions/mcu/stm32f4/stm32f439.py index 64da47b1..779fcd29 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f439.py +++ b/qiling/extensions/mcu/stm32f4/stm32f439.py @@ -4,6 +4,319 @@ # stm32f439 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f439 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,51 @@ stm32f439 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 }, "type": "peripheral" }, @@ -206,96 +469,95 @@ stm32f439 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -304,280 +566,18 @@ stm32f439 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f446.py b/qiling/extensions/mcu/stm32f4/stm32f446.py index cc8f6b08..4d0fa0fc 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f446.py +++ b/qiling/extensions/mcu/stm32f4/stm32f446.py @@ -4,6 +4,315 @@ # stm32f446 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x80000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "SPDIFRX": { + "base": 0x40004000, + "struct": "STM32F446Spdifrx", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "FMPI2C1": { + "base": 0x40006000, + "struct": "STM32F4xxFmpi2c", + "kwargs": { + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CEC": { + "base": 0x40006c00, + "struct": "STM32F446Cec", + "kwargs": { + "intn": 0x5d + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,90 +328,33 @@ stm32f446 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CEC": { - "base": 0x40006c00, - "struct": "STM32F446Cec", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 93 + "intn": 0x54 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F446Syscfg", "type": "peripheral" }, "EXTI": { @@ -110,36 +362,34 @@ stm32f446 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x80000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", "kwargs": { - "intn": 4, + "intn": 0x57 }, "type": "peripheral" }, - "FMPI2C1": { - "base": 0x40006000, - "struct": "STM32F4xxFmpi2c", + "SAI2": { + "base": 0x40015c00, + "struct": "STM32F4xxSai", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "intn": 0x5b }, "type": "peripheral" }, @@ -183,335 +433,85 @@ stm32f446 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F446Rcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 87 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SAI2": { - "base": 0x40015c00, - "struct": "STM32F4xxSai", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 91 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", "kwargs": { - "intn": 49 + "intn": 0x4e }, "type": "peripheral" }, - "SPDIFRX": { - "base": 0x40004000, - "struct": "STM32F446Spdifrx", - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "intn": 35 + "intn": 0x5c }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F446Syscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f469.py b/qiling/extensions/mcu/stm32f4/stm32f469.py index a9664367..527aa390 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f469.py +++ b/qiling/extensions/mcu/stm32f4/stm32f469.py @@ -4,6 +4,319 @@ # stm32f469 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f469 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "DSI": { - "base": 0x40016c00, - "struct": "STM32F4xxDsi", - "kwargs": { - "intn": 92 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,59 @@ stm32f469 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 + }, + "type": "peripheral" + }, + "DSI": { + "base": 0x40016c00, + "struct": "STM32F4xxDsi", + "kwargs": { + "intn": 0x5c }, "type": "peripheral" }, @@ -206,96 +477,79 @@ stm32f469 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 91 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -304,280 +558,26 @@ stm32f469 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5b }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f479.py b/qiling/extensions/mcu/stm32f4/stm32f479.py index 9a605bf3..6a504fe5 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f479.py +++ b/qiling/extensions/mcu/stm32f4/stm32f479.py @@ -4,6 +4,319 @@ # stm32f479 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,115 +332,33 @@ stm32f479 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "DSI": { - "base": 0x40016c00, - "struct": "STM32F4xxDsi", - "kwargs": { - "intn": 92 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -135,27 +366,59 @@ stm32f479 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 + }, + "type": "peripheral" + }, + "DSI": { + "base": 0x40016c00, + "struct": "STM32F4xxDsi", + "kwargs": { + "intn": 0x5c }, "type": "peripheral" }, @@ -214,104 +477,95 @@ stm32f479 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 91 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -320,280 +574,26 @@ stm32f479 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5b }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file From e5d6c4059dba5deb00ff6fd998a3a6768c86cb8c Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 12:37:56 +0800 Subject: [PATCH 05/66] Simplify arch peripheral name --- qiling/extensions/mcu/gd32vf1/gd32vf103.py | 2 +- qiling/loader/mcu.py | 2 +- tests/profiles/stm32f411.yml | 8 ++++---- tests/test_mcu.py | 1 + 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/qiling/extensions/mcu/gd32vf1/gd32vf103.py b/qiling/extensions/mcu/gd32vf1/gd32vf103.py index c81e3bc5..67a5f132 100644 --- a/qiling/extensions/mcu/gd32vf1/gd32vf103.py +++ b/qiling/extensions/mcu/gd32vf1/gd32vf103.py @@ -101,7 +101,7 @@ gd32vf103 = { "ECLIC": { "base": 0xd2000000, "struct": "GD32VF1xxEclic", - "type": "core peripheral" + "type": "core" }, "EXMC": { "base": 0xa0000000, diff --git a/qiling/loader/mcu.py b/qiling/loader/mcu.py index 4cd4b5c7..9142a45a 100644 --- a/qiling/loader/mcu.py +++ b/qiling/loader/mcu.py @@ -137,7 +137,7 @@ class QlLoaderMCU(QlLoader): base = args['base'] self.ql.hw.setup_mmio(base, size, info=f'[{name}]') - if memtype == 'core peripheral': + if memtype == 'core': self.ql.hw.create(name.lower()) def run(self): diff --git a/tests/profiles/stm32f411.yml b/tests/profiles/stm32f411.yml index 96efeee1..400eb410 100644 --- a/tests/profiles/stm32f411.yml +++ b/tests/profiles/stm32f411.yml @@ -15,7 +15,7 @@ "kwargs": { "dev_id": 0x413, }, - "type": "core peripheral" + "type": "peripheral" }, "DMA1": { "base": 0x40026000, @@ -143,7 +143,7 @@ "NVIC": { "base": 0xe000e100, "struct": "CortexM4Nvic", - "type": "core peripheral" + "type": "core" }, "PERIP": { "base": 0x40000000, @@ -186,7 +186,7 @@ "SCB": { "base": 0xe000ed00, "struct": "CortexM4Scb", - "type": "core peripheral" + "type": "core" }, "SDIO": { "base": 0x40012c00, @@ -260,7 +260,7 @@ "SYSTICK": { "base": 0xe000e010, "struct": "CortexM4SysTick", - "type": "core peripheral" + "type": "core" }, "TIM1": { "base": 0x40010000, diff --git a/tests/test_mcu.py b/tests/test_mcu.py index 01e7bec0..bc4fafb6 100644 --- a/tests/test_mcu.py +++ b/tests/test_mcu.py @@ -331,6 +331,7 @@ class MCUTest(unittest.TestCase): ql.hw.create('gpiod') ql.hw.create('spi1') ql.hw.create('crc') + ql.hw.create('dbgmcu') flag = False def indicator(ql): From ea92ed9c4abd7c513c5da56a9d2fbe7a750b82e7 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 13:05:05 +0800 Subject: [PATCH 06/66] Format GD32 config format --- qiling/extensions/mcu/gd32vf1/gd32vf103.py | 502 ++++++++++----------- 1 file changed, 251 insertions(+), 251 deletions(-) diff --git a/qiling/extensions/mcu/gd32vf1/gd32vf103.py b/qiling/extensions/mcu/gd32vf1/gd32vf103.py index 67a5f132..647e0414 100644 --- a/qiling/extensions/mcu/gd32vf1/gd32vf103.py +++ b/qiling/extensions/mcu/gd32vf1/gd32vf103.py @@ -4,45 +4,180 @@ # gd32vf103 = { - "ADC0": { - "base": 0x40012400, - "struct": "GD32VF1xxAdc", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" + "ECLIC": { + "base": 0xd2000000, + "struct": "GD32VF1xxEclic", + "type": "core" }, - "ADC1": { - "base": 0x40012800, - "struct": "GD32VF1xxAdc", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "AFIO": { - "base": 0x40010000, - "struct": "GD32VF1xxAfio", - "type": "peripheral" - }, - "BKP": { - "base": 0x40006c00, - "struct": "GD32VF1xxBkp", - "type": "peripheral" + "FLASH": { + "base": 0x8000000, + "size": 0x20000, + "type": "memory" }, "BOOT": { "base": 0x1fffb000, "size": 0x5000, "type": "memory" }, + "SRAM": { + "base": 0x20000000, + "size": 0x18000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x40000, + "type": "mmio" + }, + "USBFS": { + "base": 0x50000000, + "size": 0x40000, + "type": "mmio" + }, + "TIMER1": { + "base": 0x40000000, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x2f + }, + "type": "peripheral" + }, + "TIMER2": { + "base": 0x40000400, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x30 + }, + "type": "peripheral" + }, + "TIMER3": { + "base": 0x40000800, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "TIMER4": { + "base": 0x40000c00, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x45 + }, + "type": "peripheral" + }, + "TIMER5": { + "base": 0x40001000, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x49 + }, + "type": "peripheral" + }, + "TIMER6": { + "base": 0x40001400, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x4a + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "GD32VF1xxRtc", + "kwargs": { + "alarm_intn": 0x3c, + "intn": 0x16 + }, + "type": "peripheral" + }, + "WWDGT": { + "base": 0x40002c00, + "struct": "GD32VF1xxWwdgt", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "FWDGT": { + "base": 0x40003000, + "struct": "GD32VF1xxFwdgt", + "type": "peripheral" + }, + "SPI1": { + "base": 0x40003800, + "struct": "GD32VF1xxSpi", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003c00, + "struct": "GD32VF1xxSpi", + "kwargs": { + "intn": 0x46 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40004400, + "struct": "GD32VF1xxUsart", + "kwargs": { + "intn": 0x39 + }, + "type": "peripheral" + }, + "USART2": { + "base": 0x40004800, + "struct": "GD32VF1xxUsart", + "kwargs": { + "intn": 0x3a + }, + "type": "peripheral" + }, + "UART3": { + "base": 0x40004c00, + "struct": "GD32VF1xxUart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40005000, + "struct": "GD32VF1xxUart", + "kwargs": { + "intn": 0x48 + }, + "type": "peripheral" + }, + "I2C0": { + "base": 0x40005400, + "struct": "GD32VF1xxI2c", + "kwargs": { + "er_intn": 0x33, + "ev_intn": 0x32 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005800, + "struct": "GD32VF1xxI2c", + "kwargs": { + "er_intn": 0x35, + "ev_intn": 0x34 + }, + "type": "peripheral" + }, "CAN0": { "base": 0x40006400, "struct": "GD32VF1xxCan", "kwargs": { - "ewmc_intn": 41, - "rx0_intn": 39, - "rx1_intn": 40, - "tx_intn": 38 + "ewmc_intn": 0x29, + "rx0_intn": 0x27, + "rx1_intn": 0x28, + "tx_intn": 0x26 }, "type": "peripheral" }, @@ -50,16 +185,21 @@ gd32vf103 = { "base": 0x40006800, "struct": "GD32VF1xxCan", "kwargs": { - "ewmc_intn": 85, - "rx0_intn": 83, - "rx1_intn": 84, - "tx_intn": 82 + "ewmc_intn": 0x55, + "rx0_intn": 0x53, + "rx1_intn": 0x54, + "tx_intn": 0x52 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "GD32VF1xxCrc", + "BKP": { + "base": 0x40006c00, + "struct": "GD32VF1xxBkp", + "type": "peripheral" + }, + "PMU": { + "base": 0x40007000, + "struct": "GD32VF1xxPmu", "type": "peripheral" }, "DAC": { @@ -67,79 +207,25 @@ gd32vf103 = { "struct": "GD32VF1xxDac", "type": "peripheral" }, - "DBG": { - "base": 0xe0042000, - "struct": "GD32VF1xxDbg", - "type": "peripheral" - }, - "DMA0": { - "base": 0x40020000, - "struct": "GD32VF1xxDma", - "kwargs": { - "stream0_intn": 30, - "stream1_intn": 31, - "stream2_intn": 32, - "stream3_intn": 33, - "stream4_intn": 34, - "stream5_intn": 35, - "stream6_intn": 36 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40020400, - "struct": "GD32VF1xxDma", - "kwargs": { - "stream0_intn": 75, - "stream1_intn": 76, - "stream2_intn": 77, - "stream3_intn": 78, - "stream4_intn": 79 - }, - "type": "peripheral" - }, - "ECLIC": { - "base": 0xd2000000, - "struct": "GD32VF1xxEclic", - "type": "core" - }, - "EXMC": { - "base": 0xa0000000, - "struct": "GD32VF1xxExmc", + "AFIO": { + "base": 0x40010000, + "struct": "GD32VF1xxAfio", "type": "peripheral" }, "EXTI": { "base": 0x40010400, "struct": "GD32VF1xxExti", "kwargs": { - "line0_intn": 25, - "line15_10_intn": 59, - "line1_intn": 26, - "line2_intn": 27, - "line3_intn": 28, - "line4_intn": 29, - "line9_5_intn": 42 + "line0_intn": 0x19, + "line15_10_intn": 0x3b, + "line1_intn": 0x1a, + "line2_intn": 0x1b, + "line3_intn": 0x1c, + "line4_intn": 0x1d, + "line9_5_intn": 0x2a }, "type": "peripheral" }, - "FLASH": { - "base": 0x08000000, - "size": 0x20000, - "type": "memory" - }, - "FMC": { - "base": 0x40022000, - "struct": "GD32VF1xxFmc", - "kwargs": { - "intn": 23 - }, - "type": "peripheral" - }, - "FWDGT": { - "base": 0x40003000, - "struct": "GD32VF1xxFwdgt", - "type": "peripheral" - }, "GPIOA": { "base": 0x40010800, "struct": "GD32VF1xxGpio", @@ -165,48 +251,30 @@ gd32vf103 = { "struct": "GD32VF1xxGpio", "type": "peripheral" }, - "I2C0": { - "base": 0x40005400, - "struct": "GD32VF1xxI2c", + "ADC0": { + "base": 0x40012400, + "struct": "GD32VF1xxAdc", "kwargs": { - "er_intn": 51, - "ev_intn": 50 + "intn": 0x25 }, "type": "peripheral" }, - "I2C1": { - "base": 0x40005800, - "struct": "GD32VF1xxI2c", + "ADC1": { + "base": 0x40012800, + "struct": "GD32VF1xxAdc", "kwargs": { - "er_intn": 53, - "ev_intn": 52 + "intn": 0x25 }, "type": "peripheral" }, - "PERIP": { - "base": 0x40000000, - "size": 0x40000, - "type": "mmio" - }, - "PMU": { - "base": 0x40007000, - "struct": "GD32VF1xxPmu", - "type": "peripheral" - }, - "RCU": { - "base": 0x40021000, - "struct": "GD32VF1xxRcu", + "TIMER0": { + "base": 0x40012c00, + "struct": "GD32VF1xxTimer", "kwargs": { - "intn": 24 - }, - "type": "peripheral" - }, - "RTC": { - "base": 0x40002800, - "struct": "GD32VF1xxRtc", - "kwargs": { - "alarm_intn": 60, - "intn": 22 + "brk_intn": 0x2b, + "channel_intn": 0x2e, + "trg_cmt_intn": 0x2d, + "up_intn": 0x2c }, "type": "peripheral" }, @@ -214,103 +282,7 @@ gd32vf103 = { "base": 0x40013000, "struct": "GD32VF1xxSpi", "kwargs": { - "intn": 54 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40003800, - "struct": "GD32VF1xxSpi", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003c00, - "struct": "GD32VF1xxSpi", - "kwargs": { - "intn": 70 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x18000, - "type": "memory" - }, - "TIMER0": { - "base": 0x40012c00, - "struct": "GD32VF1xxTimer", - "kwargs": { - "brk_intn": 43, - "channel_intn": 46, - "trg_cmt_intn": 45, - "up_intn": 44 - }, - "type": "peripheral" - }, - "TIMER1": { - "base": 0x40000000, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 47 - }, - "type": "peripheral" - }, - "TIMER2": { - "base": 0x40000400, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 48 - }, - "type": "peripheral" - }, - "TIMER3": { - "base": 0x40000800, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "TIMER4": { - "base": 0x40000c00, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 69 - }, - "type": "peripheral" - }, - "TIMER5": { - "base": 0x40001000, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 73 - }, - "type": "peripheral" - }, - "TIMER6": { - "base": 0x40001400, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 74 - }, - "type": "peripheral" - }, - "UART3": { - "base": 0x40004c00, - "struct": "GD32VF1xxUart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40005000, - "struct": "GD32VF1xxUart", - "kwargs": { - "intn": 72 + "intn": 0x36 }, "type": "peripheral" }, @@ -318,34 +290,55 @@ gd32vf103 = { "base": 0x40013800, "struct": "GD32VF1xxUsart", "kwargs": { - "intn": 56 + "intn": 0x38 }, "type": "peripheral" }, - "USART1": { - "base": 0x40004400, - "struct": "GD32VF1xxUsart", + "DMA0": { + "base": 0x40020000, + "struct": "GD32VF1xxDma", "kwargs": { - "intn": 57 + "stream0_intn": 0x1e, + "stream1_intn": 0x1f, + "stream2_intn": 0x20, + "stream3_intn": 0x21, + "stream4_intn": 0x22, + "stream5_intn": 0x23, + "stream6_intn": 0x24 }, "type": "peripheral" }, - "USART2": { - "base": 0x40004800, - "struct": "GD32VF1xxUsart", + "DMA1": { + "base": 0x40020400, + "struct": "GD32VF1xxDma", "kwargs": { - "intn": 58 + "stream0_intn": 0x4b, + "stream1_intn": 0x4c, + "stream2_intn": 0x4d, + "stream3_intn": 0x4e, + "stream4_intn": 0x4f }, "type": "peripheral" }, - "USBFS": { - "base": 0x50000000, - "size": 0x40000, - "type": "mmio" + "RCU": { + "base": 0x40021000, + "struct": "GD32VF1xxRcu", + "kwargs": { + "intn": 0x18 + }, + "type": "peripheral" }, - "USBFS_DEVICE": { - "base": 0x50000800, - "struct": "GD32VF1xxUsbfs", + "FMC": { + "base": 0x40022000, + "struct": "GD32VF1xxFmc", + "kwargs": { + "intn": 0x17 + }, + "type": "peripheral" + }, + "CRC": { + "base": 0x40023000, + "struct": "GD32VF1xxCrc", "type": "peripheral" }, "USBFS_GLOBAL": { @@ -358,17 +351,24 @@ gd32vf103 = { "struct": "GD32VF1xxUsbfs", "type": "peripheral" }, + "USBFS_DEVICE": { + "base": 0x50000800, + "struct": "GD32VF1xxUsbfs", + "type": "peripheral" + }, "USBFS_PWRCLK": { "base": 0x50000e00, "struct": "GD32VF1xxUsbfs", "type": "peripheral" }, - "WWDGT": { - "base": 0x40002c00, - "struct": "GD32VF1xxWwdgt", - "kwargs": { - "intn": 0 - }, + "EXMC": { + "base": 0xa0000000, + "struct": "GD32VF1xxExmc", + "type": "peripheral" + }, + "DBG": { + "base": 0xe0042000, + "struct": "GD32VF1xxDbg", "type": "peripheral" } } \ No newline at end of file From d4184a49a8af185f71b74cf4da32d22e5a038d99 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:25:23 +0800 Subject: [PATCH 07/66] Make stm32f103 config --- qiling/extensions/mcu/stm32f1/stm32f103.py | 297 +++++++++++++++++++++ 1 file changed, 297 insertions(+) create mode 100644 qiling/extensions/mcu/stm32f1/stm32f103.py diff --git a/qiling/extensions/mcu/stm32f1/stm32f103.py b/qiling/extensions/mcu/stm32f1/stm32f103.py new file mode 100644 index 00000000..fa0dff5c --- /dev/null +++ b/qiling/extensions/mcu/stm32f1/stm32f103.py @@ -0,0 +1,297 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +stm32f103 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM3SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM3Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM3Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x20000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1ffff000, + "size": 0x1000, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x5000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "type": "peripheral", + "base": 0x40000000, + "class": "STM32F1xxTim", + "kwargs": { + "intn": 0x1c + } + }, + "TIM3": { + "type": "peripheral", + "base": 0x40000400, + "class": "STM32F1xxTim", + "kwargs": { + "intn": 0x1d + } + }, + "TIM4": { + "type": "peripheral", + "base": 0x40000800, + "class": "STM32F1xxTim", + "kwargs": { + "intn": 0x1e + } + }, + "RTC": { + "type": "peripheral", + "base": 0x40002800, + "class": "STM32F1xxRtc", + "kwargs": { + "intn": 0x3, + "alarm_intn": 0x29 + } + }, + "WWDG": { + "type": "peripheral", + "base": 0x40002c00, + "class": "STM32F1xxWwdg", + "kwargs": { + "intn": 0x0 + } + }, + "IWDG": { + "type": "peripheral", + "base": 0x40003000, + "class": "STM32F1xxIwdg" + }, + "SPI2": { + "type": "peripheral", + "base": 0x40003800, + "class": "STM32F1xxSpi", + "kwargs": { + "intn": 0x24 + } + }, + "USART2": { + "type": "peripheral", + "base": 0x40004400, + "class": "STM32F1xxUsart", + "kwargs": { + "intn": 0x26 + } + }, + "USART3": { + "type": "peripheral", + "base": 0x40004800, + "class": "STM32F1xxUsart", + "kwargs": { + "intn": 0x27 + } + }, + "I2C1": { + "type": "peripheral", + "base": 0x40005400, + "class": "STM32F1xxI2c", + "kwargs": { + "ev_intn": 0x1f, + "er_intn": 0x20 + } + }, + "I2C2": { + "type": "peripheral", + "base": 0x40005800, + "class": "STM32F1xxI2c", + "kwargs": { + "ev_intn": 0x21, + "er_intn": 0x22 + } + }, + "USB": { + "type": "peripheral", + "base": 0x40005c00, + "class": "STM32F1xxUsb", + "kwargs": { + "hp_can1_tx_intn": 0x13, + "lp_can1_rx0_intn": 0x14, + "hp_intn": 0x13, + "lp_intn": 0x14 + } + }, + "CAN1": { + "type": "peripheral", + "base": 0x40006400, + "class": "STM32F1xxCan", + "kwargs": { + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13, + "rx0_intn": 0x14 + } + }, + "BKP": { + "type": "peripheral", + "base": 0x40006c00, + "class": "STM32F1xxBkp" + }, + "PWR": { + "type": "peripheral", + "base": 0x40007000, + "class": "STM32F1xxPwr" + }, + "AFIO": { + "type": "peripheral", + "base": 0x40010000, + "class": "STM32F1xxAfio" + }, + "EXTI": { + "type": "peripheral", + "base": 0x40010400, + "class": "STM32F1xxExti" + }, + "GPIOA": { + "type": "peripheral", + "base": 0x40010800, + "class": "STM32F1xxGpio" + }, + "GPIOB": { + "type": "peripheral", + "base": 0x40010c00, + "class": "STM32F1xxGpio" + }, + "GPIOC": { + "type": "peripheral", + "base": 0x40011000, + "class": "STM32F1xxGpio" + }, + "GPIOD": { + "type": "peripheral", + "base": 0x40011400, + "class": "STM32F1xxGpio" + }, + "GPIOE": { + "type": "peripheral", + "base": 0x40011800, + "class": "STM32F1xxGpio" + }, + "ADC1": { + "type": "peripheral", + "base": 0x40012400, + "class": "STM32F1xxAdc", + "kwargs": { + "intn": 0x12 + } + }, + "ADC2": { + "type": "peripheral", + "base": 0x40012800, + "class": "STM32F1xxAdc" + }, + "TIM1": { + "type": "peripheral", + "base": 0x40012c00, + "class": "STM32F1xxTim", + "kwargs": { + "brk_intn": 0x18, + "up_intn": 0x19, + "trg_com_intn": 0x1a, + "cc_intn": 0x1b, + "brk_tim15_intn": 0x18, + "brk_tim9_intn": 0x18, + "trg_com_tim17_intn": 0x1a, + "trg_com_tim11_intn": 0x1a, + "up_tim16_intn": 0x19, + "up_tim10_intn": 0x19 + } + }, + "SPI1": { + "type": "peripheral", + "base": 0x40013000, + "class": "STM32F1xxSpi", + "kwargs": { + "intn": 0x23 + } + }, + "USART1": { + "type": "peripheral", + "base": 0x40013800, + "class": "STM32F1xxUsart", + "kwargs": { + "intn": 0x25 + } + }, + "DMA1": { + "type": "peripheral", + "base": 0x40020000, + "class": "STM32F1xxDma" + }, + "RCC": { + "type": "peripheral", + "base": 0x40021000, + "class": "STM32F1xxRcc", + "kwargs": { + "intn": 0x5 + } + }, + "FLASH INTERFACE": { + "type": "peripheral", + "base": 0x40022000, + "class": "STM32F1xxFlash", + "kwargs": { + "intn": 0x4 + } + }, + "CRC": { + "type": "peripheral", + "base": 0x40023000, + "class": "STM32F1xxCrc" + }, + "DBGMCU": { + "type": "peripheral", + "base": 0xe0042000, + "class": "STM32F1xxDbgmcu" + }, + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" + } +} \ No newline at end of file From df9a1de3acb3f796846985c903b8aea2bbc44b75 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:31:01 +0800 Subject: [PATCH 08/66] Add stm32f103 support --- qiling/extensions/mcu/stm32f1/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 qiling/extensions/mcu/stm32f1/__init__.py diff --git a/qiling/extensions/mcu/stm32f1/__init__.py b/qiling/extensions/mcu/stm32f1/__init__.py new file mode 100644 index 00000000..14fd6f33 --- /dev/null +++ b/qiling/extensions/mcu/stm32f1/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .stm32f103 import stm32f103 From f3886f1d75ad44e3f3bc0fe68d93f4c77e18dc43 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:31:12 +0800 Subject: [PATCH 09/66] Add CortexM3 Timer --- qiling/hw/timer/__init__.py | 1 + qiling/hw/timer/cm3_systick.py | 12 +++++++ qiling/hw/timer/cm4_systick.py | 60 +++---------------------------- qiling/hw/timer/cm_systick.py | 64 ++++++++++++++++++++++++++++++++++ 4 files changed, 81 insertions(+), 56 deletions(-) create mode 100644 qiling/hw/timer/cm3_systick.py create mode 100644 qiling/hw/timer/cm_systick.py diff --git a/qiling/hw/timer/__init__.py b/qiling/hw/timer/__init__.py index bbf2dc95..3f37f727 100644 --- a/qiling/hw/timer/__init__.py +++ b/qiling/hw/timer/__init__.py @@ -3,6 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_systick import CortexM3SysTick from .cm4_systick import CortexM4SysTick from .stm32f4xx_rtc import STM32F4xxRtc from .stm32f4xx_tim import STM32F4xxTim diff --git a/qiling/hw/timer/cm3_systick.py b/qiling/hw/timer/cm3_systick.py new file mode 100644 index 00000000..37eae5b6 --- /dev/null +++ b/qiling/hw/timer/cm3_systick.py @@ -0,0 +1,12 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.timer.cm_systick import CortexMSysTick + + +class CortexM3SysTick(CortexMSysTick): + pass diff --git a/qiling/hw/timer/cm4_systick.py b/qiling/hw/timer/cm4_systick.py index 0d67b1ba..37945b90 100644 --- a/qiling/hw/timer/cm4_systick.py +++ b/qiling/hw/timer/cm4_systick.py @@ -4,61 +4,9 @@ # import ctypes -from qiling.arch.cortex_m_const import IRQ -from qiling.hw.peripheral import QlPeripheral -from qiling.hw.timer.timer import QlTimerPeripheral -from qiling.hw.const.cm4_systick import SYSTICK_CTRL + +from qiling.hw.timer.cm_systick import CortexMSysTick -class CortexM4SysTick(QlTimerPeripheral): - class Type(ctypes.Structure): - _fields_ = [ - ('CTRL' , ctypes.c_uint32), - ('LOAD' , ctypes.c_int32), - ('VAL' , ctypes.c_int32), - ('CALIB', ctypes.c_uint32), - ] - - def __init__(self, ql, label): - super().__init__(ql, label) - - self.systick = self.struct( - CALIB = 0xC0000000 - ) - - def step(self): - if not self.systick.CTRL & SYSTICK_CTRL.ENABLE: - return - - if self.systick.VAL <= 0: - self.systick.VAL = self.systick.LOAD - self.systick.CTRL |= SYSTICK_CTRL.COUNTFLAG - - if self.systick.CTRL & SYSTICK_CTRL.TICKINT: - self.ql.hw.nvic.set_pending(IRQ.SYSTICK) - else: - self.systick.VAL -= self.ratio - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.systick) + offset, size) - - if offset == self.struct.CTRL.offset: - self.systick.CTRL &= ~SYSTICK_CTRL.COUNTFLAG - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - # ignore the reserved bit - if offset == self.struct.CTRL.offset: - value &= SYSTICK_CTRL.MASK - else: - value &= 0xffffff # only low-24 bit available - - # restart the timer - if offset == self.struct.LOAD.offset: - self.systick.VAL = value - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.systick) + offset, data, size) +class CortexM4SysTick(CortexMSysTick): + pass diff --git a/qiling/hw/timer/cm_systick.py b/qiling/hw/timer/cm_systick.py new file mode 100644 index 00000000..81e9bc46 --- /dev/null +++ b/qiling/hw/timer/cm_systick.py @@ -0,0 +1,64 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes +from qiling.arch.cortex_m_const import IRQ +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.timer.timer import QlTimerPeripheral +from qiling.hw.const.cm4_systick import SYSTICK_CTRL + + +class CortexMSysTick(QlTimerPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ('CTRL' , ctypes.c_uint32), + ('LOAD' , ctypes.c_int32), + ('VAL' , ctypes.c_int32), + ('CALIB', ctypes.c_uint32), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.systick = self.struct( + CALIB = 0xC0000000 + ) + + def step(self): + if not self.systick.CTRL & SYSTICK_CTRL.ENABLE: + return + + if self.systick.VAL <= 0: + self.systick.VAL = self.systick.LOAD + self.systick.CTRL |= SYSTICK_CTRL.COUNTFLAG + + if self.systick.CTRL & SYSTICK_CTRL.TICKINT: + self.ql.hw.nvic.set_pending(IRQ.SYSTICK) + else: + self.systick.VAL -= self.ratio + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.systick) + offset, size) + + if offset == self.struct.CTRL.offset: + self.systick.CTRL &= ~SYSTICK_CTRL.COUNTFLAG + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + # ignore the reserved bit + if offset == self.struct.CTRL.offset: + value &= SYSTICK_CTRL.MASK + else: + value &= 0xffffff # only low-24 bit available + + # restart the timer + if offset == self.struct.LOAD.offset: + self.systick.VAL = value + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.systick) + offset, data, size) From b342d9b1c995d57fb2b5f6563580af859369084d Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:35:14 +0800 Subject: [PATCH 10/66] Delete rebundant import --- qiling/hw/timer/cm3_systick.py | 2 -- qiling/hw/timer/cm4_systick.py | 2 -- 2 files changed, 4 deletions(-) diff --git a/qiling/hw/timer/cm3_systick.py b/qiling/hw/timer/cm3_systick.py index 37eae5b6..b78e6d1d 100644 --- a/qiling/hw/timer/cm3_systick.py +++ b/qiling/hw/timer/cm3_systick.py @@ -3,8 +3,6 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -import ctypes - from qiling.hw.timer.cm_systick import CortexMSysTick diff --git a/qiling/hw/timer/cm4_systick.py b/qiling/hw/timer/cm4_systick.py index 37945b90..b46712a4 100644 --- a/qiling/hw/timer/cm4_systick.py +++ b/qiling/hw/timer/cm4_systick.py @@ -3,8 +3,6 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -import ctypes - from qiling.hw.timer.cm_systick import CortexMSysTick From 9b13199d47775ee36cbd6aa3cd4e5020d75d10cd Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:35:46 +0800 Subject: [PATCH 11/66] Add Cortex M3 NVIC --- qiling/hw/intc/__init__.py | 1 + qiling/hw/intc/cm3_nvic.py | 9 +++ qiling/hw/intc/cm4_nvic.py | 141 +----------------------------------- qiling/hw/intc/cm_nvic.py | 144 +++++++++++++++++++++++++++++++++++++ 4 files changed, 157 insertions(+), 138 deletions(-) create mode 100644 qiling/hw/intc/cm3_nvic.py create mode 100644 qiling/hw/intc/cm_nvic.py diff --git a/qiling/hw/intc/__init__.py b/qiling/hw/intc/__init__.py index c7321929..e620b151 100644 --- a/qiling/hw/intc/__init__.py +++ b/qiling/hw/intc/__init__.py @@ -3,6 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_nvic import CortexM3Nvic from .cm4_nvic import CortexM4Nvic from .stm32f4xx_exti import STM32F4xxExti from .gd32vf1xx_eclic import GD32VF1xxEclic diff --git a/qiling/hw/intc/cm3_nvic.py b/qiling/hw/intc/cm3_nvic.py new file mode 100644 index 00000000..24d12ffa --- /dev/null +++ b/qiling/hw/intc/cm3_nvic.py @@ -0,0 +1,9 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from qiling.hw.intc.cm_nvic import CortexMNvic + +class CortexM3Nvic(CortexMNvic): + pass diff --git a/qiling/hw/intc/cm4_nvic.py b/qiling/hw/intc/cm4_nvic.py index 1d28276b..423859f3 100644 --- a/qiling/hw/intc/cm4_nvic.py +++ b/qiling/hw/intc/cm4_nvic.py @@ -3,142 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -import ctypes +from qiling.hw.intc.cm_nvic import CortexMNvic -from qiling.hw.peripheral import QlPeripheral - - -class CortexM4Nvic(QlPeripheral): - class Type(ctypes.Structure): - _fields_ = [ - ('ISER' , ctypes.c_uint32 * 8), - ('RESERVED0', ctypes.c_uint32 * 24), - ('ICER' , ctypes.c_uint32 * 8), - ('RESERVED1', ctypes.c_uint32 * 24), - ('ISPR' , ctypes.c_uint32 * 8), - ('RESERVED2', ctypes.c_uint32 * 24), - ('ICPR' , ctypes.c_uint32 * 8), - ('RESERVED3', ctypes.c_uint32 * 24), - ('IABR' , ctypes.c_uint32 * 8), - ('RESERVED4', ctypes.c_uint32 * 56), - ('IPR' , ctypes.c_uint8 * 240), - ('RESERVED5', ctypes.c_uint32 * 644), - ('STIR' , ctypes.c_uint32 * 8), - ] - - def __init__(self, ql, label): - super().__init__(ql, label) - - # reference: - # https://www.youtube.com/watch?v=uFBNf7F3l60 - # https://developer.arm.com/documentation/ddi0439/b/Nested-Vectored-Interrupt-Controller - - self.nvic = self.struct() - - ## The max number of interrupt request - self.IRQN_MAX = self.struct.ISER.size * 8 - - ## The ISER unit size - self.MASK = self.IRQN_MAX // len(self.nvic.ISER) - 1 - self.OFFSET = self.MASK.bit_length() - - ## special write behavior - self.triggers = [ - (self.struct.ISER, self.enable), - (self.struct.ICER, self.disable), - (self.struct.ISPR, self.set_pending), - (self.struct.ICPR, self.clear_pending), - ] - - self.intrs = [] - self.interrupt_handler = self.ql.arch.hard_interrupt_handler - - def enable(self, IRQn): - if IRQn >= 0: - self.nvic.ISER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - self.nvic.ICER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - else: - self.ql.hw.scb.enable(IRQn) - - def disable(self, IRQn): - if IRQn >= 0: - self.nvic.ISER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - self.nvic.ICER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - else: - self.ql.hw.scb.disable(IRQn) - - def get_enable(self, IRQn): - if IRQn >= 0: - return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 - else: - return self.ql.hw.scb.get_enable(IRQn) - - def set_pending(self, IRQn): - if IRQn >= 0: - self.nvic.ISPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - self.nvic.ICPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - else: - self.ql.hw.scb.set_pending(IRQn) - - if self.get_enable(IRQn): - self.intrs.append(IRQn) - - def clear_pending(self, IRQn): - if IRQn >= 0: - self.nvic.ISPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - self.nvic.ICPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - else: - self.ql.hw.scb.clear_pending(IRQn) - - def get_pending(self, IRQn): - if IRQn >= 0: - return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 - else: - return self.ql.hw.scb.get_pending(IRQn) - - def get_priority(self, IRQn): - if IRQn >= 0: - return self.nvic.IPR[IRQn] - else: - return self.ql.hw.scb.get_priority(IRQn) - - def step(self): - if not self.intrs: - return - - self.intrs.sort(key=lambda x: self.get_priority(x)) - - while self.intrs: - IRQn = self.intrs.pop(0) - self.clear_pending(IRQn) - self.interrupt_handler(self.ql, IRQn) - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.nvic) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - def write_byte(ofs, byte): - for var, func in self.triggers: - if var.offset <= ofs < var.offset + var.size: - for i in range(8): - if (byte >> i) & 1: - func(i + (ofs - var.offset) * 8) - break - else: - ipr = self.struct.IPR - if ipr.offset <= ofs < ipr.offset + ipr.size: - byte &= 0xf0 # IPR[3: 0] reserved - - ctypes.memmove(ctypes.addressof(self.nvic) + ofs, bytes([byte]), 1) - - for ofs in range(offset, offset + size): - write_byte(ofs, value & 0xff) - value >>= 8 - - @property - def region(self): - return [(0, self.struct.RESERVED5.offset), (self.struct.STIR.offset, ctypes.sizeof(self.struct))] \ No newline at end of file +class CortexM4Nvic(CortexMNvic): + pass diff --git a/qiling/hw/intc/cm_nvic.py b/qiling/hw/intc/cm_nvic.py new file mode 100644 index 00000000..f52b31f3 --- /dev/null +++ b/qiling/hw/intc/cm_nvic.py @@ -0,0 +1,144 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class CortexMNvic(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ('ISER' , ctypes.c_uint32 * 8), + ('RESERVED0', ctypes.c_uint32 * 24), + ('ICER' , ctypes.c_uint32 * 8), + ('RESERVED1', ctypes.c_uint32 * 24), + ('ISPR' , ctypes.c_uint32 * 8), + ('RESERVED2', ctypes.c_uint32 * 24), + ('ICPR' , ctypes.c_uint32 * 8), + ('RESERVED3', ctypes.c_uint32 * 24), + ('IABR' , ctypes.c_uint32 * 8), + ('RESERVED4', ctypes.c_uint32 * 56), + ('IPR' , ctypes.c_uint8 * 240), + ('RESERVED5', ctypes.c_uint32 * 644), + ('STIR' , ctypes.c_uint32 * 8), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + # reference: + # https://www.youtube.com/watch?v=uFBNf7F3l60 + # https://developer.arm.com/documentation/ddi0439/b/Nested-Vectored-Interrupt-Controller + + self.nvic = self.struct() + + ## The max number of interrupt request + self.IRQN_MAX = self.struct.ISER.size * 8 + + ## The ISER unit size + self.MASK = self.IRQN_MAX // len(self.nvic.ISER) - 1 + self.OFFSET = self.MASK.bit_length() + + ## special write behavior + self.triggers = [ + (self.struct.ISER, self.enable), + (self.struct.ICER, self.disable), + (self.struct.ISPR, self.set_pending), + (self.struct.ICPR, self.clear_pending), + ] + + self.intrs = [] + self.interrupt_handler = self.ql.arch.hard_interrupt_handler + + def enable(self, IRQn): + if IRQn >= 0: + self.nvic.ISER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + self.nvic.ICER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + else: + self.ql.hw.scb.enable(IRQn) + + def disable(self, IRQn): + if IRQn >= 0: + self.nvic.ISER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + self.nvic.ICER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + else: + self.ql.hw.scb.disable(IRQn) + + def get_enable(self, IRQn): + if IRQn >= 0: + return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 + else: + return self.ql.hw.scb.get_enable(IRQn) + + def set_pending(self, IRQn): + if IRQn >= 0: + self.nvic.ISPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + self.nvic.ICPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + else: + self.ql.hw.scb.set_pending(IRQn) + + if self.get_enable(IRQn): + self.intrs.append(IRQn) + + def clear_pending(self, IRQn): + if IRQn >= 0: + self.nvic.ISPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + self.nvic.ICPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + else: + self.ql.hw.scb.clear_pending(IRQn) + + def get_pending(self, IRQn): + if IRQn >= 0: + return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 + else: + return self.ql.hw.scb.get_pending(IRQn) + + def get_priority(self, IRQn): + if IRQn >= 0: + return self.nvic.IPR[IRQn] + else: + return self.ql.hw.scb.get_priority(IRQn) + + def step(self): + if not self.intrs: + return + + self.intrs.sort(key=lambda x: self.get_priority(x)) + + while self.intrs: + IRQn = self.intrs.pop(0) + self.clear_pending(IRQn) + self.interrupt_handler(self.ql, IRQn) + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.nvic) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + def write_byte(ofs, byte): + for var, func in self.triggers: + if var.offset <= ofs < var.offset + var.size: + for i in range(8): + if (byte >> i) & 1: + func(i + (ofs - var.offset) * 8) + break + else: + ipr = self.struct.IPR + if ipr.offset <= ofs < ipr.offset + ipr.size: + byte &= 0xf0 # IPR[3: 0] reserved + + ctypes.memmove(ctypes.addressof(self.nvic) + ofs, bytes([byte]), 1) + + for ofs in range(offset, offset + size): + write_byte(ofs, value & 0xff) + value >>= 8 + + @property + def region(self): + return [(0, self.struct.RESERVED5.offset), (self.struct.STIR.offset, ctypes.sizeof(self.struct))] \ No newline at end of file From 43094aeeb9d611d0fc1b41afb3573fd4496ebfa7 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:40:00 +0800 Subject: [PATCH 12/66] Fix the format cm4 --- qiling/hw/misc/cm4_scb.py | 1 + 1 file changed, 1 insertion(+) diff --git a/qiling/hw/misc/cm4_scb.py b/qiling/hw/misc/cm4_scb.py index 85077c9e..9eb0c05c 100644 --- a/qiling/hw/misc/cm4_scb.py +++ b/qiling/hw/misc/cm4_scb.py @@ -9,6 +9,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral from qiling.arch.cortex_m_const import IRQ + class CortexM4Scb(QlPeripheral): class Type(ctypes.Structure): _fields_ = [ From 971d7aabcf0d56b1c7ba8bf9105d00c41d6c5cf6 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 16:54:41 +0800 Subject: [PATCH 13/66] Add cortex series SCB --- qiling/hw/misc/__init__.py | 1 + qiling/hw/misc/cm3_scb.py | 36 +++++++++++++ qiling/hw/misc/cm4_scb.py | 100 +--------------------------------- qiling/hw/misc/cm_scb.py | 107 +++++++++++++++++++++++++++++++++++++ 4 files changed, 146 insertions(+), 98 deletions(-) create mode 100644 qiling/hw/misc/cm3_scb.py create mode 100644 qiling/hw/misc/cm_scb.py diff --git a/qiling/hw/misc/__init__.py b/qiling/hw/misc/__init__.py index 9a290150..ed72c159 100644 --- a/qiling/hw/misc/__init__.py +++ b/qiling/hw/misc/__init__.py @@ -3,6 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_scb import CortexM3Scb from .cm4_scb import CortexM4Scb from .stm32f4xx_rcc import STM32F4xxRcc from .stm32f4xx_rcc_derive import ( diff --git a/qiling/hw/misc/cm3_scb.py b/qiling/hw/misc/cm3_scb.py new file mode 100644 index 00000000..148bca83 --- /dev/null +++ b/qiling/hw/misc/cm3_scb.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes + +from qiling.hw.misc.cm_scb import CortexMScb + + +class CortexM3Scb(CortexMScb): + class Type(ctypes.Structure): + _fields_ = [ + ('CPUID' , ctypes.c_uint32), + ('ICSR' , ctypes.c_uint32), + ('VTOR' , ctypes.c_uint32), + ('AIRCR' , ctypes.c_uint32), + ('SCR' , ctypes.c_uint32), + ('CCR' , ctypes.c_uint32), + ('SHP' , ctypes.c_uint8 * 12), + ('SHCSR' , ctypes.c_uint32), + ('CFSR' , ctypes.c_uint32), + ('HFSR' , ctypes.c_uint32), + ('DFSR' , ctypes.c_uint32), + ('MMFAR' , ctypes.c_uint32), + ('BFSR' , ctypes.c_uint32), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.scb = self.struct( + CPUID = 0x411FC231, + AIRCR = 0xFA050000, + ) diff --git a/qiling/hw/misc/cm4_scb.py b/qiling/hw/misc/cm4_scb.py index 9eb0c05c..7cf2de0b 100644 --- a/qiling/hw/misc/cm4_scb.py +++ b/qiling/hw/misc/cm4_scb.py @@ -6,11 +6,10 @@ import ctypes -from qiling.hw.peripheral import QlPeripheral -from qiling.arch.cortex_m_const import IRQ +from qiling.hw.misc.cm_scb import CortexMScb -class CortexM4Scb(QlPeripheral): +class CortexM4Scb(CortexMScb): class Type(ctypes.Structure): _fields_ = [ ('CPUID' , ctypes.c_uint32), @@ -37,98 +36,3 @@ class CortexM4Scb(QlPeripheral): AIRCR = 0xFA050000, CCR = 0x00000200, ) - - def enable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR |= 1 << 18 - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR |= 1 << 17 - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR |= 1 << 16 - - def disable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR &= ~(1 << 18) - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR &= ~(1 << 17) - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR &= ~(1 << 16) - - def get_enable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - return (self.scb.SHCSR >> 18) & 1 - if IRQn == IRQ.BUS_FAULT: - return (self.scb.SHCSR >> 17) & 1 - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - return (self.scb.SHCSR >> 16) & 1 - return 1 - - def set_pending(self, IRQn): - if IRQn == IRQ.NMI: - self.scb.ICSR |= 1 << 31 - if IRQn == IRQ.PENDSV: - self.scb.ICSR |= 3 << 27 # set-bit and clear-bit - if IRQn == IRQ.SYSTICK: - self.scb.ICSR |= 3 << 25 # set-bit and clear-bit - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR |= 1 << 13 - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR |= 1 << 14 - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR |= 1 << 12 - if IRQn == IRQ.SVCALL: - self.scb.SHCSR |= 1 << 15 - - def clear_pending(self, IRQn): - if IRQn == IRQ.NMI: - self.scb.ICSR &= ~(1 << 31) - if IRQn == IRQ.PENDSV: - self.scb.ICSR &= ~(3 << 27) - if IRQn == IRQ.SYSTICK: - self.scb.ICSR &= ~(3 << 25) - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR &= ~(1 << 13) - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR &= ~(1 << 14) - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR &= ~(1 << 12) - if IRQn == IRQ.SVCALL: - self.scb.SHCSR &= ~(1 << 15) - - def get_pending(self, IRQn): - if IRQn == IRQ.NMI: - return (self.scb.ICSR >> 31) & 1 - if IRQn == IRQ.PENDSV: - return (self.scb.ICSR >> 28) & 1 - if IRQn == IRQ.SYSTICK: - return (self.scb.ICSR >> 26) & 1 - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - return (self.scb.SHCSR >> 13) & 1 - if IRQn == IRQ.BUS_FAULT: - return (self.scb.SHCSR >> 14) & 1 - if IRQn == IRQ.USAGE_FAULT: - return (self.scb.SHCSR >> 12) & 1 - if IRQn == IRQ.SVCALL: - return (self.scb.SHCSR >> 15) & 1 - return 0 - - def get_priority(self, IRQn): - return self.scb.SHP[(IRQn & 0xf) - 4] - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.scb) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - if offset == self.struct.ICSR.offset: - if (value >> 28) & 1: - self.ql.hw.nvic.set_pending(IRQ.PENDSV) - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.scb) + offset, data, size) diff --git a/qiling/hw/misc/cm_scb.py b/qiling/hw/misc/cm_scb.py new file mode 100644 index 00000000..a98a0eef --- /dev/null +++ b/qiling/hw/misc/cm_scb.py @@ -0,0 +1,107 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.arch.cortex_m_const import IRQ + + +class CortexMScb(QlPeripheral): + def enable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR |= 1 << 18 + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR |= 1 << 17 + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR |= 1 << 16 + + def disable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR &= ~(1 << 18) + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR &= ~(1 << 17) + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR &= ~(1 << 16) + + def get_enable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + return (self.scb.SHCSR >> 18) & 1 + if IRQn == IRQ.BUS_FAULT: + return (self.scb.SHCSR >> 17) & 1 + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + return (self.scb.SHCSR >> 16) & 1 + return 1 + + def set_pending(self, IRQn): + if IRQn == IRQ.NMI: + self.scb.ICSR |= 1 << 31 + if IRQn == IRQ.PENDSV: + self.scb.ICSR |= 3 << 27 # set-bit and clear-bit + if IRQn == IRQ.SYSTICK: + self.scb.ICSR |= 3 << 25 # set-bit and clear-bit + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR |= 1 << 13 + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR |= 1 << 14 + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR |= 1 << 12 + if IRQn == IRQ.SVCALL: + self.scb.SHCSR |= 1 << 15 + + def clear_pending(self, IRQn): + if IRQn == IRQ.NMI: + self.scb.ICSR &= ~(1 << 31) + if IRQn == IRQ.PENDSV: + self.scb.ICSR &= ~(3 << 27) + if IRQn == IRQ.SYSTICK: + self.scb.ICSR &= ~(3 << 25) + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR &= ~(1 << 13) + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR &= ~(1 << 14) + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR &= ~(1 << 12) + if IRQn == IRQ.SVCALL: + self.scb.SHCSR &= ~(1 << 15) + + def get_pending(self, IRQn): + if IRQn == IRQ.NMI: + return (self.scb.ICSR >> 31) & 1 + if IRQn == IRQ.PENDSV: + return (self.scb.ICSR >> 28) & 1 + if IRQn == IRQ.SYSTICK: + return (self.scb.ICSR >> 26) & 1 + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + return (self.scb.SHCSR >> 13) & 1 + if IRQn == IRQ.BUS_FAULT: + return (self.scb.SHCSR >> 14) & 1 + if IRQn == IRQ.USAGE_FAULT: + return (self.scb.SHCSR >> 12) & 1 + if IRQn == IRQ.SVCALL: + return (self.scb.SHCSR >> 15) & 1 + return 0 + + def get_priority(self, IRQn): + return self.scb.SHP[(IRQn & 0xf) - 4] + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.scb) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.ICSR.offset: + if (value >> 28) & 1: + self.ql.hw.nvic.set_pending(IRQ.PENDSV) + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.scb) + offset, data, size) From 5e998be73f2c7c1d8201b4306ae19c47bb789780 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 17:33:08 +0800 Subject: [PATCH 14/66] Replace class with struct --- qiling/extensions/mcu/stm32f1/stm32f103.py | 64 +++++++++++----------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/qiling/extensions/mcu/stm32f1/stm32f103.py b/qiling/extensions/mcu/stm32f1/stm32f103.py index fa0dff5c..67530b48 100644 --- a/qiling/extensions/mcu/stm32f1/stm32f103.py +++ b/qiling/extensions/mcu/stm32f1/stm32f103.py @@ -59,7 +59,7 @@ stm32f103 = { "TIM2": { "type": "peripheral", "base": 0x40000000, - "class": "STM32F1xxTim", + "struct": "STM32F1xxTim", "kwargs": { "intn": 0x1c } @@ -67,7 +67,7 @@ stm32f103 = { "TIM3": { "type": "peripheral", "base": 0x40000400, - "class": "STM32F1xxTim", + "struct": "STM32F1xxTim", "kwargs": { "intn": 0x1d } @@ -75,7 +75,7 @@ stm32f103 = { "TIM4": { "type": "peripheral", "base": 0x40000800, - "class": "STM32F1xxTim", + "struct": "STM32F1xxTim", "kwargs": { "intn": 0x1e } @@ -83,7 +83,7 @@ stm32f103 = { "RTC": { "type": "peripheral", "base": 0x40002800, - "class": "STM32F1xxRtc", + "struct": "STM32F1xxRtc", "kwargs": { "intn": 0x3, "alarm_intn": 0x29 @@ -92,7 +92,7 @@ stm32f103 = { "WWDG": { "type": "peripheral", "base": 0x40002c00, - "class": "STM32F1xxWwdg", + "struct": "STM32F1xxWwdg", "kwargs": { "intn": 0x0 } @@ -100,12 +100,12 @@ stm32f103 = { "IWDG": { "type": "peripheral", "base": 0x40003000, - "class": "STM32F1xxIwdg" + "struct": "STM32F1xxIwdg" }, "SPI2": { "type": "peripheral", "base": 0x40003800, - "class": "STM32F1xxSpi", + "struct": "STM32F1xxSpi", "kwargs": { "intn": 0x24 } @@ -113,7 +113,7 @@ stm32f103 = { "USART2": { "type": "peripheral", "base": 0x40004400, - "class": "STM32F1xxUsart", + "struct": "STM32F1xxUsart", "kwargs": { "intn": 0x26 } @@ -121,7 +121,7 @@ stm32f103 = { "USART3": { "type": "peripheral", "base": 0x40004800, - "class": "STM32F1xxUsart", + "struct": "STM32F1xxUsart", "kwargs": { "intn": 0x27 } @@ -129,7 +129,7 @@ stm32f103 = { "I2C1": { "type": "peripheral", "base": 0x40005400, - "class": "STM32F1xxI2c", + "struct": "STM32F1xxI2c", "kwargs": { "ev_intn": 0x1f, "er_intn": 0x20 @@ -138,7 +138,7 @@ stm32f103 = { "I2C2": { "type": "peripheral", "base": 0x40005800, - "class": "STM32F1xxI2c", + "struct": "STM32F1xxI2c", "kwargs": { "ev_intn": 0x21, "er_intn": 0x22 @@ -147,7 +147,7 @@ stm32f103 = { "USB": { "type": "peripheral", "base": 0x40005c00, - "class": "STM32F1xxUsb", + "struct": "STM32F1xxUsb", "kwargs": { "hp_can1_tx_intn": 0x13, "lp_can1_rx0_intn": 0x14, @@ -158,7 +158,7 @@ stm32f103 = { "CAN1": { "type": "peripheral", "base": 0x40006400, - "class": "STM32F1xxCan", + "struct": "STM32F1xxCan", "kwargs": { "rx1_intn": 0x15, "sce_intn": 0x16, @@ -169,52 +169,52 @@ stm32f103 = { "BKP": { "type": "peripheral", "base": 0x40006c00, - "class": "STM32F1xxBkp" + "struct": "STM32F1xxBkp" }, "PWR": { "type": "peripheral", "base": 0x40007000, - "class": "STM32F1xxPwr" + "struct": "STM32F1xxPwr" }, "AFIO": { "type": "peripheral", "base": 0x40010000, - "class": "STM32F1xxAfio" + "struct": "STM32F1xxAfio" }, "EXTI": { "type": "peripheral", "base": 0x40010400, - "class": "STM32F1xxExti" + "struct": "STM32F1xxExti" }, "GPIOA": { "type": "peripheral", "base": 0x40010800, - "class": "STM32F1xxGpio" + "struct": "STM32F1xxGpio" }, "GPIOB": { "type": "peripheral", "base": 0x40010c00, - "class": "STM32F1xxGpio" + "struct": "STM32F1xxGpio" }, "GPIOC": { "type": "peripheral", "base": 0x40011000, - "class": "STM32F1xxGpio" + "struct": "STM32F1xxGpio" }, "GPIOD": { "type": "peripheral", "base": 0x40011400, - "class": "STM32F1xxGpio" + "struct": "STM32F1xxGpio" }, "GPIOE": { "type": "peripheral", "base": 0x40011800, - "class": "STM32F1xxGpio" + "struct": "STM32F1xxGpio" }, "ADC1": { "type": "peripheral", "base": 0x40012400, - "class": "STM32F1xxAdc", + "struct": "STM32F1xxAdc", "kwargs": { "intn": 0x12 } @@ -222,12 +222,12 @@ stm32f103 = { "ADC2": { "type": "peripheral", "base": 0x40012800, - "class": "STM32F1xxAdc" + "struct": "STM32F1xxAdc" }, "TIM1": { "type": "peripheral", "base": 0x40012c00, - "class": "STM32F1xxTim", + "struct": "STM32F1xxTim", "kwargs": { "brk_intn": 0x18, "up_intn": 0x19, @@ -244,7 +244,7 @@ stm32f103 = { "SPI1": { "type": "peripheral", "base": 0x40013000, - "class": "STM32F1xxSpi", + "struct": "STM32F1xxSpi", "kwargs": { "intn": 0x23 } @@ -252,7 +252,7 @@ stm32f103 = { "USART1": { "type": "peripheral", "base": 0x40013800, - "class": "STM32F1xxUsart", + "struct": "STM32F1xxUsart", "kwargs": { "intn": 0x25 } @@ -260,12 +260,12 @@ stm32f103 = { "DMA1": { "type": "peripheral", "base": 0x40020000, - "class": "STM32F1xxDma" + "struct": "STM32F1xxDma" }, "RCC": { "type": "peripheral", "base": 0x40021000, - "class": "STM32F1xxRcc", + "struct": "STM32F1xxRcc", "kwargs": { "intn": 0x5 } @@ -273,7 +273,7 @@ stm32f103 = { "FLASH INTERFACE": { "type": "peripheral", "base": 0x40022000, - "class": "STM32F1xxFlash", + "struct": "STM32F1xxFlash", "kwargs": { "intn": 0x4 } @@ -281,12 +281,12 @@ stm32f103 = { "CRC": { "type": "peripheral", "base": 0x40023000, - "class": "STM32F1xxCrc" + "struct": "STM32F1xxCrc" }, "DBGMCU": { "type": "peripheral", "base": 0xe0042000, - "class": "STM32F1xxDbgmcu" + "struct": "STM32F1xxDbgmcu" }, "CODE": { "base": 0x8000000, From 1c831e540db47df6c5a5884df74b61edd8869702 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 17:42:54 +0800 Subject: [PATCH 15/66] Summary stm32 RCC --- qiling/hw/const/{stm32f4xx_rcc.py => stm32_rcc.py} | 0 qiling/hw/misc/stm32f4xx_rcc.py | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename qiling/hw/const/{stm32f4xx_rcc.py => stm32_rcc.py} (100%) diff --git a/qiling/hw/const/stm32f4xx_rcc.py b/qiling/hw/const/stm32_rcc.py similarity index 100% rename from qiling/hw/const/stm32f4xx_rcc.py rename to qiling/hw/const/stm32_rcc.py diff --git a/qiling/hw/misc/stm32f4xx_rcc.py b/qiling/hw/misc/stm32f4xx_rcc.py index f259eab0..817a455a 100644 --- a/qiling/hw/misc/stm32f4xx_rcc.py +++ b/qiling/hw/misc/stm32f4xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32f4xx_rcc import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32_rcc import RCC_CR, RCC_CFGR, RCC_CSR class STM32F4xxRcc(QlPeripheral): From 6331207af747073a766e283de2514744fda81a5a Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 17:47:15 +0800 Subject: [PATCH 16/66] Add stm32f1xx RCC --- qiling/hw/misc/__init__.py | 1 + qiling/hw/misc/stm32f1xx_rcc.py | 82 +++++++++++++++++++++++++++++++++ 2 files changed, 83 insertions(+) create mode 100644 qiling/hw/misc/stm32f1xx_rcc.py diff --git a/qiling/hw/misc/__init__.py b/qiling/hw/misc/__init__.py index ed72c159..0be48f5d 100644 --- a/qiling/hw/misc/__init__.py +++ b/qiling/hw/misc/__init__.py @@ -5,6 +5,7 @@ from .cm3_scb import CortexM3Scb from .cm4_scb import CortexM4Scb +from .stm32f1xx_rcc import STM32F1xxRcc from .stm32f4xx_rcc import STM32F4xxRcc from .stm32f4xx_rcc_derive import ( STM32F4xxRccV1, STM32F4xxRccV2, diff --git a/qiling/hw/misc/stm32f1xx_rcc.py b/qiling/hw/misc/stm32f1xx_rcc.py new file mode 100644 index 00000000..32d67027 --- /dev/null +++ b/qiling/hw/misc/stm32f1xx_rcc.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.const.stm32_rcc import RCC_CR, RCC_CFGR, RCC_CSR + + +class STM32F1xxRcc(QlPeripheral): + class Type(ctypes.Structure): + """ the structure is available in : + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + """ + + _fields_ = [ + ("CR" , ctypes.c_uint32), + ("CFGR" , ctypes.c_uint32), + ("CIR" , ctypes.c_uint32), + ("APB2RSTR", ctypes.c_uint32), + ("APB1RSTR", ctypes.c_uint32), + ("AHBENR" , ctypes.c_uint32), + ("APB2ENR" , ctypes.c_uint32), + ("APB1ENR" , ctypes.c_uint32), + ("BDCR" , ctypes.c_uint32), + ("CSR" , ctypes.c_uint32), + ] + + def __init__(self, ql, label, intn=None): + super().__init__(ql, label) + + self.rcc = self.struct( + CR = 0x00000083, + AHBENR = 0x00000014, + CSR = 0x0C000000, + ) + + self.rdyon = { + 'CR': [ + (RCC_CR.HSIRDY , RCC_CR.HSION ), + (RCC_CR.HSERDY , RCC_CR.HSEON ), + (RCC_CR.PLLRDY , RCC_CR.PLLON ), + (RCC_CR.PLLI2SRDY, RCC_CR.PLLI2SON), + ], + 'CFGR': [ + (RCC_CFGR.SWS_0, RCC_CFGR.SW_0), + (RCC_CFGR.SWS_1, RCC_CFGR.SW_1), + ], + 'CSR': [ + (RCC_CSR.LSIRDY, RCC_CSR.LSION) + ] + } + + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.rcc) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.rcc) + offset, data, size) + + def step(self): + for reg, rdyon in self.rdyon.items(): + value = getattr(self.rcc, reg) + for rdy, on in rdyon: + if value & on: + value |= rdy + else: + value &= ~rdy + setattr(self.rcc, reg, value) From 4133f7e7d3ad2c84f7208d65c82cdb13dc416a9c Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 17:56:11 +0800 Subject: [PATCH 17/66] Add stm32f1 usart --- qiling/hw/char/__init__.py | 1 + qiling/hw/char/stm32f1xx_usart.py | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 qiling/hw/char/stm32f1xx_usart.py diff --git a/qiling/hw/char/__init__.py b/qiling/hw/char/__init__.py index 4fb762c0..5b2e40b8 100644 --- a/qiling/hw/char/__init__.py +++ b/qiling/hw/char/__init__.py @@ -3,5 +3,6 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .stm32f1xx_usart import STM32F1xxUsart from .stm32f4xx_usart import STM32F4xxUsart from .gd32vf1xx_usart import GD32VF1xxUsart \ No newline at end of file diff --git a/qiling/hw/char/stm32f1xx_usart.py b/qiling/hw/char/stm32f1xx_usart.py new file mode 100644 index 00000000..fa8d57f8 --- /dev/null +++ b/qiling/hw/char/stm32f1xx_usart.py @@ -0,0 +1,30 @@ +import ctypes + +from qiling.hw.char.stm32f4xx_usart import STM32F4xxUsart + + +class STM32F1xxUsart(STM32F4xxUsart): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("SR" , ctypes.c_uint32), #USART Status register, Address offset: 0x00 + ("DR" , ctypes.c_uint32), #USART Data register, Address offset: 0x04 + ("BRR" , ctypes.c_uint32), #USART Baud rate register, Address offset: 0x08 + ("CR1" , ctypes.c_uint32), #USART Control register 1, Address offset: 0x0C + ("CR2" , ctypes.c_uint32), #USART Control register 2, Address offset: 0x10 + ("CR3" , ctypes.c_uint32), #USART Control register 3, Address offset: 0x14 + ("GTPR", ctypes.c_uint32), #USART Guard time and prescaler register, Address offset: 0x18 + ] From c46314f99cc3003c1c1342b54b5fa53c9468b2cc Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 18:12:21 +0800 Subject: [PATCH 18/66] Add stm32f1xx flash --- qiling/hw/misc/__init__.py | 1 + qiling/hw/misc/stm32f1xx_flash.py | 55 +++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 qiling/hw/misc/stm32f1xx_flash.py diff --git a/qiling/hw/misc/__init__.py b/qiling/hw/misc/__init__.py index 0be48f5d..b7d0d499 100644 --- a/qiling/hw/misc/__init__.py +++ b/qiling/hw/misc/__init__.py @@ -6,6 +6,7 @@ from .cm3_scb import CortexM3Scb from .cm4_scb import CortexM4Scb from .stm32f1xx_rcc import STM32F1xxRcc +from .stm32f1xx_flash import STM32F1xxFlash from .stm32f4xx_rcc import STM32F4xxRcc from .stm32f4xx_rcc_derive import ( STM32F4xxRccV1, STM32F4xxRccV2, diff --git a/qiling/hw/misc/stm32f1xx_flash.py b/qiling/hw/misc/stm32f1xx_flash.py new file mode 100644 index 00000000..46afeed2 --- /dev/null +++ b/qiling/hw/misc/stm32f1xx_flash.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes +from qiling.core import Qiling + +from qiling.hw.peripheral import QlPeripheral + + +class STM32F1xxFlash(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f102xb + stm32f103xb + stm32f103xe + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("ACR" , ctypes.c_uint32), + ("KEYR" , ctypes.c_uint32), + ("OPTKEYR" , ctypes.c_uint32), + ("SR" , ctypes.c_uint32), + ("CR" , ctypes.c_uint32), + ("AR" , ctypes.c_uint32), + ("RESERVED", ctypes.c_uint32), + ("OBR" , ctypes.c_uint32), + ("WRPR" , ctypes.c_uint32), + ] + + def __init__(self, ql: Qiling, label: str, intn: int = None): + super().__init__(ql, label) + + self.intn = intn + self.flash = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.flash) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.flash) + offset, data, size) + From 1c77daa431bd6e39476dee39e5538dbff8f0cede Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 18:26:26 +0800 Subject: [PATCH 19/66] Add stm32f1xx exti --- qiling/hw/intc/__init__.py | 1 + qiling/hw/intc/stm32f1xx_exti.py | 34 ++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 qiling/hw/intc/stm32f1xx_exti.py diff --git a/qiling/hw/intc/__init__.py b/qiling/hw/intc/__init__.py index e620b151..6493d709 100644 --- a/qiling/hw/intc/__init__.py +++ b/qiling/hw/intc/__init__.py @@ -5,5 +5,6 @@ from .cm3_nvic import CortexM3Nvic from .cm4_nvic import CortexM4Nvic +from .stm32f1xx_exti import STM32F1xxExti from .stm32f4xx_exti import STM32F4xxExti from .gd32vf1xx_eclic import GD32VF1xxEclic diff --git a/qiling/hw/intc/stm32f1xx_exti.py b/qiling/hw/intc/stm32f1xx_exti.py new file mode 100644 index 00000000..d6fc9851 --- /dev/null +++ b/qiling/hw/intc/stm32f1xx_exti.py @@ -0,0 +1,34 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.intc.stm32f4xx_exti import STM32F4xxExti + + +class STM32F1xxExti(STM32F4xxExti): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("IMR" , ctypes.c_uint32), + ("EMR" , ctypes.c_uint32), + ("RTSR" , ctypes.c_uint32), + ("FTSR" , ctypes.c_uint32), + ("SWIER", ctypes.c_uint32), + ("PR" , ctypes.c_uint32), + ] From 9c58c8c340c96f80cb15a643a7bb8b6916189ebd Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 18:26:37 +0800 Subject: [PATCH 20/66] Add stm32f1xx gpio --- qiling/hw/gpio/__init__.py | 1 + qiling/hw/gpio/stm32f1xx_gpio.py | 42 ++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 qiling/hw/gpio/stm32f1xx_gpio.py diff --git a/qiling/hw/gpio/__init__.py b/qiling/hw/gpio/__init__.py index a6828608..41599dfb 100644 --- a/qiling/hw/gpio/__init__.py +++ b/qiling/hw/gpio/__init__.py @@ -3,5 +3,6 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .stm32f1xx_gpio import STM32F1xxGpio from .stm32f4xx_gpio import STM32F4xxGpio from .gd32vf1xx_gpio import GD32VF1xxGpio \ No newline at end of file diff --git a/qiling/hw/gpio/stm32f1xx_gpio.py b/qiling/hw/gpio/stm32f1xx_gpio.py new file mode 100644 index 00000000..da7d0a79 --- /dev/null +++ b/qiling/hw/gpio/stm32f1xx_gpio.py @@ -0,0 +1,42 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.gpio.hooks import GpioHooks + + +class STM32F1xxGpio(QlPeripheral, GpioHooks): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("CRL" , ctypes.c_uint32), + ("CRH" , ctypes.c_uint32), + ("IDR" , ctypes.c_uint32), + ("ODR" , ctypes.c_uint32), + ("BSRR", ctypes.c_uint32), + ("BRR" , ctypes.c_uint32), + ("LCKR", ctypes.c_uint32), + ] + + def __init__(self, ql, label): + QlPeripheral.__init__(self, ql, label) + GpioHooks.__init__(self, ql, 16) + + self.gpio = self.struct() From 89fddb57d477b5ab55b22e2cb29f1918c3f6f65a Mon Sep 17 00:00:00 2001 From: dataisland Date: Sat, 5 Feb 2022 18:30:29 +0800 Subject: [PATCH 21/66] Add stm32f1xx afio --- qiling/hw/gpio/__init__.py | 1 + qiling/hw/gpio/stm32f1xx_afio.py | 33 ++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 qiling/hw/gpio/stm32f1xx_afio.py diff --git a/qiling/hw/gpio/__init__.py b/qiling/hw/gpio/__init__.py index 41599dfb..ae794314 100644 --- a/qiling/hw/gpio/__init__.py +++ b/qiling/hw/gpio/__init__.py @@ -4,5 +4,6 @@ # from .stm32f1xx_gpio import STM32F1xxGpio +from .stm32f1xx_afio import STM32F1xxAfio from .stm32f4xx_gpio import STM32F4xxGpio from .gd32vf1xx_gpio import GD32VF1xxGpio \ No newline at end of file diff --git a/qiling/hw/gpio/stm32f1xx_afio.py b/qiling/hw/gpio/stm32f1xx_afio.py new file mode 100644 index 00000000..24249257 --- /dev/null +++ b/qiling/hw/gpio/stm32f1xx_afio.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class STM32F1xxAfio(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("EVCR" , ctypes.c_uint32), + ("MAPR" , ctypes.c_uint32), + ("EXTICR" , ctypes.c_uint32 * 4), + ("RESERVED0", ctypes.c_uint32), + ("MAPR2" , ctypes.c_uint32), + ] From 3c7245b07037cd664eb03c77c45ced2f8c44701b Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 10:38:25 +0800 Subject: [PATCH 22/66] Fix RCC const name --- qiling/hw/const/{stm32_rcc.py => stm32fxxx_rcc.py} | 0 qiling/hw/misc/stm32f1xx_rcc.py | 2 +- qiling/hw/misc/stm32f4xx_rcc.py | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename qiling/hw/const/{stm32_rcc.py => stm32fxxx_rcc.py} (100%) diff --git a/qiling/hw/const/stm32_rcc.py b/qiling/hw/const/stm32fxxx_rcc.py similarity index 100% rename from qiling/hw/const/stm32_rcc.py rename to qiling/hw/const/stm32fxxx_rcc.py diff --git a/qiling/hw/misc/stm32f1xx_rcc.py b/qiling/hw/misc/stm32f1xx_rcc.py index 32d67027..234b7950 100644 --- a/qiling/hw/misc/stm32f1xx_rcc.py +++ b/qiling/hw/misc/stm32f1xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32_rcc import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32fxxx import RCC_CR, RCC_CFGR, RCC_CSR class STM32F1xxRcc(QlPeripheral): diff --git a/qiling/hw/misc/stm32f4xx_rcc.py b/qiling/hw/misc/stm32f4xx_rcc.py index 817a455a..c2ccf09d 100644 --- a/qiling/hw/misc/stm32f4xx_rcc.py +++ b/qiling/hw/misc/stm32f4xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32_rcc import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32fxxx import RCC_CR, RCC_CFGR, RCC_CSR class STM32F4xxRcc(QlPeripheral): From b92e75ea9a3d5d1081552ef9106c925303fc58f3 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 10:49:00 +0800 Subject: [PATCH 23/66] Fix RCC const typo --- qiling/hw/misc/stm32f1xx_rcc.py | 2 +- qiling/hw/misc/stm32f4xx_rcc.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/qiling/hw/misc/stm32f1xx_rcc.py b/qiling/hw/misc/stm32f1xx_rcc.py index 234b7950..aff4323e 100644 --- a/qiling/hw/misc/stm32f1xx_rcc.py +++ b/qiling/hw/misc/stm32f1xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32fxxx import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32fxxx_rcc import RCC_CR, RCC_CFGR, RCC_CSR class STM32F1xxRcc(QlPeripheral): diff --git a/qiling/hw/misc/stm32f4xx_rcc.py b/qiling/hw/misc/stm32f4xx_rcc.py index c2ccf09d..ac45168c 100644 --- a/qiling/hw/misc/stm32f4xx_rcc.py +++ b/qiling/hw/misc/stm32f4xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32fxxx import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32fxxx_rcc import RCC_CR, RCC_CFGR, RCC_CSR class STM32F4xxRcc(QlPeripheral): From 59b90d3aae754ba70d23c12ea39ce0641aef4452 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 11:03:07 +0800 Subject: [PATCH 24/66] Delete stm32f4 dma magic number --- qiling/hw/dma/stm32f4xx_dma.py | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/qiling/hw/dma/stm32f4xx_dma.py b/qiling/hw/dma/stm32f4xx_dma.py index 8aebfbc0..83825477 100644 --- a/qiling/hw/dma/stm32f4xx_dma.py +++ b/qiling/hw/dma/stm32f4xx_dma.py @@ -104,10 +104,7 @@ class STM32F4xxDma(QlPeripheral): super().__init__(ql, label) self.dma = self.struct() - - self.stream_base = 0x10 - self.stream_size = ctypes.sizeof(Stream) - + self.intn = [ stream0_intn, stream1_intn, @@ -120,7 +117,7 @@ class STM32F4xxDma(QlPeripheral): ] def stream_index(self, offset): - return (offset - self.stream_base) // self.stream_size + return (offset - self.struct.stream.offset) // ctypes.sizeof(Stream) @QlPeripheral.monitor(width=15) def read(self, offset: int, size: int) -> int: From 91ea1078a431ccc11016fa6b6ee7a73e18161df8 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 12:38:52 +0800 Subject: [PATCH 25/66] Uncompress adio register --- qiling/hw/gpio/stm32f1xx_afio.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/qiling/hw/gpio/stm32f1xx_afio.py b/qiling/hw/gpio/stm32f1xx_afio.py index 24249257..dbdaeafc 100644 --- a/qiling/hw/gpio/stm32f1xx_afio.py +++ b/qiling/hw/gpio/stm32f1xx_afio.py @@ -27,7 +27,10 @@ class STM32F1xxAfio(QlPeripheral): _fields_ = [ ("EVCR" , ctypes.c_uint32), ("MAPR" , ctypes.c_uint32), - ("EXTICR" , ctypes.c_uint32 * 4), + ("EXTICR1" , ctypes.c_uint32), + ("EXTICR2" , ctypes.c_uint32), + ("EXTICR3" , ctypes.c_uint32), + ("EXTICR4" , ctypes.c_uint32), ("RESERVED0", ctypes.c_uint32), ("MAPR2" , ctypes.c_uint32), ] From a82144d2a929725d98d36a335ff6435fc8d26bfb Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 12:39:20 +0800 Subject: [PATCH 26/66] Add stm32f103 DMA interrupt setting --- qiling/extensions/mcu/stm32f1/stm32f103.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/qiling/extensions/mcu/stm32f1/stm32f103.py b/qiling/extensions/mcu/stm32f1/stm32f103.py index 67530b48..911989a4 100644 --- a/qiling/extensions/mcu/stm32f1/stm32f103.py +++ b/qiling/extensions/mcu/stm32f1/stm32f103.py @@ -260,7 +260,17 @@ stm32f103 = { "DMA1": { "type": "peripheral", "base": 0x40020000, - "struct": "STM32F1xxDma" + "struct": "STM32F1xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, }, "RCC": { "type": "peripheral", From 68d236f184cf82a25f5556eff52b568a667e2e2b Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 20:21:33 +0800 Subject: [PATCH 27/66] Unity stm32f1/4 gpio --- qiling/hw/gpio/stm32f1xx_gpio.py | 56 ++++++++++++++++++++++++++++++ qiling/hw/gpio/stm32f4xx_gpio.py | 59 ++------------------------------ 2 files changed, 58 insertions(+), 57 deletions(-) diff --git a/qiling/hw/gpio/stm32f1xx_gpio.py b/qiling/hw/gpio/stm32f1xx_gpio.py index da7d0a79..5b30c6c8 100644 --- a/qiling/hw/gpio/stm32f1xx_gpio.py +++ b/qiling/hw/gpio/stm32f1xx_gpio.py @@ -40,3 +40,59 @@ class STM32F1xxGpio(QlPeripheral, GpioHooks): GpioHooks.__init__(self, ql, 16) self.gpio = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + if offset == self.struct.BSRR.offset: + return 0x00 + + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.gpio) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.IDR.offset: + return + + if offset == self.struct.BSRR.offset: + for i in range(32): + if ((value >> i) & 1) == 0: + continue + if i < 16: + self.set_pin(i) + else: + self.reset_pin(i - 16) + + return + + if offset == self.struct.ODR.offset: + for i in range(16): + new_bit = (value >> i) & 1 + old_bit = (self.gpio.ODR >> i) & 1 + + if new_bit != old_bit: + if new_bit: + self.set_pin(i) + else: + self.reset_pin(i) + + return + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.gpio) + offset, data, size) + + def set_pin(self, i): + self.ql.log.debug(f'[{self.label}] Set P{self.label[-1].upper()}{i}') + + self.gpio.ODR |= 1 << i + self.call_hook_set(i) + + def reset_pin(self, i): + self.ql.log.debug(f'[{self.label}] Reset P{self.label[-1].upper()}{i}') + + self.gpio.ODR &= ~(1 << i) + self.call_hook_reset(i) + + def pin(self, index): + return (self.gpio.ODR >> index) & 1 \ No newline at end of file diff --git a/qiling/hw/gpio/stm32f4xx_gpio.py b/qiling/hw/gpio/stm32f4xx_gpio.py index 89ad20de..de00d172 100644 --- a/qiling/hw/gpio/stm32f4xx_gpio.py +++ b/qiling/hw/gpio/stm32f4xx_gpio.py @@ -5,11 +5,12 @@ import ctypes +from qiling.hw.gpio.stm32f1xx_gpio import STM32F1xxGpio from qiling.hw.peripheral import QlPeripheral from qiling.hw.gpio.hooks import GpioHooks -class STM32F4xxGpio(QlPeripheral, GpioHooks): +class STM32F4xxGpio(STM32F1xxGpio): class Type(ctypes.Structure): """ the structure available in : stm32f413xx.h @@ -63,59 +64,3 @@ class STM32F4xxGpio(QlPeripheral, GpioHooks): OSPEEDR = ospeedr_reset, PUPDR = pupdr_reset, ) - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - if offset == self.struct.BSRR.offset: - return 0x00 - - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.gpio) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - if offset == self.struct.IDR.offset: - return - - if offset == self.struct.BSRR.offset: - for i in range(32): - if ((value >> i) & 1) == 0: - continue - if i < 16: - self.set_pin(i) - else: - self.reset_pin(i - 16) - - return - - if offset == self.struct.ODR.offset: - for i in range(16): - new_bit = (value >> i) & 1 - old_bit = (self.gpio.ODR >> i) & 1 - - if new_bit != old_bit: - if new_bit: - self.set_pin(i) - else: - self.reset_pin(i) - - return - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.gpio) + offset, data, size) - - def set_pin(self, i): - self.ql.log.debug(f'[{self.label}] Set P{self.label[-1].upper()}{i}') - - self.gpio.ODR |= 1 << i - self.call_hook_set(i) - - def reset_pin(self, i): - self.ql.log.debug(f'[{self.label}] Reset P{self.label[-1].upper()}{i}') - - self.gpio.ODR &= ~(1 << i) - self.call_hook_reset(i) - - def pin(self, index): - return (self.gpio.ODR >> index) & 1 From 204e0f99944ddfe609c1b2247af0a55dbef3a437 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 21:28:00 +0800 Subject: [PATCH 28/66] Connect afio with exti --- qiling/hw/gpio/stm32f1xx_afio.py | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/qiling/hw/gpio/stm32f1xx_afio.py b/qiling/hw/gpio/stm32f1xx_afio.py index dbdaeafc..c0305833 100644 --- a/qiling/hw/gpio/stm32f1xx_afio.py +++ b/qiling/hw/gpio/stm32f1xx_afio.py @@ -27,10 +27,31 @@ class STM32F1xxAfio(QlPeripheral): _fields_ = [ ("EVCR" , ctypes.c_uint32), ("MAPR" , ctypes.c_uint32), - ("EXTICR1" , ctypes.c_uint32), - ("EXTICR2" , ctypes.c_uint32), - ("EXTICR3" , ctypes.c_uint32), - ("EXTICR4" , ctypes.c_uint32), + ("EXTICR" , ctypes.c_uint32 * 4), ("RESERVED0", ctypes.c_uint32), ("MAPR2" , ctypes.c_uint32), ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.afio = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.afio) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.afio) + offset, data, size) + + def exti(self, index): + """ Get EXTI{index} mapping information """ + + port_index = self.afio.EXTICR[index // 4] >> ((index & 3) * 4) + port_name = 'gpio' + 'abcdefg'[port_index] + + return getattr(self.ql.hw, port_name, None) From 120da77b8cc2a3f1bb25d7e1f84914927ebdcc6c Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 21:28:18 +0800 Subject: [PATCH 29/66] Add exti soft interrupt support --- qiling/hw/intc/stm32f1xx_exti.py | 56 ++++++++++++++++++++++++++++++-- 1 file changed, 54 insertions(+), 2 deletions(-) diff --git a/qiling/hw/intc/stm32f1xx_exti.py b/qiling/hw/intc/stm32f1xx_exti.py index d6fc9851..cea43ad7 100644 --- a/qiling/hw/intc/stm32f1xx_exti.py +++ b/qiling/hw/intc/stm32f1xx_exti.py @@ -5,10 +5,10 @@ import ctypes -from qiling.hw.intc.stm32f4xx_exti import STM32F4xxExti +from qiling.hw.peripheral import QlPeripheral -class STM32F1xxExti(STM32F4xxExti): +class STM32F1xxExti(QlPeripheral): class Type(ctypes.Structure): """ the structure available in : stm32f100xb @@ -32,3 +32,55 @@ class STM32F1xxExti(STM32F4xxExti): ("SWIER", ctypes.c_uint32), ("PR" , ctypes.c_uint32), ] + + def __init__(self, ql, label, + exti0_intn = None, + exti1_intn = None, + exti2_intn = None, + exti3_intn = None, + exti4_intn = None, + exti9_5_intn = None, + exti15_10_intn = None, + ): + super().__init__(ql, label) + + self.exti = self.struct() + self.intn = [ + exti0_intn , exti1_intn , exti2_intn , exti3_intn, + exti4_intn , exti9_5_intn , exti9_5_intn , exti9_5_intn, + exti9_5_intn , exti9_5_intn , exti15_10_intn, exti15_10_intn, + exti15_10_intn, exti15_10_intn, exti15_10_intn, exti15_10_intn + ] + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.exti) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.SWIER.offset: + value = value & self.exti.IMR & 0x7ffff + for i in range(20): + if ((self.exti.SWIER >> i) & 1) == 0 and ((value >> i) & 1) == 1: + self.send_interrupt(i) + + elif offset == self.struct.PR.offset: + for i in range(20): + if (value >> i) & 1: + self.exti.PR &= ~(1 << i) + self.exti.SWIER &= ~(1 << i) + + return + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.exti) + offset, data, size) + + def send_interrupt(self, index): + if 0 <= index < 20 and (self.exti.IMR >> index) & 1: + self.exti.PR |= 1 << index + + if index < 16: + self.ql.hw.afio.exti(index).set_pin(index) + self.ql.hw.nvic.set_pending(self.intn[index]) From efb05a3da01f40a52529951938ec57ed95c60f8f Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 21:52:24 +0800 Subject: [PATCH 30/66] Add exti interrupt config --- qiling/extensions/mcu/stm32f1/stm32f103.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/qiling/extensions/mcu/stm32f1/stm32f103.py b/qiling/extensions/mcu/stm32f1/stm32f103.py index 911989a4..a7331ffe 100644 --- a/qiling/extensions/mcu/stm32f1/stm32f103.py +++ b/qiling/extensions/mcu/stm32f1/stm32f103.py @@ -184,7 +184,16 @@ stm32f103 = { "EXTI": { "type": "peripheral", "base": 0x40010400, - "struct": "STM32F1xxExti" + "struct": "STM32F1xxExti", + "kwargs": { + "exti0_intn": 6, + "exti1_intn": 7, + "exti2_intn": 8, + "exti3_intn": 9, + "exti4_intn": 10, + "exti9_5_intn": 23, + "exti15_10_intn": 40, + } }, "GPIOA": { "type": "peripheral", From 1c502ecdf472f83f5dc23e643607d1acbbffa970 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 22:15:03 +0800 Subject: [PATCH 31/66] Delete useless temporary variable --- qiling/hw/dma/stm32f4xx_dma.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/qiling/hw/dma/stm32f4xx_dma.py b/qiling/hw/dma/stm32f4xx_dma.py index 83825477..ab149978 100644 --- a/qiling/hw/dma/stm32f4xx_dma.py +++ b/qiling/hw/dma/stm32f4xx_dma.py @@ -123,8 +123,7 @@ class STM32F4xxDma(QlPeripheral): def read(self, offset: int, size: int) -> int: buf = ctypes.create_string_buffer(size) ctypes.memmove(buf, ctypes.addressof(self.dma) + offset, size) - retval = int.from_bytes(buf.raw, byteorder='little') - return retval + return int.from_bytes(buf.raw, byteorder='little') @QlPeripheral.monitor(width=15) def write(self, offset: int, size: int, value: int): From 8f349b529649e1a7f2ce6a0bc5ccee1bbceb0906 Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 22:27:44 +0800 Subject: [PATCH 32/66] Delete redundant function in DMA --- qiling/hw/dma/stm32f4xx_dma.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/qiling/hw/dma/stm32f4xx_dma.py b/qiling/hw/dma/stm32f4xx_dma.py index ab149978..fa22982d 100644 --- a/qiling/hw/dma/stm32f4xx_dma.py +++ b/qiling/hw/dma/stm32f4xx_dma.py @@ -116,9 +116,6 @@ class STM32F4xxDma(QlPeripheral): stream7_intn, ] - def stream_index(self, offset): - return (offset - self.struct.stream.offset) // ctypes.sizeof(Stream) - @QlPeripheral.monitor(width=15) def read(self, offset: int, size: int) -> int: buf = ctypes.create_string_buffer(size) @@ -134,8 +131,6 @@ class STM32F4xxDma(QlPeripheral): self.dma.HISR &= ~value elif offset > self.struct.HIFCR.offset: - stream_id = self.stream_index(offset) - data = (value).to_bytes(size, byteorder='little') ctypes.memmove(ctypes.addressof(self.dma) + offset, data, size) From 22339191f34e65691f199efadb68c1bc106f034d Mon Sep 17 00:00:00 2001 From: dataisland Date: Sun, 6 Feb 2022 23:57:38 +0800 Subject: [PATCH 33/66] Add stm32f1xx dma --- qiling/hw/const/stm32f1xx_dma.py | 97 +++++++++++++++++ qiling/hw/dma/__init__.py | 1 + qiling/hw/dma/stm32f1xx_dma.py | 172 +++++++++++++++++++++++++++++++ 3 files changed, 270 insertions(+) create mode 100644 qiling/hw/const/stm32f1xx_dma.py create mode 100644 qiling/hw/dma/stm32f1xx_dma.py diff --git a/qiling/hw/const/stm32f1xx_dma.py b/qiling/hw/const/stm32f1xx_dma.py new file mode 100644 index 00000000..a848428e --- /dev/null +++ b/qiling/hw/const/stm32f1xx_dma.py @@ -0,0 +1,97 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class DMA_ISR(IntEnum): + GIF1 = 1 << 0 + TCIF1 = 1 << 1 + HTIF1 = 1 << 2 + TEIF1 = 1 << 3 + GIF2 = 1 << 4 + TCIF2 = 1 << 5 + HTIF2 = 1 << 6 + TEIF2 = 1 << 7 + GIF3 = 1 << 8 + TCIF3 = 1 << 9 + HTIF3 = 1 << 10 + TEIF3 = 1 << 11 + GIF4 = 1 << 12 + TCIF4 = 1 << 13 + HTIF4 = 1 << 14 + TEIF4 = 1 << 15 + GIF5 = 1 << 16 + TCIF5 = 1 << 17 + HTIF5 = 1 << 18 + TEIF5 = 1 << 19 + GIF6 = 1 << 20 + TCIF6 = 1 << 21 + HTIF6 = 1 << 22 + TEIF6 = 1 << 23 + GIF7 = 1 << 24 + TCIF7 = 1 << 25 + HTIF7 = 1 << 26 + TEIF7 = 1 << 27 + +class DMA_IFCR(IntEnum): + CGIF1 = 1 << 0 + CTCIF1 = 1 << 1 + CHTIF1 = 1 << 2 + CTEIF1 = 1 << 3 + CGIF2 = 1 << 4 + CTCIF2 = 1 << 5 + CHTIF2 = 1 << 6 + CTEIF2 = 1 << 7 + CGIF3 = 1 << 8 + CTCIF3 = 1 << 9 + CHTIF3 = 1 << 10 + CTEIF3 = 1 << 11 + CGIF4 = 1 << 12 + CTCIF4 = 1 << 13 + CHTIF4 = 1 << 14 + CTEIF4 = 1 << 15 + CGIF5 = 1 << 16 + CTCIF5 = 1 << 17 + CHTIF5 = 1 << 18 + CTEIF5 = 1 << 19 + CGIF6 = 1 << 20 + CTCIF6 = 1 << 21 + CHTIF6 = 1 << 22 + CTEIF6 = 1 << 23 + CGIF7 = 1 << 24 + CTCIF7 = 1 << 25 + CHTIF7 = 1 << 26 + CTEIF7 = 1 << 27 + +class DMA_CR(IntEnum): + EN = 1 << 0 + TCIE = 1 << 1 + HTIE = 1 << 2 + TEIE = 1 << 3 + DIR = 1 << 4 + CIRC = 1 << 5 + PINC = 1 << 6 + MINC = 1 << 7 + PSIZE_0 = 1 << 8 + PSIZE_1 = 2 << 8 + PSIZE = 0x3 << 8 + MSIZE_0 = 1 << 10 + MSIZE_1 = 2 << 10 + MSIZE = 0x3 << 10 + PL = 0x3 << 12 + MEM2MEM = 1 << 14 + +class DMA(IntEnum): + PERIPH_TO_MEMORY = 0 + MEMORY_TO_PERIPH = DMA_CR.DIR + + PDATAALIGN_BYTE = 0 + PDATAALIGN_HALFWORD = DMA_CR.PSIZE_0 + PDATAALIGN_WORD = DMA_CR.PSIZE_1 + + MDATAALIGN_BYTE = 0 + MDATAALIGN_HALFWORD = DMA_CR.MSIZE_0 + MDATAALIGN_WORD = DMA_CR.MSIZE_1 diff --git a/qiling/hw/dma/__init__.py b/qiling/hw/dma/__init__.py index 1f4f5c50..8767eeca 100644 --- a/qiling/hw/dma/__init__.py +++ b/qiling/hw/dma/__init__.py @@ -3,5 +3,6 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .stm32f1xx_dma import STM32F1xxDma from .stm32f4xx_dma import STM32F4xxDma from .gd32vf1xx_dma import GD32VF1xxDma \ No newline at end of file diff --git a/qiling/hw/dma/stm32f1xx_dma.py b/qiling/hw/dma/stm32f1xx_dma.py new file mode 100644 index 00000000..49e2a02e --- /dev/null +++ b/qiling/hw/dma/stm32f1xx_dma.py @@ -0,0 +1,172 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.const.stm32f1xx_dma import DMA_CR, DMA + + +class Stream(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), + ("NDTR", ctypes.c_uint32), + ("PAR" , ctypes.c_uint32), + ("MAR" , ctypes.c_uint32), + ("RESEVERED" , ctypes.c_uint32), + ] + + def enable(self): + return self.CR & DMA_CR.EN + + def transfer_direction(self): + return self.CR & DMA_CR.DIR + + def transfer_peripheral_size(self): + PSIZE = self.CR & DMA_CR.PSIZE + if PSIZE == DMA.PDATAALIGN_BYTE: + return 1 + if PSIZE == DMA.PDATAALIGN_HALFWORD: + return 2 + if PSIZE == DMA.PDATAALIGN_WORD: + return 4 + + def transfer_memory_size(self): + MSIZE = self.CR & DMA_CR.MSIZE + if MSIZE == DMA.MDATAALIGN_BYTE: + return 1 + if MSIZE == DMA.MDATAALIGN_HALFWORD: + return 2 + if MSIZE == DMA.MDATAALIGN_WORD: + return 4 + + def step(self, mem): + if self.NDTR == 0: + return + + dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH + + psize = self.transfer_peripheral_size() + msize = self.transfer_memory_size() + + src, dst = (self.MAR, self.PAR) if dir_flag else (self.PAR, self.MAR) + src_size, dst_size = (msize, psize) if dir_flag else (psize, msize) + + data = bytes(mem.read(src, src_size)).ljust(dst_size)[:dst_size] + mem.write(dst, data) + + self.NDTR -= 1 + if self.CR & DMA_CR.MINC: + self.MAR += msize + if self.CR & DMA_CR.PINC: + self.PAR += psize + + if self.NDTR == 0: + self.CR &= ~DMA_CR.EN + return True + + +class STM32F1xxDma(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("ISR" , ctypes.c_uint32), + ("IFCR", ctypes.c_uint32), + ("stream", Stream * 8), + ] + + def __init__(self, ql, label, + stream0_intn=None, + stream1_intn=None, + stream2_intn=None, + stream3_intn=None, + stream4_intn=None, + stream5_intn=None, + stream6_intn=None, + stream7_intn=None, + ): + super().__init__(ql, label) + + self.dma = self.struct() + + self.intn = [ + stream0_intn, + stream1_intn, + stream2_intn, + stream3_intn, + stream4_intn, + stream5_intn, + stream6_intn, + stream7_intn, + ] + + def find_field(self, offset: int, size: int) -> str: + field_list = [] + if offset < self.struct.stream.offset: + field_list.append(super().find_field(offset, min(size, self.struct.stream.offset - offset))) + + if offset >= self.struct.stream.offset: + for i in range(8): + prefix_offset = self.struct.stream.offset + ctypes.sizeof(Stream) * i + + for name, _ in Stream._fields_: + field = getattr(Stream, name) + field_offset = field.offset + prefix_offset + + lbound = max(0, offset - field_offset) + ubound = min(offset + size - field_offset, field.size) + if lbound < ubound: + if lbound == 0 and ubound == field.size: + field_list.append(f'stream[{i}].{name}') + else: + field_list.append(f'stream[{i}].{name}[{lbound}:{ubound}]') + + return ','.join(field_list) + + @QlPeripheral.monitor(width=15) + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.dma) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor(width=15) + def write(self, offset: int, size: int, value: int): + if offset == self.struct.ISR.offset: + return + + elif offset == self.struct.IFCR.offset: + self.dma.ISR &= ~value + + else: + data = (value).to_bytes(size, byteorder='little') + ctypes.memmove(ctypes.addressof(self.dma) + offset, data, size) + + def transfer_complete(self, id): + tc_bits = [1, 5, 9, 13, 17, 21, 25] + self.dma.ISR |= 1 << tc_bits[id] + + if self.intn[id] is not None: + self.ql.hw.nvic.set_pending(self.intn[id]) + + def step(self): + for id, stream in enumerate(self.dma.stream): + if not stream.enable(): + continue + + if stream.step(self.ql.mem): + self.transfer_complete(id) From 2a582f75ed3fa521e88afcb32ff479595e31ce27 Mon Sep 17 00:00:00 2001 From: dataisland Date: Mon, 7 Feb 2022 00:00:41 +0800 Subject: [PATCH 34/66] Fix stm32f4 DMA copy bug --- qiling/hw/const/stm32f4xx_dma.py | 16 ++++++++++------ qiling/hw/dma/stm32f4xx_dma.py | 29 +++++++++++++++++++++-------- 2 files changed, 31 insertions(+), 14 deletions(-) diff --git a/qiling/hw/const/stm32f4xx_dma.py b/qiling/hw/const/stm32f4xx_dma.py index 0a86062d..e4852701 100644 --- a/qiling/hw/const/stm32f4xx_dma.py +++ b/qiling/hw/const/stm32f4xx_dma.py @@ -146,10 +146,14 @@ class DMA_SxM1AR(IntEnum): M1A = 0xffffffff << 0 class DMA(IntEnum): - PERIPH_TO_MEMORY = 0 - MEMORY_TO_PERIPH = DMA_SxCR.DIR_0 - MEMORY_TO_MEMORY = DMA_SxCR.DIR_1 + PERIPH_TO_MEMORY = 0 + MEMORY_TO_PERIPH = DMA_SxCR.DIR_0 + MEMORY_TO_MEMORY = DMA_SxCR.DIR_1 - PDATAALIGN_BYTE = 0 - PDATAALIGN_HALFWORD = DMA_SxCR.MSIZE_0 - PDATAALIGN_WORD = DMA_SxCR.MSIZE_1 \ No newline at end of file + PDATAALIGN_BYTE = 0 + PDATAALIGN_HALFWORD = DMA_SxCR.PSIZE_0 + PDATAALIGN_WORD = DMA_SxCR.PSIZE_1 + + MDATAALIGN_BYTE = 0 + MDATAALIGN_HALFWORD = DMA_SxCR.MSIZE_0 + MDATAALIGN_WORD = DMA_SxCR.MSIZE_1 diff --git a/qiling/hw/dma/stm32f4xx_dma.py b/qiling/hw/dma/stm32f4xx_dma.py index fa22982d..93a95c16 100644 --- a/qiling/hw/dma/stm32f4xx_dma.py +++ b/qiling/hw/dma/stm32f4xx_dma.py @@ -23,7 +23,7 @@ class Stream(ctypes.Structure): def transfer_direction(self): return self.CR & DMA_SxCR.DIR - def transfer_size(self): + def transfer_peripheral_size(self): PSIZE = self.CR & DMA_SxCR.PSIZE if PSIZE == DMA.PDATAALIGN_BYTE: return 1 @@ -32,22 +32,35 @@ class Stream(ctypes.Structure): if PSIZE == DMA.PDATAALIGN_WORD: return 4 + def transfer_memory_size(self): + MSIZE = self.CR & DMA_SxCR.MSIZE + if MSIZE == DMA.MDATAALIGN_BYTE: + return 1 + if MSIZE == DMA.MDATAALIGN_HALFWORD: + return 2 + if MSIZE == DMA.MDATAALIGN_WORD: + return 4 + def step(self, mem): if self.NDTR == 0: return - dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH - - size = self.transfer_size() - src, dst = (self.M0AR, self.PAR) if dir_flag else (self.PAR, self.M0AR) + dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH - mem.write(dst, bytes(mem.read(src, size))) + psize = self.transfer_peripheral_size() + msize = self.transfer_memory_size() + src, dst = (self.M0AR, self.PAR) if dir_flag else (self.PAR, self.M0AR) + src_size, dst_size = (msize, psize) if dir_flag else (psize, msize) + + data = bytes(mem.read(src, src_size)).ljust(dst_size)[:dst_size] + mem.write(dst, data) + self.NDTR -= 1 if self.CR & DMA_SxCR.MINC: - self.M0AR += size + self.M0AR += msize if self.CR & DMA_SxCR.PINC: - self.PAR += size + self.PAR += psize if self.NDTR == 0: self.CR &= ~DMA_SxCR.EN From 89b1a7fa2098a62ace3f5455c52824189d37202e Mon Sep 17 00:00:00 2001 From: dataisland Date: Mon, 7 Feb 2022 00:04:34 +0800 Subject: [PATCH 35/66] Add stm32f103 testcase --- examples/rootfs | 2 +- tests/test_mcu.py | 29 +++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/examples/rootfs b/examples/rootfs index a489ff51..2c1aa456 160000 --- a/examples/rootfs +++ b/examples/rootfs @@ -1 +1 @@ -Subproject commit a489ff519f570539249c34c7d1bd5abb3ec74488 +Subproject commit 2c1aa456c249e8fdeb5383233a7e45e0b791cb56 diff --git a/tests/test_mcu.py b/tests/test_mcu.py index bc4fafb6..01cb5f0f 100644 --- a/tests/test_mcu.py +++ b/tests/test_mcu.py @@ -10,6 +10,7 @@ sys.path.append("..") from qiling.core import Qiling from qiling.const import QL_VERBOSE from qiling.extensions.mcu.stm32f4 import stm32f407, stm32f411 +from qiling.extensions.mcu.stm32f1 import stm32f103 from qiling.extensions.mcu.gd32vf1 import gd32vf103 class MCUTest(unittest.TestCase): @@ -347,6 +348,34 @@ class MCUTest(unittest.TestCase): del ql + def test_mcu_usart_stm32f103(self): + ql = Qiling(["../examples/rootfs/mcu/stm32f103/sctf2020-password-lock-plus.hex"], + archtype="cortex_m", env=stm32f103, verbose=QL_VERBOSE.DEFAULT) + + ql.hw.create('rcc') + ql.hw.create('flash interface') + ql.hw.create('exti') + ql.hw.create('usart1') + ql.hw.create('gpioa') + ql.hw.create('afio') + ql.hw.create('dma1').watch() + + data = [] + def gpio_set_cb(pin): + data.append(pin) + + ql.hw.gpioa.hook_set(1, gpio_set_cb, '1') + ql.hw.gpioa.hook_set(2, gpio_set_cb, '2') + ql.hw.gpioa.hook_set(3, gpio_set_cb, '3') + ql.hw.gpioa.hook_set(4, gpio_set_cb, '4') + + ql.run(count=400000) + + self.assertTrue((''.join(data)).find('1442413') != -1) + self.assertTrue(ql.hw.usart1.recv()[:23] == b'SCTF{that1s___r1ghtflag') + + del ql + if __name__ == "__main__": unittest.main() From 59500cc519a825547078f1bc74a3a149ec2f54d7 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 00:24:22 +0800 Subject: [PATCH 36/66] Add sam3x8e memory layout --- qiling/extensions/mcu/atmel/__init__.py | 6 +++ qiling/extensions/mcu/atmel/sam3x8e.py | 65 +++++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 qiling/extensions/mcu/atmel/__init__.py create mode 100644 qiling/extensions/mcu/atmel/sam3x8e.py diff --git a/qiling/extensions/mcu/atmel/__init__.py b/qiling/extensions/mcu/atmel/__init__.py new file mode 100644 index 00000000..245839d1 --- /dev/null +++ b/qiling/extensions/mcu/atmel/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .sam3x8e import sam3x8e diff --git a/qiling/extensions/mcu/atmel/sam3x8e.py b/qiling/extensions/mcu/atmel/sam3x8e.py new file mode 100644 index 00000000..7fbafadc --- /dev/null +++ b/qiling/extensions/mcu/atmel/sam3x8e.py @@ -0,0 +1,65 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +sam3x8e = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x200000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000 , + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM3SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM3Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM3Scb", + "type": "core" + }, + "FLASH": { + "base": 0x80000, + "size": 0x80000, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x10000, + "type": "memory" + }, + "RAM": { + "base": 0x20070000, + "size": 0x18000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "CODE": { + "base": 0x80000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" + } +} \ No newline at end of file From 1984a09f20e043ed0d6cf0ed4a01ee5b949689d8 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:04:01 +0800 Subject: [PATCH 37/66] Add sam3x8e peripheral config --- qiling/extensions/mcu/atmel/sam3x8e.py | 345 +++++++++++++++++++++++++ 1 file changed, 345 insertions(+) diff --git a/qiling/extensions/mcu/atmel/sam3x8e.py b/qiling/extensions/mcu/atmel/sam3x8e.py index 7fbafadc..a65a14ee 100644 --- a/qiling/extensions/mcu/atmel/sam3x8e.py +++ b/qiling/extensions/mcu/atmel/sam3x8e.py @@ -55,6 +55,351 @@ sam3x8e = { "base": 0xe0000000, "size": 0x100000, "type": "mmio" + }, + "HSMCI": { + "base": 0x40000000, + "struct": "SAM3xaHsmci", + "type": "peripheral", + "kwargs": { + "intn": 0x15 + } + }, + "SSC": { + "base": 0x40004000, + "struct": "SAM3xaSsc", + "type": "peripheral", + "kwargs": { + "intn": 0x1a + } + }, + "SPI0": { + "base": 0x40008000, + "struct": "SAM3xaSpi", + "type": "peripheral", + "kwargs": { + "intn": 0x18 + } + }, + "TC0": { + "base": 0x40080000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1b + } + }, + "TC1": { + "base": 0x40084000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1c + } + }, + "TC2": { + "base": 0x40088000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1d + } + }, + "TWI0": { + "base": 0x4008c000, + "struct": "SAM3xaTwi", + "type": "peripheral", + "kwargs": { + "intn": 0x16 + } + }, + "PDC_TWI0": { + "base": 0x4008c100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "TWI1": { + "base": 0x40090000, + "struct": "SAM3xaTwi", + "type": "peripheral", + "kwargs": { + "intn": 0x17 + } + }, + "PDC_TWI1": { + "base": 0x40090100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "PWM": { + "base": 0x40094000, + "struct": "SAM3xaPwm", + "type": "peripheral", + "kwargs": { + "intn": 0x24 + } + }, + "PDC_PWM": { + "base": 0x40094100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART0": { + "base": 0x40098000, + "struct": "SAM3xasart", + "type": "peripheral", + "kwargs": { + "intn": 0x11 + } + }, + "PDC_USART0": { + "base": 0x40098100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART1": { + "base": 0x4009c000, + "struct": "SAM3xasart", + "type": "peripheral", + "kwargs": { + "intn": 0x12 + } + }, + "PDC_USART1": { + "base": 0x4009c100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART2": { + "base": 0x400a0000, + "struct": "SAM3xasart", + "type": "peripheral", + "kwargs": { + "intn": 0x13 + } + }, + "PDC_USART2": { + "base": 0x400a0100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART3": { + "base": 0x400a4000, + "struct": "SAM3xasart", + "type": "peripheral", + "kwargs": { + "intn": 0x14 + } + }, + "PDC_USART3": { + "base": 0x400a4100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "UOTGHS": { + "base": 0x400ac000, + "struct": "SAM3xaotghs", + "type": "peripheral", + "kwargs": { + "intn": 0x28 + } + }, + "EMAC": { + "base": 0x400b0000, + "struct": "SAM3xaEmac", + "type": "peripheral", + "kwargs": { + "intn": 0x2a + } + }, + "CAN0": { + "base": 0x400b4000, + "struct": "SAM3xaCan", + "type": "peripheral", + "kwargs": { + "intn": 0x2b + } + }, + "CAN1": { + "base": 0x400b8000, + "struct": "SAM3xaCan", + "type": "peripheral", + "kwargs": { + "intn": 0x2c + } + }, + "TRNG": { + "base": 0x400bc000, + "struct": "SAM3xaTrng", + "type": "peripheral", + "kwargs": { + "intn": 0x29 + } + }, + "ADC": { + "base": 0x400c0000, + "struct": "SAM3xaAdc", + "type": "peripheral", + "kwargs": { + "intn": 0x25 + } + }, + "PDC_ADC": { + "base": 0x400c0100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "DMAC": { + "base": 0x400c4000, + "struct": "SAM3xaDmac", + "type": "peripheral", + "kwargs": { + "intn": 0x27 + } + }, + "DACC": { + "base": 0x400c8000, + "struct": "SAM3xaDacc", + "type": "peripheral", + "kwargs": { + "intn": 0x26 + } + }, + "PDC_DACC": { + "base": 0x400c8100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "SMC": { + "base": 0x400e0000, + "struct": "SAM3xaSmc", + "type": "peripheral", + "kwargs": { + "intn": 0x9 + } + }, + "MATRIX": { + "base": 0x400e0400, + "struct": "SAM3xaMatrix", + "type": "peripheral" + }, + "PMC": { + "base": 0x400e0600, + "struct": "SAM3xaPmc", + "type": "peripheral", + "kwargs": { + "intn": 0x5 + } + }, + "UART": { + "base": 0x400e0800, + "struct": "SAM3xaart", + "type": "peripheral", + "kwargs": { + "intn": 0x8 + } + }, + "PDC_UART": { + "base": 0x400e0900, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "CHIPID": { + "base": 0x400e0940, + "struct": "SAM3xaChipid", + "type": "peripheral" + }, + "EFC0": { + "base": 0x400e0a00, + "struct": "SAM3xaEfc", + "type": "peripheral", + "kwargs": { + "intn": 0x6 + } + }, + "EFC1": { + "base": 0x400e0c00, + "struct": "SAM3xaEfc", + "type": "peripheral", + "kwargs": { + "intn": 0x7 + } + }, + "PIOA": { + "base": 0x400e0e00, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xb + } + }, + "PIOB": { + "base": 0x400e1000, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xc + } + }, + "PIOC": { + "base": 0x400e1200, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xd + } + }, + "PIOD": { + "base": 0x400e1400, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xe + } + }, + "RSTC": { + "base": 0x400e1a00, + "struct": "SAM3xaRstc", + "type": "peripheral", + "kwargs": { + "intn": 0x1 + } + }, + "SUPC": { + "base": 0x400e1a10, + "struct": "SAM3xaSupc", + "type": "peripheral", + "kwargs": { + "intn": 0x0 + } + }, + "RTT": { + "base": 0x400e1a30, + "struct": "SAM3xaRtt", + "type": "peripheral", + "kwargs": { + "intn": 0x3 + } + }, + "WDT": { + "base": 0x400e1a50, + "struct": "SAM3xaWdt", + "type": "peripheral", + "kwargs": { + "intn": 0x4 + } + }, + "RTC": { + "base": 0x400e1a60, + "struct": "SAM3xaRtc", + "type": "peripheral", + "kwargs": { + "intn": 0x2 + } + }, + "GPBR": { + "base": 0x400e1a90, + "struct": "SAM3xaGpbr", + "type": "peripheral" }, "CODE": { "base": 0x80000, From f79bf17ef8e1e4c9f676e9703641d028fb1a15aa Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:11:30 +0800 Subject: [PATCH 38/66] Fix sam3x8e peripheral name typo --- qiling/extensions/mcu/atmel/sam3x8e.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/qiling/extensions/mcu/atmel/sam3x8e.py b/qiling/extensions/mcu/atmel/sam3x8e.py index a65a14ee..1be34c01 100644 --- a/qiling/extensions/mcu/atmel/sam3x8e.py +++ b/qiling/extensions/mcu/atmel/sam3x8e.py @@ -56,7 +56,7 @@ sam3x8e = { "size": 0x100000, "type": "mmio" }, - "HSMCI": { + "HSMCI": { "base": 0x40000000, "struct": "SAM3xaHsmci", "type": "peripheral", @@ -145,7 +145,7 @@ sam3x8e = { }, "USART0": { "base": 0x40098000, - "struct": "SAM3xasart", + "struct": "SAM3xaUsart", "type": "peripheral", "kwargs": { "intn": 0x11 @@ -158,7 +158,7 @@ sam3x8e = { }, "USART1": { "base": 0x4009c000, - "struct": "SAM3xasart", + "struct": "SAM3xaUsart", "type": "peripheral", "kwargs": { "intn": 0x12 @@ -171,7 +171,7 @@ sam3x8e = { }, "USART2": { "base": 0x400a0000, - "struct": "SAM3xasart", + "struct": "SAM3xaUsart", "type": "peripheral", "kwargs": { "intn": 0x13 @@ -184,7 +184,7 @@ sam3x8e = { }, "USART3": { "base": 0x400a4000, - "struct": "SAM3xasart", + "struct": "SAM3xaUsart", "type": "peripheral", "kwargs": { "intn": 0x14 @@ -197,7 +197,7 @@ sam3x8e = { }, "UOTGHS": { "base": 0x400ac000, - "struct": "SAM3xaotghs", + "struct": "SAM3xaUotghs", "type": "peripheral", "kwargs": { "intn": 0x28 @@ -292,7 +292,7 @@ sam3x8e = { }, "UART": { "base": 0x400e0800, - "struct": "SAM3xaart", + "struct": "SAM3xaUart", "type": "peripheral", "kwargs": { "intn": 0x8 From 25923f462156c4038473c3b47ca320358e6fe8c3 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:42:54 +0800 Subject: [PATCH 39/66] Add sam3xa PMC --- qiling/hw/power/__init__.py | 3 +- qiling/hw/power/sam3xa_pmc.py | 65 +++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 qiling/hw/power/sam3xa_pmc.py diff --git a/qiling/hw/power/__init__.py b/qiling/hw/power/__init__.py index bfe04cda..b16158d8 100644 --- a/qiling/hw/power/__init__.py +++ b/qiling/hw/power/__init__.py @@ -3,4 +3,5 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -from .stm32f4xx_pwr import STM32F4xxPwr \ No newline at end of file +from .stm32f4xx_pwr import STM32F4xxPwr +from .sam3xa_pmc import SAM3xaPmc diff --git a/qiling/hw/power/sam3xa_pmc.py b/qiling/hw/power/sam3xa_pmc.py new file mode 100644 index 00000000..d9fe67ba --- /dev/null +++ b/qiling/hw/power/sam3xa_pmc.py @@ -0,0 +1,65 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.core import Qiling +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaPmc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("SCER" , ctypes.c_uint32), # (Pmc Offset: 0x0000) System Clock Enable Register + ("SCDR" , ctypes.c_uint32), # (Pmc Offset: 0x0004) System Clock Disable Register + ("SCSR" , ctypes.c_uint32), # (Pmc Offset: 0x0008) System Clock Status Register + ("Reserved1" , ctypes.c_uint32), # + ("PCER0" , ctypes.c_uint32), # (Pmc Offset: 0x0010) Peripheral Clock Enable Register 0 + ("PCDR0" , ctypes.c_uint32), # (Pmc Offset: 0x0014) Peripheral Clock Disable Register 0 + ("PCSR0" , ctypes.c_uint32), # (Pmc Offset: 0x0018) Peripheral Clock Status Register 0 + ("CKGR_UCKR" , ctypes.c_uint32), # (Pmc Offset: 0x001C) UTMI Clock Register + ("CKGR_MOR" , ctypes.c_uint32), # (Pmc Offset: 0x0020) Main Oscillator Register + ("CKGR_MCFR" , ctypes.c_uint32), # (Pmc Offset: 0x0024) Main Clock Frequency Register + ("CKGR_PLLAR", ctypes.c_uint32), # (Pmc Offset: 0x0028) PLLA Register + ("Reserved2" , ctypes.c_uint32), # + ("MCKR" , ctypes.c_uint32), # (Pmc Offset: 0x0030) Master Clock Register + ("Reserved3" , ctypes.c_uint32), # + ("USB" , ctypes.c_uint32), # (Pmc Offset: 0x0038) USB Clock Register + ("Reserved4" , ctypes.c_uint32), # + ("PCK" , ctypes.c_uint32 * 3), # (Pmc Offset: 0x0040) Programmable Clock 0 Register + ("Reserved5" , ctypes.c_uint32 * 5), # + ("IER" , ctypes.c_uint32), # (Pmc Offset: 0x0060) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Pmc Offset: 0x0064) Interrupt Disable Register + ("SR" , ctypes.c_uint32), # (Pmc Offset: 0x0068) Status Register + ("IMR" , ctypes.c_uint32), # (Pmc Offset: 0x006C) Interrupt Mask Register + ("FSMR" , ctypes.c_uint32), # (Pmc Offset: 0x0070) Fast Startup Mode Register + ("FSPR" , ctypes.c_uint32), # (Pmc Offset: 0x0074) Fast Startup Polarity Register + ("FOCR" , ctypes.c_uint32), # (Pmc Offset: 0x0078) Fault Output Clear Register + ("Reserved6" , ctypes.c_uint32 * 26), # + ("WPMR" , ctypes.c_uint32), # (Pmc Offset: 0x00E4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Pmc Offset: 0x00E8) Write Protect Status Register + ("Reserved7" , ctypes.c_uint32 * 5), # + ("PCER1" , ctypes.c_uint32), # (Pmc Offset: 0x0100) Peripheral Clock Enable Register 1 + ("PCDR1" , ctypes.c_uint32), # (Pmc Offset: 0x0104) Peripheral Clock Disable Register 1 + ("PCSR1" , ctypes.c_uint32), # (Pmc Offset: 0x0108) Peripheral Clock Status Register 1 + ("PCR" , ctypes.c_uint32), # (Pmc Offset: 0x010C) Peripheral Control Register + ] + + def __init__(self, ql: Qiling, label: str, intn = None): + super().__init__(ql, label) + + self.pmc = self.struct() + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.pmc) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.pmc) + offset, data, size) \ No newline at end of file From bb656f803305ac7bde863f8f1a7f91312e00aee5 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:47:21 +0800 Subject: [PATCH 40/66] Add description for PMC --- qiling/hw/power/sam3xa_pmc.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/qiling/hw/power/sam3xa_pmc.py b/qiling/hw/power/sam3xa_pmc.py index d9fe67ba..0584e586 100644 --- a/qiling/hw/power/sam3xa_pmc.py +++ b/qiling/hw/power/sam3xa_pmc.py @@ -10,6 +10,18 @@ from qiling.hw.peripheral import QlPeripheral class SAM3xaPmc(QlPeripheral): + """ + The Power Management Controller (PMC) optimizes power consumption by controlling all system and user + peripheral clocks. The PMC enables/disables the clock inputs to many of the peripherals and the Cortex-M3 + Processor. + + The Supply Controller selects between the 32 kHz RC oscillator or the crystal oscillator. The unused oscillator is + disabled automatically so that power consumption is optimized. + + By default, at startup the chip runs out of the Master Clock using the Fast RC oscillator running at 4 MHz. + The user can trim the 8 and 12 MHz RC Oscillator frequencies by software. + """ + class Type(ctypes.Structure): _fields_ = [ ("SCER" , ctypes.c_uint32), # (Pmc Offset: 0x0000) System Clock Enable Register From 9f7888598095168b8dee3e8e19261bd6f7834730 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:47:38 +0800 Subject: [PATCH 41/66] Add sam3xa Power Management Controller --- qiling/hw/timer/__init__.py | 1 + qiling/hw/timer/sam3xa_wdt.py | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 qiling/hw/timer/sam3xa_wdt.py diff --git a/qiling/hw/timer/__init__.py b/qiling/hw/timer/__init__.py index 3f37f727..cbd21e55 100644 --- a/qiling/hw/timer/__init__.py +++ b/qiling/hw/timer/__init__.py @@ -9,3 +9,4 @@ from .stm32f4xx_rtc import STM32F4xxRtc from .stm32f4xx_tim import STM32F4xxTim from .gd32vf1xx_rtc import GD32VF1xxRtc from .gd32vf1xx_timer import GD32VF1xxTimer +from .sam3xa_wdt import SAM3xaWdt diff --git a/qiling/hw/timer/sam3xa_wdt.py b/qiling/hw/timer/sam3xa_wdt.py new file mode 100644 index 00000000..0ffe0fd1 --- /dev/null +++ b/qiling/hw/timer/sam3xa_wdt.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaWdt(QlPeripheral): + """ + The Watchdog Timer can be used to prevent system lock-up if the software becomes trapped in a deadlock. It + features a 12-bit down counter that allows a watchdog period of up to 16 seconds (slow clock at 32.768 kHz). It + can generate a general reset or a processor reset only. In addition, it can be stopped while the processor is in + debug mode or idle mode. + """ + + class Type(ctypes.Structure): + _fields_ = [ + ("CR", ctypes.c_uint32), # (Wdt Offset: 0x00) Control Register + ("MR", ctypes.c_uint32), # (Wdt Offset: 0x04) Mode Register + ("SR", ctypes.c_uint32), # (Wdt Offset: 0x08) Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.wdt = self.struct() + self.intn = intn From 131da6180ffe9c0d5cb9a1e5f75e8f44cf3c837b Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:50:24 +0800 Subject: [PATCH 42/66] Add hw flash type --- qiling/hw/flash/__init__.py | 7 +++++++ qiling/hw/{misc => flash}/stm32f1xx_flash.py | 0 qiling/hw/{misc => flash}/stm32f4xx_flash.py | 0 3 files changed, 7 insertions(+) create mode 100644 qiling/hw/flash/__init__.py rename qiling/hw/{misc => flash}/stm32f1xx_flash.py (100%) rename qiling/hw/{misc => flash}/stm32f4xx_flash.py (100%) diff --git a/qiling/hw/flash/__init__.py b/qiling/hw/flash/__init__.py new file mode 100644 index 00000000..06eac8d5 --- /dev/null +++ b/qiling/hw/flash/__init__.py @@ -0,0 +1,7 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .stm32f1xx_flash import STM32F1xxFlash +from .stm32f4xx_flash import STM32F4xxFlash diff --git a/qiling/hw/misc/stm32f1xx_flash.py b/qiling/hw/flash/stm32f1xx_flash.py similarity index 100% rename from qiling/hw/misc/stm32f1xx_flash.py rename to qiling/hw/flash/stm32f1xx_flash.py diff --git a/qiling/hw/misc/stm32f4xx_flash.py b/qiling/hw/flash/stm32f4xx_flash.py similarity index 100% rename from qiling/hw/misc/stm32f4xx_flash.py rename to qiling/hw/flash/stm32f4xx_flash.py From 4760caa4a3bf4f2063a328275f6a5c67e389eae1 Mon Sep 17 00:00:00 2001 From: dataisland Date: Tue, 8 Feb 2022 01:53:40 +0800 Subject: [PATCH 43/66] Add sam3xa efc --- qiling/hw/__init__.py | 1 + qiling/hw/flash/__init__.py | 1 + qiling/hw/flash/sam3xa_efc.py | 24 ++++++++++++++++++++++++ qiling/hw/misc/__init__.py | 2 -- 4 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 qiling/hw/flash/sam3xa_efc.py diff --git a/qiling/hw/__init__.py b/qiling/hw/__init__.py index 0ab9cef3..324e3ccb 100644 --- a/qiling/hw/__init__.py +++ b/qiling/hw/__init__.py @@ -5,6 +5,7 @@ from .char import * from .dma import * +from .flash import * from .gpio import * from .i2c import * from .intc import * diff --git a/qiling/hw/flash/__init__.py b/qiling/hw/flash/__init__.py index 06eac8d5..ac107f06 100644 --- a/qiling/hw/flash/__init__.py +++ b/qiling/hw/flash/__init__.py @@ -5,3 +5,4 @@ from .stm32f1xx_flash import STM32F1xxFlash from .stm32f4xx_flash import STM32F4xxFlash +from .sam3xa_efc import SAM3xaEfc \ No newline at end of file diff --git a/qiling/hw/flash/sam3xa_efc.py b/qiling/hw/flash/sam3xa_efc.py new file mode 100644 index 00000000..0a6c6c07 --- /dev/null +++ b/qiling/hw/flash/sam3xa_efc.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaEfc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("FMR", ctypes.c_uint32), # (Efc Offset: 0x00) EEFC Flash Mode Register + ("FCR", ctypes.c_uint32), # (Efc Offset: 0x04) EEFC Flash Command Register + ("FSR", ctypes.c_uint32), # (Efc Offset: 0x08) EEFC Flash Status Register + ("FRR", ctypes.c_uint32), # (Efc Offset: 0x0C) EEFC Flash Result Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.efc = self.struct() + self.intn = intn diff --git a/qiling/hw/misc/__init__.py b/qiling/hw/misc/__init__.py index b7d0d499..1c8390b8 100644 --- a/qiling/hw/misc/__init__.py +++ b/qiling/hw/misc/__init__.py @@ -6,7 +6,6 @@ from .cm3_scb import CortexM3Scb from .cm4_scb import CortexM4Scb from .stm32f1xx_rcc import STM32F1xxRcc -from .stm32f1xx_flash import STM32F1xxFlash from .stm32f4xx_rcc import STM32F4xxRcc from .stm32f4xx_rcc_derive import ( STM32F4xxRccV1, STM32F4xxRccV2, @@ -14,6 +13,5 @@ from .stm32f4xx_rcc_derive import ( STM32F446Rcc, STM32F412Rcc, ) from .stm32f4xx_syscfg import STM32F4xxSyscfg -from .stm32f4xx_flash import STM32F4xxFlash from .stm32f4xx_dbg import STM32F4xxDbgmcu from .gd32vf1xx_rcu import GD32VF1xxRcu From 8ce387c679811d9f7c4b68c3585705399e60367c Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Tue, 8 Feb 2022 02:32:34 +0800 Subject: [PATCH 44/66] implement partial jumping instruction handler for x86 --- qiling/debugger/qdb/qdb.py | 18 ++++-- qiling/debugger/qdb/utils.py | 107 ++++++++++++++++++++++++++++++++--- 2 files changed, 113 insertions(+), 12 deletions(-) diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 819c04b5..4fb4c95e 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -13,7 +13,7 @@ from qiling.const import QL_ARCH, QL_VERBOSE from qiling.debugger import QlDebugger from .frontend import context_reg, context_asm, examine_mem -from .utils import _parse_int, handle_bnj, is_thumb, CODE_END, parse_int +from .utils import handle_bnj, is_thumb, CODE_END, parse_int from .utils import Breakpoint, TempBreakpoint from .const import * @@ -40,6 +40,16 @@ class QlQdb(cmd.Cmd, QlDebugger): # self.ql.loader.entry_point # ld.so # self.ql.loader.elf_entry # .text of binary + if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + # def pause(ql, addr, size): + # data = ql.mem.read(addr, size) + # ql.disassembler.detail = True + # breakpoint() + # ret = next(ql.disassembler.disasm(data, addr)) + # print(ret) + + self.ql.hook_code(handle_bnj) + if init_hook and self.ql.loader.entry_point != init_hook: self.do_breakpoint(init_hook) @@ -222,10 +232,10 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._save() - _, next_stop = handle_bnj(self.ql, self.cur_addr) + # _, next_stop = handle_bnj(self.ql, self.cur_addr) - if next_stop is CODE_END: - return True + # if next_stop is CODE_END: + # return True if self.ql.archtype == QL_ARCH.CORTEX_M: self.ql.arch.step() diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index f3200320..29c6f395 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -103,13 +103,14 @@ def signed_val(val: int) -> int: # handle braches and jumps so we can set berakpoint properly -def handle_bnj(ql: Qiling, cur_addr: str) -> Callable[[Qiling, str], int]: +def handle_bnj(ql: Qiling, cur_addr: str, size: int) -> Callable[[Qiling, str], int]: return { QL_ARCH.MIPS : handle_bnj_mips, QL_ARCH.ARM : handle_bnj_arm, QL_ARCH.ARM_THUMB: handle_bnj_arm, QL_ARCH.CORTEX_M : handle_bnj_arm, - }.get(ql.archtype)(ql, cur_addr) + QL_ARCH.X86 : handle_bnj_x86, + }.get(ql.archtype)(ql, cur_addr, size) def get_cpsr(bits: int) -> (bool, bool, bool, bool): @@ -121,6 +122,27 @@ def get_cpsr(bits: int) -> (bool, bool, bool, bool): ) +def get_x86_eflags(bits: int) -> Dict[str, bool]: + return { + "CF" : bits & 0x0001 != 0, # CF, carry flag + "PF" : bits & 0x0004 != 0, # PF, parity flag + "AF" : bits & 0x0010 != 0, # AF, adjust flag + "ZF" : bits & 0x0040 != 0, # ZF, zero flag + "SF" : bits & 0x0080 != 0, # SF, sign flag + "OF" : bits & 0x0800 != 0, # OF, overflow flag + } + +def get_eflags(bits: int) -> (bool, bool, bool, bool, bool, bool): + return ( + bits & 0x0001 != 0, # CF, carry flag + bits & 0x0004 != 0, # PF, parity flag + bits & 0x0010 != 0, # AF, adjust flag + bits & 0x0040 != 0, # ZF, zero flag + bits & 0x0080 != 0, # SF, sign flag + bits & 0x0800 != 0, # OF, overflow flag + ) + + def is_thumb(bits: int) -> bool: return bits & 0x00000020 != 0 @@ -160,8 +182,77 @@ def _read_inst(ql: Qiling, addr: int) -> int: return result +def handle_bnj_x86(ql: Qilng, cur_addr: str, size: int) -> (bool, int): -def handle_bnj_arm(ql: Qiling, cur_addr: str) -> int: + # FIXME: NO HANDLE BRANCH AND JUMP FOR X86 FOR NOW + + ret_addr = None + + md = ql.disassembler + data = ql.mem.read(cur_addr, size) + line = next(md.disasm(data, cur_addr)) + + jump_table = { + + # conditional jump + "jo" : (lambda C, P, A, Z, S, O: O == 1), + "jno" : (lambda C, P, A, Z, S, O: O == 0), + + "js" : (lambda C, P, A, Z, S, O: S == 1), + "jns" : (lambda C, P, A, Z, S, O: S == 0), + + "je" : (lambda C, P, A, Z, S, O: Z == 1), + "jz" : (lambda C, P, A, Z, S, O: Z == 1), + + "jne" : (lambda C, P, A, Z, S, O: Z == 0), + "jnz" : (lambda C, P, A, Z, S, O: Z == 0), + + "jb" : (lambda C, P, A, Z, S, O: C == 1), + "jc" : (lambda C, P, A, Z, S, O: C == 1), + "jnae" : (lambda C, P, A, Z, S, O: C == 1), + + "jnb" : (lambda C, P, A, Z, S, O: C == 0), + "jnc" : (lambda C, P, A, Z, S, O: C == 0), + "jae" : (lambda C, P, A, Z, S, O: C == 0), + + "jbe" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + "jna" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + + "ja" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + "jnbe" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + + "jl" : (lambda C, P, A, Z, S, O: S != O), + "jnge" : (lambda C, P, A, Z, S, O: S != O), + + "jge" : (lambda C, P, A, Z, S, O: S == O), + "jnl" : (lambda C, P, A, Z, S, O: S == O), + + "jle" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + "jng" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + + "jg" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + "jnle" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + + "jp" : (lambda C, P, A, Z, S, O: P == 1), + "jpe" : (lambda C, P, A, Z, S, O: P == 1), + + "jnp" : (lambda C, P, A, Z, S, O: P == 0), + "jpo" : (lambda C, P, A, Z, S, O: P == 0), + + # unconditional jump + + "call" : (lambda *_: True), + + } + + to_jump = False + if line.mnemonic in jump_table: + to_jump = jump_table.get(line.mnemonic)(*get_eflags(ql.reg.ef)) + + return (to_jump, ret_addr) + + +def handle_bnj_arm(ql: Qiling, cur_addr: str) -> (bool, int): def _read_reg_val(regs, _reg): return getattr(ql.reg, _reg.replace("ip", "r12").replace("fp", "r11")) @@ -383,7 +474,7 @@ def handle_bnj_arm(ql: Qiling, cur_addr: str) -> int: return (to_jump, ret_addr) -def handle_bnj_mips(ql: Qiling, cur_addr: str) -> int: +def handle_bnj_mips(ql: Qiling, cur_addr: str) -> (bool, int): MIPS_INST_SIZE = 4 def _read_reg(regs, _reg): @@ -413,10 +504,10 @@ def handle_bnj_mips(ql: Qiling, cur_addr: str) -> int: ] to_jump = { - "j" : (lambda _: True), # uncontitional jump - "jr" : (lambda _: True), # uncontitional jump - "jal" : (lambda _: True), # uncontitional jump - "jalr" : (lambda _: True), # uncontitional jump + "j" : (lambda _: True), # unconditional jump + "jr" : (lambda _: True), # unconditional jump + "jal" : (lambda _: True), # unconditional jump + "jalr" : (lambda _: True), # unconditional jump "b" : (lambda _: True), # unconditional branch "bl" : (lambda _: True), # unconditional branch "bal" : (lambda _: True), # unconditional branch From 1aee3fbcd64e4a07c5f780fd38847dec8ff1ede0 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 01:19:32 +0800 Subject: [PATCH 45/66] Add SAM3XA PMC basic logic --- qiling/hw/const/sam3xa_pmc.py | 313 ++++++++++++++++++++++++++++++++++ qiling/hw/power/sam3xa_pmc.py | 20 ++- 2 files changed, 332 insertions(+), 1 deletion(-) create mode 100644 qiling/hw/const/sam3xa_pmc.py diff --git a/qiling/hw/const/sam3xa_pmc.py b/qiling/hw/const/sam3xa_pmc.py new file mode 100644 index 00000000..68155b96 --- /dev/null +++ b/qiling/hw/const/sam3xa_pmc.py @@ -0,0 +1,313 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class SCER(IntEnum): + UOTGCLK = 0x1 << 5 # Enable USB OTG Clock (48 MHz, USB_48M) for UTMI + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Enable + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Enable + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Enable + +class SCDR(IntEnum): + UOTGCLK = 0x1 << 5 # Disable USB OTG Clock (48 MHz, USB_48M) for UTMI + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Disable + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Disable + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Disable + +class SCSR(IntEnum): + UOTGCLK = 0x1 << 5 # USB OTG Clock (48 MHz, USB_48M) Clock Status + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Status + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Status + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Status + +class PCER0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Enable + PID3 = 0x1 << 3 # Peripheral Clock 3 Enable + PID4 = 0x1 << 4 # Peripheral Clock 4 Enable + PID5 = 0x1 << 5 # Peripheral Clock 5 Enable + PID6 = 0x1 << 6 # Peripheral Clock 6 Enable + PID7 = 0x1 << 7 # Peripheral Clock 7 Enable + PID8 = 0x1 << 8 # Peripheral Clock 8 Enable + PID9 = 0x1 << 9 # Peripheral Clock 9 Enable + PID10 = 0x1 << 10 # Peripheral Clock 10 Enable + PID11 = 0x1 << 11 # Peripheral Clock 11 Enable + PID12 = 0x1 << 12 # Peripheral Clock 12 Enable + PID13 = 0x1 << 13 # Peripheral Clock 13 Enable + PID14 = 0x1 << 14 # Peripheral Clock 14 Enable + PID15 = 0x1 << 15 # Peripheral Clock 15 Enable + PID16 = 0x1 << 16 # Peripheral Clock 16 Enable + PID17 = 0x1 << 17 # Peripheral Clock 17 Enable + PID18 = 0x1 << 18 # Peripheral Clock 18 Enable + PID19 = 0x1 << 19 # Peripheral Clock 19 Enable + PID20 = 0x1 << 20 # Peripheral Clock 20 Enable + PID21 = 0x1 << 21 # Peripheral Clock 21 Enable + PID22 = 0x1 << 22 # Peripheral Clock 22 Enable + PID23 = 0x1 << 23 # Peripheral Clock 23 Enable + PID24 = 0x1 << 24 # Peripheral Clock 24 Enable + PID25 = 0x1 << 25 # Peripheral Clock 25 Enable + PID26 = 0x1 << 26 # Peripheral Clock 26 Enable + PID27 = 0x1 << 27 # Peripheral Clock 27 Enable + PID28 = 0x1 << 28 # Peripheral Clock 28 Enable + PID29 = 0x1 << 29 # Peripheral Clock 29 Enable + PID30 = 0x1 << 30 # Peripheral Clock 30 Enable + PID31 = 0x1 << 31 # Peripheral Clock 31 Enable + +class PCDR0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Disable + PID3 = 0x1 << 3 # Peripheral Clock 3 Disable + PID4 = 0x1 << 4 # Peripheral Clock 4 Disable + PID5 = 0x1 << 5 # Peripheral Clock 5 Disable + PID6 = 0x1 << 6 # Peripheral Clock 6 Disable + PID7 = 0x1 << 7 # Peripheral Clock 7 Disable + PID8 = 0x1 << 8 # Peripheral Clock 8 Disable + PID9 = 0x1 << 9 # Peripheral Clock 9 Disable + PID10 = 0x1 << 10 # Peripheral Clock 10 Disable + PID11 = 0x1 << 11 # Peripheral Clock 11 Disable + PID12 = 0x1 << 12 # Peripheral Clock 12 Disable + PID13 = 0x1 << 13 # Peripheral Clock 13 Disable + PID14 = 0x1 << 14 # Peripheral Clock 14 Disable + PID15 = 0x1 << 15 # Peripheral Clock 15 Disable + PID16 = 0x1 << 16 # Peripheral Clock 16 Disable + PID17 = 0x1 << 17 # Peripheral Clock 17 Disable + PID18 = 0x1 << 18 # Peripheral Clock 18 Disable + PID19 = 0x1 << 19 # Peripheral Clock 19 Disable + PID20 = 0x1 << 20 # Peripheral Clock 20 Disable + PID21 = 0x1 << 21 # Peripheral Clock 21 Disable + PID22 = 0x1 << 22 # Peripheral Clock 22 Disable + PID23 = 0x1 << 23 # Peripheral Clock 23 Disable + PID24 = 0x1 << 24 # Peripheral Clock 24 Disable + PID25 = 0x1 << 25 # Peripheral Clock 25 Disable + PID26 = 0x1 << 26 # Peripheral Clock 26 Disable + PID27 = 0x1 << 27 # Peripheral Clock 27 Disable + PID28 = 0x1 << 28 # Peripheral Clock 28 Disable + PID29 = 0x1 << 29 # Peripheral Clock 29 Disable + PID30 = 0x1 << 30 # Peripheral Clock 30 Disable + PID31 = 0x1 << 31 # Peripheral Clock 31 Disable + +class PCSR0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Status + PID3 = 0x1 << 3 # Peripheral Clock 3 Status + PID4 = 0x1 << 4 # Peripheral Clock 4 Status + PID5 = 0x1 << 5 # Peripheral Clock 5 Status + PID6 = 0x1 << 6 # Peripheral Clock 6 Status + PID7 = 0x1 << 7 # Peripheral Clock 7 Status + PID8 = 0x1 << 8 # Peripheral Clock 8 Status + PID9 = 0x1 << 9 # Peripheral Clock 9 Status + PID10 = 0x1 << 10 # Peripheral Clock 10 Status + PID11 = 0x1 << 11 # Peripheral Clock 11 Status + PID12 = 0x1 << 12 # Peripheral Clock 12 Status + PID13 = 0x1 << 13 # Peripheral Clock 13 Status + PID14 = 0x1 << 14 # Peripheral Clock 14 Status + PID15 = 0x1 << 15 # Peripheral Clock 15 Status + PID16 = 0x1 << 16 # Peripheral Clock 16 Status + PID17 = 0x1 << 17 # Peripheral Clock 17 Status + PID18 = 0x1 << 18 # Peripheral Clock 18 Status + PID19 = 0x1 << 19 # Peripheral Clock 19 Status + PID20 = 0x1 << 20 # Peripheral Clock 20 Status + PID21 = 0x1 << 21 # Peripheral Clock 21 Status + PID22 = 0x1 << 22 # Peripheral Clock 22 Status + PID23 = 0x1 << 23 # Peripheral Clock 23 Status + PID24 = 0x1 << 24 # Peripheral Clock 24 Status + PID25 = 0x1 << 25 # Peripheral Clock 25 Status + PID26 = 0x1 << 26 # Peripheral Clock 26 Status + PID27 = 0x1 << 27 # Peripheral Clock 27 Status + PID28 = 0x1 << 28 # Peripheral Clock 28 Status + PID29 = 0x1 << 29 # Peripheral Clock 29 Status + PID30 = 0x1 << 30 # Peripheral Clock 30 Status + PID31 = 0x1 << 31 # Peripheral Clock 31 Status + +class CKGR_UCKR(IntEnum): + UPLLEN = 0x1 << 16 # UTMI PLL Enable + UPLLCOUNT = 0xf << 20 # UTMI PLL Start-up Time + +class CKGR_MOR(IntEnum): + MOSCXTEN = 0x1 << 0 # Main Crystal Oscillator Enable + MOSCXTBY = 0x1 << 1 # Main Crystal Oscillator Bypass + MOSCRCEN = 0x1 << 3 # Main On-Chip RC Oscillator Enable + MOSCRCF = 0x7 << 4 # Main On-Chip RC Oscillator Frequency Selection + MOSCXTST = 0xff << 8 # Main Crystal Oscillator Start-up Time + KEY = 0xff << 16 # Password + MOSCSEL = 0x1 << 24 # Main Oscillator Selection + CFDEN = 0x1 << 25 # Clock Failure Detector Enable + +class CKGR_MCFR(IntEnum): + MAINF = 0xffff << 0 # Main Clock Frequency + MAINFRDY = 0x1 << 16 # Main Clock Ready + +class CKGR_PLLAR(IntEnum): + DIVA = 0xff << 0 # Divider + PLLACOUNT = 0x3f << 8 # PLLA Counter + MULA = 0x7ff << 16 # PLLA Multiplier + ONE = 0x1 << 29 # Must Be Set to 1 + +class MCKR(IntEnum): + CSS = 0x3 << 0 # Master Clock Source Selection + PRES = 0x7 << 4 # Processor Clock Prescaler + PLLADIV2 = 0x1 << 12 # PLLA Divisor by 2 + UPLLDIV2 = 0x1 << 13 # + +class USB(IntEnum): + USBS = 0x1 << 0 # USB Input Clock Selection + USBDIV = 0xf << 8 # Divider for USB Clock. + +class PCK(IntEnum): + CSS = 0x7 << 0 # Master Clock Source Selection + PRES = 0x7 << 4 # Programmable Clock Prescaler + +class IER(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Enable + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Enable + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Enable + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Enable + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Enable + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Enable + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Enable + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Enable + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Enable + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Enable + +class IDR(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Disable + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Disable + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Disable + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Disable + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Disable + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Disable + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Disable + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Disable + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Disable + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Disable + +class SR(IntEnum): + MOSCXTS = 0x1 << 0 # Main XTAL Oscillator Status + LOCKA = 0x1 << 1 # PLLA Lock Status + MCKRDY = 0x1 << 3 # Master Clock Status + LOCKU = 0x1 << 6 # UTMI PLL Lock Status + OSCSELS = 0x1 << 7 # Slow Clock Oscillator Selection + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready Status + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready Status + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready Status + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status + MOSCRCS = 0x1 << 17 # Main On-Chip RC Oscillator Status + CFDEV = 0x1 << 18 # Clock Failure Detector Event + CFDS = 0x1 << 19 # Clock Failure Detector Status + FOS = 0x1 << 20 # Clock Failure Detector Fault Output Status + +class IMR(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Mask + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Mask + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Mask + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Mask + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Mask + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Mask + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Mask + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Mask + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Mask + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Mask + +class FSMR(IntEnum): + FSTT0 = 0x1 << 0 # Fast Startup Input Enable 0 + FSTT1 = 0x1 << 1 # Fast Startup Input Enable 1 + FSTT2 = 0x1 << 2 # Fast Startup Input Enable 2 + FSTT3 = 0x1 << 3 # Fast Startup Input Enable 3 + FSTT4 = 0x1 << 4 # Fast Startup Input Enable 4 + FSTT5 = 0x1 << 5 # Fast Startup Input Enable 5 + FSTT6 = 0x1 << 6 # Fast Startup Input Enable 6 + FSTT7 = 0x1 << 7 # Fast Startup Input Enable 7 + FSTT8 = 0x1 << 8 # Fast Startup Input Enable 8 + FSTT9 = 0x1 << 9 # Fast Startup Input Enable 9 + FSTT10 = 0x1 << 10 # Fast Startup Input Enable 10 + FSTT11 = 0x1 << 11 # Fast Startup Input Enable 11 + FSTT12 = 0x1 << 12 # Fast Startup Input Enable 12 + FSTT13 = 0x1 << 13 # Fast Startup Input Enable 13 + FSTT14 = 0x1 << 14 # Fast Startup Input Enable 14 + FSTT15 = 0x1 << 15 # Fast Startup Input Enable 15 + RTTAL = 0x1 << 16 # RTT Alarm Enable + RTCAL = 0x1 << 17 # RTC Alarm Enable + USBAL = 0x1 << 18 # USB Alarm Enable + LPM = 0x1 << 20 # Low Power Mode + +class FSPR(IntEnum): + FSTP0 = 0x1 << 0 # Fast Startup Input Polarityx + FSTP1 = 0x1 << 1 # Fast Startup Input Polarityx + FSTP2 = 0x1 << 2 # Fast Startup Input Polarityx + FSTP3 = 0x1 << 3 # Fast Startup Input Polarityx + FSTP4 = 0x1 << 4 # Fast Startup Input Polarityx + FSTP5 = 0x1 << 5 # Fast Startup Input Polarityx + FSTP6 = 0x1 << 6 # Fast Startup Input Polarityx + FSTP7 = 0x1 << 7 # Fast Startup Input Polarityx + FSTP8 = 0x1 << 8 # Fast Startup Input Polarityx + FSTP9 = 0x1 << 9 # Fast Startup Input Polarityx + FSTP10 = 0x1 << 10 # Fast Startup Input Polarityx + FSTP11 = 0x1 << 11 # Fast Startup Input Polarityx + FSTP12 = 0x1 << 12 # Fast Startup Input Polarityx + FSTP13 = 0x1 << 13 # Fast Startup Input Polarityx + FSTP14 = 0x1 << 14 # Fast Startup Input Polarityx + FSTP15 = 0x1 << 15 # Fast Startup Input Polarityx + +class FOCR(IntEnum): + FOCLR = 0x1 << 0 # Fault Output Clear + +class WPMR(IntEnum): + WPEN = 0x1 << 0 # Write Protect Enable + WPKEY = 0xffffff << 8 # Write Protect KEY + +class WPSR(IntEnum): + WPVS = 0x1 << 0 # Write Protect Violation Status + WPVSRC = 0xffff << 8 # Write Protect Violation Source + +class PCER1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Enable + PID33 = 0x1 << 1 # Peripheral Clock 33 Enable + PID34 = 0x1 << 2 # Peripheral Clock 34 Enable + PID35 = 0x1 << 3 # Peripheral Clock 35 Enable + PID36 = 0x1 << 4 # Peripheral Clock 36 Enable + PID37 = 0x1 << 5 # Peripheral Clock 37 Enable + PID38 = 0x1 << 6 # Peripheral Clock 38 Enable + PID39 = 0x1 << 7 # Peripheral Clock 39 Enable + PID40 = 0x1 << 8 # Peripheral Clock 40 Enable + PID41 = 0x1 << 9 # Peripheral Clock 41 Enable + PID42 = 0x1 << 10 # Peripheral Clock 42 Enable + PID43 = 0x1 << 11 # Peripheral Clock 43 Enable + PID44 = 0x1 << 12 # Peripheral Clock 44 Enable + +class PCDR1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Disable + PID33 = 0x1 << 1 # Peripheral Clock 33 Disable + PID34 = 0x1 << 2 # Peripheral Clock 34 Disable + PID35 = 0x1 << 3 # Peripheral Clock 35 Disable + PID36 = 0x1 << 4 # Peripheral Clock 36 Disable + PID37 = 0x1 << 5 # Peripheral Clock 37 Disable + PID38 = 0x1 << 6 # Peripheral Clock 38 Disable + PID39 = 0x1 << 7 # Peripheral Clock 39 Disable + PID40 = 0x1 << 8 # Peripheral Clock 40 Disable + PID41 = 0x1 << 9 # Peripheral Clock 41 Disable + PID42 = 0x1 << 10 # Peripheral Clock 42 Disable + PID43 = 0x1 << 11 # Peripheral Clock 43 Disable + PID44 = 0x1 << 12 # Peripheral Clock 44 Disable + +class PCSR1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Status + PID33 = 0x1 << 1 # Peripheral Clock 33 Status + PID34 = 0x1 << 2 # Peripheral Clock 34 Status + PID35 = 0x1 << 3 # Peripheral Clock 35 Status + PID36 = 0x1 << 4 # Peripheral Clock 36 Status + PID37 = 0x1 << 5 # Peripheral Clock 37 Status + PID38 = 0x1 << 6 # Peripheral Clock 38 Status + PID39 = 0x1 << 7 # Peripheral Clock 39 Status + PID40 = 0x1 << 8 # Peripheral Clock 40 Status + PID41 = 0x1 << 9 # Peripheral Clock 41 Status + PID42 = 0x1 << 10 # Peripheral Clock 42 Status + PID43 = 0x1 << 11 # Peripheral Clock 43 Status + PID44 = 0x1 << 12 # Peripheral Clock 44 Status + +class PCR(IntEnum): + PID = 0x3f << 0 # Peripheral ID + CMD = 0x1 << 12 # Command + DIV = 0x3 << 16 # Divisor Value + EN = 0x1 << 28 # Enable + diff --git a/qiling/hw/power/sam3xa_pmc.py b/qiling/hw/power/sam3xa_pmc.py index 0584e586..df010a36 100644 --- a/qiling/hw/power/sam3xa_pmc.py +++ b/qiling/hw/power/sam3xa_pmc.py @@ -7,7 +7,7 @@ import ctypes from qiling.core import Qiling from qiling.hw.peripheral import QlPeripheral - +from qiling.hw.const.sam3xa_pmc import CKGR_MOR, SR, MCKR, CKGR_PLLAR, CKGR_UCKR class SAM3xaPmc(QlPeripheral): """ @@ -73,5 +73,23 @@ class SAM3xaPmc(QlPeripheral): @QlPeripheral.monitor() def write(self, offset: int, size: int, value: int): + if offset == self.struct.CKGR_MOR.offset: + if value & CKGR_MOR.MOSCXTEN: + self.pmc.SR |= SR.MOSCXTS + if value & CKGR_MOR.MOSCSEL: + self.pmc.SR |= SR.MOSCSELS + + elif offset == self.struct.MCKR.offset: + if value & MCKR.CSS: + self.pmc.SR |= SR.MCKRDY + + elif offset == self.struct.CKGR_PLLAR.offset: + if value & CKGR_PLLAR.ONE: + self.pmc.SR |= SR.LOCKA + + elif offset == self.struct.CKGR_UCKR.offset: + if value & CKGR_UCKR.UPLLEN: + self.pmc.SR |= SR.LOCKU + data = (value).to_bytes(size, 'little') ctypes.memmove(ctypes.addressof(self.pmc) + offset, data, size) \ No newline at end of file From e4add3c216eb94ff7f7e8cdbd8a803a81765d726 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:33:56 +0800 Subject: [PATCH 46/66] Add SAM3xa ADC --- qiling/hw/__init__.py | 1 + qiling/hw/adc/__init__.py | 6 +++++ qiling/hw/adc/sam3xa_adc.py | 54 +++++++++++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+) create mode 100644 qiling/hw/adc/__init__.py create mode 100644 qiling/hw/adc/sam3xa_adc.py diff --git a/qiling/hw/__init__.py b/qiling/hw/__init__.py index 324e3ccb..1edb4b43 100644 --- a/qiling/hw/__init__.py +++ b/qiling/hw/__init__.py @@ -3,6 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .adc import * from .char import * from .dma import * from .flash import * diff --git a/qiling/hw/adc/__init__.py b/qiling/hw/adc/__init__.py new file mode 100644 index 00000000..446ef249 --- /dev/null +++ b/qiling/hw/adc/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .sam3xa_adc import SAM3xaAdc diff --git a/qiling/hw/adc/sam3xa_adc.py b/qiling/hw/adc/sam3xa_adc.py new file mode 100644 index 00000000..47f009a6 --- /dev/null +++ b/qiling/hw/adc/sam3xa_adc.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaAdc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), # (Adc Offset: 0x00) Control Register + ("MR" , ctypes.c_uint32), # (Adc Offset: 0x04) Mode Register + ("SEQR1" , ctypes.c_uint32), # (Adc Offset: 0x08) Channel Sequence Register 1 + ("SEQR2" , ctypes.c_uint32), # (Adc Offset: 0x0C) Channel Sequence Register 2 + ("CHER" , ctypes.c_uint32), # (Adc Offset: 0x10) Channel Enable Register + ("CHDR" , ctypes.c_uint32), # (Adc Offset: 0x14) Channel Disable Register + ("CHSR" , ctypes.c_uint32), # (Adc Offset: 0x18) Channel Status Register + ("Reserved1", ctypes.c_uint32), # + ("LCDR" , ctypes.c_uint32), # (Adc Offset: 0x20) Last Converted Data Register + ("IER" , ctypes.c_uint32), # (Adc Offset: 0x24) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Adc Offset: 0x28) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Adc Offset: 0x2C) Interrupt Mask Register + ("ISR" , ctypes.c_uint32), # (Adc Offset: 0x30) Interrupt Status Register + ("Reserved2", ctypes.c_uint32 * 2), # + ("OVER" , ctypes.c_uint32), # (Adc Offset: 0x3C) Overrun Status Register + ("EMR" , ctypes.c_uint32), # (Adc Offset: 0x40) Extended Mode Register + ("CWR" , ctypes.c_uint32), # (Adc Offset: 0x44) Compare Window Register + ("CGR" , ctypes.c_uint32), # (Adc Offset: 0x48) Channel Gain Register + ("COR" , ctypes.c_uint32), # (Adc Offset: 0x4C) Channel Offset Register + ("CDR" , ctypes.c_uint32 * 16), # (Adc Offset: 0x50) Channel Data Register + ("Reserved3", ctypes.c_uint32), # + ("ACR" , ctypes.c_uint32), # (Adc Offset: 0x94) Analog Control Register + ("Reserved4", ctypes.c_uint32 * 19), # + ("WPMR" , ctypes.c_uint32), # (Adc Offset: 0xE4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Adc Offset: 0xE8) Write Protect Status Register + ("Reserved5", ctypes.c_uint32 * 5), # + ("RPR" , ctypes.c_uint32), # (Adc Offset: 0x100) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Adc Offset: 0x104) Receive Counter Register + ("Reserved6", ctypes.c_uint32 * 2), # + ("RNPR" , ctypes.c_uint32), # (Adc Offset: 0x110) Receive Next Pointer Register + ("RNCR" , ctypes.c_uint32), # (Adc Offset: 0x114) Receive Next Counter Register + ("Reserved7", ctypes.c_uint32 * 2), # + ("PTCR" , ctypes.c_uint32), # (Adc Offset: 0x120) Transfer Control Register + ("PTSR" , ctypes.c_uint32), # (Adc Offset: 0x124) Transfer Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.adc = self.struct() + self.intn = intn From e5a2fe10cf30467675b63e292b66fae7c5beb018 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:34:09 +0800 Subject: [PATCH 47/66] Add SAM3xa UART --- qiling/hw/char/sam3xa_uart.py | 41 +++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 qiling/hw/char/sam3xa_uart.py diff --git a/qiling/hw/char/sam3xa_uart.py b/qiling/hw/char/sam3xa_uart.py new file mode 100644 index 00000000..aa22ebd9 --- /dev/null +++ b/qiling/hw/char/sam3xa_uart.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.connectivity import QlConnectivityPeripheral + + +class SAM3xaUart(QlConnectivityPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), # (Uart Offset: 0x0000) Control Register + ("MR" , ctypes.c_uint32), # (Uart Offset: 0x0004) Mode Register + ("IER" , ctypes.c_uint32), # (Uart Offset: 0x0008) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Uart Offset: 0x000C) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Uart Offset: 0x0010) Interrupt Mask Register + ("SR" , ctypes.c_uint32), # (Uart Offset: 0x0014) Status Register + ("RHR" , ctypes.c_uint32), # (Uart Offset: 0x0018) Receive Holding Register + ("THR" , ctypes.c_uint32), # (Uart Offset: 0x001C) Transmit Holding Register + ("BRGR" , ctypes.c_uint32), # (Uart Offset: 0x0020) Baud Rate Generator Register + ("Reserved1", ctypes.c_uint32 * 55), # + ("RPR" , ctypes.c_uint32), # (Uart Offset: 0x100) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Uart Offset: 0x104) Receive Counter Register + ("TPR" , ctypes.c_uint32), # (Uart Offset: 0x108) Transmit Pointer Register + ("TCR" , ctypes.c_uint32), # (Uart Offset: 0x10C) Transmit Counter Register + ("RNPR" , ctypes.c_uint32), # (Uart Offset: 0x110) Receive Next Pointer Register + ("RNCR" , ctypes.c_uint32), # (Uart Offset: 0x114) Receive Next Counter Register + ("TNPR" , ctypes.c_uint32), # (Uart Offset: 0x118) Transmit Next Pointer Register + ("TNCR" , ctypes.c_uint32), # (Uart Offset: 0x11C) Transmit Next Counter Register + ("PTCR" , ctypes.c_uint32), # (Uart Offset: 0x120) Transfer Control Register + ("PTSR" , ctypes.c_uint32), # (Uart Offset: 0x124) Transfer Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.uart = self.struct() + self.intn = intn From 7946bee4427c768de48e069023ee7fb3aa2ee709 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:34:20 +0800 Subject: [PATCH 48/66] Add SAM3xa UOTGHS --- qiling/hw/char/sam3xa_uotghs.py | 121 ++++ qiling/hw/const/sam3xa_uotghs.py | 997 +++++++++++++++++++++++++++++++ 2 files changed, 1118 insertions(+) create mode 100644 qiling/hw/char/sam3xa_uotghs.py create mode 100644 qiling/hw/const/sam3xa_uotghs.py diff --git a/qiling/hw/char/sam3xa_uotghs.py b/qiling/hw/char/sam3xa_uotghs.py new file mode 100644 index 00000000..0903fcab --- /dev/null +++ b/qiling/hw/char/sam3xa_uotghs.py @@ -0,0 +1,121 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + + +from qiling.hw.connectivity import QlConnectivityPeripheral +from qiling.hw.peripheral import QlPeripheral + +from qiling.hw.const.sam3xa_uotghs import CTRL, SR + + +class UotghsDevdma(ctypes.Structure): + _fields_ = [ + ("DEVDMANXTDSC", ctypes.c_uint32), + ("DEVDMAADDRESS", ctypes.c_uint32), + ("DEVDMACONTROL", ctypes.c_uint32), + ("DEVDMASTATUS", ctypes.c_uint32), + ] + +class UotghsHstdma(ctypes.Structure): + _fields_ = [ + ("HSTDMANXTDSC", ctypes.c_uint32), + ("HSTDMAADDRESS", ctypes.c_uint32), + ("HSTDMACONTROL", ctypes.c_uint32), + ("HSTDMASTATUS", ctypes.c_uint32), + ] + +class SAM3xaUotghs(QlConnectivityPeripheral): + """ USB On-The-Go Interface """ + class Type(ctypes.Structure): + _fields_ = [ + ("DEVCTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0000) Device General Control Register + ("DEVISR" , ctypes.c_uint32), # (Uotghs Offset: 0x0004) Device Global Interrupt Status Register + ("DEVICR" , ctypes.c_uint32), # (Uotghs Offset: 0x0008) Device Global Interrupt Clear Register + ("DEVIFR" , ctypes.c_uint32), # (Uotghs Offset: 0x000C) Device Global Interrupt Set Register + ("DEVIMR" , ctypes.c_uint32), # (Uotghs Offset: 0x0010) Device Global Interrupt Mask Register + ("DEVIDR" , ctypes.c_uint32), # (Uotghs Offset: 0x0014) Device Global Interrupt Disable Register + ("DEVIER" , ctypes.c_uint32), # (Uotghs Offset: 0x0018) Device Global Interrupt Enable Register + ("DEVEPT" , ctypes.c_uint32), # (Uotghs Offset: 0x001C) Device Endpoint Register + ("DEVFNUM" , ctypes.c_uint32), # (Uotghs Offset: 0x0020) Device Frame Number Register + ("Reserved1" , ctypes.c_uint32 * 55), # + ("DEVEPTCFG" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x100) Device Endpoint Configuration Register (n = 0) + ("Reserved2" , ctypes.c_uint32 * 2), # + ("DEVEPTISR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x130) Device Endpoint Status Register (n = 0) + ("Reserved3" , ctypes.c_uint32 * 2), # + ("DEVEPTICR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x160) Device Endpoint Clear Register (n = 0) + ("Reserved4" , ctypes.c_uint32 * 2), # + ("DEVEPTIFR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x190) Device Endpoint Set Register (n = 0) + ("Reserved5" , ctypes.c_uint32 * 2), # + ("DEVEPTIMR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x1C0) Device Endpoint Mask Register (n = 0) + ("Reserved6" , ctypes.c_uint32 * 2), # + ("DEVEPTIER" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x1F0) Device Endpoint Enable Register (n = 0) + ("Reserved7" , ctypes.c_uint32 * 2), # + ("DEVEPTIDR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x220) Device Endpoint Disable Register (n = 0) + ("Reserved8" , ctypes.c_uint32 * 50), # + ("DEVDMA" , UotghsDevdma * 7), # (Uotghs Offset: 0x310) n = 1 .. 7 + ("Reserved9" , ctypes.c_uint32 * 32), # + ("HSTCTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0400) Host General Control Register + ("HSTISR" , ctypes.c_uint32), # (Uotghs Offset: 0x0404) Host Global Interrupt Status Register + ("HSTICR" , ctypes.c_uint32), # (Uotghs Offset: 0x0408) Host Global Interrupt Clear Register + ("HSTIFR" , ctypes.c_uint32), # (Uotghs Offset: 0x040C) Host Global Interrupt Set Register + ("HSTIMR" , ctypes.c_uint32), # (Uotghs Offset: 0x0410) Host Global Interrupt Mask Register + ("HSTIDR" , ctypes.c_uint32), # (Uotghs Offset: 0x0414) Host Global Interrupt Disable Register + ("HSTIER" , ctypes.c_uint32), # (Uotghs Offset: 0x0418) Host Global Interrupt Enable Register + ("HSTPIP" , ctypes.c_uint32), # (Uotghs Offset: 0x0041C) Host Pipe Register + ("HSTFNUM" , ctypes.c_uint32), # (Uotghs Offset: 0x0420) Host Frame Number Register + ("HSTADDR1" , ctypes.c_uint32), # (Uotghs Offset: 0x0424) Host Address 1 Register + ("HSTADDR2" , ctypes.c_uint32), # (Uotghs Offset: 0x0428) Host Address 2 Register + ("HSTADDR3" , ctypes.c_uint32), # (Uotghs Offset: 0x042C) Host Address 3 Register + ("Reserved10", ctypes.c_uint32 * 52), # + ("HSTPIPCFG" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x500) Host Pipe Configuration Register (n = 0) + ("Reserved11", ctypes.c_uint32 * 2), # + ("HSTPIPISR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x530) Host Pipe Status Register (n = 0) + ("Reserved12", ctypes.c_uint32 * 2), # + ("HSTPIPICR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x560) Host Pipe Clear Register (n = 0) + ("Reserved13", ctypes.c_uint32 * 2), # + ("HSTPIPIFR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x590) Host Pipe Set Register (n = 0) + ("Reserved14", ctypes.c_uint32 * 2), # + ("HSTPIPIMR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x5C0) Host Pipe Mask Register (n = 0) + ("Reserved15", ctypes.c_uint32 * 2), # + ("HSTPIPIER" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x5F0) Host Pipe Enable Register (n = 0) + ("Reserved16", ctypes.c_uint32 * 2), # + ("HSTPIPIDR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x620) Host Pipe Disable Register (n = 0) + ("Reserved17", ctypes.c_uint32 * 2), # + ("HSTPIPINRQ", ctypes.c_uint32 * 10), # (Uotghs Offset: 0x650) Host Pipe IN Request Register (n = 0) + ("Reserved18", ctypes.c_uint32 * 2), # + ("HSTPIPERR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x680) Host Pipe Error Register (n = 0) + ("Reserved19", ctypes.c_uint32 * 26), # + ("HSTDMA" , UotghsHstdma * 7), # (Uotghs Offset: 0x710) n = 1 .. 7 + ("Reserved20", ctypes.c_uint32 * 32), # + ("CTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0800) General Control Register + ("SR" , ctypes.c_uint32), # (Uotghs Offset: 0x0804) General Status Register + ("SCR" , ctypes.c_uint32), # (Uotghs Offset: 0x0808) General Status Clear Register + ("SFR" , ctypes.c_uint32), # (Uotghs Offset: 0x080C) General Status Set Register + ("Reserved21", ctypes.c_uint32 * 7), # + ("FSM" , ctypes.c_uint32), # (Uotghs Offset: 0x082C) General Finite State Machine Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.uotghs = self.struct() + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.uotghs) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.CTRL.offset: + if value & CTRL.OTGPADE == 0: + self.uotghs.SR |= SR.CLKUSABLE + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.uotghs) + offset, data, size) diff --git a/qiling/hw/const/sam3xa_uotghs.py b/qiling/hw/const/sam3xa_uotghs.py new file mode 100644 index 00000000..416e23b6 --- /dev/null +++ b/qiling/hw/const/sam3xa_uotghs.py @@ -0,0 +1,997 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class DEVCTRL(IntEnum): + UADD = 0x7f << 0 # USB Address + ADDEN = 0x1 << 7 # Address Enable + DETACH = 0x1 << 8 # Detach + RMWKUP = 0x1 << 9 # Remote Wake-Up + SPDCONF = 0x3 << 10 # Mode Configuration + LS = 0x1 << 12 # Low-Speed Mode Force + TSTJ = 0x1 << 13 # Test mode J + TSTK = 0x1 << 14 # Test mode K + TSTPCKT = 0x1 << 15 # Test packet mode + OPMODE2 = 0x1 << 16 # Specific Operational mode + +class DEVISR(IntEnum): + SUSP = 0x1 << 0 # Suspend Interrupt + MSOF = 0x1 << 1 # Micro Start of Frame Interrupt + SOF = 0x1 << 2 # Start of Frame Interrupt + EORST = 0x1 << 3 # End of Reset Interrupt + WAKEUP = 0x1 << 4 # Wake-Up Interrupt + EORSM = 0x1 << 5 # End of Resume Interrupt + UPRSM = 0x1 << 6 # Upstream Resume Interrupt + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt + +class DEVICR(IntEnum): + SUSPC = 0x1 << 0 # Suspend Interrupt Clear + MSOFC = 0x1 << 1 # Micro Start of Frame Interrupt Clear + SOFC = 0x1 << 2 # Start of Frame Interrupt Clear + EORSTC = 0x1 << 3 # End of Reset Interrupt Clear + WAKEUPC = 0x1 << 4 # Wake-Up Interrupt Clear + EORSMC = 0x1 << 5 # End of Resume Interrupt Clear + UPRSMC = 0x1 << 6 # Upstream Resume Interrupt Clear + +class DEVIFR(IntEnum): + SUSPS = 0x1 << 0 # Suspend Interrupt Set + MSOFS = 0x1 << 1 # Micro Start of Frame Interrupt Set + SOFS = 0x1 << 2 # Start of Frame Interrupt Set + EORSTS = 0x1 << 3 # End of Reset Interrupt Set + WAKEUPS = 0x1 << 4 # Wake-Up Interrupt Set + EORSMS = 0x1 << 5 # End of Resume Interrupt Set + UPRSMS = 0x1 << 6 # Upstream Resume Interrupt Set + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Set + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Set + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Set + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Set + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Set + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Set + +class DEVIMR(IntEnum): + SUSPE = 0x1 << 0 # Suspend Interrupt Mask + MSOFE = 0x1 << 1 # Micro Start of Frame Interrupt Mask + SOFE = 0x1 << 2 # Start of Frame Interrupt Mask + EORSTE = 0x1 << 3 # End of Reset Interrupt Mask + WAKEUPE = 0x1 << 4 # Wake-Up Interrupt Mask + EORSME = 0x1 << 5 # End of Resume Interrupt Mask + UPRSME = 0x1 << 6 # Upstream Resume Interrupt Mask + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Mask + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Mask + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Mask + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Mask + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Mask + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Mask + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Mask + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Mask + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Mask + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Mask + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Mask + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Mask + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Mask + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Mask + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Mask + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Mask + +class DEVIDR(IntEnum): + SUSPEC = 0x1 << 0 # Suspend Interrupt Disable + MSOFEC = 0x1 << 1 # Micro Start of Frame Interrupt Disable + SOFEC = 0x1 << 2 # Start of Frame Interrupt Disable + EORSTEC = 0x1 << 3 # End of Reset Interrupt Disable + WAKEUPEC = 0x1 << 4 # Wake-Up Interrupt Disable + EORSMEC = 0x1 << 5 # End of Resume Interrupt Disable + UPRSMEC = 0x1 << 6 # Upstream Resume Interrupt Disable + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Disable + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Disable + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Disable + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Disable + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Disable + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Disable + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Disable + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Disable + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Disable + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Disable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Disable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Disable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Disable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Disable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Disable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Disable + +class DEVIER(IntEnum): + SUSPES = 0x1 << 0 # Suspend Interrupt Enable + MSOFES = 0x1 << 1 # Micro Start of Frame Interrupt Enable + SOFES = 0x1 << 2 # Start of Frame Interrupt Enable + EORSTES = 0x1 << 3 # End of Reset Interrupt Enable + WAKEUPES = 0x1 << 4 # Wake-Up Interrupt Enable + EORSMES = 0x1 << 5 # End of Resume Interrupt Enable + UPRSMES = 0x1 << 6 # Upstream Resume Interrupt Enable + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Enable + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Enable + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Enable + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Enable + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Enable + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Enable + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Enable + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Enable + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Enable + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class DEVEPT(IntEnum): + EPEN0 = 0x1 << 0 # Endpoint 0 Enable + EPEN1 = 0x1 << 1 # Endpoint 1 Enable + EPEN2 = 0x1 << 2 # Endpoint 2 Enable + EPEN3 = 0x1 << 3 # Endpoint 3 Enable + EPEN4 = 0x1 << 4 # Endpoint 4 Enable + EPEN5 = 0x1 << 5 # Endpoint 5 Enable + EPEN6 = 0x1 << 6 # Endpoint 6 Enable + EPEN7 = 0x1 << 7 # Endpoint 7 Enable + EPEN8 = 0x1 << 8 # Endpoint 8 Enable + EPRST0 = 0x1 << 16 # Endpoint 0 Reset + EPRST1 = 0x1 << 17 # Endpoint 1 Reset + EPRST2 = 0x1 << 18 # Endpoint 2 Reset + EPRST3 = 0x1 << 19 # Endpoint 3 Reset + EPRST4 = 0x1 << 20 # Endpoint 4 Reset + EPRST5 = 0x1 << 21 # Endpoint 5 Reset + EPRST6 = 0x1 << 22 # Endpoint 6 Reset + EPRST7 = 0x1 << 23 # Endpoint 7 Reset + EPRST8 = 0x1 << 24 # Endpoint 8 Reset + +class DEVFNUM(IntEnum): + MFNUM = 0x7 << 0 # Micro Frame Number + FNUM = 0x7ff << 3 # Frame Number + FNCERR = 0x1 << 15 # Frame Number CRC Error + +class DEVEPTCFG(IntEnum): + ALLOC = 0x1 << 1 # Endpoint Memory Allocate + EPBK = 0x3 << 2 # Endpoint Banks + EPSIZE = 0x7 << 4 # Endpoint Size + EPDIR = 0x1 << 8 # Endpoint Direction + AUTOSW = 0x1 << 9 # Automatic Switch + EPTYPE = 0x3 << 11 # Endpoint Type + NBTRANS = 0x3 << 13 # Number of transaction per microframe for isochronous endpoint + +class DEVEPTISR(IntEnum): + TXINI = 0x1 << 0 # Transmitted IN Data Interrupt + RXOUTI = 0x1 << 1 # Received OUT Data Interrupt + RXSTPI = 0x1 << 2 # Received SETUP Interrupt + UNDERFI = 0x1 << 2 # Underflow Interrupt + NAKOUTI = 0x1 << 3 # NAKed OUT Interrupt + HBISOINERRI = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt + NAKINI = 0x1 << 4 # NAKed IN Interrupt + HBISOFLUSHI = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt + OVERFI = 0x1 << 5 # Overflow Interrupt + STALLEDI = 0x1 << 6 # STALLed Interrupt + CRCERRI = 0x1 << 6 # CRC Error Interrupt + SHORTPACKET = 0x1 << 7 # Short Packet Interrupt + DTSEQ = 0x3 << 8 # Data Toggle Sequence + ERRORTRANS = 0x1 << 10 # High-bandwidth isochronous OUT endpoint transaction error Interrupt + NBUSYBK = 0x3 << 12 # Number of Busy Banks + CURRBK = 0x3 << 14 # Current Bank + RWALL = 0x1 << 16 # Read-write Allowed + CTRLDIR = 0x1 << 17 # Control Direction + CFGOK = 0x1 << 18 # Configuration OK Status + BYCT = 0x7ff << 20 # Byte Count + +class DEVEPTICR(IntEnum): + TXINIC = 0x1 << 0 # Transmitted IN Data Interrupt Clear + RXOUTIC = 0x1 << 1 # Received OUT Data Interrupt Clear + RXSTPIC = 0x1 << 2 # Received SETUP Interrupt Clear + UNDERFIC = 0x1 << 2 # Underflow Interrupt Clear + NAKOUTIC = 0x1 << 3 # NAKed OUT Interrupt Clear + HBISOINERRIC = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt Clear + NAKINIC = 0x1 << 4 # NAKed IN Interrupt Clear + HBISOFLUSHIC = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Clear + OVERFIC = 0x1 << 5 # Overflow Interrupt Clear + STALLEDIC = 0x1 << 6 # STALLed Interrupt Clear + CRCERRIC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETC = 0x1 << 7 # Short Packet Interrupt Clear + +class DEVEPTIFR(IntEnum): + TXINIS = 0x1 << 0 # Transmitted IN Data Interrupt Set + RXOUTIS = 0x1 << 1 # Received OUT Data Interrupt Set + RXSTPIS = 0x1 << 2 # Received SETUP Interrupt Set + UNDERFIS = 0x1 << 2 # Underflow Interrupt Set + NAKOUTIS = 0x1 << 3 # NAKed OUT Interrupt Set + HBISOINERRIS = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt Set + NAKINIS = 0x1 << 4 # NAKed IN Interrupt Set + HBISOFLUSHIS = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Set + OVERFIS = 0x1 << 5 # Overflow Interrupt Set + STALLEDIS = 0x1 << 6 # STALLed Interrupt Set + CRCERRIS = 0x1 << 6 # CRC Error Interrupt Set + SHORTPACKETS = 0x1 << 7 # Short Packet Interrupt Set + NBUSYBKS = 0x1 << 12 # Number of Busy Banks Interrupt Set + +class DEVEPTIMR(IntEnum): + TXINE = 0x1 << 0 # Transmitted IN Data Interrupt + RXOUTE = 0x1 << 1 # Received OUT Data Interrupt + RXSTPE = 0x1 << 2 # Received SETUP Interrupt + UNDERFE = 0x1 << 2 # Underflow Interrupt + NAKOUTE = 0x1 << 3 # NAKed OUT Interrupt + HBISOINERRE = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt + NAKINE = 0x1 << 4 # NAKed IN Interrupt + HBISOFLUSHE = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt + OVERFE = 0x1 << 5 # Overflow Interrupt + STALLEDE = 0x1 << 6 # STALLed Interrupt + CRCERRE = 0x1 << 6 # CRC Error Interrupt + SHORTPACKETE = 0x1 << 7 # Short Packet Interrupt + MDATAE = 0x1 << 8 # MData Interrupt + DATAXE = 0x1 << 9 # DataX Interrupt + ERRORTRANSE = 0x1 << 10 # Transaction Error Interrupt + NBUSYBKE = 0x1 << 12 # Number of Busy Banks Interrupt + KILLBK = 0x1 << 13 # Kill IN Bank + FIFOCON = 0x1 << 14 # FIFO Control + EPDISHDMA = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request + NYETDIS = 0x1 << 17 # NYET Token Disable + RSTDT = 0x1 << 18 # Reset Data Toggle + STALLRQ = 0x1 << 19 # STALL Request + +class DEVEPTIER(IntEnum): + TXINES = 0x1 << 0 # Transmitted IN Data Interrupt Enable + RXOUTES = 0x1 << 1 # Received OUT Data Interrupt Enable + RXSTPES = 0x1 << 2 # Received SETUP Interrupt Enable + UNDERFES = 0x1 << 2 # Underflow Interrupt Enable + NAKOUTES = 0x1 << 3 # NAKed OUT Interrupt Enable + HBISOINERRES = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt Enable + NAKINES = 0x1 << 4 # NAKed IN Interrupt Enable + HBISOFLUSHES = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Enable + OVERFES = 0x1 << 5 # Overflow Interrupt Enable + STALLEDES = 0x1 << 6 # STALLed Interrupt Enable + CRCERRES = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETES = 0x1 << 7 # Short Packet Interrupt Enable + MDATAES = 0x1 << 8 # MData Interrupt Enable + DATAXES = 0x1 << 9 # DataX Interrupt Enable + ERRORTRANSES = 0x1 << 10 # Transaction Error Interrupt Enable + NBUSYBKES = 0x1 << 12 # Number of Busy Banks Interrupt Enable + KILLBKS = 0x1 << 13 # Kill IN Bank + EPDISHDMAS = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request Enable + NYETDISS = 0x1 << 17 # NYET Token Disable Enable + RSTDTS = 0x1 << 18 # Reset Data Toggle Enable + STALLRQS = 0x1 << 19 # STALL Request Enable + +class DEVEPTIDR(IntEnum): + TXINEC = 0x1 << 0 # Transmitted IN Interrupt Clear + RXOUTEC = 0x1 << 1 # Received OUT Data Interrupt Clear + RXSTPEC = 0x1 << 2 # Received SETUP Interrupt Clear + UNDERFEC = 0x1 << 2 # Underflow Interrupt Clear + NAKOUTEC = 0x1 << 3 # NAKed OUT Interrupt Clear + HBISOINERREC = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt Clear + NAKINEC = 0x1 << 4 # NAKed IN Interrupt Clear + HBISOFLUSHEC = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Clear + OVERFEC = 0x1 << 5 # Overflow Interrupt Clear + STALLEDEC = 0x1 << 6 # STALLed Interrupt Clear + CRCERREC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETEC = 0x1 << 7 # Shortpacket Interrupt Clear + MDATEC = 0x1 << 8 # MData Interrupt Clear + DATAXEC = 0x1 << 9 # DataX Interrupt Clear + ERRORTRANSEC = 0x1 << 10 # Transaction Error Interrupt Clear + NBUSYBKEC = 0x1 << 12 # Number of Busy Banks Interrupt Clear + FIFOCONC = 0x1 << 14 # FIFO Control Clear + EPDISHDMAC = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request Clear + NYETDISC = 0x1 << 17 # NYET Token Disable Clear + STALLRQC = 0x1 << 19 # STALL Request Clear + +class DEVDMANXTDSC1(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS1(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC2(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS2(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC3(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS3(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC4(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS4(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC5(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS5(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC6(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS6(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC7(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS7(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTCTRL(IntEnum): + SOFE = 0x1 << 8 # Start of Frame Generation Enable + RESET = 0x1 << 9 # Send USB Reset + RESUME = 0x1 << 10 # Send USB Resume + SPDCONF = 0x3 << 12 # Mode Configuration + +class HSTISR(IntEnum): + DCONNI = 0x1 << 0 # Device Connection Interrupt + DDISCI = 0x1 << 1 # Device Disconnection Interrupt + RSTI = 0x1 << 2 # USB Reset Sent Interrupt + RSMEDI = 0x1 << 3 # Downstream Resume Sent Interrupt + RXRSMI = 0x1 << 4 # Upstream Resume Received Interrupt + HSOFI = 0x1 << 5 # Host Start of Frame Interrupt + HWUPI = 0x1 << 6 # Host Wake-Up Interrupt + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt + +class HSTICR(IntEnum): + DCONNIC = 0x1 << 0 # Device Connection Interrupt Clear + DDISCIC = 0x1 << 1 # Device Disconnection Interrupt Clear + RSTIC = 0x1 << 2 # USB Reset Sent Interrupt Clear + RSMEDIC = 0x1 << 3 # Downstream Resume Sent Interrupt Clear + RXRSMIC = 0x1 << 4 # Upstream Resume Received Interrupt Clear + HSOFIC = 0x1 << 5 # Host Start of Frame Interrupt Clear + HWUPIC = 0x1 << 6 # Host Wake-Up Interrupt Clear + +class HSTIFR(IntEnum): + DCONNIS = 0x1 << 0 # Device Connection Interrupt Set + DDISCIS = 0x1 << 1 # Device Disconnection Interrupt Set + RSTIS = 0x1 << 2 # USB Reset Sent Interrupt Set + RSMEDIS = 0x1 << 3 # Downstream Resume Sent Interrupt Set + RXRSMIS = 0x1 << 4 # Upstream Resume Received Interrupt Set + HSOFIS = 0x1 << 5 # Host Start of Frame Interrupt Set + HWUPIS = 0x1 << 6 # Host Wake-Up Interrupt Set + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Set + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Set + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Set + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Set + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Set + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Set + +class HSTIMR(IntEnum): + DCONNIE = 0x1 << 0 # Device Connection Interrupt Enable + DDISCIE = 0x1 << 1 # Device Disconnection Interrupt Enable + RSTIE = 0x1 << 2 # USB Reset Sent Interrupt Enable + RSMEDIE = 0x1 << 3 # Downstream Resume Sent Interrupt Enable + RXRSMIE = 0x1 << 4 # Upstream Resume Received Interrupt Enable + HSOFIE = 0x1 << 5 # Host Start of Frame Interrupt Enable + HWUPIE = 0x1 << 6 # Host Wake-Up Interrupt Enable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Enable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Enable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Enable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Enable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Enable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Enable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Enable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Enable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Enable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class HSTIDR(IntEnum): + DCONNIEC = 0x1 << 0 # Device Connection Interrupt Disable + DDISCIEC = 0x1 << 1 # Device Disconnection Interrupt Disable + RSTIEC = 0x1 << 2 # USB Reset Sent Interrupt Disable + RSMEDIEC = 0x1 << 3 # Downstream Resume Sent Interrupt Disable + RXRSMIEC = 0x1 << 4 # Upstream Resume Received Interrupt Disable + HSOFIEC = 0x1 << 5 # Host Start of Frame Interrupt Disable + HWUPIEC = 0x1 << 6 # Host Wake-Up Interrupt Disable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Disable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Disable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Disable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Disable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Disable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Disable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Disable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Disable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Disable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Disable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Disable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Disable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Disable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Disable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Disable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Disable + +class HSTIER(IntEnum): + DCONNIES = 0x1 << 0 # Device Connection Interrupt Enable + DDISCIES = 0x1 << 1 # Device Disconnection Interrupt Enable + RSTIES = 0x1 << 2 # USB Reset Sent Interrupt Enable + RSMEDIES = 0x1 << 3 # Downstream Resume Sent Interrupt Enable + RXRSMIES = 0x1 << 4 # Upstream Resume Received Interrupt Enable + HSOFIES = 0x1 << 5 # Host Start of Frame Interrupt Enable + HWUPIES = 0x1 << 6 # Host Wake-Up Interrupt Enable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Enable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Enable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Enable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Enable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Enable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Enable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Enable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Enable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Enable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class HSTPIP(IntEnum): + PEN0 = 0x1 << 0 # Pipe 0 Enable + PEN1 = 0x1 << 1 # Pipe 1 Enable + PEN2 = 0x1 << 2 # Pipe 2 Enable + PEN3 = 0x1 << 3 # Pipe 3 Enable + PEN4 = 0x1 << 4 # Pipe 4 Enable + PEN5 = 0x1 << 5 # Pipe 5 Enable + PEN6 = 0x1 << 6 # Pipe 6 Enable + PEN7 = 0x1 << 7 # Pipe 7 Enable + PEN8 = 0x1 << 8 # Pipe 8 Enable + PRST0 = 0x1 << 16 # Pipe 0 Reset + PRST1 = 0x1 << 17 # Pipe 1 Reset + PRST2 = 0x1 << 18 # Pipe 2 Reset + PRST3 = 0x1 << 19 # Pipe 3 Reset + PRST4 = 0x1 << 20 # Pipe 4 Reset + PRST5 = 0x1 << 21 # Pipe 5 Reset + PRST6 = 0x1 << 22 # Pipe 6 Reset + PRST7 = 0x1 << 23 # Pipe 7 Reset + PRST8 = 0x1 << 24 # Pipe 8 Reset + +class HSTFNUM(IntEnum): + MFNUM = 0x7 << 0 # Micro Frame Number + FNUM = 0x7ff << 3 # Frame Number + FLENHIGH = 0xff << 16 # Frame Length + +class HSTADDR1(IntEnum): + HSTADDRP0 = 0x7f << 0 # USB Host Address + HSTADDRP1 = 0x7f << 8 # USB Host Address + HSTADDRP2 = 0x7f << 16 # USB Host Address + HSTADDRP3 = 0x7f << 24 # USB Host Address + +class HSTADDR2(IntEnum): + HSTADDRP4 = 0x7f << 0 # USB Host Address + HSTADDRP5 = 0x7f << 8 # USB Host Address + HSTADDRP6 = 0x7f << 16 # USB Host Address + HSTADDRP7 = 0x7f << 24 # USB Host Address + +class HSTADDR3(IntEnum): + HSTADDRP8 = 0x7f << 0 # USB Host Address + HSTADDRP9 = 0x7f << 8 # USB Host Address + +class HSTPIPCFG(IntEnum): + ALLOC = 0x1 << 1 # Pipe Memory Allocate + PBK = 0x3 << 2 # Pipe Banks + PSIZE = 0x7 << 4 # Pipe Size + PTOKEN = 0x3 << 8 # Pipe Token + AUTOSW = 0x1 << 10 # Automatic Switch + PTYPE = 0x3 << 12 # Pipe Type + PEPNUM = 0xf << 16 # Pipe Endpoint Number + PINGEN = 0x1 << 20 # Ping Enable + INTFRQ = 0xff << 24 # Pipe Interrupt Request Frequency + BINTERVAL = 0xff << 24 # bInterval parameter for the Bulk-Out/Ping transaction + +class HSTPIPISR(IntEnum): + RXINI = 0x1 << 0 # Received IN Data Interrupt + TXOUTI = 0x1 << 1 # Transmitted OUT Data Interrupt + TXSTPI = 0x1 << 2 # Transmitted SETUP Interrupt + UNDERFI = 0x1 << 2 # Underflow Interrupt + PERRI = 0x1 << 3 # Pipe Error Interrupt + NAKEDI = 0x1 << 4 # NAKed Interrupt + OVERFI = 0x1 << 5 # Overflow Interrupt + RXSTALLDI = 0x1 << 6 # Received STALLed Interrupt + CRCERRI = 0x1 << 6 # CRC Error Interrupt + SHORTPACKETI = 0x1 << 7 # Short Packet Interrupt + DTSEQ = 0x3 << 8 # Data Toggle Sequence + NBUSYBK = 0x3 << 12 # Number of Busy Banks + CURRBK = 0x3 << 14 # Current Bank + RWALL = 0x1 << 16 # Read-write Allowed + CFGOK = 0x1 << 18 # Configuration OK Status + PBYCT = 0x7ff << 20 # Pipe Byte Count + +class HSTPIPICR(IntEnum): + RXINIC = 0x1 << 0 # Received IN Data Interrupt Clear + TXOUTIC = 0x1 << 1 # Transmitted OUT Data Interrupt Clear + TXSTPIC = 0x1 << 2 # Transmitted SETUP Interrupt Clear + UNDERFIC = 0x1 << 2 # Underflow Interrupt Clear + NAKEDIC = 0x1 << 4 # NAKed Interrupt Clear + OVERFIC = 0x1 << 5 # Overflow Interrupt Clear + RXSTALLDIC = 0x1 << 6 # Received STALLed Interrupt Clear + CRCERRIC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETIC = 0x1 << 7 # Short Packet Interrupt Clear + +class HSTPIPIFR(IntEnum): + RXINIS = 0x1 << 0 # Received IN Data Interrupt Set + TXOUTIS = 0x1 << 1 # Transmitted OUT Data Interrupt Set + TXSTPIS = 0x1 << 2 # Transmitted SETUP Interrupt Set + UNDERFIS = 0x1 << 2 # Underflow Interrupt Set + PERRIS = 0x1 << 3 # Pipe Error Interrupt Set + NAKEDIS = 0x1 << 4 # NAKed Interrupt Set + OVERFIS = 0x1 << 5 # Overflow Interrupt Set + RXSTALLDIS = 0x1 << 6 # Received STALLed Interrupt Set + CRCERRIS = 0x1 << 6 # CRC Error Interrupt Set + SHORTPACKETIS = 0x1 << 7 # Short Packet Interrupt Set + NBUSYBKS = 0x1 << 12 # Number of Busy Banks Set + +class HSTPIPIMR(IntEnum): + RXINE = 0x1 << 0 # Received IN Data Interrupt Enable + TXOUTE = 0x1 << 1 # Transmitted OUT Data Interrupt Enable + TXSTPE = 0x1 << 2 # Transmitted SETUP Interrupt Enable + UNDERFIE = 0x1 << 2 # Underflow Interrupt Enable + PERRE = 0x1 << 3 # Pipe Error Interrupt Enable + NAKEDE = 0x1 << 4 # NAKed Interrupt Enable + OVERFIE = 0x1 << 5 # Overflow Interrupt Enable + RXSTALLDE = 0x1 << 6 # Received STALLed Interrupt Enable + CRCERRE = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETIE = 0x1 << 7 # Short Packet Interrupt Enable + NBUSYBKE = 0x1 << 12 # Number of Busy Banks Interrupt Enable + FIFOCON = 0x1 << 14 # FIFO Control + PDISHDMA = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Enable + PFREEZE = 0x1 << 17 # Pipe Freeze + RSTDT = 0x1 << 18 # Reset Data Toggle + +class HSTPIPIER(IntEnum): + RXINES = 0x1 << 0 # Received IN Data Interrupt Enable + TXOUTES = 0x1 << 1 # Transmitted OUT Data Interrupt Enable + TXSTPES = 0x1 << 2 # Transmitted SETUP Interrupt Enable + UNDERFIES = 0x1 << 2 # Underflow Interrupt Enable + PERRES = 0x1 << 3 # Pipe Error Interrupt Enable + NAKEDES = 0x1 << 4 # NAKed Interrupt Enable + OVERFIES = 0x1 << 5 # Overflow Interrupt Enable + RXSTALLDES = 0x1 << 6 # Received STALLed Interrupt Enable + CRCERRES = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETIES = 0x1 << 7 # Short Packet Interrupt Enable + NBUSYBKES = 0x1 << 12 # Number of Busy Banks Enable + PDISHDMAS = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Enable + PFREEZES = 0x1 << 17 # Pipe Freeze Enable + RSTDTS = 0x1 << 18 # Reset Data Toggle Enable + +class HSTPIPIDR(IntEnum): + RXINEC = 0x1 << 0 # Received IN Data Interrupt Disable + TXOUTEC = 0x1 << 1 # Transmitted OUT Data Interrupt Disable + TXSTPEC = 0x1 << 2 # Transmitted SETUP Interrupt Disable + UNDERFIEC = 0x1 << 2 # Underflow Interrupt Disable + PERREC = 0x1 << 3 # Pipe Error Interrupt Disable + NAKEDEC = 0x1 << 4 # NAKed Interrupt Disable + OVERFIEC = 0x1 << 5 # Overflow Interrupt Disable + RXSTALLDEC = 0x1 << 6 # Received STALLed Interrupt Disable + CRCERREC = 0x1 << 6 # CRC Error Interrupt Disable + SHORTPACKETIEC = 0x1 << 7 # Short Packet Interrupt Disable + NBUSYBKEC = 0x1 << 12 # Number of Busy Banks Disable + FIFOCONC = 0x1 << 14 # FIFO Control Disable + PDISHDMAC = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Disable + PFREEZEC = 0x1 << 17 # Pipe Freeze Disable + +class HSTPIPINRQ(IntEnum): + INRQ = 0xff << 0 # IN Request Number before Freeze + INMODE = 0x1 << 8 # IN Request Mode + +class HSTPIPERR(IntEnum): + DATATGL = 0x1 << 0 # Data Toggle Error + DATAPID = 0x1 << 1 # Data PID Error + PID = 0x1 << 2 # PID Error + TIMEOUT = 0x1 << 3 # Time-Out Error + CRC16 = 0x1 << 4 # CRC16 Error + COUNTER = 0x3 << 5 # Error Counter + +class HSTDMANXTDSC1(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS1(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC2(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS2(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC3(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS3(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC4(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS4(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC5(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS5(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC6(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS6(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC7(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS7(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class CTRL(IntEnum): + IDTE = 0x1 << 0 # ID Transition Interrupt Enable + VBUSTE = 0x1 << 1 # VBus Transition Interrupt Enable + SRPE = 0x1 << 2 # SRP Interrupt Enable + VBERRE = 0x1 << 3 # VBus Error Interrupt Enable + BCERRE = 0x1 << 4 # B-Connection Error Interrupt Enable + ROLEEXE = 0x1 << 5 # Role Exchange Interrupt Enable + HNPERRE = 0x1 << 6 # HNP Error Interrupt Enable + STOE = 0x1 << 7 # Suspend Time-Out Interrupt Enable + VBUSHWC = 0x1 << 8 # VBus Hardware Control + SRPSEL = 0x1 << 9 # SRP Selection + SRPREQ = 0x1 << 10 # SRP Request + HNPREQ = 0x1 << 11 # HNP Request + OTGPADE = 0x1 << 12 # OTG Pad Enable + VBUSPO = 0x1 << 13 # VBus Polarity Off + FRZCLK = 0x1 << 14 # Freeze USB Clock + USBE = 0x1 << 15 # UOTGHS Enable + TIMVALUE = 0x3 << 16 # Timer Value + TIMPAGE = 0x3 << 20 # Timer Page + UNLOCK = 0x1 << 22 # Timer Access Unlock + UIDE = 0x1 << 24 # UOTGID Pin Enable + UIMOD = 0x1 << 25 # UOTGHS Mode + +class SR(IntEnum): + IDTI = 0x1 << 0 # ID Transition Interrupt + VBUSTI = 0x1 << 1 # VBus Transition Interrupt + SRPI = 0x1 << 2 # SRP Interrupt + VBERRI = 0x1 << 3 # VBus Error Interrupt + BCERRI = 0x1 << 4 # B-Connection Error Interrupt + ROLEEXI = 0x1 << 5 # Role Exchange Interrupt + HNPERRI = 0x1 << 6 # HNP Error Interrupt + STOI = 0x1 << 7 # Suspend Time-Out Interrupt + VBUSRQ = 0x1 << 9 # VBus Request + ID = 0x1 << 10 # UOTGID Pin State + VBUS = 0x1 << 11 # VBus Level + SPEED = 0x3 << 12 # Speed Status + CLKUSABLE = 0x1 << 14 # UTMI Clock Usable + +class SCR(IntEnum): + IDTIC = 0x1 << 0 # ID Transition Interrupt Clear + VBUSTIC = 0x1 << 1 # VBus Transition Interrupt Clear + SRPIC = 0x1 << 2 # SRP Interrupt Clear + VBERRIC = 0x1 << 3 # VBus Error Interrupt Clear + BCERRIC = 0x1 << 4 # B-Connection Error Interrupt Clear + ROLEEXIC = 0x1 << 5 # Role Exchange Interrupt Clear + HNPERRIC = 0x1 << 6 # HNP Error Interrupt Clear + STOIC = 0x1 << 7 # Suspend Time-Out Interrupt Clear + VBUSRQC = 0x1 << 9 # VBus Request Clear + +class SFR(IntEnum): + IDTIS = 0x1 << 0 # ID Transition Interrupt Set + VBUSTIS = 0x1 << 1 # VBus Transition Interrupt Set + SRPIS = 0x1 << 2 # SRP Interrupt Set + VBERRIS = 0x1 << 3 # VBus Error Interrupt Set + BCERRIS = 0x1 << 4 # B-Connection Error Interrupt Set + ROLEEXIS = 0x1 << 5 # Role Exchange Interrupt Set + HNPERRIS = 0x1 << 6 # HNP Error Interrupt Set + STOIS = 0x1 << 7 # Suspend Time-Out Interrupt Set + VBUSRQS = 0x1 << 9 # VBus Request Set + +class FSM(IntEnum): + DRDSTATE = 0xf << 0 # + From 08fa6e0d7eecb7bbcf089ece7b8c4427e0a7a2e6 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:34:37 +0800 Subject: [PATCH 49/66] Add SAM3xa char peripheral --- qiling/hw/char/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/qiling/hw/char/__init__.py b/qiling/hw/char/__init__.py index 5b2e40b8..444f179f 100644 --- a/qiling/hw/char/__init__.py +++ b/qiling/hw/char/__init__.py @@ -5,4 +5,6 @@ from .stm32f1xx_usart import STM32F1xxUsart from .stm32f4xx_usart import STM32F4xxUsart -from .gd32vf1xx_usart import GD32VF1xxUsart \ No newline at end of file +from .gd32vf1xx_usart import GD32VF1xxUsart +from .sam3xa_uotghs import SAM3xaUotghs +from .sam3xa_uart import SAM3xaUart From 1c7b126f35a0e67c6eb9f86f5a9af4bacb43875f Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:34:46 +0800 Subject: [PATCH 50/66] Add SAM3xa PDC (DMA) --- qiling/hw/dma/__init__.py | 1 + qiling/hw/dma/sam3xa_pdc.py | 29 +++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 qiling/hw/dma/sam3xa_pdc.py diff --git a/qiling/hw/dma/__init__.py b/qiling/hw/dma/__init__.py index 8767eeca..2f5ea331 100644 --- a/qiling/hw/dma/__init__.py +++ b/qiling/hw/dma/__init__.py @@ -3,6 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .sam3xa_pdc import SAM3xaPdc from .stm32f1xx_dma import STM32F1xxDma from .stm32f4xx_dma import STM32F4xxDma from .gd32vf1xx_dma import GD32VF1xxDma \ No newline at end of file diff --git a/qiling/hw/dma/sam3xa_pdc.py b/qiling/hw/dma/sam3xa_pdc.py new file mode 100644 index 00000000..d68079a5 --- /dev/null +++ b/qiling/hw/dma/sam3xa_pdc.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaPdc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("RPR" , ctypes.c_uint32), # (Pdc Offset: 0x0) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Pdc Offset: 0x4) Receive Counter Register + ("TPR" , ctypes.c_uint32), # (Pdc Offset: 0x8) Transmit Pointer Register + ("TCR" , ctypes.c_uint32), # (Pdc Offset: 0xC) Transmit Counter Register + ("RNPR", ctypes.c_uint32), # (Pdc Offset: 0x10) Receive Next Pointer Register + ("RNCR", ctypes.c_uint32), # (Pdc Offset: 0x14) Receive Next Counter Register + ("TNPR", ctypes.c_uint32), # (Pdc Offset: 0x18) Transmit Next Pointer Register + ("TNCR", ctypes.c_uint32), # (Pdc Offset: 0x1C) Transmit Next Counter Register + ("PTCR", ctypes.c_uint32), # (Pdc Offset: 0x20) Transfer Control Register + ("PTSR", ctypes.c_uint32), # (Pdc Offset: 0x24) Transfer Status Register + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.pdc = self.struct() From 354dcabecb97b73428fa644d6fc4ccb02ce114c0 Mon Sep 17 00:00:00 2001 From: dataisland Date: Wed, 9 Feb 2022 12:34:58 +0800 Subject: [PATCH 51/66] Add SAM3xa PIO (GPIO) --- qiling/hw/gpio/__init__.py | 3 +- qiling/hw/gpio/sam3xa_pio.py | 76 ++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 qiling/hw/gpio/sam3xa_pio.py diff --git a/qiling/hw/gpio/__init__.py b/qiling/hw/gpio/__init__.py index ae794314..ecc8c804 100644 --- a/qiling/hw/gpio/__init__.py +++ b/qiling/hw/gpio/__init__.py @@ -6,4 +6,5 @@ from .stm32f1xx_gpio import STM32F1xxGpio from .stm32f1xx_afio import STM32F1xxAfio from .stm32f4xx_gpio import STM32F4xxGpio -from .gd32vf1xx_gpio import GD32VF1xxGpio \ No newline at end of file +from .gd32vf1xx_gpio import GD32VF1xxGpio +from .sam3xa_pio import SAM3xaPio diff --git a/qiling/hw/gpio/sam3xa_pio.py b/qiling/hw/gpio/sam3xa_pio.py new file mode 100644 index 00000000..11fa572d --- /dev/null +++ b/qiling/hw/gpio/sam3xa_pio.py @@ -0,0 +1,76 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes +from qiling.hw.gpio.hooks import GpioHooks +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaPio(QlPeripheral, GpioHooks): + class Type(ctypes.Structure): + _fields_ = [ + ("PER" , ctypes.c_uint32), # (Pio Offset: 0x0000) PIO Enable Register + ("PDR" , ctypes.c_uint32), # (Pio Offset: 0x0004) PIO Disable Register + ("PSR" , ctypes.c_uint32), # (Pio Offset: 0x0008) PIO Status Register + ("Reserved1" , ctypes.c_uint32), # + ("OER" , ctypes.c_uint32), # (Pio Offset: 0x0010) Output Enable Register + ("ODR" , ctypes.c_uint32), # (Pio Offset: 0x0014) Output Disable Register + ("OSR" , ctypes.c_uint32), # (Pio Offset: 0x0018) Output Status Register + ("Reserved2" , ctypes.c_uint32), # + ("IFER" , ctypes.c_uint32), # (Pio Offset: 0x0020) Glitch Input Filter Enable Register + ("IFDR" , ctypes.c_uint32), # (Pio Offset: 0x0024) Glitch Input Filter Disable Register + ("IFSR" , ctypes.c_uint32), # (Pio Offset: 0x0028) Glitch Input Filter Status Register + ("Reserved3" , ctypes.c_uint32), # + ("SODR" , ctypes.c_uint32), # (Pio Offset: 0x0030) Set Output Data Register + ("CODR" , ctypes.c_uint32), # (Pio Offset: 0x0034) Clear Output Data Register + ("ODSR" , ctypes.c_uint32), # (Pio Offset: 0x0038) Output Data Status Register + ("PDSR" , ctypes.c_uint32), # (Pio Offset: 0x003C) Pin Data Status Register + ("IER" , ctypes.c_uint32), # (Pio Offset: 0x0040) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Pio Offset: 0x0044) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Pio Offset: 0x0048) Interrupt Mask Register + ("ISR" , ctypes.c_uint32), # (Pio Offset: 0x004C) Interrupt Status Register + ("MDER" , ctypes.c_uint32), # (Pio Offset: 0x0050) Multi-driver Enable Register + ("MDDR" , ctypes.c_uint32), # (Pio Offset: 0x0054) Multi-driver Disable Register + ("MDSR" , ctypes.c_uint32), # (Pio Offset: 0x0058) Multi-driver Status Register + ("Reserved4" , ctypes.c_uint32), # + ("PUDR" , ctypes.c_uint32), # (Pio Offset: 0x0060) Pull-up Disable Register + ("PUER" , ctypes.c_uint32), # (Pio Offset: 0x0064) Pull-up Enable Register + ("PUSR" , ctypes.c_uint32), # (Pio Offset: 0x0068) Pad Pull-up Status Register + ("Reserved5" , ctypes.c_uint32), # + ("ABSR" , ctypes.c_uint32), # (Pio Offset: 0x0070) Peripheral AB Select Register + ("Reserved6" , ctypes.c_uint32 * 3), # + ("SCIFSR" , ctypes.c_uint32), # (Pio Offset: 0x0080) System Clock Glitch Input Filter Select Register + ("DIFSR" , ctypes.c_uint32), # (Pio Offset: 0x0084) Debouncing Input Filter Select Register + ("IFDGSR" , ctypes.c_uint32), # (Pio Offset: 0x0088) Glitch or Debouncing Input Filter Clock Selection Status Register + ("SCDR" , ctypes.c_uint32), # (Pio Offset: 0x008C) Slow Clock Divider Debouncing Register + ("Reserved7" , ctypes.c_uint32 * 4), # + ("OWER" , ctypes.c_uint32), # (Pio Offset: 0x00A0) Output Write Enable + ("OWDR" , ctypes.c_uint32), # (Pio Offset: 0x00A4) Output Write Disable + ("OWSR" , ctypes.c_uint32), # (Pio Offset: 0x00A8) Output Write Status Register + ("Reserved8" , ctypes.c_uint32), # + ("AIMER" , ctypes.c_uint32), # (Pio Offset: 0x00B0) Additional Interrupt Modes Enable Register + ("AIMDR" , ctypes.c_uint32), # (Pio Offset: 0x00B4) Additional Interrupt Modes Disables Register + ("AIMMR" , ctypes.c_uint32), # (Pio Offset: 0x00B8) Additional Interrupt Modes Mask Register + ("Reserved9" , ctypes.c_uint32), # + ("ESR" , ctypes.c_uint32), # (Pio Offset: 0x00C0) Edge Select Register + ("LSR" , ctypes.c_uint32), # (Pio Offset: 0x00C4) Level Select Register + ("ELSR" , ctypes.c_uint32), # (Pio Offset: 0x00C8) Edge/Level Status Register + ("Reserved10", ctypes.c_uint32), # + ("FELLSR" , ctypes.c_uint32), # (Pio Offset: 0x00D0) Falling Edge/Low Level Select Register + ("REHLSR" , ctypes.c_uint32), # (Pio Offset: 0x00D4) Rising Edge/ High Level Select Register + ("FRLHSR" , ctypes.c_uint32), # (Pio Offset: 0x00D8) Fall/Rise - Low/High Status Register + ("Reserved11", ctypes.c_uint32), # + ("LOCKSR" , ctypes.c_uint32), # (Pio Offset: 0x00E0) Lock Status + ("WPMR" , ctypes.c_uint32), # (Pio Offset: 0x00E4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Pio Offset: 0x00E8) Write Protect Status Register + ] + + def __init__(self, ql, label, intn = None): + QlPeripheral.__init__(self, ql, label) + GpioHooks.__init__(self, ql, 16) + + self.pio = self.struct() + self.intn = intn From 98452a841abf1247ac9ab186e7aaae5fe7fa74ea Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Wed, 9 Feb 2022 19:10:00 +0800 Subject: [PATCH 52/66] add jump hint --- qiling/debugger/qdb/frontend.py | 12 ++++++++---- qiling/debugger/qdb/qdb.py | 16 +++------------- qiling/debugger/qdb/utils.py | 24 ++++++++---------------- 3 files changed, 19 insertions(+), 33 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 03f584d8..5a3def3a 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -301,7 +301,7 @@ def print_asm(ql: Qiling, insn: CsInsn, to_jump: Optional[bool] = None, address: cursor = "►" jump_sign = " " - if to_jump and address != ql.reg.arch_pc+4: + if to_jump: jump_sign = f"{color.RED}✓{color.END}" print(f"{jump_sign} {cursor} {color.DARKGRAY}{trace_line}{color.END}") @@ -314,18 +314,22 @@ def context_asm(ql: Qiling, address: int) -> None: if ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): past_list = [] - # assembly before current location + # assembly for current location line = disasm(ql, address) + to_jump, next_stop = handle_bnj(ql, address) + print_asm(ql, line, to_jump=to_jump) + + # assembly after current location + acc_size = line.size while line and len(past_list) != 10: - past_list.append(line) next_start = address + acc_size line = disasm(ql, next_start) acc_size += line.size + past_list.append(line) - # print four insns before current location for line in past_list[:-1]: print_asm(ql, line) diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 541e8d68..16734953 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -40,16 +40,6 @@ class QlQdb(cmd.Cmd, QlDebugger): # self.ql.loader.entry_point # ld.so # self.ql.loader.elf_entry # .text of binary - if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - # def pause(ql, addr, size): - # data = ql.mem.read(addr, size) - # ql.disassembler.detail = True - # breakpoint() - # ret = next(ql.disassembler.disasm(data, addr)) - # print(ret) - - self.ql.hook_code(handle_bnj) - if init_hook and self.ql.loader.entry_point != init_hook: self.do_breakpoint(init_hook) @@ -232,10 +222,10 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._save() - # _, next_stop = handle_bnj(self.ql, self.cur_addr) + _, next_stop = handle_bnj(self.ql, self.cur_addr) - # if next_stop is CODE_END: - # return True + if next_stop is CODE_END: + return True if self.ql.archtype == QL_ARCH.CORTEX_M: self.ql.arch.step() diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index 8e2715a9..90bff673 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -112,14 +112,14 @@ def signed_val(val: int) -> int: # handle braches and jumps so we can set berakpoint properly -def handle_bnj(ql: Qiling, cur_addr: str, size: int) -> Callable[[Qiling, str], int]: +def handle_bnj(ql: Qiling, cur_addr: str) -> Callable[[Qiling, str], int]: return { QL_ARCH.MIPS : handle_bnj_mips, QL_ARCH.ARM : handle_bnj_arm, QL_ARCH.ARM_THUMB: handle_bnj_arm, QL_ARCH.CORTEX_M : handle_bnj_arm, QL_ARCH.X86 : handle_bnj_x86, - }.get(ql.archtype)(ql, cur_addr, size) + }.get(ql.archtype)(ql, cur_addr) def get_cpsr(bits: int) -> (bool, bool, bool, bool): @@ -141,15 +141,6 @@ def get_x86_eflags(bits: int) -> Dict[str, bool]: "OF" : bits & 0x0800 != 0, # OF, overflow flag } -def get_eflags(bits: int) -> (bool, bool, bool, bool, bool, bool): - return ( - bits & 0x0001 != 0, # CF, carry flag - bits & 0x0004 != 0, # PF, parity flag - bits & 0x0010 != 0, # AF, adjust flag - bits & 0x0040 != 0, # ZF, zero flag - bits & 0x0080 != 0, # SF, sign flag - bits & 0x0800 != 0, # OF, overflow flag - ) def is_thumb(bits: int) -> bool: return bits & 0x00000020 != 0 @@ -196,15 +187,14 @@ def _read_inst(ql: Qiling, addr: int) -> int: return result -def handle_bnj_x86(ql: Qilng, cur_addr: str, size: int) -> (bool, int): + +def handle_bnj_x86(ql: Qilng, cur_addr: str) -> (bool, int): # FIXME: NO HANDLE BRANCH AND JUMP FOR X86 FOR NOW ret_addr = None - md = ql.disassembler - data = ql.mem.read(cur_addr, size) - line = next(md.disasm(data, cur_addr)) + line = disasm(ql, cur_addr) jump_table = { @@ -256,12 +246,14 @@ def handle_bnj_x86(ql: Qilng, cur_addr: str, size: int) -> (bool, int): # unconditional jump "call" : (lambda *_: True), + "jmp" : (lambda *_: True), } to_jump = False if line.mnemonic in jump_table: - to_jump = jump_table.get(line.mnemonic)(*get_eflags(ql.reg.ef)) + eflags = get_x86_eflags(ql.reg.ef).values() + to_jump = jump_table.get(line.mnemonic)(*eflags) return (to_jump, ret_addr) From 3b865bf1f6ce58ce1debecd1912b9fda9d75afa9 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Thu, 10 Feb 2022 01:59:05 +0800 Subject: [PATCH 53/66] massive refactor --- qiling/debugger/qdb/frontend.py | 549 +++++++++++++--------- qiling/debugger/qdb/qdb.py | 25 +- qiling/debugger/qdb/utils.py | 806 +++++++++++++++----------------- 3 files changed, 734 insertions(+), 646 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 5a3def3a..4f9e5e61 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -13,9 +13,22 @@ from qiling.const import QL_ARCH import unicorn -from .utils import dump_regs, get_x86_eflags, get_arm_flags, disasm, _parse_int, handle_bnj from .const import * +from .utils import disasm, get_x86_eflags, setup_branch_predictor +def setup_ctx_manager(ql: Qiling) -> CtxManager: + + if ql.archtype == QL_ARCH.MIPS: + return CtxManager_MIPS(ql) + + elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): + return CtxManager_ARM(ql) + + elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + return CtxManager_X86(ql) + + elif ql.archtype == QL_ARCH.CORTEX_M: + return CtxManager_CORTEX_M(ql) # read data from memory of qiling instance def examine_mem(ql: Qiling, line: str) -> Union[bool, (str, int, int)]: @@ -146,228 +159,348 @@ def _try_read(ql: Qiling, address: int, size: int) -> Optional[bytes]: return (result, err_msg) +""" + + Context Manager for rendering UI + +""" + +COLORS = (color.DARKCYAN, color.BLUE, color.RED, color.YELLOW, color.GREEN, color.PURPLE, color.CYAN, color.WHITE) + # divider printer -@contextmanager -def context_printer(ql: Qiling, field_name: str, ruler: str = "─") -> None: - height, width = get_terminal_size() - bar = (width - len(field_name)) // 2 - 1 - print(ruler * bar, field_name, ruler * bar) - yield - if "DISASM" in field_name: - print(ruler * width) +def context_printer(field_name, ruler="─"): + def decorator(context_dumper): + def wrapper(*args, **kwargs): + height, width = get_terminal_size() + bar = (width - len(field_name)) // 2 - 1 + print(ruler * bar, field_name, ruler * bar) + context_dumper(*args, **kwargs) + if "DISASM" in field_name: + print(ruler * width) + return wrapper + return decorator +class CtxManager(object): -def context_reg(ql: Qiling, saved_states: Optional[Mapping[str, int]] = None, /, *args, **kwargs) -> None: + def __init__(self, ql): + self.ql = ql + self.predictor = setup_branch_predictor(ql) - # context render for registers - with context_printer(ql, "[ REGISTERS ]"): - - _cur_regs = dump_regs(ql) - - _colors = (color.DARKCYAN, color.BLUE, color.RED, color.YELLOW, color.GREEN, color.PURPLE, color.CYAN, color.WHITE) - - if ql.archtype == QL_ARCH.MIPS: - - _cur_regs.update({"fp": _cur_regs.pop("s8")}) - - if saved_states is not None: - _saved_states = copy.deepcopy(saved_states) - _saved_states.update({"fp": _saved_states.pop("s8")}) - _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] - - else: - _diff = None - - lines = "" - for idx, r in enumerate(_cur_regs, 1): - line = "{}{}: 0x{{:08x}} {}\t".format(_colors[(idx-1) // 4], r, color.END) - - if _diff and r in _diff: - line = f"{color.UNDERLINE}{color.BOLD}{line}" - - if idx % 4 == 0 and idx != 32: - line += "\n" - - lines += line - - print(lines.format(*_cur_regs.values())) - - elif ql.archtype == QL_ARCH.X86: - - if saved_states is not None: - _saved_states = copy.deepcopy(saved_states) - _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] - - else: - _diff = None - - lines = "" - for idx, r in enumerate(_cur_regs, 1): - if len(r) == 2: - line = "{}{}: 0x{{:08x}} {}\t\t".format(_colors[(idx-1) // 4], r, color.END) - else: - line = "{}{}: 0x{{:08x}} {}\t".format(_colors[(idx-1) // 4], r, color.END) - - if _diff and r in _diff: - line = f"{color.UNDERLINE}{color.BOLD}{line}" - - if idx % 4 == 0 and idx != 32: - line += "\n" - - lines += line - - print(lines.format(*_cur_regs.values())) - print(color.GREEN, "EFLAGS: [CF: {flags[CF]}, PF: {flags[PF]}, AF: {flags[AF]}, ZF: {flags[ZF]}, SF: {flags[SF]}, OF: {flags[OF]}]".format(flags=get_x86_eflags(ql.reg.ef)), color.END, sep="") - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): - - _cur_regs.update({"sl": _cur_regs.pop("r10")}) - _cur_regs.update({"ip": _cur_regs.pop("r12")}) - _cur_regs.update({"fp": _cur_regs.pop("r11")}) - - regs_in_row = 4 - if ql.archtype == QL_ARCH.CORTEX_M: - regs_in_row = 3 - - # for re-order - _cur_regs.update({"xpsr": _cur_regs.pop("xpsr")}) - _cur_regs.update({"control": _cur_regs.pop("control")}) - _cur_regs.update({"primask": _cur_regs.pop("primask")}) - _cur_regs.update({"faultmask": _cur_regs.pop("faultmask")}) - _cur_regs.update({"basepri": _cur_regs.pop("basepri")}) - - _diff = None - if saved_states is not None: - _saved_states = copy.deepcopy(saved_states) - _saved_states.update({"sl": _saved_states.pop("r10")}) - _saved_states.update({"ip": _saved_states.pop("r12")}) - _saved_states.update({"fp": _saved_states.pop("r11")}) - _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] - - lines = "" - for idx, r in enumerate(_cur_regs, 1): - - line = "{}{:}: 0x{{:08x}} {} ".format(_colors[(idx-1) // regs_in_row], r, color.END) - - if _diff and r in _diff: - line = "{}{}".format(color.UNDERLINE, color.BOLD) + line - - if idx % regs_in_row == 0: - line += "\n" - - lines += line - - print(lines.format(*_cur_regs.values())) - print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=get_arm_flags(ql.reg.cpsr)), color.END, sep="") - - if ql.archtype != QL_ARCH.CORTEX_M: - # context render for Stack, skip this for CORTEX_M - with context_printer(ql, "[ STACK ]", ruler="─"): - - for idx in range(10): - addr = ql.reg.arch_sp + idx * ql.pointersize - val = ql.mem.read(addr, ql.pointersize) - print(f"$sp+0x{idx*ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{ql.unpack(val):08x}", end="") - - # try to dereference wether it's a pointer - if (buf := _try_read(ql, addr, ql.pointersize))[0] is not None: - - if (addr := ql.unpack(buf[0])): - - # try to dereference again - if (buf := _try_read(ql, addr, ql.pointersize))[0] is not None: - try: - s = ql.mem.string(addr) - except: - s = None - - if s and s.isprintable(): - print(f" ◂— {ql.mem.string(addr)}", end="") - else: - print(f" ◂— 0x{ql.unpack(buf[0]):08x}", end="") - print() - - -def print_asm(ql: Qiling, insn: CsInsn, to_jump: Optional[bool] = None, address: int = None) -> None: - - opcode = "".join(f"{b:02x}" for b in insn.bytes) - if ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - trace_line = f"0x{insn.address:08x} │ {opcode:20s} {insn.mnemonic:10} {insn.op_str:35s}" - else: - trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" - - cursor = " " - if ql.reg.arch_pc == insn.address: - cursor = "►" - - jump_sign = " " - if to_jump: - jump_sign = f"{color.RED}✓{color.END}" - - print(f"{jump_sign} {cursor} {color.DARKGRAY}{trace_line}{color.END}") - - -def context_asm(ql: Qiling, address: int) -> None: - - with context_printer(ql, field_name="[ DISASM ]"): - - if ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - past_list = [] - - # assembly for current location - - line = disasm(ql, address) - to_jump, next_stop = handle_bnj(ql, address) - print_asm(ql, line, to_jump=to_jump) - - # assembly after current location - - acc_size = line.size - - while line and len(past_list) != 10: - next_start = address + acc_size - line = disasm(ql, next_start) - acc_size += line.size - past_list.append(line) - - for line in past_list[:-1]: - print_asm(ql, line) + def print_asm(self, insn: CsInsn, to_jump: Optional[bool] = None, address: int = None) -> None: + opcode = "".join(f"{b:02x}" for b in insn.bytes) + if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + trace_line = f"0x{insn.address:08x} │ {opcode:20s} {insn.mnemonic:10} {insn.op_str:35s}" else: + trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" - # assembly before current location + cursor = " " + if self.ql.reg.arch_pc == insn.address: + cursor = "►" - past_list = [] + jump_sign = " " + if to_jump: + jump_sign = f"{color.RED}✓{color.END}" - line = disasm(ql, address-0x10) + print(f"{jump_sign} {cursor} {color.DARKGRAY}{trace_line}{color.END}") - while line: - if line.address == address: - break + def dump_regs(self): + return {reg_name: getattr(self.ql.reg, reg_name) for reg_name in self.regs} - addr = line.address + line.size - line = disasm(ql, addr) + def context_reg(self, saved_states): + return NotImplementedError - if not line: - break + @context_printer("[ STACK ]") + def context_stack(self): - past_list.append(line) + for idx in range(10): + addr = self.ql.reg.arch_sp + idx * self.ql.pointersize + val = self.ql.mem.read(addr, self.ql.pointersize) + print(f"$sp+0x{idx*self.ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{self.ql.unpack(val):08x}", end="") - # print four insns before current location - for line in past_list[:-1][:4]: - print_asm(ql, line) + # try to dereference wether it's a pointer + if (buf := _try_read(self.ql, addr, self.ql.pointersize))[0] is not None: - # assembly for current location + if (addr := self.ql.unpack(buf[0])): - cur_ins = disasm(ql, address) - to_jump, next_stop = handle_bnj(ql, address) - print_asm(ql, cur_ins, to_jump=to_jump) + # try to dereference again + if (buf := _try_read(self.ql, addr, self.ql.pointersize))[0] is not None: + try: + s = self.ql.mem.string(addr) + except: + s = None - # assembly after current location + if s and s.isprintable(): + print(f" ◂— {self.ql.mem.string(addr)}", end="") + else: + print(f" ◂— 0x{self.ql.unpack(buf[0]):08x}", end="") + print() + + @context_printer("[ DISASM ]") + def context_asm(self): + # assembly before current location + past_list = [] + cur_addr = self.ql.reg.arch_pc + + line = disasm(self.ql, cur_addr-0x10) + + while line: + if line.address == cur_addr: + break + + addr = line.address + line.size + line = disasm(self.ql, addr) + + if not line: + break + + past_list.append(line) + + # print four insns before current location + for line in past_list[:-1][:4]: + self.print_asm(line) + + # assembly for current location + + cur_ins = disasm(self.ql, cur_addr) + to_jump, _ = self.predictor.predict() + self.print_asm(cur_ins, to_jump=to_jump) + + # assembly after current location + + forward_insn_size = cur_ins.size + for _ in range(5): + forward_insn = disasm(self.ql, cur_addr+forward_insn_size) + if forward_insn: + self.print_asm(forward_insn) + forward_insn_size += forward_insn.size + +class CtxManager_ARM(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "r0", "r1", "r2", "r3", + "r4", "r5", "r6", "r7", + "r8", "r9", "r10", "r11", + "r12", "sp", "lr", "pc", + ) + + @staticmethod + def get_flags(bits: int) -> Mapping[str, int]: + + def _get_mode(bits): + return { + 0b10000: "User", + 0b10001: "FIQ", + 0b10010: "IRQ", + 0b10011: "Supervisor", + 0b10110: "Monitor", + 0b10111: "Abort", + 0b11010: "Hypervisor", + 0b11011: "Undefined", + 0b11111: "System", + }.get(bits & 0x00001f) + + return { + "mode": _get_mode(bits), + "thumb": bits & 0x00000020 != 0, + "fiq": bits & 0x00000040 != 0, + "irq": bits & 0x00000080 != 0, + "neg": bits & 0x80000000 != 0, + "zero": bits & 0x40000000 != 0, + "carry": bits & 0x20000000 != 0, + "overflow": bits & 0x10000000 != 0, + } + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + cur_regs = self.dump_regs() + + cur_regs.update({"sl": cur_regs.pop("r10")}) + cur_regs.update({"ip": cur_regs.pop("r12")}) + cur_regs.update({"fp": cur_regs.pop("r11")}) + + regs_in_row = 4 + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"sl": reg_dump.pop("r10")}) + reg_dump.update({"ip": reg_dump.pop("r12")}) + reg_dump.update({"fp": reg_dump.pop("r11")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + + line = "{}{:}: 0x{{:08x}} {} ".format(COLORS[(idx-1) // regs_in_row], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % regs_in_row == 0: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=self.get_flags(self.ql.reg.cpsr)), color.END, sep="") + + +class CtxManager_MIPS(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "gp", "at", "v0", "v1", + "a0", "a1", "a2", "a3", + "t0", "t1", "t2", "t3", + "t4", "t5", "t6", "t7", + "t8", "t9", "sp", "s8", + "s0", "s1", "s2", "s3", + "s4", "s5", "s6", "s7", + "ra", "k0", "k1", "pc", + ) + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + + cur_regs = self.dump_regs() + + cur_regs.update({"fp": cur_regs.pop("s8")}) + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"fp": saved_reg_dump.pop("s8")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + line = "{}{}: 0x{{:08x}} {}\t".format(COLORS[(idx-1) // 4], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % 4 == 0 and idx != 32: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + +class CtxManager_X86(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "eax", "ebx", "ecx", "edx", + "esp", "ebp", "esi", "edi", + "eip", "ss", "cs", "ds", "es", + "fs", "gs", "ef", + ) + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + cur_regs = self.dump_regs() + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + diff = [k for k in cur_regs if cur_regs[k] != saved_reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + if len(r) == 2: + line = "{}{}: 0x{{:08x}} {}\t\t".format(COLORS[(idx-1) // 4], r, color.END) + else: + line = "{}{}: 0x{{:08x}} {}\t".format(COLORS[(idx-1) // 4], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % 4 == 0 and idx != 32: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + print(color.GREEN, "EFLAGS: [CF: {flags[CF]}, PF: {flags[PF]}, AF: {flags[AF]}, ZF: {flags[ZF]}, SF: {flags[SF]}, OF: {flags[OF]}]".format(flags=get_x86_eflags(self.ql.reg.ef)), color.END, sep="") + + @context_printer("[ DISASM ]") + def context_asm(self): + past_list = [] + cur_addr = self.ql.reg.arch_pc + + # assembly before current location + + line = disasm(self.ql, cur_addr) + acc_size = line.size + + while line and len(past_list) != 10: + past_list.append(line) + next_start = cur_addr + acc_size + line = disasm(self.ql, next_start) + acc_size += line.size + + # print four insns before current location + for line in past_list[:-1]: + self.print_asm(line) + + +class CtxManager_CORTEX_M(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "r0", "r1", "r2", "r3", + "r4", "r5", "r6", "r7", + "r8", "r9", "r10", "r11", + "r12", "sp", "lr", "pc", + "xpsr", "control", "primask", "basepri", "faultmask" + ) + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + + cur_regs.update({"sl": cur_regs.pop("r10")}) + cur_regs.update({"ip": cur_regs.pop("r12")}) + cur_regs.update({"fp": cur_regs.pop("r11")}) + + regs_in_row = 3 + + # for re-order + cur_regs.update({"xpsr": cur_regs.pop("xpsr")}) + cur_regs.update({"control": cur_regs.pop("control")}) + cur_regs.update({"primask": cur_regs.pop("primask")}) + cur_regs.update({"faultmask": cur_regs.pop("faultmask")}) + cur_regs.update({"basepri": cur_regs.pop("basepri")}) + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"sl": reg_dump.pop("r10")}) + reg_dump.update({"ip": reg_dump.pop("r12")}) + reg_dump.update({"fp": reg_dump.pop("r11")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(_cur_regs, 1): + + line = "{}{:}: 0x{{:08x}} {} ".format(_colors[(idx-1) // regs_in_row], r, color.END) + + if _diff and r in _diff: + line = "{}{}".format(color.UNDERLINE, color.BOLD) + line + + if idx % regs_in_row == 0: + line += "\n" + + lines += line + + print(lines.format(cur_regs.values())) + print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=get_arm_flags(self.ql.reg.cpsr)), color.END, sep="") + + +if __name__ == "__main__": + pass - forward_insn_size = cur_ins.size - for _ in range(5): - forward_insn = disasm(ql, address+forward_insn_size) - if forward_insn: - print_asm(ql, forward_insn) - forward_insn_size += forward_insn.size diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 16734953..a55b9d81 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -12,8 +12,9 @@ from qiling import Qiling from qiling.const import QL_ARCH, QL_VERBOSE from qiling.debugger import QlDebugger -from .frontend import context_reg, context_asm, examine_mem -from .utils import handle_bnj, is_thumb, CODE_END, parse_int +# from .frontend import context_reg, context_asm, examine_mem +from .frontend import examine_mem, setup_ctx_manager +from .utils import _parse_int, is_thumb, parse_int from .utils import Breakpoint, TempBreakpoint from .const import * @@ -31,6 +32,8 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._states_list = [] + self.ctx = setup_ctx_manager(ql) + super().__init__() self.dbg_hook(init_hook) @@ -191,8 +194,9 @@ class QlQdb(cmd.Cmd, QlDebugger): show context information for current location """ - context_reg(self.ql, self._saved_reg_dump) - context_asm(self.ql, self.cur_addr) + self.ctx.context_reg(self._saved_reg_dump) + self.ctx.context_stack() + self.ctx.context_asm() def do_backward(self: QlQdb, *args) -> None: """ @@ -222,22 +226,17 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._save() - _, next_stop = handle_bnj(self.ql, self.cur_addr) + # next_stop = self.predictor.predict() - if next_stop is CODE_END: - return True + # if next_stop is True: + # return True if self.ql.archtype == QL_ARCH.CORTEX_M: self.ql.arch.step() self.ql.count -= 1 else: - if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - count = 1 - else: - count = 1 if next_stop == self.cur_addr + 4 else 2 - - self._run(count=count) + self._run(count=1) self.do_context() diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index 90bff673..d93f8dfa 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -5,92 +5,15 @@ from __future__ import annotations from typing import Callable, Optional, Mapping -from functools import partial from qiling.const import * -CODE_END = True - - -def dump_regs(ql: Qiling) -> Mapping[str, int]: - - if ql.archtype == QL_ARCH.MIPS: - - _reg_order = ( - "gp", "at", "v0", "v1", - "a0", "a1", "a2", "a3", - "t0", "t1", "t2", "t3", - "t4", "t5", "t6", "t7", - "t8", "t9", "sp", "s8", - "s0", "s1", "s2", "s3", - "s4", "s5", "s6", "s7", - "ra", "k0", "k1", "pc", - ) - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): - - _reg_order = ( - "r0", "r1", "r2", "r3", - "r4", "r5", "r6", "r7", - "r8", "r9", "r10", "r11", - "r12", "sp", "lr", "pc", - ) - - elif ql.archtype == QL_ARCH.X86: - - _reg_order = ( - "eax", "ebx", "ecx", "edx", - "esp", "ebp", "esi", "edi", - "eip", "ss", "cs", "ds", "es", - "fs", "gs", "ef", - ) - - elif ql.archtype == QL_ARCH.CORTEX_M: - - _reg_order = ( - "r0", "r1", "r2", "r3", - "r4", "r5", "r6", "r7", - "r8", "r9", "r10", "r11", - "r12", "sp", "lr", "pc", - "xpsr", "control", "primask", "basepri", "faultmask" - ) - - return {reg_name: getattr(ql.reg, reg_name) for reg_name in _reg_order} - - -def get_arm_flags(bits: int) -> Mapping[str, int]: - - def _get_mode(bits): - return { - 0b10000: "User", - 0b10001: "FIQ", - 0b10010: "IRQ", - 0b10011: "Supervisor", - 0b10110: "Monitor", - 0b10111: "Abort", - 0b11010: "Hypervisor", - 0b11011: "Undefined", - 0b11111: "System", - }.get(bits & 0x00001f) - - return { - "mode": _get_mode(bits), - "thumb": bits & 0x00000020 != 0, - "fiq": bits & 0x00000040 != 0, - "irq": bits & 0x00000080 != 0, - "neg": bits & 0x80000000 != 0, - "zero": bits & 0x40000000 != 0, - "carry": bits & 0x20000000 != 0, - "overflow": bits & 0x10000000 != 0, - } - - # parse unsigned integer from string def _parse_int(s: str) -> int: return int(s, 0) -# function dectorator for parse argument as integer +# function dectorator for parsing argument as integer def parse_int(func: Callable) -> Callable: def wrap(qdb, s: str = "") -> int: assert type(s) is str @@ -101,27 +24,17 @@ def parse_int(func: Callable) -> Callable: return func(qdb, ret) return wrap + # check wether negative value or not def is_negative(i: int) -> int: return i & (1 << 31) -# convert valu to signed +# signed value convertion def signed_val(val: int) -> int: return (val-1 << 32) if is_negative(val) else val -# handle braches and jumps so we can set berakpoint properly -def handle_bnj(ql: Qiling, cur_addr: str) -> Callable[[Qiling, str], int]: - return { - QL_ARCH.MIPS : handle_bnj_mips, - QL_ARCH.ARM : handle_bnj_arm, - QL_ARCH.ARM_THUMB: handle_bnj_arm, - QL_ARCH.CORTEX_M : handle_bnj_arm, - QL_ARCH.X86 : handle_bnj_x86, - }.get(ql.archtype)(ql, cur_addr) - - def get_cpsr(bits: int) -> (bool, bool, bool, bool): return ( bits & 0x10000000 != 0, # V, overflow flag @@ -147,6 +60,9 @@ def is_thumb(bits: int) -> bool: def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: + """ + helper function for disassembling + """ md = ql.disassembler md.detail = detail @@ -160,7 +76,6 @@ def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: def _read_inst(ql: Qiling, addr: int) -> int: - result = ql.mem.read(addr, 4) if ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): @@ -187,357 +102,397 @@ def _read_inst(ql: Qiling, addr: int) -> int: return result +""" + Try to predict certian branch will be taken or not based on current context +""" -def handle_bnj_x86(ql: Qilng, cur_addr: str) -> (bool, int): +def setup_branch_predictor(ql: Qiling) -> BranchPredictor: - # FIXME: NO HANDLE BRANCH AND JUMP FOR X86 FOR NOW + if ql.archtype == QL_ARCH.MIPS: + return BranchPredictor_MIPS(ql) - ret_addr = None + elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): + return BranchPredictor_ARM(ql) - line = disasm(ql, cur_addr) + elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + return BranchPredictor_X86(ql) - jump_table = { + elif ql.archtype == QL_ARCH.CORTEX_M: + return BranchPredictor_CORTEX_M(ql) - # conditional jump - "jo" : (lambda C, P, A, Z, S, O: O == 1), - "jno" : (lambda C, P, A, Z, S, O: O == 0), +class BranchPredictor(object): + def __init__(self, ql): + self.ql = ql - "js" : (lambda C, P, A, Z, S, O: S == 1), - "jns" : (lambda C, P, A, Z, S, O: S == 0), + def read_reg(self, reg_name): + return NotImplementedError - "je" : (lambda C, P, A, Z, S, O: Z == 1), - "jz" : (lambda C, P, A, Z, S, O: Z == 1), + def resolve(self): + return NotImplementedError - "jne" : (lambda C, P, A, Z, S, O: Z == 0), - "jnz" : (lambda C, P, A, Z, S, O: Z == 0), +class BranchPredictor_ARM(BranchPredictor): + def __init__(self, ql): + super().__init__(ql) - "jb" : (lambda C, P, A, Z, S, O: C == 1), - "jc" : (lambda C, P, A, Z, S, O: C == 1), - "jnae" : (lambda C, P, A, Z, S, O: C == 1), + self.INST_SIZE = 4 + self.THUMB_INST_SIZE = 2 + self.CODE_END = "udf" - "jnb" : (lambda C, P, A, Z, S, O: C == 0), - "jnc" : (lambda C, P, A, Z, S, O: C == 0), - "jae" : (lambda C, P, A, Z, S, O: C == 0), + def read_reg(self, reg_name): + reg_name = reg_name.replace("ip", "r12").replace("fp", "r11") + return getattr(self.ql.reg, reg_name) - "jbe" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), - "jna" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), - - "ja" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), - "jnbe" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), - - "jl" : (lambda C, P, A, Z, S, O: S != O), - "jnge" : (lambda C, P, A, Z, S, O: S != O), - - "jge" : (lambda C, P, A, Z, S, O: S == O), - "jnl" : (lambda C, P, A, Z, S, O: S == O), - - "jle" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), - "jng" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), - - "jg" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), - "jnle" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), - - "jp" : (lambda C, P, A, Z, S, O: P == 1), - "jpe" : (lambda C, P, A, Z, S, O: P == 1), - - "jnp" : (lambda C, P, A, Z, S, O: P == 0), - "jpo" : (lambda C, P, A, Z, S, O: P == 0), - - # unconditional jump - - "call" : (lambda *_: True), - "jmp" : (lambda *_: True), - - } - - to_jump = False - if line.mnemonic in jump_table: - eflags = get_x86_eflags(ql.reg.ef).values() - to_jump = jump_table.get(line.mnemonic)(*eflags) - - return (to_jump, ret_addr) - - -def handle_bnj_arm(ql: Qiling, cur_addr: str) -> (bool, int): - - def _read_reg_val(regs, _reg): - return getattr(ql.reg, _reg.replace("ip", "r12").replace("fp", "r11")) - - def regdst_eq_pc(op_str): + def regdst_eq_pc(self, op_str): return op_str.partition(", ")[0] == "pc" - read_inst = partial(_read_inst, ql) - read_reg_val = partial(_read_reg_val, ql.reg) - - ARM_INST_SIZE = 4 - ARM_THUMB_INST_SIZE = 2 - - line = disasm(ql, cur_addr) - ret_addr = cur_addr + line.size - - if line.mnemonic == "udf": # indicates program exited - return CODE_END - - jump_table = { - # unconditional branch - "b" : (lambda *_: True), - "bl" : (lambda *_: True), - "bx" : (lambda *_: True), - "blx" : (lambda *_: True), - "b.w" : (lambda *_: True), - - # branch on equal, Z == 1 - "beq" : (lambda V, C, Z, N: Z == 1), - "bxeq" : (lambda V, C, Z, N: Z == 1), - "beq.w": (lambda V, C, Z, N: Z == 1), - - # branch on not equal, Z == 0 - "bne" : (lambda V, C, Z, N: Z == 0), - "bxne" : (lambda V, C, Z, N: Z == 0), - "bne.w": (lambda V, C, Z, N: Z == 0), - - # branch on signed greater than, Z == 0 and N == V - "bgt" : (lambda V, C, Z, N: (Z == 0 and N == V)), - "bgt.w": (lambda V, C, Z, N: (Z == 0 and N == V)), - - # branch on signed less than, N != V - "blt" : (lambda V, C, Z, N: N != V), - - # branch on signed greater than or equal, N == V - "bge" : (lambda V, C, Z, N: N == V), - - # branch on signed less than or queal - "ble" : (lambda V, C, Z, N: Z == 1 or N != V), - - # branch on unsigned higher or same (or carry set), C == 1 - "bhs" : (lambda V, C, Z, N: C == 1), - "bcs" : (lambda V, C, Z, N: C == 1), - - # branch on unsigned lower (or carry clear), C == 0 - "bcc" : (lambda V, C, Z, N: C == 0), - "blo" : (lambda V, C, Z, N: C == 0), - "bxlo" : (lambda V, C, Z, N: C == 0), - "blo.w": (lambda V, C, Z, N: C == 0), - - # branch on negative or minus, N == 1 - "bmi" : (lambda V, C, Z, N: N == 1), - - # branch on positive or plus, N == 0 - "bpl" : (lambda V, C, Z, N: N == 0), - - # branch on signed overflow - "bvs" : (lambda V, C, Z, N: V == 1), - - # branch on no signed overflow - "bvc" : (lambda V, C, Z, N: V == 0), - - # branch on unsigned higher - "bhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), - "bxhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), - "bhi.w": (lambda V, C, Z, N: (Z == 0 and C == 1)), - - # branch on unsigned lower - "bls" : (lambda V, C, Z, N: (C == 0 or Z == 1)), - "bls.w": (lambda V, C, Z, N: (C == 0 or Z == 1)), - } - - cb_table = { - # branch on equal to zero - "cbz" : (lambda r: r == 0), - - # branch on not equal to zero - "cbnz": (lambda r: r != 0), - } - - to_jump = False - if line.mnemonic in jump_table: - to_jump = jump_table.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)) - - elif line.mnemonic in cb_table: - to_jump = cb_table.get(line.mnemonic)(read_reg_val(line.op_str.split(", ")[0])) - - if to_jump: - if "#" in line.op_str: - ret_addr = _parse_int(line.op_str.split("#")[-1]) - else: - ret_addr = read_reg_val(line.op_str) - - if regdst_eq_pc(line.op_str): - next_addr = cur_addr + line.size - n2_addr = next_addr + len(read_inst(next_addr)) - ret_addr += len(read_inst(n2_addr)) + len(read_inst(next_addr)) - - elif line.mnemonic.startswith("it"): - # handle IT block here - - cond_met = { - "eq": lambda V, C, Z, N: (Z == 1), - "ne": lambda V, C, Z, N: (Z == 0), - "ge": lambda V, C, Z, N: (N == V), - "hs": lambda V, C, Z, N: (C == 1), - "lo": lambda V, C, Z, N: (C == 0), - "mi": lambda V, C, Z, N: (N == 1), - "pl": lambda V, C, Z, N: (N == 0), - "ls": lambda V, C, Z, N: (C == 0 or Z == 1), - "le": lambda V, C, Z, N: (Z == 1 or N != V), - "hi": lambda V, C, Z, N: (Z == 0 and C == 1), - }.get(line.op_str)(*get_cpsr(ql.reg.cpsr)) - - it_block_range = [each_char for each_char in line.mnemonic[1:]] - - next_addr = cur_addr + ARM_THUMB_INST_SIZE - for each in it_block_range: - _inst = read_inst(next_addr) - n2_addr = handle_bnj_arm(ql, next_addr) - - if (cond_met and each == "t") or (not cond_met and each == "e"): - if n2_addr != (next_addr+len(_inst)): # branch detected - break - - next_addr += len(_inst) - - ret_addr = next_addr - - elif line.mnemonic in ("ldr",): - - if regdst_eq_pc(line.op_str): - _, _, rn_offset = line.op_str.partition(", ") - r, _, imm = rn_offset.strip("[]!").partition(", #") - - if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate - ret_addr = ql.unpack32(ql.mem.read(_parse_int(imm) + read_reg_val(r), ARM_INST_SIZE)) - - else: # post-indexed immediate - # FIXME: weired behavior, immediate here does not apply - ret_addr = ql.unpack32(ql.mem.read(read_reg_val(r), ARM_INST_SIZE)) - - elif line.mnemonic in ("addls", "addne", "add") and regdst_eq_pc(line.op_str): - V, C, Z, N = get_cpsr(ql.reg.cpsr) - r0, r1, r2, *imm = line.op_str.split(", ") - - # program counter is awalys 8 bytes ahead when it comes with pc, need to add extra 8 bytes - extra = 8 if 'pc' in (r0, r1, r2) else 0 - - if imm: - expr = imm[0].split() - # TODO: should support more bit shifting and rotating operation - if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 - - if line.mnemonic == "addls" and (C == 0 or Z == 1): - ret_addr = extra + read_reg_val(r1) + read_reg_val(r2) * n - - elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): - ret_addr = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) - - elif line.mnemonic in ("tbh", "tbb"): - - cur_addr += ARM_INST_SIZE - r0, r1, *imm = line.op_str.strip("[]").split(", ") - - if imm: - expr = imm[0].split() - if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 - - if line.mnemonic == "tbh": - - r1 = read_reg_val(r1) * n - - elif line.mnemonic == "tbb": - - r1 = read_reg_val(r1) - - to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n - ret_addr = cur_addr + to_add - - elif line.mnemonic.startswith("pop") and "pc" in line.op_str: - - ret_addr = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * ARM_INST_SIZE) - if not { # step to next instruction if cond does not meet - "pop" : lambda *_: True, - "pop.w": lambda *_: True, - "popeq": lambda V, C, Z, N: (Z == 1), - "popne": lambda V, C, Z, N: (Z == 0), - "pophi": lambda V, C, Z, N: (C == 1), - "popge": lambda V, C, Z, N: (N == V), - "poplt": lambda V, C, Z, N: (N != V), - }.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)): - - ret_addr = cur_addr + ARM_INST_SIZE - - elif line.mnemonic == "sub" and regdst_eq_pc(line.op_str): - _, r, imm = line.op_str.split(", ") - ret_addr = read_reg_val(r) - _parse_int(imm.strip("#")) - - elif line.mnemonic == "mov" and regdst_eq_pc(line.op_str): - _, r = line.op_str.split(", ") - ret_addr = read_reg_val(r) - - if ret_addr & 1: - ret_addr -= 1 - - return (to_jump, ret_addr) - - -def handle_bnj_mips(ql: Qiling, cur_addr: str) -> (bool, int): - MIPS_INST_SIZE = 4 - - def _read_reg(regs, _reg): - return signed_val(getattr(regs, _reg.strip('$').replace("fp", "s8"))) - - read_reg_val = partial(_read_reg, ql.reg) - - line = disasm(ql, cur_addr) - - if line.mnemonic == "break": # indicates program extied - return CODE_END - - # default breakpoint address if no jumps and branches here - ret_addr = cur_addr + MIPS_INST_SIZE - - to_jump = False - if line.mnemonic.startswith('j') or line.mnemonic.startswith('b'): - - # make sure at least delay slot executed - ret_addr += MIPS_INST_SIZE - - # get registers or memory address from op_str - targets = [ - read_reg_val(each) - if '$' in each else _parse_int(each) - for each in line.op_str.split(", ") - ] - - to_jump = { - "j" : (lambda _: True), # unconditional jump - "jr" : (lambda _: True), # unconditional jump - "jal" : (lambda _: True), # unconditional jump - "jalr" : (lambda _: True), # unconditional jump - "b" : (lambda _: True), # unconditional branch - "bl" : (lambda _: True), # unconditional branch - "bal" : (lambda _: True), # unconditional branch - "beq" : (lambda r0, r1, _: r0 == r1), # branch on equal - "bne" : (lambda r0, r1, _: r0 != r1), # branch on not equal - "blt" : (lambda r0, r1, _: r0 < r1), # branch on r0 less than r1 - "bgt" : (lambda r0, r1, _: r0 > r1), # branch on r0 greater than r1 - "ble" : (lambda r0, r1, _: r0 <= r1), # brach on r0 less than or equal to r1 - "bge" : (lambda r0, r1, _: r0 >= r1), # branch on r0 greater than or equal to r1 - "beqz" : (lambda r, _: r == 0), # branch on equal to zero - "bnez" : (lambda r, _: r != 0), # branch on not equal to zero - "bgtz" : (lambda r, _: r > 0), # branch on greater than zero - "bltz" : (lambda r, _: r < 0), # branch on less than zero - "bltzal" : (lambda r, _: r < 0), # branch on less than zero and link - "blez" : (lambda r, _: r <= 0), # branch on less than or equal to zero - "bgez" : (lambda r, _: r >= 0), # branch on greater than or equal to zero - "bgezal" : (lambda r, _: r >= 0), # branch on greater than or equal to zero and link - }.get(line.mnemonic)(*targets) + def predict(self): + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + ret_addr = cur_addr + line.size + + if line.mnemonic == self.CODE_END: # indicates program exited + return True + + jump_table = { + # unconditional branch + "b" : (lambda *_: True), + "bl" : (lambda *_: True), + "bx" : (lambda *_: True), + "blx" : (lambda *_: True), + "b.w" : (lambda *_: True), + + # branch on equal, Z == 1 + "beq" : (lambda V, C, Z, N: Z == 1), + "bxeq" : (lambda V, C, Z, N: Z == 1), + "beq.w": (lambda V, C, Z, N: Z == 1), + + # branch on not equal, Z == 0 + "bne" : (lambda V, C, Z, N: Z == 0), + "bxne" : (lambda V, C, Z, N: Z == 0), + "bne.w": (lambda V, C, Z, N: Z == 0), + + # branch on signed greater than, Z == 0 and N == V + "bgt" : (lambda V, C, Z, N: (Z == 0 and N == V)), + "bgt.w": (lambda V, C, Z, N: (Z == 0 and N == V)), + + # branch on signed less than, N != V + "blt" : (lambda V, C, Z, N: N != V), + + # branch on signed greater than or equal, N == V + "bge" : (lambda V, C, Z, N: N == V), + + # branch on signed less than or queal + "ble" : (lambda V, C, Z, N: Z == 1 or N != V), + + # branch on unsigned higher or same (or carry set), C == 1 + "bhs" : (lambda V, C, Z, N: C == 1), + "bcs" : (lambda V, C, Z, N: C == 1), + + # branch on unsigned lower (or carry clear), C == 0 + "bcc" : (lambda V, C, Z, N: C == 0), + "blo" : (lambda V, C, Z, N: C == 0), + "bxlo" : (lambda V, C, Z, N: C == 0), + "blo.w": (lambda V, C, Z, N: C == 0), + + # branch on negative or minus, N == 1 + "bmi" : (lambda V, C, Z, N: N == 1), + + # branch on positive or plus, N == 0 + "bpl" : (lambda V, C, Z, N: N == 0), + + # branch on signed overflow + "bvs" : (lambda V, C, Z, N: V == 1), + + # branch on no signed overflow + "bvc" : (lambda V, C, Z, N: V == 0), + + # branch on unsigned higher + "bhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), + "bxhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), + "bhi.w": (lambda V, C, Z, N: (Z == 0 and C == 1)), + + # branch on unsigned lower + "bls" : (lambda V, C, Z, N: (C == 0 or Z == 1)), + "bls.w": (lambda V, C, Z, N: (C == 0 or Z == 1)), + } + + cb_table = { + # branch on equal to zero + "cbz" : (lambda r: r == 0), + + # branch on not equal to zero + "cbnz": (lambda r: r != 0), + } + + to_jump = False + if line.mnemonic in jump_table: + to_jump = jump_table.get(line.mnemonic)(*get_cpsr(self.ql.reg.cpsr)) + + elif line.mnemonic in cb_table: + to_jump = cb_table.get(line.mnemonic)(self.read_reg(line.op_str.split(", ")[0])) if to_jump: - # target address is always the rightmost one - ret_addr = targets[-1] + if "#" in line.op_str: + ret_addr = _parse_int(line.op_str.split("#")[-1]) + else: + ret_addr = read_reg_val(line.op_str) - return (to_jump, ret_addr) + if regdst_eq_pc(line.op_str): + next_addr = cur_addr + line.size + n2_addr = next_addr + len(read_inst(next_addr)) + ret_addr += len(read_inst(n2_addr)) + len(read_inst(next_addr)) + + elif line.mnemonic.startswith("it"): + # handle IT block here + + cond_met = { + "eq": lambda V, C, Z, N: (Z == 1), + "ne": lambda V, C, Z, N: (Z == 0), + "ge": lambda V, C, Z, N: (N == V), + "hs": lambda V, C, Z, N: (C == 1), + "lo": lambda V, C, Z, N: (C == 0), + "mi": lambda V, C, Z, N: (N == 1), + "pl": lambda V, C, Z, N: (N == 0), + "ls": lambda V, C, Z, N: (C == 0 or Z == 1), + "le": lambda V, C, Z, N: (Z == 1 or N != V), + "hi": lambda V, C, Z, N: (Z == 0 and C == 1), + }.get(line.op_str)(*get_cpsr(ql.reg.cpsr)) + + it_block_range = [each_char for each_char in line.mnemonic[1:]] + + next_addr = cur_addr + self.THUMB_INST_SIZE + for each in it_block_range: + _inst = read_inst(next_addr) + n2_addr = handle_bnj_arm(ql, next_addr) + + if (cond_met and each == "t") or (not cond_met and each == "e"): + if n2_addr != (next_addr+len(_inst)): # branch detected + break + + next_addr += len(_inst) + + ret_addr = next_addr + + elif line.mnemonic in ("ldr",): + + if self.regdst_eq_pc(line.op_str): + _, _, rn_offset = line.op_str.partition(", ") + r, _, imm = rn_offset.strip("[]!").partition(", #") + + if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate + ret_addr = ql.unpack32(ql.mem.read(_parse_int(imm) + read_reg_val(r), self.INST_SIZE)) + + else: # post-indexed immediate + # FIXME: weired behavior, immediate here does not apply + ret_addr = ql.unpack32(ql.mem.read(read_reg_val(r), self.INST_SIZE)) + + elif line.mnemonic in ("addls", "addne", "add") and self.regdst_eq_pc(line.op_str): + V, C, Z, N = get_cpsr(ql.reg.cpsr) + r0, r1, r2, *imm = line.op_str.split(", ") + + # program counter is awalys 8 bytes ahead when it comes with pc, need to add extra 8 bytes + extra = 8 if 'pc' in (r0, r1, r2) else 0 + + if imm: + expr = imm[0].split() + # TODO: should support more bit shifting and rotating operation + if expr[0] == "lsl": # logical shift left + n = _parse_int(expr[-1].strip("#")) * 2 + + if line.mnemonic == "addls" and (C == 0 or Z == 1): + ret_addr = extra + read_reg_val(r1) + read_reg_val(r2) * n + + elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): + ret_addr = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) + + elif line.mnemonic in ("tbh", "tbb"): + + cur_addr += self.INST_SIZE + r0, r1, *imm = line.op_str.strip("[]").split(", ") + + if imm: + expr = imm[0].split() + if expr[0] == "lsl": # logical shift left + n = _parse_int(expr[-1].strip("#")) * 2 + + if line.mnemonic == "tbh": + + r1 = read_reg_val(r1) * n + + elif line.mnemonic == "tbb": + + r1 = read_reg_val(r1) + + to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n + ret_addr = cur_addr + to_add + + elif line.mnemonic.startswith("pop") and "pc" in line.op_str: + + ret_addr = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * self.INST_SIZE) + if not { # step to next instruction if cond does not meet + "pop" : lambda *_: True, + "pop.w": lambda *_: True, + "popeq": lambda V, C, Z, N: (Z == 1), + "popne": lambda V, C, Z, N: (Z == 0), + "pophi": lambda V, C, Z, N: (C == 1), + "popge": lambda V, C, Z, N: (N == V), + "poplt": lambda V, C, Z, N: (N != V), + }.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)): + + ret_addr = cur_addr + self.INST_SIZE + + elif line.mnemonic == "sub" and self.regdst_eq_pc(line.op_str): + _, r, imm = line.op_str.split(", ") + ret_addr = read_reg_val(r) - _parse_int(imm.strip("#")) + + elif line.mnemonic == "mov" and self.regdst_eq_pc(line.op_str): + _, r = line.op_str.split(", ") + ret_addr = read_reg_val(r) + + if ret_addr & 1: + ret_addr -= 1 + + return (to_jump, ret_addr) + +class BranchPredictor_MIPS(BranchPredictor): + def __init__(self, ql): + self.CODE_END = "break" + self.INST_SIZE = 4 + self.ql = ql + + def read_reg(self, reg_name): + reg_name = reg_name.strip("$").replace("fp", "s8") + return signed_val(getattr(self.ql.reg, reg_name)) + + def predict(self): + + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + + if line.mnemonic == self.CODE_END: # indicates program extied + return True + + ret_addr = None + to_jump = False + if line.mnemonic.startswith('j') or line.mnemonic.startswith('b'): + + # make sure at least delay slot executed + ret_addr = cur_addr + self.INST_SIZE + + # get registers or memory address from op_str + targets = [ + self.read_reg(each) + if '$' in each else _parse_int(each) + for each in line.op_str.split(", ") + ] + + to_jump = { + "j" : (lambda _: True), # unconditional jump + "jr" : (lambda _: True), # unconditional jump + "jal" : (lambda _: True), # unconditional jump + "jalr" : (lambda _: True), # unconditional jump + "b" : (lambda _: True), # unconditional branch + "bl" : (lambda _: True), # unconditional branch + "bal" : (lambda _: True), # unconditional branch + "beq" : (lambda r0, r1, _: r0 == r1), # branch on equal + "bne" : (lambda r0, r1, _: r0 != r1), # branch on not equal + "blt" : (lambda r0, r1, _: r0 < r1), # branch on r0 less than r1 + "bgt" : (lambda r0, r1, _: r0 > r1), # branch on r0 greater than r1 + "ble" : (lambda r0, r1, _: r0 <= r1), # brach on r0 less than or equal to r1 + "bge" : (lambda r0, r1, _: r0 >= r1), # branch on r0 greater than or equal to r1 + "beqz" : (lambda r, _: r == 0), # branch on equal to zero + "bnez" : (lambda r, _: r != 0), # branch on not equal to zero + "bgtz" : (lambda r, _: r > 0), # branch on greater than zero + "bltz" : (lambda r, _: r < 0), # branch on less than zero + "bltzal" : (lambda r, _: r < 0), # branch on less than zero and link + "blez" : (lambda r, _: r <= 0), # branch on less than or equal to zero + "bgez" : (lambda r, _: r >= 0), # branch on greater than or equal to zero + "bgezal" : (lambda r, _: r >= 0), # branch on greater than or equal to zero and link + }.get(line.mnemonic)(*targets) + + if to_jump: + # target address is always the rightmost one + ret_addr = targets[-1] + + return (to_jump, ret_addr) + +class BranchPredictor_X86(BranchPredictor): + def __init__(self, ql): + super().__init__(ql) + + def predict(self): + + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + + jump_table = { + + # conditional jump + "jo" : (lambda C, P, A, Z, S, O: O == 1), + "jno" : (lambda C, P, A, Z, S, O: O == 0), + + "js" : (lambda C, P, A, Z, S, O: S == 1), + "jns" : (lambda C, P, A, Z, S, O: S == 0), + + "je" : (lambda C, P, A, Z, S, O: Z == 1), + "jz" : (lambda C, P, A, Z, S, O: Z == 1), + + "jne" : (lambda C, P, A, Z, S, O: Z == 0), + "jnz" : (lambda C, P, A, Z, S, O: Z == 0), + + "jb" : (lambda C, P, A, Z, S, O: C == 1), + "jc" : (lambda C, P, A, Z, S, O: C == 1), + "jnae" : (lambda C, P, A, Z, S, O: C == 1), + + "jnb" : (lambda C, P, A, Z, S, O: C == 0), + "jnc" : (lambda C, P, A, Z, S, O: C == 0), + "jae" : (lambda C, P, A, Z, S, O: C == 0), + + "jbe" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + "jna" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + + "ja" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + "jnbe" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + + "jl" : (lambda C, P, A, Z, S, O: S != O), + "jnge" : (lambda C, P, A, Z, S, O: S != O), + + "jge" : (lambda C, P, A, Z, S, O: S == O), + "jnl" : (lambda C, P, A, Z, S, O: S == O), + + "jle" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + "jng" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + + "jg" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + "jnle" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + + "jp" : (lambda C, P, A, Z, S, O: P == 1), + "jpe" : (lambda C, P, A, Z, S, O: P == 1), + + "jnp" : (lambda C, P, A, Z, S, O: P == 0), + "jpo" : (lambda C, P, A, Z, S, O: P == 0), + + # unconditional jump + + "call" : (lambda *_: True), + "jmp" : (lambda *_: True), + + } + + to_jump = False + ret_addr = None + if line.mnemonic in jump_table: + eflags = get_x86_eflags(self.ql.reg.ef).values() + to_jump = jump_table.get(line.mnemonic)(*eflags) + + if to_jump: + ret_addr = _parse_int(line.op_str) + + return (to_jump, ret_addr) + +class BranchPredictor_CORTEXT_M(BranchPredictor_ARM): + def __init__(self, ql): + super().__init__(ql) class Breakpoint(object): """ @@ -556,5 +511,6 @@ class TempBreakpoint(Breakpoint): super().__init__(address) + if __name__ == "__main__": pass From 7374d37f4afe83ab96aeb04fef79dc3c9f0abb05 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Thu, 10 Feb 2022 10:05:43 +0800 Subject: [PATCH 54/66] add basic support for X86 branch prediction --- qiling/debugger/qdb/frontend.py | 10 ++++-- qiling/debugger/qdb/utils.py | 55 ++++++++++++++++++++++++++++++--- 2 files changed, 57 insertions(+), 8 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 4f9e5e61..7c1eeec0 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -432,12 +432,16 @@ class CtxManager_X86(CtxManager): past_list = [] cur_addr = self.ql.reg.arch_pc + cur_insn = disasm(self.ql, cur_addr) + to_jump, _ = self.predictor.predict() + self.print_asm(cur_insn, to_jump=to_jump) + # assembly before current location - line = disasm(self.ql, cur_addr) - acc_size = line.size + line = disasm(self.ql, cur_addr+cur_insn.size) + acc_size = line.size + cur_insn.size - while line and len(past_list) != 10: + while line and len(past_list) != 8: past_list.append(line) next_start = cur_addr + acc_size line = disasm(self.ql, next_start) diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index d93f8dfa..87c029c5 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -5,8 +5,8 @@ from __future__ import annotations from typing import Callable, Optional, Mapping - from qiling.const import * +import ast, re # parse unsigned integer from string def _parse_int(s: str) -> int: @@ -125,7 +125,7 @@ class BranchPredictor(object): self.ql = ql def read_reg(self, reg_name): - return NotImplementedError + return getattr(self.ql.reg, reg_name) def resolve(self): return NotImplementedError @@ -426,8 +426,8 @@ class BranchPredictor_X86(BranchPredictor): line = disasm(self.ql, cur_addr) jump_table = { - # conditional jump + "jo" : (lambda C, P, A, Z, S, O: O == 1), "jno" : (lambda C, P, A, Z, S, O: O == 0), @@ -479,13 +479,56 @@ class BranchPredictor_X86(BranchPredictor): } + jump_reg_table = { + "jcxz" : (lambda cx: cx == 0), + "jecxz" : (lambda ecx: ecx == 0), + "jrcxz" : (lambda rcx: rcx == 0), + } + to_jump = False - ret_addr = None if line.mnemonic in jump_table: eflags = get_x86_eflags(self.ql.reg.ef).values() to_jump = jump_table.get(line.mnemonic)(*eflags) - if to_jump: + elif line.mnemonic in jump_reg_table: + to_jump = jump_reg_table.get(line.mnemonic)(self.ql.reg.ecx) + + ret_addr = None + + if to_jump: + takeaway_list = ["ptr", "dword", "[", "]"] + class AST_checker(ast.NodeVisitor): + def generic_visit(self, node): + if type(node) in (ast.Module, ast.Expr, ast.BinOp, ast.Constant, ast.Add, ast.Mult, ast.Sub): + ast.NodeVisitor.generic_visit(self, node) + else: + raise ParseError("malform or invalid ast node") + + if len(line.op_str.split()) > 1: + new_line = line.op_str.replace(":", "+") + for each in takeaway_list: + new_line = new_line.replace(each, " ") + + new_line = " ".join(new_line.split()) + for each_reg in filter(lambda r: len(r) == 3, self.ql.reg.register_mapping.keys()): + if each_reg in new_line: + new_line = re.sub(each_reg, hex(self.read_reg(each_reg)), new_line) + + for each_reg in filter(lambda r: len(r) == 2, self.ql.reg.register_mapping.keys()): + if each_reg in new_line: + new_line = re.sub(each_reg, hex(self.read_reg(each_reg)), new_line) + + checker = AST_checker() + ast_tree = ast.parse(new_line) + + checker.visit(ast_tree) + + ret_addr = eval(new_line) + + elif line.op_str in self.ql.reg.register_mapping: + ret_addr = getattr(self.ql.reg, line.op_str) + + else: ret_addr = _parse_int(line.op_str) return (to_jump, ret_addr) @@ -510,6 +553,8 @@ class TempBreakpoint(Breakpoint): def __init__(self, address): super().__init__(address) +class ParseError(Exception): + pass if __name__ == "__main__": From 0cf23594e0a29e357ad09adef224d0bd0c613754 Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:14:08 +0800 Subject: [PATCH 55/66] Add SAM3xa UART --- qiling/hw/char/sam3xa_uart.py | 19 ++++++++- qiling/hw/const/sam3xa_uart.py | 78 ++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 qiling/hw/const/sam3xa_uart.py diff --git a/qiling/hw/char/sam3xa_uart.py b/qiling/hw/char/sam3xa_uart.py index aa22ebd9..1ea3f6a2 100644 --- a/qiling/hw/char/sam3xa_uart.py +++ b/qiling/hw/char/sam3xa_uart.py @@ -7,6 +7,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral from qiling.hw.connectivity import QlConnectivityPeripheral +from qiling.hw.const.sam3xa_uart import SR class SAM3xaUart(QlConnectivityPeripheral): @@ -37,5 +38,21 @@ class SAM3xaUart(QlConnectivityPeripheral): def __init__(self, ql, label, intn = None): super().__init__(ql, label) - self.uart = self.struct() + self.uart = self.struct( + SR = SR.TXRDY + ) self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.uart) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.THR.offset: + self.send_to_user(value) + + data = (value).to_bytes(size, byteorder='little') + ctypes.memmove(ctypes.addressof(self.uart) + offset, data, size) diff --git a/qiling/hw/const/sam3xa_uart.py b/qiling/hw/const/sam3xa_uart.py new file mode 100644 index 00000000..5358e92e --- /dev/null +++ b/qiling/hw/const/sam3xa_uart.py @@ -0,0 +1,78 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class CR(IntEnum): + RSTRX = 0x1 << 2 # Reset Receiver + RSTTX = 0x1 << 3 # Reset Transmitter + RXEN = 0x1 << 4 # Receiver Enable + RXDIS = 0x1 << 5 # Receiver Disable + TXEN = 0x1 << 6 # Transmitter Enable + TXDIS = 0x1 << 7 # Transmitter Disable + RSTSTA = 0x1 << 8 # Reset Status Bits + +class MR(IntEnum): + PAR = 0x7 << 9 # Parity Type + CHMODE = 0x3 << 14 # Channel Mode + +class IER(IntEnum): + RXRDY = 0x1 << 0 # Enable RXRDY Interrupt + TXRDY = 0x1 << 1 # Enable TXRDY Interrupt + ENDRX = 0x1 << 3 # Enable End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Enable End of Transmit Interrupt + OVRE = 0x1 << 5 # Enable Overrun Error Interrupt + FRAME = 0x1 << 6 # Enable Framing Error Interrupt + PARE = 0x1 << 7 # Enable Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Enable TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Enable Buffer Empty Interrupt + RXBUFF = 0x1 << 12 # Enable Buffer Full Interrupt + +class IDR(IntEnum): + RXRDY = 0x1 << 0 # Disable RXRDY Interrupt + TXRDY = 0x1 << 1 # Disable TXRDY Interrupt + ENDRX = 0x1 << 3 # Disable End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Disable End of Transmit Interrupt + OVRE = 0x1 << 5 # Disable Overrun Error Interrupt + FRAME = 0x1 << 6 # Disable Framing Error Interrupt + PARE = 0x1 << 7 # Disable Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Disable TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Disable Buffer Empty Interrupt + RXBUFF = 0x1 << 12 # Disable Buffer Full Interrupt + +class IMR(IntEnum): + RXRDY = 0x1 << 0 # Mask RXRDY Interrupt + TXRDY = 0x1 << 1 # Disable TXRDY Interrupt + ENDRX = 0x1 << 3 # Mask End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Mask End of Transmit Interrupt + OVRE = 0x1 << 5 # Mask Overrun Error Interrupt + FRAME = 0x1 << 6 # Mask Framing Error Interrupt + PARE = 0x1 << 7 # Mask Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Mask TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Mask TXBUFE Interrupt + RXBUFF = 0x1 << 12 # Mask RXBUFF Interrupt + +class SR(IntEnum): + RXRDY = 0x1 << 0 # Receiver Ready + TXRDY = 0x1 << 1 # Transmitter Ready + ENDRX = 0x1 << 3 # End of Receiver Transfer + ENDTX = 0x1 << 4 # End of Transmitter Transfer + OVRE = 0x1 << 5 # Overrun Error + FRAME = 0x1 << 6 # Framing Error + PARE = 0x1 << 7 # Parity Error + TXEMPTY = 0x1 << 9 # Transmitter Empty + TXBUFE = 0x1 << 11 # Transmission Buffer Empty + RXBUFF = 0x1 << 12 # Receive Buffer Full + +class PTCR(IntEnum): + RXTEN = 0x1 << 0 # Receiver Transfer Enable + RXTDIS = 0x1 << 1 # Receiver Transfer Disable + TXTEN = 0x1 << 8 # Transmitter Transfer Enable + TXTDIS = 0x1 << 9 # Transmitter Transfer Disable + +class PTSR(IntEnum): + RXTEN = 0x1 << 0 # Receiver Transfer Enable + TXTEN = 0x1 << 8 # Transmitter Transfer Enable From ccbe8be1b96e2197e3afe59bf14fc44f8d222f34 Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:34:26 +0800 Subject: [PATCH 56/66] Fix ihex parser loader --- qiling/loader/mcu.py | 49 +++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/qiling/loader/mcu.py b/qiling/loader/mcu.py index 9142a45a..3b3cc582 100644 --- a/qiling/loader/mcu.py +++ b/qiling/loader/mcu.py @@ -5,19 +5,16 @@ import io -import struct from elftools.elf.elffile import ELFFile from qiling.const import * from qiling.core import Qiling from qiling.utils import component_setup +from qiling.loader import QlLoader -from .loader import QlLoader class IhexParser: def __init__(self, path): - self.pc = None - self.base = None self.mem = [] self.segments = [] @@ -25,38 +22,38 @@ class IhexParser: for line in f.read().splitlines(): self.parse_line(line.strip()) - begin, end, bindata = 0, 0, b'' + begin, stream = 0, b'' for addr, data in self.mem: - if addr != end: - self.add_segment(begin, end, bindata) - begin, end, bindata = addr, addr + len(data), data + if addr != begin + len(stream): + self.segments.append((begin, stream)) + begin, stream = addr, data + else: - bindata += data - end += len(data) - self.add_segment(begin, end, bindata) - - def add_segment(self, begin, end, bindata): - if len(bindata) > 0 and end - begin == len(bindata): - self.segments.append((begin, end, bindata)) + stream += data + + self.segments.append((begin, stream)) def parse_line(self, line): if len(line) < 9: return + desc = line[7: 9] size = int(line[1: 3], 16) - type = line[7: 9] - + addr = bytes.fromhex(line[3: 7]) - data = bytes.fromhex(line[9: 9 + size * 2]) - - if type == '04': - self.base = struct.unpack('>I', data + b'\x00\x00')[0] - elif type == '05': - self.pc = struct.unpack('>I', data)[0] - elif type == '00': - offset = struct.unpack('>I', b'\x00\x00' + addr)[0] + data = bytes.fromhex(line[9: 9 + size * 2]) + + if desc == '00': # Data + offset = int.from_bytes(addr, byteorder='big') self.mem.append((self.base + offset, data)) + elif desc == '02': # Extended Segment Address + self.base = int.from_bytes(data, byteorder='big') * 0x10 + + elif desc == '04': # Extended Linear Address + self.base = int.from_bytes(data, byteorder='big') * 0x10000 + + class QlLoaderMCU(QlLoader): def __init__(self, ql:Qiling): super().__init__(ql) @@ -102,7 +99,7 @@ class QlLoaderMCU(QlLoader): self.ql.mem.write(self.map_address, f.read()) else: # self.filetype == 'hex': - for begin, _, data in self.ihex.segments: + for begin, data in self.ihex.segments: self.ql.mem.write(begin, data) From 57d3a34f266ff9dbb5d66008056d82b93a888d20 Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:34:51 +0800 Subject: [PATCH 57/66] Add sam3x8e board --- tests/test_mcu.py | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/tests/test_mcu.py b/tests/test_mcu.py index 01cb5f0f..1a6290fc 100644 --- a/tests/test_mcu.py +++ b/tests/test_mcu.py @@ -11,6 +11,7 @@ from qiling.core import Qiling from qiling.const import QL_VERBOSE from qiling.extensions.mcu.stm32f4 import stm32f407, stm32f411 from qiling.extensions.mcu.stm32f1 import stm32f103 +from qiling.extensions.mcu.atmel import sam3x8e from qiling.extensions.mcu.gd32vf1 import gd32vf103 class MCUTest(unittest.TestCase): @@ -376,6 +377,29 @@ class MCUTest(unittest.TestCase): del ql + def test_mcu_serial_sam3x8e(self): + ql = Qiling(["../examples/rootfs/mcu/sam3x8e/Blink.ino.hex"], + archtype="cortex_m", env=sam3x8e, verbose=QL_VERBOSE.DEFAULT) + + ql.hw.create('wdt') + ql.hw.create('efc0') + ql.hw.create('efc1') + ql.hw.create('pmc') + ql.hw.create('uotghs') + ql.hw.create('pioa') + ql.hw.create('piob') + ql.hw.create('pioc') + ql.hw.create('piod') + ql.hw.create('adc') + ql.hw.create('uart') + ql.hw.create('pdc_uart') + + ql.hw.systick.ratio = 1000 + ql.run(count=100000) + self.assertTrue(ql.hw.uart.recv().startswith(b'hello world\nhello world\n')) + + del ql + if __name__ == "__main__": unittest.main() From 7bd78c6bc8ce41f77556bb2e584f1933850d5879 Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:37:17 +0800 Subject: [PATCH 58/66] Fix error import --- qiling/loader/mcu.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qiling/loader/mcu.py b/qiling/loader/mcu.py index 3b3cc582..4b28447a 100644 --- a/qiling/loader/mcu.py +++ b/qiling/loader/mcu.py @@ -10,7 +10,7 @@ from elftools.elf.elffile import ELFFile from qiling.const import * from qiling.core import Qiling from qiling.utils import component_setup -from qiling.loader import QlLoader +from .loader import QlLoader class IhexParser: From e27e2a26d86b8db1934a38f285d888a9a06e15f8 Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:37:28 +0800 Subject: [PATCH 59/66] Fix test_mcu typo --- tests/test_mcu.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_mcu.py b/tests/test_mcu.py index 1a6290fc..140681f5 100644 --- a/tests/test_mcu.py +++ b/tests/test_mcu.py @@ -378,7 +378,7 @@ class MCUTest(unittest.TestCase): del ql def test_mcu_serial_sam3x8e(self): - ql = Qiling(["../examples/rootfs/mcu/sam3x8e/Blink.ino.hex"], + ql = Qiling(["../examples/rootfs/mcu/sam3x8e/serial.ino.hex"], archtype="cortex_m", env=sam3x8e, verbose=QL_VERBOSE.DEFAULT) ql.hw.create('wdt') From 3a2af8f7e19c169d18b3bb1f02bbfb95ee791e9f Mon Sep 17 00:00:00 2001 From: dataisland Date: Thu, 10 Feb 2022 12:38:24 +0800 Subject: [PATCH 60/66] Update rootfs --- examples/rootfs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rootfs b/examples/rootfs index 2c1aa456..d8d54fcd 160000 --- a/examples/rootfs +++ b/examples/rootfs @@ -1 +1 @@ -Subproject commit 2c1aa456c249e8fdeb5383233a7e45e0b791cb56 +Subproject commit d8d54fcd0835b9bcdbb146e9f277fc2eb69ff79f From 24f5e3d9e3cc9830cc47ff0bd052fa7aab0e6185 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Fri, 11 Feb 2022 02:11:01 +0800 Subject: [PATCH 61/66] fix typo and minor refactor --- qiling/debugger/qdb/frontend.py | 39 +++++++++++++++---------------- qiling/debugger/qdb/qdb.py | 6 ++--- qiling/debugger/qdb/utils.py | 41 +++++++++++++++------------------ 3 files changed, 39 insertions(+), 47 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 7c1eeec0..3613210f 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -5,30 +5,15 @@ from __future__ import annotations from typing import Optional, Mapping, Iterable, Union - import copy, math, os -from contextlib import contextmanager - -from qiling.const import QL_ARCH import unicorn -from .const import * +from qiling.const import QL_ARCH + from .utils import disasm, get_x86_eflags, setup_branch_predictor +from .const import color, SIZE_LETTER, FORMAT_LETTER -def setup_ctx_manager(ql: Qiling) -> CtxManager: - - if ql.archtype == QL_ARCH.MIPS: - return CtxManager_MIPS(ql) - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): - return CtxManager_ARM(ql) - - elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - return CtxManager_X86(ql) - - elif ql.archtype == QL_ARCH.CORTEX_M: - return CtxManager_CORTEX_M(ql) # read data from memory of qiling instance def examine_mem(ql: Qiling, line: str) -> Union[bool, (str, int, int)]: @@ -84,7 +69,7 @@ def examine_mem(ql: Qiling, line: str) -> Union[bool, (str, int, int)]: if elem in ql.reg.register_mapping.keys(): items.append(getattr(ql.reg, elem, None)) else: - items.append(_parse_int(elem)) + items.append(read_int(elem)) addr = sum(items) @@ -167,7 +152,7 @@ def _try_read(ql: Qiling, address: int, size: int) -> Optional[bytes]: COLORS = (color.DARKCYAN, color.BLUE, color.RED, color.YELLOW, color.GREEN, color.PURPLE, color.CYAN, color.WHITE) -# divider printer +# decorator function for printing divider def context_printer(field_name, ruler="─"): def decorator(context_dumper): def wrapper(*args, **kwargs): @@ -180,8 +165,18 @@ def context_printer(field_name, ruler="─"): return wrapper return decorator -class CtxManager(object): +def setup_ctx_manager(ql: Qiling) -> CtxManager: + return { + QL_ARCH.X86: CtxManager_X86, + QL_ARCH.ARM: CtxManager_ARM, + QL_ARCH.ARM_THUMB: CtxManager_ARM, + QL_ARCH.CORTEX_M: CtxManager_ARM, + QL_ARCH.MIPS: CtxManager_MIPS, + }.get(ql.archtype)(ql) + + +class CtxManager(object): def __init__(self, ql): self.ql = ql self.predictor = setup_branch_predictor(ql) @@ -275,6 +270,7 @@ class CtxManager(object): self.print_asm(forward_insn) forward_insn_size += forward_insn.size + class CtxManager_ARM(CtxManager): def __init__(self, ql): super().__init__(ql) @@ -390,6 +386,7 @@ class CtxManager_MIPS(CtxManager): print(lines.format(*cur_regs.values())) + class CtxManager_X86(CtxManager): def __init__(self, ql): super().__init__(ql) diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index a55b9d81..74b16d7a 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -12,11 +12,10 @@ from qiling import Qiling from qiling.const import QL_ARCH, QL_VERBOSE from qiling.debugger import QlDebugger -# from .frontend import context_reg, context_asm, examine_mem from .frontend import examine_mem, setup_ctx_manager -from .utils import _parse_int, is_thumb, parse_int +from .utils import is_thumb, parse_int from .utils import Breakpoint, TempBreakpoint -from .const import * +from .const import color class QlQdb(cmd.Cmd, QlDebugger): @@ -355,6 +354,7 @@ class QlQdb(cmd.Cmd, QlDebugger): if input(f"{color.RED}[!] Are you sure about saying good bye ~ ? [Y/n]{color.END} ").strip() == "Y": self.do_quit() + do_r = do_run do_s = do_step do_q = do_quit diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index 87c029c5..eeb32253 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -9,7 +9,7 @@ from qiling.const import * import ast, re # parse unsigned integer from string -def _parse_int(s: str) -> int: +def read_int(s: str) -> int: return int(s, 0) @@ -18,7 +18,7 @@ def parse_int(func: Callable) -> Callable: def wrap(qdb, s: str = "") -> int: assert type(s) is str try: - ret = _parse_int(s) + ret = read_int(s) except: ret = None return func(qdb, ret) @@ -107,18 +107,13 @@ def _read_inst(ql: Qiling, addr: int) -> int: """ def setup_branch_predictor(ql: Qiling) -> BranchPredictor: - - if ql.archtype == QL_ARCH.MIPS: - return BranchPredictor_MIPS(ql) - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): - return BranchPredictor_ARM(ql) - - elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): - return BranchPredictor_X86(ql) - - elif ql.archtype == QL_ARCH.CORTEX_M: - return BranchPredictor_CORTEX_M(ql) + return { + QL_ARCH.X86: BranchPredictor_X86, + QL_ARCH.ARM: BranchPredictor_ARM, + QL_ARCH.ARM_THUMB: BranchPredictor_ARM, + QL_ARCH.CORTEX_M: BranchPredictor_CORTEX_M, + QL_ARCH.MIPS: BranchPredictor_MIPS, + }.get(ql.archtype)(ql) class BranchPredictor(object): def __init__(self, ql): @@ -127,7 +122,7 @@ class BranchPredictor(object): def read_reg(self, reg_name): return getattr(self.ql.reg, reg_name) - def resolve(self): + def predict(self): return NotImplementedError class BranchPredictor_ARM(BranchPredictor): @@ -233,7 +228,7 @@ class BranchPredictor_ARM(BranchPredictor): if to_jump: if "#" in line.op_str: - ret_addr = _parse_int(line.op_str.split("#")[-1]) + ret_addr = read_int(line.op_str.split("#")[-1]) else: ret_addr = read_reg_val(line.op_str) @@ -280,7 +275,7 @@ class BranchPredictor_ARM(BranchPredictor): r, _, imm = rn_offset.strip("[]!").partition(", #") if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate - ret_addr = ql.unpack32(ql.mem.read(_parse_int(imm) + read_reg_val(r), self.INST_SIZE)) + ret_addr = ql.unpack32(ql.mem.read(read_int(imm) + read_reg_val(r), self.INST_SIZE)) else: # post-indexed immediate # FIXME: weired behavior, immediate here does not apply @@ -297,7 +292,7 @@ class BranchPredictor_ARM(BranchPredictor): expr = imm[0].split() # TODO: should support more bit shifting and rotating operation if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 + n = read_int(expr[-1].strip("#")) * 2 if line.mnemonic == "addls" and (C == 0 or Z == 1): ret_addr = extra + read_reg_val(r1) + read_reg_val(r2) * n @@ -313,7 +308,7 @@ class BranchPredictor_ARM(BranchPredictor): if imm: expr = imm[0].split() if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 + n = read_int(expr[-1].strip("#")) * 2 if line.mnemonic == "tbh": @@ -343,7 +338,7 @@ class BranchPredictor_ARM(BranchPredictor): elif line.mnemonic == "sub" and self.regdst_eq_pc(line.op_str): _, r, imm = line.op_str.split(", ") - ret_addr = read_reg_val(r) - _parse_int(imm.strip("#")) + ret_addr = read_reg_val(r) - read_int(imm.strip("#")) elif line.mnemonic == "mov" and self.regdst_eq_pc(line.op_str): _, r = line.op_str.split(", ") @@ -382,7 +377,7 @@ class BranchPredictor_MIPS(BranchPredictor): # get registers or memory address from op_str targets = [ self.read_reg(each) - if '$' in each else _parse_int(each) + if '$' in each else read_int(each) for each in line.op_str.split(", ") ] @@ -529,11 +524,11 @@ class BranchPredictor_X86(BranchPredictor): ret_addr = getattr(self.ql.reg, line.op_str) else: - ret_addr = _parse_int(line.op_str) + ret_addr = read_int(line.op_str) return (to_jump, ret_addr) -class BranchPredictor_CORTEXT_M(BranchPredictor_ARM): +class BranchPredictor_CORTEX_M(BranchPredictor_ARM): def __init__(self, ql): super().__init__(ql) From cfca0cc5fcb4e6f8d77e23aa8cdeddff45592a92 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Sat, 12 Feb 2022 00:01:26 +0800 Subject: [PATCH 62/66] try to adopt new strategy for starting and pausing --- qiling/debugger/qdb/frontend.py | 16 +++--- qiling/debugger/qdb/qdb.py | 57 +++++++++++++++----- qiling/debugger/qdb/utils.py | 94 ++++++++++++++++++--------------- 3 files changed, 103 insertions(+), 64 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 3613210f..3e34abc3 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -210,8 +210,8 @@ class CtxManager(object): for idx in range(10): addr = self.ql.reg.arch_sp + idx * self.ql.pointersize - val = self.ql.mem.read(addr, self.ql.pointersize) - print(f"$sp+0x{idx*self.ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{self.ql.unpack(val):08x}", end="") + if (val := _try_read(self.ql, addr, self.ql.pointersize)[0]): + print(f"$sp+0x{idx*self.ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{self.ql.unpack(val):08x}", end="") # try to dereference wether it's a pointer if (buf := _try_read(self.ql, addr, self.ql.pointersize))[0] is not None: @@ -257,13 +257,13 @@ class CtxManager(object): # assembly for current location - cur_ins = disasm(self.ql, cur_addr) - to_jump, _ = self.predictor.predict() - self.print_asm(cur_ins, to_jump=to_jump) + cur_insn = disasm(self.ql, cur_addr) + prophecy = self.predictor.predict() + self.print_asm(cur_insn, to_jump=prophecy.going) # assembly after current location - forward_insn_size = cur_ins.size + forward_insn_size = cur_insn.size for _ in range(5): forward_insn = disasm(self.ql, cur_addr+forward_insn_size) if forward_insn: @@ -430,8 +430,8 @@ class CtxManager_X86(CtxManager): cur_addr = self.ql.reg.arch_pc cur_insn = disasm(self.ql, cur_addr) - to_jump, _ = self.predictor.predict() - self.print_asm(cur_insn, to_jump=to_jump) + prophecy = self.predictor.predict() + self.print_asm(cur_insn, to_jump=prophecy.going) # assembly before current location diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 74b16d7a..4bb5c64d 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -13,8 +13,8 @@ from qiling.const import QL_ARCH, QL_VERBOSE from qiling.debugger import QlDebugger from .frontend import examine_mem, setup_ctx_manager -from .utils import is_thumb, parse_int -from .utils import Breakpoint, TempBreakpoint +from .utils import is_thumb, parse_int, setup_branch_predictor, disasm +from .utils import Breakpoint, TempBreakpoint, read_inst from .const import color @@ -32,6 +32,7 @@ class QlQdb(cmd.Cmd, QlDebugger): self._states_list = [] self.ctx = setup_ctx_manager(ql) + self.predictor = setup_branch_predictor(ql) super().__init__() @@ -42,7 +43,16 @@ class QlQdb(cmd.Cmd, QlDebugger): # self.ql.loader.entry_point # ld.so # self.ql.loader.elf_entry # .text of binary + def bp_handler(ql, address, size, bp_list): + if address in bp_list: + ql.emu_stop() + _ = bp_list.pop(address) + self.do_context() + + self.ql.hook_code(bp_handler, self.bp_list) + if init_hook and self.ql.loader.entry_point != init_hook: + breakpoint() self.do_breakpoint(init_hook) self.cur_addr = self.ql.loader.entry_point @@ -210,9 +220,9 @@ class QlQdb(cmd.Cmd, QlDebugger): self._restore() self.do_context() - def do_step(self: QlQdb, *args) -> Optional[bool]: + def do_step_in(self: QlQdb, *args) -> Optional[bool]: """ - execute one instruction at a time + execute one instruction at a time, will enter subroutine """ if self.ql is None: @@ -225,20 +235,40 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._save() - # next_stop = self.predictor.predict() + prophecy = self.predictor.predict() - # if next_stop is True: - # return True + if prophecy.where is True: + return True if self.ql.archtype == QL_ARCH.CORTEX_M: - self.ql.arch.step() self.ql.count -= 1 + self.set_breakpoint(self.cur_addr, is_temp=True) - else: - self._run(count=1) + self._run(count=1) self.do_context() + def do_step_over(self: QlQdb, *args) -> Option[bool]: + """ + execute one instruction at a time, but WON't enter subroutine + """ + + if self.ql is None: + print(f"{color.RED}[!] The program is not being run.{color.END}") + + else: + + prophecy = self.predictor.predict() + + if prophecy.going: + cur_insn = disasm(self.ql, self.cur_addr) + self.set_breakpoint(self.cur_addr + cur_insn.size, is_temp=True) + + else: + self.set_breakpoint(prophecy.where, is_temp=True) + + self._run(self.cur_addr) + def set_breakpoint(self: QlQdb, address: int, is_temp: bool = False) -> None: """ internal function for placing breakpoint @@ -246,9 +276,9 @@ class QlQdb(cmd.Cmd, QlDebugger): bp = TempBreakpoint(address) if is_temp else Breakpoint(address) - if self.ql.archtype != QL_ARCH.CORTEX_M: + # if self.ql.archtype != QL_ARCH.CORTEX_M: # skip hook_address for cortex_m - bp.hook = self.ql.hook_address(self._bp_handler, address) + # bp.hook = self.ql.hook_address(self._bp_handler, address) self.bp_list.update({address: bp}) @@ -356,7 +386,8 @@ class QlQdb(cmd.Cmd, QlDebugger): do_r = do_run - do_s = do_step + do_s = do_step_in + do_n = do_step_over do_q = do_quit do_x = do_examine do_p = do_backward diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index eeb32253..dd9f5f8d 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -6,6 +6,8 @@ from __future__ import annotations from typing import Callable, Optional, Mapping from qiling.const import * + +from collections import namedtuple import ast, re # parse unsigned integer from string @@ -67,7 +69,7 @@ def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: md = ql.disassembler md.detail = detail try: - ret = next(md.disasm(_read_inst(ql, address), address)) + ret = next(md.disasm(read_inst(ql, address), address)) except StopIteration: ret = None @@ -75,7 +77,7 @@ def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: return ret -def _read_inst(ql: Qiling, addr: int) -> int: +def read_inst(ql: Qiling, addr: int) -> int: result = ql.mem.read(addr, 4) if ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): @@ -115,6 +117,14 @@ def setup_branch_predictor(ql: Qiling) -> BranchPredictor: QL_ARCH.MIPS: BranchPredictor_MIPS, }.get(ql.archtype)(ql) +class Prophecy(object): + def __init__(self): + self.going = False + self.where = None + + def __iter__(self): + return iter((self.going, self.where)) + class BranchPredictor(object): def __init__(self, ql): self.ql = ql @@ -141,9 +151,10 @@ class BranchPredictor_ARM(BranchPredictor): return op_str.partition(", ")[0] == "pc" def predict(self): + prophecy = Prophecy() cur_addr = self.ql.reg.arch_pc line = disasm(self.ql, cur_addr) - ret_addr = cur_addr + line.size + prophecy.where = cur_addr + line.size if line.mnemonic == self.CODE_END: # indicates program exited return True @@ -219,23 +230,22 @@ class BranchPredictor_ARM(BranchPredictor): "cbnz": (lambda r: r != 0), } - to_jump = False if line.mnemonic in jump_table: - to_jump = jump_table.get(line.mnemonic)(*get_cpsr(self.ql.reg.cpsr)) + prophecy.going = jump_table.get(line.mnemonic)(*get_cpsr(self.ql.reg.cpsr)) elif line.mnemonic in cb_table: - to_jump = cb_table.get(line.mnemonic)(self.read_reg(line.op_str.split(", ")[0])) + prophecy.going = cb_table.get(line.mnemonic)(self.read_reg(line.op_str.split(", ")[0])) - if to_jump: + if prophecy.going: if "#" in line.op_str: - ret_addr = read_int(line.op_str.split("#")[-1]) + prophecy.where = read_int(line.op_str.split("#")[-1]) else: - ret_addr = read_reg_val(line.op_str) + prophecy.where = read_reg_val(line.op_str) if regdst_eq_pc(line.op_str): next_addr = cur_addr + line.size n2_addr = next_addr + len(read_inst(next_addr)) - ret_addr += len(read_inst(n2_addr)) + len(read_inst(next_addr)) + prophecy.where += len(read_inst(n2_addr)) + len(read_inst(next_addr)) elif line.mnemonic.startswith("it"): # handle IT block here @@ -266,7 +276,7 @@ class BranchPredictor_ARM(BranchPredictor): next_addr += len(_inst) - ret_addr = next_addr + prophecy.where = next_addr elif line.mnemonic in ("ldr",): @@ -275,11 +285,11 @@ class BranchPredictor_ARM(BranchPredictor): r, _, imm = rn_offset.strip("[]!").partition(", #") if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate - ret_addr = ql.unpack32(ql.mem.read(read_int(imm) + read_reg_val(r), self.INST_SIZE)) + prophecy.where = ql.unpack32(ql.mem.read(read_int(imm) + read_reg_val(r), self.INST_SIZE)) else: # post-indexed immediate # FIXME: weired behavior, immediate here does not apply - ret_addr = ql.unpack32(ql.mem.read(read_reg_val(r), self.INST_SIZE)) + prophecy.where = ql.unpack32(ql.mem.read(read_reg_val(r), self.INST_SIZE)) elif line.mnemonic in ("addls", "addne", "add") and self.regdst_eq_pc(line.op_str): V, C, Z, N = get_cpsr(ql.reg.cpsr) @@ -295,10 +305,10 @@ class BranchPredictor_ARM(BranchPredictor): n = read_int(expr[-1].strip("#")) * 2 if line.mnemonic == "addls" and (C == 0 or Z == 1): - ret_addr = extra + read_reg_val(r1) + read_reg_val(r2) * n + prophecy.where = extra + read_reg_val(r1) + read_reg_val(r2) * n elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): - ret_addr = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) + prophecy.where = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) elif line.mnemonic in ("tbh", "tbb"): @@ -319,11 +329,11 @@ class BranchPredictor_ARM(BranchPredictor): r1 = read_reg_val(r1) to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n - ret_addr = cur_addr + to_add + prophecy.where = cur_addr + to_add elif line.mnemonic.startswith("pop") and "pc" in line.op_str: - ret_addr = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * self.INST_SIZE) + prophecy.where = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * self.INST_SIZE) if not { # step to next instruction if cond does not meet "pop" : lambda *_: True, "pop.w": lambda *_: True, @@ -334,45 +344,44 @@ class BranchPredictor_ARM(BranchPredictor): "poplt": lambda V, C, Z, N: (N != V), }.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)): - ret_addr = cur_addr + self.INST_SIZE + prophecy.where = cur_addr + self.INST_SIZE elif line.mnemonic == "sub" and self.regdst_eq_pc(line.op_str): _, r, imm = line.op_str.split(", ") - ret_addr = read_reg_val(r) - read_int(imm.strip("#")) + prophecy.where = read_reg_val(r) - read_int(imm.strip("#")) elif line.mnemonic == "mov" and self.regdst_eq_pc(line.op_str): _, r = line.op_str.split(", ") - ret_addr = read_reg_val(r) + prophecy.where = read_reg_val(r) - if ret_addr & 1: - ret_addr -= 1 + if prophecy.where & 1: + prophecy.where -= 1 - return (to_jump, ret_addr) + return prophecy class BranchPredictor_MIPS(BranchPredictor): def __init__(self, ql): + super().__init__(ql) self.CODE_END = "break" self.INST_SIZE = 4 - self.ql = ql def read_reg(self, reg_name): reg_name = reg_name.strip("$").replace("fp", "s8") return signed_val(getattr(self.ql.reg, reg_name)) def predict(self): - + prophecy = Prophecy() cur_addr = self.ql.reg.arch_pc line = disasm(self.ql, cur_addr) if line.mnemonic == self.CODE_END: # indicates program extied return True - ret_addr = None - to_jump = False + prophecy.where = cur_addr + self.INST_SIZE if line.mnemonic.startswith('j') or line.mnemonic.startswith('b'): # make sure at least delay slot executed - ret_addr = cur_addr + self.INST_SIZE + prophecy.where += self.INST_SIZE # get registers or memory address from op_str targets = [ @@ -381,7 +390,7 @@ class BranchPredictor_MIPS(BranchPredictor): for each in line.op_str.split(", ") ] - to_jump = { + prophecy.going = { "j" : (lambda _: True), # unconditional jump "jr" : (lambda _: True), # unconditional jump "jal" : (lambda _: True), # unconditional jump @@ -405,18 +414,18 @@ class BranchPredictor_MIPS(BranchPredictor): "bgezal" : (lambda r, _: r >= 0), # branch on greater than or equal to zero and link }.get(line.mnemonic)(*targets) - if to_jump: + if prophecy.going: # target address is always the rightmost one - ret_addr = targets[-1] + prophecy.where = targets[-1] - return (to_jump, ret_addr) + return prophecy class BranchPredictor_X86(BranchPredictor): def __init__(self, ql): super().__init__(ql) def predict(self): - + prophecy = Prophecy() cur_addr = self.ql.reg.arch_pc line = disasm(self.ql, cur_addr) @@ -480,17 +489,14 @@ class BranchPredictor_X86(BranchPredictor): "jrcxz" : (lambda rcx: rcx == 0), } - to_jump = False if line.mnemonic in jump_table: eflags = get_x86_eflags(self.ql.reg.ef).values() - to_jump = jump_table.get(line.mnemonic)(*eflags) + prophecy.going = jump_table.get(line.mnemonic)(*eflags) elif line.mnemonic in jump_reg_table: - to_jump = jump_reg_table.get(line.mnemonic)(self.ql.reg.ecx) + prophecy.going = jump_reg_table.get(line.mnemonic)(self.ql.reg.ecx) - ret_addr = None - - if to_jump: + if prophecy.going: takeaway_list = ["ptr", "dword", "[", "]"] class AST_checker(ast.NodeVisitor): def generic_visit(self, node): @@ -518,15 +524,17 @@ class BranchPredictor_X86(BranchPredictor): checker.visit(ast_tree) - ret_addr = eval(new_line) + prophecy.where = eval(new_line) elif line.op_str in self.ql.reg.register_mapping: - ret_addr = getattr(self.ql.reg, line.op_str) + prophecy.where = getattr(self.ql.reg, line.op_str) else: - ret_addr = read_int(line.op_str) + prophecy.where = read_int(line.op_str) + else: + prophecy.where = cur_addr + line.size - return (to_jump, ret_addr) + return prophecy class BranchPredictor_CORTEX_M(BranchPredictor_ARM): def __init__(self, ql): From 8b4fa21ab63d3ad4e98120f30f7360285e1bb434 Mon Sep 17 00:00:00 2001 From: ucgJhe Date: Sat, 12 Feb 2022 11:15:29 +0800 Subject: [PATCH 63/66] fix asm listing for cortex_m and breakpoint --- qiling/debugger/qdb/frontend.py | 2 +- qiling/debugger/qdb/qdb.py | 68 ++++++++++++++------------------- qiling/debugger/qdb/utils.py | 29 +++++++------- 3 files changed, 44 insertions(+), 55 deletions(-) diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index 3e34abc3..cf4a1d08 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -252,7 +252,7 @@ class CtxManager(object): past_list.append(line) # print four insns before current location - for line in past_list[:-1][:4]: + for line in past_list[:-1]: self.print_asm(line) # assembly for current location diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 4bb5c64d..d6366254 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -44,15 +44,26 @@ class QlQdb(cmd.Cmd, QlDebugger): # self.ql.loader.elf_entry # .text of binary def bp_handler(ql, address, size, bp_list): - if address in bp_list: - ql.emu_stop() - _ = bp_list.pop(address) + + if (bp := self.bp_list.get(address, None)): + + if isinstance(bp, TempBreakpoint): + # remove TempBreakpoint once hitted + self.del_breakpoint(bp) + + else: + if bp.hitted: + return + + print(f"{color.CYAN}[+] hit breakpoint at 0x{self.cur_addr:08x}{color.END}") + bp.hitted = True + + ql.stop() self.do_context() self.ql.hook_code(bp_handler, self.bp_list) if init_hook and self.ql.loader.entry_point != init_hook: - breakpoint() self.do_breakpoint(init_hook) self.cur_addr = self.ql.loader.entry_point @@ -82,27 +93,6 @@ class QlQdb(cmd.Cmd, QlDebugger): self.ql.reg.arch_pc = address - def _bp_handler(self: QlQdb, *args) -> None: - """ - internal function for handling once breakpoint hitted - """ - - if (bp := self.bp_list.get(self.cur_addr, None)): - - if isinstance(bp, TempBreakpoint): - # remove TempBreakpoint once hitted - self.del_breakpoint(bp) - - else: - if bp.hitted: - return - - print(f"{color.CYAN}[+] hit breakpoint at 0x{self.cur_addr:08x}{color.END}") - bp.hitted = True - - self.ql.stop() - self.do_context() - def _save(self: QlQdb, *args) -> None: """ internal function for saving state of qiling instance @@ -220,6 +210,12 @@ class QlQdb(cmd.Cmd, QlDebugger): self._restore() self.do_context() + def update_reg_dump(self: QlQdb) -> None: + """ + internal function for updating registers dump + """ + self._saved_reg_dump = dict(filter(lambda d: isinstance(d[0], str), self.ql.reg.save().items())) + def do_step_in(self: QlQdb, *args) -> Optional[bool]: """ execute one instruction at a time, will enter subroutine @@ -229,8 +225,7 @@ class QlQdb(cmd.Cmd, QlDebugger): print(f"{color.RED}[!] The program is not being run.{color.END}") else: - # save reg dump for data highlighting changes - self._saved_reg_dump = dict(filter(lambda d: isinstance(d[0], str), self.ql.reg.save().items())) + self.update_reg_dump() if self.rr: self._save() @@ -241,10 +236,9 @@ class QlQdb(cmd.Cmd, QlDebugger): return True if self.ql.archtype == QL_ARCH.CORTEX_M: - self.ql.count -= 1 - self.set_breakpoint(self.cur_addr, is_temp=True) - - self._run(count=1) + self.ql.arch.step() + else: + self._run(count=1) self.do_context() @@ -259,6 +253,7 @@ class QlQdb(cmd.Cmd, QlDebugger): else: prophecy = self.predictor.predict() + self.update_reg_dump() if prophecy.going: cur_insn = disasm(self.ql, self.cur_addr) @@ -267,7 +262,7 @@ class QlQdb(cmd.Cmd, QlDebugger): else: self.set_breakpoint(prophecy.where, is_temp=True) - self._run(self.cur_addr) + self._run() def set_breakpoint(self: QlQdb, address: int, is_temp: bool = False) -> None: """ @@ -276,19 +271,14 @@ class QlQdb(cmd.Cmd, QlDebugger): bp = TempBreakpoint(address) if is_temp else Breakpoint(address) - # if self.ql.archtype != QL_ARCH.CORTEX_M: - # skip hook_address for cortex_m - # bp.hook = self.ql.hook_address(self._bp_handler, address) - self.bp_list.update({address: bp}) def del_breakpoint(self: QlQdb, bp: Union[Breakpoint, TempBreakpoint]) -> None: """ - internal function for removing breakpoints + internal function for removing breakpoint """ - if self.bp_list.pop(bp.addr, None): - bp.hook.remove() + self.bp_list.pop(bp.addr, None) def do_start(self: QlQdb, *args) -> None: """ diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index dd9f5f8d..9178a262 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -240,9 +240,9 @@ class BranchPredictor_ARM(BranchPredictor): if "#" in line.op_str: prophecy.where = read_int(line.op_str.split("#")[-1]) else: - prophecy.where = read_reg_val(line.op_str) + prophecy.where = self.read_reg(line.op_str) - if regdst_eq_pc(line.op_str): + if self.regdst_eq_pc(line.op_str): next_addr = cur_addr + line.size n2_addr = next_addr + len(read_inst(next_addr)) prophecy.where += len(read_inst(n2_addr)) + len(read_inst(next_addr)) @@ -285,11 +285,11 @@ class BranchPredictor_ARM(BranchPredictor): r, _, imm = rn_offset.strip("[]!").partition(", #") if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate - prophecy.where = ql.unpack32(ql.mem.read(read_int(imm) + read_reg_val(r), self.INST_SIZE)) + prophecy.where = ql.unpack32(ql.mem.read(read_int(imm) + self.read_reg(r), self.INST_SIZE)) else: # post-indexed immediate # FIXME: weired behavior, immediate here does not apply - prophecy.where = ql.unpack32(ql.mem.read(read_reg_val(r), self.INST_SIZE)) + prophecy.where = ql.unpack32(ql.mem.read(self.read_reg(r), self.INST_SIZE)) elif line.mnemonic in ("addls", "addne", "add") and self.regdst_eq_pc(line.op_str): V, C, Z, N = get_cpsr(ql.reg.cpsr) @@ -305,10 +305,10 @@ class BranchPredictor_ARM(BranchPredictor): n = read_int(expr[-1].strip("#")) * 2 if line.mnemonic == "addls" and (C == 0 or Z == 1): - prophecy.where = extra + read_reg_val(r1) + read_reg_val(r2) * n + prophecy.where = extra + self.read_reg(r1) + self.read_reg(r2) * n elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): - prophecy.where = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) + prophecy.where = extra + self.read_reg(r1) + (self.read_reg(r2) * n if imm else self.read_reg(r2)) elif line.mnemonic in ("tbh", "tbb"): @@ -322,11 +322,11 @@ class BranchPredictor_ARM(BranchPredictor): if line.mnemonic == "tbh": - r1 = read_reg_val(r1) * n + r1 = self.read_reg(r1) * n elif line.mnemonic == "tbb": - r1 = read_reg_val(r1) + r1 = self.read_reg(r1) to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n prophecy.where = cur_addr + to_add @@ -348,11 +348,11 @@ class BranchPredictor_ARM(BranchPredictor): elif line.mnemonic == "sub" and self.regdst_eq_pc(line.op_str): _, r, imm = line.op_str.split(", ") - prophecy.where = read_reg_val(r) - read_int(imm.strip("#")) + prophecy.where = self.read_reg(r) - read_int(imm.strip("#")) elif line.mnemonic == "mov" and self.regdst_eq_pc(line.op_str): _, r = line.op_str.split(", ") - prophecy.where = read_reg_val(r) + prophecy.where = self.read_reg(r) if prophecy.where & 1: prophecy.where -= 1 @@ -544,17 +544,16 @@ class Breakpoint(object): """ dummy class for breakpoint """ - def __init__(self, address: int): - self.addr = address + def __init__(self, addr): + self.addr = addr self.hitted = False - self.hook = None class TempBreakpoint(Breakpoint): """ dummy class for temporay breakpoint """ - def __init__(self, address): - super().__init__(address) + def __init__(self, addr): + super().__init__(addr) class ParseError(Exception): pass From 12aaf2b1fe8a669f7411d5a4402c321422659ea3 Mon Sep 17 00:00:00 2001 From: lazymio Date: Sun, 13 Feb 2022 10:22:15 +0100 Subject: [PATCH 64/66] Update rootfs --- examples/rootfs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rootfs b/examples/rootfs index 149041a1..d8a9b0d6 160000 --- a/examples/rootfs +++ b/examples/rootfs @@ -1 +1 @@ -Subproject commit 149041a153ad8b5366b1b070afb20e2f6293aaf6 +Subproject commit d8a9b0d6c52a3c5bc627c055d5f711dacbb1a1f6 From f6a0f121c7b9576bf28628664a097b63a31b4038 Mon Sep 17 00:00:00 2001 From: lazymio Date: Sun, 13 Feb 2022 10:55:31 +0100 Subject: [PATCH 65/66] Fix link path resolve --- qiling/os/path.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qiling/os/path.py b/qiling/os/path.py index e5827336..9102d745 100644 --- a/qiling/os/path.py +++ b/qiling/os/path.py @@ -133,7 +133,7 @@ class QlPathManager: if os.path.islink(real_path): link_path = Path(os.readlink(real_path)) - real_path = self.convert_path(self.ql.rootfs, os.path.dirname(real_path), link_path) + real_path = self.convert_path(os.path.dirname(real_path), "/", link_path) if os.path.islink(real_path): real_path = self.transform_to_real_path(real_path) From f9ad909a2ea03f5decccce488ccdfa6e7003cb1c Mon Sep 17 00:00:00 2001 From: lazymio Date: Sun, 13 Feb 2022 10:56:02 +0100 Subject: [PATCH 66/66] Add a TODO for VFS --- qiling/os/path.py | 1 + 1 file changed, 1 insertion(+) diff --git a/qiling/os/path.py b/qiling/os/path.py index 9102d745..b3914bca 100644 --- a/qiling/os/path.py +++ b/qiling/os/path.py @@ -128,6 +128,7 @@ class QlPathManager: return str(real_path.absolute()) def transform_to_real_path(self, path: str) -> str: + # TODO: We really need a virtual file system. real_path = self.convert_path(self.ql.rootfs, self.cwd, path) if os.path.islink(real_path):