diff --git a/examples/sality.py b/examples/sality.py index a947b652..330decaa 100644 --- a/examples/sality.py +++ b/examples/sality.py @@ -75,7 +75,7 @@ def hook_CreateFileA(ql: Qiling, address: int, params): else: return (-1) else: - ret = _CreateFile(ql, address, params, "CreateFileA") + ret = _CreateFile(ql, address, params) return ret def _WriteFile(ql: Qiling, address: int, params): diff --git a/qiling/debugger/qdb/frontend.py b/qiling/debugger/qdb/frontend.py index fb93e6e4..cf4a1d08 100644 --- a/qiling/debugger/qdb/frontend.py +++ b/qiling/debugger/qdb/frontend.py @@ -5,16 +5,14 @@ from __future__ import annotations from typing import Optional, Mapping, Iterable, Union - import copy, math, os -from contextlib import contextmanager - -from qiling.const import QL_ARCH import unicorn -from .utils import dump_regs, get_arm_flags, disasm, _parse_int, handle_bnj -from .const import * +from qiling.const import QL_ARCH + +from .utils import disasm, get_x86_eflags, setup_branch_predictor +from .const import color, SIZE_LETTER, FORMAT_LETTER # read data from memory of qiling instance @@ -71,7 +69,7 @@ def examine_mem(ql: Qiling, line: str) -> Union[bool, (str, int, int)]: if elem in ql.reg.register_mapping.keys(): items.append(getattr(ql.reg, elem, None)) else: - items.append(_parse_int(elem)) + items.append(read_int(elem)) addr = sum(items) @@ -146,154 +144,107 @@ def _try_read(ql: Qiling, address: int, size: int) -> Optional[bytes]: return (result, err_msg) -# divider printer -@contextmanager -def context_printer(ql: Qiling, field_name: str, ruler: str = "─") -> None: - height, width = get_terminal_size() - bar = (width - len(field_name)) // 2 - 1 - print(ruler * bar, field_name, ruler * bar) - yield - if "DISASM" in field_name: - print(ruler * width) +""" + + Context Manager for rendering UI + +""" + +COLORS = (color.DARKCYAN, color.BLUE, color.RED, color.YELLOW, color.GREEN, color.PURPLE, color.CYAN, color.WHITE) + +# decorator function for printing divider +def context_printer(field_name, ruler="─"): + def decorator(context_dumper): + def wrapper(*args, **kwargs): + height, width = get_terminal_size() + bar = (width - len(field_name)) // 2 - 1 + print(ruler * bar, field_name, ruler * bar) + context_dumper(*args, **kwargs) + if "DISASM" in field_name: + print(ruler * width) + return wrapper + return decorator -def context_reg(ql: Qiling, saved_states: Optional[Mapping[str, int]] = None, /, *args, **kwargs) -> None: - - # context render for registers - with context_printer(ql, "[ REGISTERS ]"): - - _cur_regs = dump_regs(ql) - - _colors = (color.DARKCYAN, color.BLUE, color.RED, color.YELLOW, color.GREEN, color.PURPLE, color.CYAN, color.WHITE) - - if ql.archtype == QL_ARCH.MIPS: - - _cur_regs.update({"fp": _cur_regs.pop("s8")}) - - if saved_states is not None: - _saved_states = copy.deepcopy(saved_states) - _saved_states.update({"fp": _saved_states.pop("s8")}) - _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] - - else: - _diff = None - - lines = "" - for idx, r in enumerate(_cur_regs, 1): - line = "{}{}: 0x{{:08x}} {}\t".format(_colors[(idx-1) // 4], r, color.END) - - if _diff and r in _diff: - line = f"{color.UNDERLINE}{color.BOLD}{line}" - - if idx % 4 == 0 and idx != 32: - line += "\n" - - lines += line - - print(lines.format(*_cur_regs.values())) - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): +def setup_ctx_manager(ql: Qiling) -> CtxManager: + return { + QL_ARCH.X86: CtxManager_X86, + QL_ARCH.ARM: CtxManager_ARM, + QL_ARCH.ARM_THUMB: CtxManager_ARM, + QL_ARCH.CORTEX_M: CtxManager_ARM, + QL_ARCH.MIPS: CtxManager_MIPS, + }.get(ql.archtype)(ql) - _cur_regs.update({"sl": _cur_regs.pop("r10")}) - _cur_regs.update({"ip": _cur_regs.pop("r12")}) - _cur_regs.update({"fp": _cur_regs.pop("r11")}) +class CtxManager(object): + def __init__(self, ql): + self.ql = ql + self.predictor = setup_branch_predictor(ql) - regs_in_row = 4 - if ql.archtype == QL_ARCH.CORTEX_M: - regs_in_row = 3 + def print_asm(self, insn: CsInsn, to_jump: Optional[bool] = None, address: int = None) -> None: - # for re-order - _cur_regs.update({"xpsr": _cur_regs.pop("xpsr")}) - _cur_regs.update({"control": _cur_regs.pop("control")}) - _cur_regs.update({"primask": _cur_regs.pop("primask")}) - _cur_regs.update({"faultmask": _cur_regs.pop("faultmask")}) - _cur_regs.update({"basepri": _cur_regs.pop("basepri")}) + opcode = "".join(f"{b:02x}" for b in insn.bytes) + if self.ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + trace_line = f"0x{insn.address:08x} │ {opcode:20s} {insn.mnemonic:10} {insn.op_str:35s}" + else: + trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" - _diff = None - if saved_states is not None: - _saved_states = copy.deepcopy(saved_states) - _saved_states.update({"sl": _saved_states.pop("r10")}) - _saved_states.update({"ip": _saved_states.pop("r12")}) - _saved_states.update({"fp": _saved_states.pop("r11")}) - _diff = [k for k in _cur_regs if _cur_regs[k] != _saved_states[k]] + cursor = " " + if self.ql.reg.arch_pc == insn.address: + cursor = "►" - lines = "" - for idx, r in enumerate(_cur_regs, 1): + jump_sign = " " + if to_jump: + jump_sign = f"{color.RED}✓{color.END}" - line = "{}{:}: 0x{{:08x}} {} ".format(_colors[(idx-1) // regs_in_row], r, color.END) + print(f"{jump_sign} {cursor} {color.DARKGRAY}{trace_line}{color.END}") - if _diff and r in _diff: - line = "{}{}".format(color.UNDERLINE, color.BOLD) + line + def dump_regs(self): + return {reg_name: getattr(self.ql.reg, reg_name) for reg_name in self.regs} - if idx % regs_in_row == 0: - line += "\n" + def context_reg(self, saved_states): + return NotImplementedError - lines += line + @context_printer("[ STACK ]") + def context_stack(self): - print(lines.format(*_cur_regs.values())) - print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=get_arm_flags(ql.reg.cpsr)), color.END, sep="") + for idx in range(10): + addr = self.ql.reg.arch_sp + idx * self.ql.pointersize + if (val := _try_read(self.ql, addr, self.ql.pointersize)[0]): + print(f"$sp+0x{idx*self.ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{self.ql.unpack(val):08x}", end="") - if ql.archtype != QL_ARCH.CORTEX_M: - # context render for Stack, skip this for CORTEX_M - with context_printer(ql, "[ STACK ]", ruler="─"): + # try to dereference wether it's a pointer + if (buf := _try_read(self.ql, addr, self.ql.pointersize))[0] is not None: - for idx in range(10): - addr = ql.reg.arch_sp + idx * ql.pointersize - val = ql.mem.read(addr, ql.pointersize) - print(f"$sp+0x{idx*ql.pointersize:02x}│ [0x{addr:08x}] —▸ 0x{ql.unpack(val):08x}", end="") + if (addr := self.ql.unpack(buf[0])): - # try to dereference wether it's a pointer - if (buf := _try_read(ql, addr, ql.pointersize))[0] is not None: + # try to dereference again + if (buf := _try_read(self.ql, addr, self.ql.pointersize))[0] is not None: + try: + s = self.ql.mem.string(addr) + except: + s = None - if (addr := ql.unpack(buf[0])): - - # try to dereference again - if (buf := _try_read(ql, addr, ql.pointersize))[0] is not None: - try: - s = ql.mem.string(addr) - except: - s = None - - if s and s.isprintable(): - print(f" ◂— {ql.mem.string(addr)}", end="") - else: - print(f" ◂— 0x{ql.unpack(buf[0]):08x}", end="") - print() - - -def print_asm(ql: Qiling, insn: CsInsn, to_jump: Optional[bool] = None, address: int = None) -> None: - - opcode = "".join(f"{b:02x}" for b in insn.bytes) - trace_line = f"0x{insn.address:08x} │ {opcode:10s} {insn.mnemonic:10} {insn.op_str:35s}" - - cursor = " " - if ql.reg.arch_pc == insn.address: - cursor = "►" - - jump_sign = " " - if to_jump and address != ql.reg.arch_pc+4: - jump_sign = f"{color.RED}✓{color.END}" - - print(f"{jump_sign} {cursor} {color.DARKGRAY}{trace_line}{color.END}") - - -def context_asm(ql: Qiling, address: int) -> None: - - with context_printer(ql, field_name="[ DISASM ]"): + if s and s.isprintable(): + print(f" ◂— {self.ql.mem.string(addr)}", end="") + else: + print(f" ◂— 0x{self.ql.unpack(buf[0]):08x}", end="") + print() + @context_printer("[ DISASM ]") + def context_asm(self): # assembly before current location - past_list = [] + cur_addr = self.ql.reg.arch_pc - line = disasm(ql, address-0x10) + line = disasm(self.ql, cur_addr-0x10) while line: - if line.address == address: + if line.address == cur_addr: break addr = line.address + line.size - line = disasm(ql, addr) + line = disasm(self.ql, addr) if not line: break @@ -301,20 +252,256 @@ def context_asm(ql: Qiling, address: int) -> None: past_list.append(line) # print four insns before current location - for line in past_list[:-1][:4]: - print_asm(ql, line) + for line in past_list[:-1]: + self.print_asm(line) # assembly for current location - cur_ins = disasm(ql, address) - to_jump, next_stop = handle_bnj(ql, address) - print_asm(ql, cur_ins, to_jump=to_jump) + cur_insn = disasm(self.ql, cur_addr) + prophecy = self.predictor.predict() + self.print_asm(cur_insn, to_jump=prophecy.going) # assembly after current location - forward_insn_size = cur_ins.size + forward_insn_size = cur_insn.size for _ in range(5): - forward_insn = disasm(ql, address+forward_insn_size) + forward_insn = disasm(self.ql, cur_addr+forward_insn_size) if forward_insn: - print_asm(ql, forward_insn) + self.print_asm(forward_insn) forward_insn_size += forward_insn.size + + +class CtxManager_ARM(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "r0", "r1", "r2", "r3", + "r4", "r5", "r6", "r7", + "r8", "r9", "r10", "r11", + "r12", "sp", "lr", "pc", + ) + + @staticmethod + def get_flags(bits: int) -> Mapping[str, int]: + + def _get_mode(bits): + return { + 0b10000: "User", + 0b10001: "FIQ", + 0b10010: "IRQ", + 0b10011: "Supervisor", + 0b10110: "Monitor", + 0b10111: "Abort", + 0b11010: "Hypervisor", + 0b11011: "Undefined", + 0b11111: "System", + }.get(bits & 0x00001f) + + return { + "mode": _get_mode(bits), + "thumb": bits & 0x00000020 != 0, + "fiq": bits & 0x00000040 != 0, + "irq": bits & 0x00000080 != 0, + "neg": bits & 0x80000000 != 0, + "zero": bits & 0x40000000 != 0, + "carry": bits & 0x20000000 != 0, + "overflow": bits & 0x10000000 != 0, + } + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + cur_regs = self.dump_regs() + + cur_regs.update({"sl": cur_regs.pop("r10")}) + cur_regs.update({"ip": cur_regs.pop("r12")}) + cur_regs.update({"fp": cur_regs.pop("r11")}) + + regs_in_row = 4 + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"sl": reg_dump.pop("r10")}) + reg_dump.update({"ip": reg_dump.pop("r12")}) + reg_dump.update({"fp": reg_dump.pop("r11")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + + line = "{}{:}: 0x{{:08x}} {} ".format(COLORS[(idx-1) // regs_in_row], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % regs_in_row == 0: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=self.get_flags(self.ql.reg.cpsr)), color.END, sep="") + + +class CtxManager_MIPS(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "gp", "at", "v0", "v1", + "a0", "a1", "a2", "a3", + "t0", "t1", "t2", "t3", + "t4", "t5", "t6", "t7", + "t8", "t9", "sp", "s8", + "s0", "s1", "s2", "s3", + "s4", "s5", "s6", "s7", + "ra", "k0", "k1", "pc", + ) + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + + cur_regs = self.dump_regs() + + cur_regs.update({"fp": cur_regs.pop("s8")}) + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"fp": saved_reg_dump.pop("s8")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + line = "{}{}: 0x{{:08x}} {}\t".format(COLORS[(idx-1) // 4], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % 4 == 0 and idx != 32: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + + +class CtxManager_X86(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "eax", "ebx", "ecx", "edx", + "esp", "ebp", "esi", "edi", + "eip", "ss", "cs", "ds", "es", + "fs", "gs", "ef", + ) + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + cur_regs = self.dump_regs() + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + diff = [k for k in cur_regs if cur_regs[k] != saved_reg_dump[k]] + + lines = "" + for idx, r in enumerate(cur_regs, 1): + if len(r) == 2: + line = "{}{}: 0x{{:08x}} {}\t\t".format(COLORS[(idx-1) // 4], r, color.END) + else: + line = "{}{}: 0x{{:08x}} {}\t".format(COLORS[(idx-1) // 4], r, color.END) + + if diff and r in diff: + line = f"{color.UNDERLINE}{color.BOLD}{line}" + + if idx % 4 == 0 and idx != 32: + line += "\n" + + lines += line + + print(lines.format(*cur_regs.values())) + print(color.GREEN, "EFLAGS: [CF: {flags[CF]}, PF: {flags[PF]}, AF: {flags[AF]}, ZF: {flags[ZF]}, SF: {flags[SF]}, OF: {flags[OF]}]".format(flags=get_x86_eflags(self.ql.reg.ef)), color.END, sep="") + + @context_printer("[ DISASM ]") + def context_asm(self): + past_list = [] + cur_addr = self.ql.reg.arch_pc + + cur_insn = disasm(self.ql, cur_addr) + prophecy = self.predictor.predict() + self.print_asm(cur_insn, to_jump=prophecy.going) + + # assembly before current location + + line = disasm(self.ql, cur_addr+cur_insn.size) + acc_size = line.size + cur_insn.size + + while line and len(past_list) != 8: + past_list.append(line) + next_start = cur_addr + acc_size + line = disasm(self.ql, next_start) + acc_size += line.size + + # print four insns before current location + for line in past_list[:-1]: + self.print_asm(line) + + +class CtxManager_CORTEX_M(CtxManager): + def __init__(self, ql): + super().__init__(ql) + + self.regs = ( + "r0", "r1", "r2", "r3", + "r4", "r5", "r6", "r7", + "r8", "r9", "r10", "r11", + "r12", "sp", "lr", "pc", + "xpsr", "control", "primask", "basepri", "faultmask" + ) + + @context_printer("[ REGISTERS ]") + def context_reg(self, saved_reg_dump): + + cur_regs.update({"sl": cur_regs.pop("r10")}) + cur_regs.update({"ip": cur_regs.pop("r12")}) + cur_regs.update({"fp": cur_regs.pop("r11")}) + + regs_in_row = 3 + + # for re-order + cur_regs.update({"xpsr": cur_regs.pop("xpsr")}) + cur_regs.update({"control": cur_regs.pop("control")}) + cur_regs.update({"primask": cur_regs.pop("primask")}) + cur_regs.update({"faultmask": cur_regs.pop("faultmask")}) + cur_regs.update({"basepri": cur_regs.pop("basepri")}) + + diff = None + if saved_reg_dump is not None: + reg_dump = copy.deepcopy(saved_reg_dump) + reg_dump.update({"sl": reg_dump.pop("r10")}) + reg_dump.update({"ip": reg_dump.pop("r12")}) + reg_dump.update({"fp": reg_dump.pop("r11")}) + diff = [k for k in cur_regs if cur_regs[k] != reg_dump[k]] + + lines = "" + for idx, r in enumerate(_cur_regs, 1): + + line = "{}{:}: 0x{{:08x}} {} ".format(_colors[(idx-1) // regs_in_row], r, color.END) + + if _diff and r in _diff: + line = "{}{}".format(color.UNDERLINE, color.BOLD) + line + + if idx % regs_in_row == 0: + line += "\n" + + lines += line + + print(lines.format(cur_regs.values())) + print(color.GREEN, "[{cpsr[mode]} mode], Thumb: {cpsr[thumb]}, FIQ: {cpsr[fiq]}, IRQ: {cpsr[irq]}, NEG: {cpsr[neg]}, ZERO: {cpsr[zero]}, Carry: {cpsr[carry]}, Overflow: {cpsr[overflow]}".format(cpsr=get_arm_flags(self.ql.reg.cpsr)), color.END, sep="") + + +if __name__ == "__main__": + pass + diff --git a/qiling/debugger/qdb/qdb.py b/qiling/debugger/qdb/qdb.py index 819c04b5..d6366254 100644 --- a/qiling/debugger/qdb/qdb.py +++ b/qiling/debugger/qdb/qdb.py @@ -12,10 +12,10 @@ from qiling import Qiling from qiling.const import QL_ARCH, QL_VERBOSE from qiling.debugger import QlDebugger -from .frontend import context_reg, context_asm, examine_mem -from .utils import _parse_int, handle_bnj, is_thumb, CODE_END, parse_int -from .utils import Breakpoint, TempBreakpoint -from .const import * +from .frontend import examine_mem, setup_ctx_manager +from .utils import is_thumb, parse_int, setup_branch_predictor, disasm +from .utils import Breakpoint, TempBreakpoint, read_inst +from .const import color class QlQdb(cmd.Cmd, QlDebugger): @@ -31,6 +31,9 @@ class QlQdb(cmd.Cmd, QlDebugger): if self.rr: self._states_list = [] + self.ctx = setup_ctx_manager(ql) + self.predictor = setup_branch_predictor(ql) + super().__init__() self.dbg_hook(init_hook) @@ -40,6 +43,26 @@ class QlQdb(cmd.Cmd, QlDebugger): # self.ql.loader.entry_point # ld.so # self.ql.loader.elf_entry # .text of binary + def bp_handler(ql, address, size, bp_list): + + if (bp := self.bp_list.get(address, None)): + + if isinstance(bp, TempBreakpoint): + # remove TempBreakpoint once hitted + self.del_breakpoint(bp) + + else: + if bp.hitted: + return + + print(f"{color.CYAN}[+] hit breakpoint at 0x{self.cur_addr:08x}{color.END}") + bp.hitted = True + + ql.stop() + self.do_context() + + self.ql.hook_code(bp_handler, self.bp_list) + if init_hook and self.ql.loader.entry_point != init_hook: self.do_breakpoint(init_hook) @@ -70,27 +93,6 @@ class QlQdb(cmd.Cmd, QlDebugger): self.ql.reg.arch_pc = address - def _bp_handler(self: QlQdb, *args) -> None: - """ - internal function for handling once breakpoint hitted - """ - - if (bp := self.bp_list.get(self.cur_addr, None)): - - if isinstance(bp, TempBreakpoint): - # remove TempBreakpoint once hitted - self.del_breakpoint(bp) - - else: - if bp.hitted: - return - - print(f"{color.CYAN}[+] hit breakpoint at 0x{self.cur_addr:08x}{color.END}") - bp.hitted = True - - self.ql.stop() - self.do_context() - def _save(self: QlQdb, *args) -> None: """ internal function for saving state of qiling instance @@ -191,8 +193,9 @@ class QlQdb(cmd.Cmd, QlDebugger): show context information for current location """ - context_reg(self.ql, self._saved_reg_dump) - context_asm(self.ql, self.cur_addr) + self.ctx.context_reg(self._saved_reg_dump) + self.ctx.context_stack() + self.ctx.context_asm() def do_backward(self: QlQdb, *args) -> None: """ @@ -207,36 +210,60 @@ class QlQdb(cmd.Cmd, QlDebugger): self._restore() self.do_context() - def do_step(self: QlQdb, *args) -> Optional[bool]: + def update_reg_dump(self: QlQdb) -> None: """ - execute one instruction at a time + internal function for updating registers dump + """ + self._saved_reg_dump = dict(filter(lambda d: isinstance(d[0], str), self.ql.reg.save().items())) + + def do_step_in(self: QlQdb, *args) -> Optional[bool]: + """ + execute one instruction at a time, will enter subroutine """ if self.ql is None: print(f"{color.RED}[!] The program is not being run.{color.END}") else: - # save reg dump for data highlighting changes - self._saved_reg_dump = dict(filter(lambda d: isinstance(d[0], str), self.ql.reg.save().items())) + self.update_reg_dump() if self.rr: self._save() - _, next_stop = handle_bnj(self.ql, self.cur_addr) + prophecy = self.predictor.predict() - if next_stop is CODE_END: + if prophecy.where is True: return True if self.ql.archtype == QL_ARCH.CORTEX_M: self.ql.arch.step() - self.ql.count -= 1 - else: - count = 1 if next_stop == self.cur_addr + 4 else 2 - self._run(count=count) + self._run(count=1) self.do_context() + def do_step_over(self: QlQdb, *args) -> Option[bool]: + """ + execute one instruction at a time, but WON't enter subroutine + """ + + if self.ql is None: + print(f"{color.RED}[!] The program is not being run.{color.END}") + + else: + + prophecy = self.predictor.predict() + self.update_reg_dump() + + if prophecy.going: + cur_insn = disasm(self.ql, self.cur_addr) + self.set_breakpoint(self.cur_addr + cur_insn.size, is_temp=True) + + else: + self.set_breakpoint(prophecy.where, is_temp=True) + + self._run() + def set_breakpoint(self: QlQdb, address: int, is_temp: bool = False) -> None: """ internal function for placing breakpoint @@ -244,19 +271,14 @@ class QlQdb(cmd.Cmd, QlDebugger): bp = TempBreakpoint(address) if is_temp else Breakpoint(address) - if self.ql.archtype != QL_ARCH.CORTEX_M: - # skip hook_address for cortex_m - bp.hook = self.ql.hook_address(self._bp_handler, address) - self.bp_list.update({address: bp}) def del_breakpoint(self: QlQdb, bp: Union[Breakpoint, TempBreakpoint]) -> None: """ - internal function for removing breakpoints + internal function for removing breakpoint """ - if self.bp_list.pop(bp.addr, None): - bp.hook.remove() + self.bp_list.pop(bp.addr, None) def do_start(self: QlQdb, *args) -> None: """ @@ -323,7 +345,7 @@ class QlQdb(cmd.Cmd, QlDebugger): """ try: - context_asm(self.ql, _parse_int(address), self.ql.pointersize) + context_asm(self.ql, address) except: print(f"{color.RED}[!] something went wrong ...{color.END}") @@ -352,8 +374,10 @@ class QlQdb(cmd.Cmd, QlDebugger): if input(f"{color.RED}[!] Are you sure about saying good bye ~ ? [Y/n]{color.END} ").strip() == "Y": self.do_quit() + do_r = do_run - do_s = do_step + do_s = do_step_in + do_n = do_step_over do_q = do_quit do_x = do_examine do_p = do_backward diff --git a/qiling/debugger/qdb/utils.py b/qiling/debugger/qdb/utils.py index f3200320..9178a262 100644 --- a/qiling/debugger/qdb/utils.py +++ b/qiling/debugger/qdb/utils.py @@ -5,113 +5,38 @@ from __future__ import annotations from typing import Callable, Optional, Mapping -from functools import partial - from qiling.const import * -CODE_END = True - - -def dump_regs(ql: Qiling) -> Mapping[str, int]: - - if ql.archtype == QL_ARCH.MIPS: - - _reg_order = ( - "gp", "at", "v0", "v1", - "a0", "a1", "a2", "a3", - "t0", "t1", "t2", "t3", - "t4", "t5", "t6", "t7", - "t8", "t9", "sp", "s8", - "s0", "s1", "s2", "s3", - "s4", "s5", "s6", "s7", - "ra", "k0", "k1", "pc", - ) - - elif ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB): - - _reg_order = ( - "r0", "r1", "r2", "r3", - "r4", "r5", "r6", "r7", - "r8", "r9", "r10", "r11", - "r12", "sp", "lr", "pc", - ) - - elif ql.archtype == QL_ARCH.CORTEX_M: - - _reg_order = ( - "r0", "r1", "r2", "r3", - "r4", "r5", "r6", "r7", - "r8", "r9", "r10", "r11", - "r12", "sp", "lr", "pc", - "xpsr", "control", "primask", "basepri", "faultmask" - ) - - return {reg_name: getattr(ql.reg, reg_name) for reg_name in _reg_order} - - -def get_arm_flags(bits: int) -> Mapping[str, int]: - - def _get_mode(bits): - return { - 0b10000: "User", - 0b10001: "FIQ", - 0b10010: "IRQ", - 0b10011: "Supervisor", - 0b10110: "Monitor", - 0b10111: "Abort", - 0b11010: "Hypervisor", - 0b11011: "Undefined", - 0b11111: "System", - }.get(bits & 0x00001f) - - return { - "mode": _get_mode(bits), - "thumb": bits & 0x00000020 != 0, - "fiq": bits & 0x00000040 != 0, - "irq": bits & 0x00000080 != 0, - "neg": bits & 0x80000000 != 0, - "zero": bits & 0x40000000 != 0, - "carry": bits & 0x20000000 != 0, - "overflow": bits & 0x10000000 != 0, - } - +from collections import namedtuple +import ast, re # parse unsigned integer from string -def _parse_int(s: str) -> int: +def read_int(s: str) -> int: return int(s, 0) -# function dectorator for parse argument as integer +# function dectorator for parsing argument as integer def parse_int(func: Callable) -> Callable: - def wrap(qdb, s: str) -> int: + def wrap(qdb, s: str = "") -> int: assert type(s) is str try: - ret = _parse_int(s) + ret = read_int(s) except: ret = None return func(qdb, ret) return wrap + # check wether negative value or not def is_negative(i: int) -> int: return i & (1 << 31) -# convert valu to signed +# signed value convertion def signed_val(val: int) -> int: return (val-1 << 32) if is_negative(val) else val -# handle braches and jumps so we can set berakpoint properly -def handle_bnj(ql: Qiling, cur_addr: str) -> Callable[[Qiling, str], int]: - return { - QL_ARCH.MIPS : handle_bnj_mips, - QL_ARCH.ARM : handle_bnj_arm, - QL_ARCH.ARM_THUMB: handle_bnj_arm, - QL_ARCH.CORTEX_M : handle_bnj_arm, - }.get(ql.archtype)(ql, cur_addr) - - def get_cpsr(bits: int) -> (bool, bool, bool, bool): return ( bits & 0x10000000 != 0, # V, overflow flag @@ -121,16 +46,30 @@ def get_cpsr(bits: int) -> (bool, bool, bool, bool): ) +def get_x86_eflags(bits: int) -> Dict[str, bool]: + return { + "CF" : bits & 0x0001 != 0, # CF, carry flag + "PF" : bits & 0x0004 != 0, # PF, parity flag + "AF" : bits & 0x0010 != 0, # AF, adjust flag + "ZF" : bits & 0x0040 != 0, # ZF, zero flag + "SF" : bits & 0x0080 != 0, # SF, sign flag + "OF" : bits & 0x0800 != 0, # OF, overflow flag + } + + def is_thumb(bits: int) -> bool: return bits & 0x00000020 != 0 def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: + """ + helper function for disassembling + """ md = ql.disassembler md.detail = detail try: - ret = next(md.disasm(_read_inst(ql, address), address)) + ret = next(md.disasm(read_inst(ql, address), address)) except StopIteration: ret = None @@ -138,8 +77,7 @@ def disasm(ql: Qiling, address: int, detail: bool = False) -> Optional[int]: return ret -def _read_inst(ql: Qiling, addr: int) -> int: - +def read_inst(ql: Qiling, addr: int) -> int: result = ql.mem.read(addr, 4) if ql.archtype in (QL_ARCH.ARM, QL_ARCH.ARM_THUMB, QL_ARCH.CORTEX_M): @@ -158,305 +96,467 @@ def _read_inst(ql: Qiling, addr: int) -> int: latter_two = ql.unpack16(ql.mem.read(addr+2, 2)) result += ql.pack16(latter_two) + elif ql.archtype in (QL_ARCH.X86, QL_ARCH.X8664): + # due to the variadic lengh of x86 instructions ( 1~15 ) + # always assume the maxium size for disassembler to tell + # what is it exactly. + result = ql.mem.read(addr, 15) + return result +""" + Try to predict certian branch will be taken or not based on current context +""" -def handle_bnj_arm(ql: Qiling, cur_addr: str) -> int: +def setup_branch_predictor(ql: Qiling) -> BranchPredictor: + return { + QL_ARCH.X86: BranchPredictor_X86, + QL_ARCH.ARM: BranchPredictor_ARM, + QL_ARCH.ARM_THUMB: BranchPredictor_ARM, + QL_ARCH.CORTEX_M: BranchPredictor_CORTEX_M, + QL_ARCH.MIPS: BranchPredictor_MIPS, + }.get(ql.archtype)(ql) - def _read_reg_val(regs, _reg): - return getattr(ql.reg, _reg.replace("ip", "r12").replace("fp", "r11")) +class Prophecy(object): + def __init__(self): + self.going = False + self.where = None - def regdst_eq_pc(op_str): + def __iter__(self): + return iter((self.going, self.where)) + +class BranchPredictor(object): + def __init__(self, ql): + self.ql = ql + + def read_reg(self, reg_name): + return getattr(self.ql.reg, reg_name) + + def predict(self): + return NotImplementedError + +class BranchPredictor_ARM(BranchPredictor): + def __init__(self, ql): + super().__init__(ql) + + self.INST_SIZE = 4 + self.THUMB_INST_SIZE = 2 + self.CODE_END = "udf" + + def read_reg(self, reg_name): + reg_name = reg_name.replace("ip", "r12").replace("fp", "r11") + return getattr(self.ql.reg, reg_name) + + def regdst_eq_pc(self, op_str): return op_str.partition(", ")[0] == "pc" - read_inst = partial(_read_inst, ql) - read_reg_val = partial(_read_reg_val, ql.reg) + def predict(self): + prophecy = Prophecy() + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + prophecy.where = cur_addr + line.size - ARM_INST_SIZE = 4 - ARM_THUMB_INST_SIZE = 2 + if line.mnemonic == self.CODE_END: # indicates program exited + return True - line = disasm(ql, cur_addr) - ret_addr = cur_addr + line.size + jump_table = { + # unconditional branch + "b" : (lambda *_: True), + "bl" : (lambda *_: True), + "bx" : (lambda *_: True), + "blx" : (lambda *_: True), + "b.w" : (lambda *_: True), - if line.mnemonic == "udf": # indicates program exited - return CODE_END + # branch on equal, Z == 1 + "beq" : (lambda V, C, Z, N: Z == 1), + "bxeq" : (lambda V, C, Z, N: Z == 1), + "beq.w": (lambda V, C, Z, N: Z == 1), - jump_table = { - # unconditional branch - "b" : (lambda *_: True), - "bl" : (lambda *_: True), - "bx" : (lambda *_: True), - "blx" : (lambda *_: True), - "b.w" : (lambda *_: True), + # branch on not equal, Z == 0 + "bne" : (lambda V, C, Z, N: Z == 0), + "bxne" : (lambda V, C, Z, N: Z == 0), + "bne.w": (lambda V, C, Z, N: Z == 0), - # branch on equal, Z == 1 - "beq" : (lambda V, C, Z, N: Z == 1), - "bxeq" : (lambda V, C, Z, N: Z == 1), - "beq.w": (lambda V, C, Z, N: Z == 1), + # branch on signed greater than, Z == 0 and N == V + "bgt" : (lambda V, C, Z, N: (Z == 0 and N == V)), + "bgt.w": (lambda V, C, Z, N: (Z == 0 and N == V)), - # branch on not equal, Z == 0 - "bne" : (lambda V, C, Z, N: Z == 0), - "bxne" : (lambda V, C, Z, N: Z == 0), - "bne.w": (lambda V, C, Z, N: Z == 0), + # branch on signed less than, N != V + "blt" : (lambda V, C, Z, N: N != V), - # branch on signed greater than, Z == 0 and N == V - "bgt" : (lambda V, C, Z, N: (Z == 0 and N == V)), - "bgt.w": (lambda V, C, Z, N: (Z == 0 and N == V)), + # branch on signed greater than or equal, N == V + "bge" : (lambda V, C, Z, N: N == V), - # branch on signed less than, N != V - "blt" : (lambda V, C, Z, N: N != V), + # branch on signed less than or queal + "ble" : (lambda V, C, Z, N: Z == 1 or N != V), - # branch on signed greater than or equal, N == V - "bge" : (lambda V, C, Z, N: N == V), + # branch on unsigned higher or same (or carry set), C == 1 + "bhs" : (lambda V, C, Z, N: C == 1), + "bcs" : (lambda V, C, Z, N: C == 1), - # branch on signed less than or queal - "ble" : (lambda V, C, Z, N: Z == 1 or N != V), + # branch on unsigned lower (or carry clear), C == 0 + "bcc" : (lambda V, C, Z, N: C == 0), + "blo" : (lambda V, C, Z, N: C == 0), + "bxlo" : (lambda V, C, Z, N: C == 0), + "blo.w": (lambda V, C, Z, N: C == 0), - # branch on unsigned higher or same (or carry set), C == 1 - "bhs" : (lambda V, C, Z, N: C == 1), - "bcs" : (lambda V, C, Z, N: C == 1), + # branch on negative or minus, N == 1 + "bmi" : (lambda V, C, Z, N: N == 1), - # branch on unsigned lower (or carry clear), C == 0 - "bcc" : (lambda V, C, Z, N: C == 0), - "blo" : (lambda V, C, Z, N: C == 0), - "bxlo" : (lambda V, C, Z, N: C == 0), - "blo.w": (lambda V, C, Z, N: C == 0), + # branch on positive or plus, N == 0 + "bpl" : (lambda V, C, Z, N: N == 0), - # branch on negative or minus, N == 1 - "bmi" : (lambda V, C, Z, N: N == 1), + # branch on signed overflow + "bvs" : (lambda V, C, Z, N: V == 1), - # branch on positive or plus, N == 0 - "bpl" : (lambda V, C, Z, N: N == 0), + # branch on no signed overflow + "bvc" : (lambda V, C, Z, N: V == 0), - # branch on signed overflow - "bvs" : (lambda V, C, Z, N: V == 1), + # branch on unsigned higher + "bhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), + "bxhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), + "bhi.w": (lambda V, C, Z, N: (Z == 0 and C == 1)), - # branch on no signed overflow - "bvc" : (lambda V, C, Z, N: V == 0), + # branch on unsigned lower + "bls" : (lambda V, C, Z, N: (C == 0 or Z == 1)), + "bls.w": (lambda V, C, Z, N: (C == 0 or Z == 1)), + } - # branch on unsigned higher - "bhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), - "bxhi" : (lambda V, C, Z, N: (Z == 0 and C == 1)), - "bhi.w": (lambda V, C, Z, N: (Z == 0 and C == 1)), + cb_table = { + # branch on equal to zero + "cbz" : (lambda r: r == 0), - # branch on unsigned lower - "bls" : (lambda V, C, Z, N: (C == 0 or Z == 1)), - "bls.w": (lambda V, C, Z, N: (C == 0 or Z == 1)), - } + # branch on not equal to zero + "cbnz": (lambda r: r != 0), + } - cb_table = { - # branch on equal to zero - "cbz" : (lambda r: r == 0), + if line.mnemonic in jump_table: + prophecy.going = jump_table.get(line.mnemonic)(*get_cpsr(self.ql.reg.cpsr)) - # branch on not equal to zero - "cbnz": (lambda r: r != 0), - } + elif line.mnemonic in cb_table: + prophecy.going = cb_table.get(line.mnemonic)(self.read_reg(line.op_str.split(", ")[0])) - to_jump = False - if line.mnemonic in jump_table: - to_jump = jump_table.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)) + if prophecy.going: + if "#" in line.op_str: + prophecy.where = read_int(line.op_str.split("#")[-1]) + else: + prophecy.where = self.read_reg(line.op_str) - elif line.mnemonic in cb_table: - to_jump = cb_table.get(line.mnemonic)(read_reg_val(line.op_str.split(", ")[0])) + if self.regdst_eq_pc(line.op_str): + next_addr = cur_addr + line.size + n2_addr = next_addr + len(read_inst(next_addr)) + prophecy.where += len(read_inst(n2_addr)) + len(read_inst(next_addr)) - if to_jump: - if "#" in line.op_str: - ret_addr = _parse_int(line.op_str.split("#")[-1]) + elif line.mnemonic.startswith("it"): + # handle IT block here + + cond_met = { + "eq": lambda V, C, Z, N: (Z == 1), + "ne": lambda V, C, Z, N: (Z == 0), + "ge": lambda V, C, Z, N: (N == V), + "hs": lambda V, C, Z, N: (C == 1), + "lo": lambda V, C, Z, N: (C == 0), + "mi": lambda V, C, Z, N: (N == 1), + "pl": lambda V, C, Z, N: (N == 0), + "ls": lambda V, C, Z, N: (C == 0 or Z == 1), + "le": lambda V, C, Z, N: (Z == 1 or N != V), + "hi": lambda V, C, Z, N: (Z == 0 and C == 1), + }.get(line.op_str)(*get_cpsr(ql.reg.cpsr)) + + it_block_range = [each_char for each_char in line.mnemonic[1:]] + + next_addr = cur_addr + self.THUMB_INST_SIZE + for each in it_block_range: + _inst = read_inst(next_addr) + n2_addr = handle_bnj_arm(ql, next_addr) + + if (cond_met and each == "t") or (not cond_met and each == "e"): + if n2_addr != (next_addr+len(_inst)): # branch detected + break + + next_addr += len(_inst) + + prophecy.where = next_addr + + elif line.mnemonic in ("ldr",): + + if self.regdst_eq_pc(line.op_str): + _, _, rn_offset = line.op_str.partition(", ") + r, _, imm = rn_offset.strip("[]!").partition(", #") + + if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate + prophecy.where = ql.unpack32(ql.mem.read(read_int(imm) + self.read_reg(r), self.INST_SIZE)) + + else: # post-indexed immediate + # FIXME: weired behavior, immediate here does not apply + prophecy.where = ql.unpack32(ql.mem.read(self.read_reg(r), self.INST_SIZE)) + + elif line.mnemonic in ("addls", "addne", "add") and self.regdst_eq_pc(line.op_str): + V, C, Z, N = get_cpsr(ql.reg.cpsr) + r0, r1, r2, *imm = line.op_str.split(", ") + + # program counter is awalys 8 bytes ahead when it comes with pc, need to add extra 8 bytes + extra = 8 if 'pc' in (r0, r1, r2) else 0 + + if imm: + expr = imm[0].split() + # TODO: should support more bit shifting and rotating operation + if expr[0] == "lsl": # logical shift left + n = read_int(expr[-1].strip("#")) * 2 + + if line.mnemonic == "addls" and (C == 0 or Z == 1): + prophecy.where = extra + self.read_reg(r1) + self.read_reg(r2) * n + + elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): + prophecy.where = extra + self.read_reg(r1) + (self.read_reg(r2) * n if imm else self.read_reg(r2)) + + elif line.mnemonic in ("tbh", "tbb"): + + cur_addr += self.INST_SIZE + r0, r1, *imm = line.op_str.strip("[]").split(", ") + + if imm: + expr = imm[0].split() + if expr[0] == "lsl": # logical shift left + n = read_int(expr[-1].strip("#")) * 2 + + if line.mnemonic == "tbh": + + r1 = self.read_reg(r1) * n + + elif line.mnemonic == "tbb": + + r1 = self.read_reg(r1) + + to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n + prophecy.where = cur_addr + to_add + + elif line.mnemonic.startswith("pop") and "pc" in line.op_str: + + prophecy.where = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * self.INST_SIZE) + if not { # step to next instruction if cond does not meet + "pop" : lambda *_: True, + "pop.w": lambda *_: True, + "popeq": lambda V, C, Z, N: (Z == 1), + "popne": lambda V, C, Z, N: (Z == 0), + "pophi": lambda V, C, Z, N: (C == 1), + "popge": lambda V, C, Z, N: (N == V), + "poplt": lambda V, C, Z, N: (N != V), + }.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)): + + prophecy.where = cur_addr + self.INST_SIZE + + elif line.mnemonic == "sub" and self.regdst_eq_pc(line.op_str): + _, r, imm = line.op_str.split(", ") + prophecy.where = self.read_reg(r) - read_int(imm.strip("#")) + + elif line.mnemonic == "mov" and self.regdst_eq_pc(line.op_str): + _, r = line.op_str.split(", ") + prophecy.where = self.read_reg(r) + + if prophecy.where & 1: + prophecy.where -= 1 + + return prophecy + +class BranchPredictor_MIPS(BranchPredictor): + def __init__(self, ql): + super().__init__(ql) + self.CODE_END = "break" + self.INST_SIZE = 4 + + def read_reg(self, reg_name): + reg_name = reg_name.strip("$").replace("fp", "s8") + return signed_val(getattr(self.ql.reg, reg_name)) + + def predict(self): + prophecy = Prophecy() + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + + if line.mnemonic == self.CODE_END: # indicates program extied + return True + + prophecy.where = cur_addr + self.INST_SIZE + if line.mnemonic.startswith('j') or line.mnemonic.startswith('b'): + + # make sure at least delay slot executed + prophecy.where += self.INST_SIZE + + # get registers or memory address from op_str + targets = [ + self.read_reg(each) + if '$' in each else read_int(each) + for each in line.op_str.split(", ") + ] + + prophecy.going = { + "j" : (lambda _: True), # unconditional jump + "jr" : (lambda _: True), # unconditional jump + "jal" : (lambda _: True), # unconditional jump + "jalr" : (lambda _: True), # unconditional jump + "b" : (lambda _: True), # unconditional branch + "bl" : (lambda _: True), # unconditional branch + "bal" : (lambda _: True), # unconditional branch + "beq" : (lambda r0, r1, _: r0 == r1), # branch on equal + "bne" : (lambda r0, r1, _: r0 != r1), # branch on not equal + "blt" : (lambda r0, r1, _: r0 < r1), # branch on r0 less than r1 + "bgt" : (lambda r0, r1, _: r0 > r1), # branch on r0 greater than r1 + "ble" : (lambda r0, r1, _: r0 <= r1), # brach on r0 less than or equal to r1 + "bge" : (lambda r0, r1, _: r0 >= r1), # branch on r0 greater than or equal to r1 + "beqz" : (lambda r, _: r == 0), # branch on equal to zero + "bnez" : (lambda r, _: r != 0), # branch on not equal to zero + "bgtz" : (lambda r, _: r > 0), # branch on greater than zero + "bltz" : (lambda r, _: r < 0), # branch on less than zero + "bltzal" : (lambda r, _: r < 0), # branch on less than zero and link + "blez" : (lambda r, _: r <= 0), # branch on less than or equal to zero + "bgez" : (lambda r, _: r >= 0), # branch on greater than or equal to zero + "bgezal" : (lambda r, _: r >= 0), # branch on greater than or equal to zero and link + }.get(line.mnemonic)(*targets) + + if prophecy.going: + # target address is always the rightmost one + prophecy.where = targets[-1] + + return prophecy + +class BranchPredictor_X86(BranchPredictor): + def __init__(self, ql): + super().__init__(ql) + + def predict(self): + prophecy = Prophecy() + cur_addr = self.ql.reg.arch_pc + line = disasm(self.ql, cur_addr) + + jump_table = { + # conditional jump + + "jo" : (lambda C, P, A, Z, S, O: O == 1), + "jno" : (lambda C, P, A, Z, S, O: O == 0), + + "js" : (lambda C, P, A, Z, S, O: S == 1), + "jns" : (lambda C, P, A, Z, S, O: S == 0), + + "je" : (lambda C, P, A, Z, S, O: Z == 1), + "jz" : (lambda C, P, A, Z, S, O: Z == 1), + + "jne" : (lambda C, P, A, Z, S, O: Z == 0), + "jnz" : (lambda C, P, A, Z, S, O: Z == 0), + + "jb" : (lambda C, P, A, Z, S, O: C == 1), + "jc" : (lambda C, P, A, Z, S, O: C == 1), + "jnae" : (lambda C, P, A, Z, S, O: C == 1), + + "jnb" : (lambda C, P, A, Z, S, O: C == 0), + "jnc" : (lambda C, P, A, Z, S, O: C == 0), + "jae" : (lambda C, P, A, Z, S, O: C == 0), + + "jbe" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + "jna" : (lambda C, P, A, Z, S, O: C == 1 or Z == 1), + + "ja" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + "jnbe" : (lambda C, P, A, Z, S, O: C == 0 and Z == 0), + + "jl" : (lambda C, P, A, Z, S, O: S != O), + "jnge" : (lambda C, P, A, Z, S, O: S != O), + + "jge" : (lambda C, P, A, Z, S, O: S == O), + "jnl" : (lambda C, P, A, Z, S, O: S == O), + + "jle" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + "jng" : (lambda C, P, A, Z, S, O: Z == 1 or S != O), + + "jg" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + "jnle" : (lambda C, P, A, Z, S, O: Z == 0 or S == O), + + "jp" : (lambda C, P, A, Z, S, O: P == 1), + "jpe" : (lambda C, P, A, Z, S, O: P == 1), + + "jnp" : (lambda C, P, A, Z, S, O: P == 0), + "jpo" : (lambda C, P, A, Z, S, O: P == 0), + + # unconditional jump + + "call" : (lambda *_: True), + "jmp" : (lambda *_: True), + + } + + jump_reg_table = { + "jcxz" : (lambda cx: cx == 0), + "jecxz" : (lambda ecx: ecx == 0), + "jrcxz" : (lambda rcx: rcx == 0), + } + + if line.mnemonic in jump_table: + eflags = get_x86_eflags(self.ql.reg.ef).values() + prophecy.going = jump_table.get(line.mnemonic)(*eflags) + + elif line.mnemonic in jump_reg_table: + prophecy.going = jump_reg_table.get(line.mnemonic)(self.ql.reg.ecx) + + if prophecy.going: + takeaway_list = ["ptr", "dword", "[", "]"] + class AST_checker(ast.NodeVisitor): + def generic_visit(self, node): + if type(node) in (ast.Module, ast.Expr, ast.BinOp, ast.Constant, ast.Add, ast.Mult, ast.Sub): + ast.NodeVisitor.generic_visit(self, node) + else: + raise ParseError("malform or invalid ast node") + + if len(line.op_str.split()) > 1: + new_line = line.op_str.replace(":", "+") + for each in takeaway_list: + new_line = new_line.replace(each, " ") + + new_line = " ".join(new_line.split()) + for each_reg in filter(lambda r: len(r) == 3, self.ql.reg.register_mapping.keys()): + if each_reg in new_line: + new_line = re.sub(each_reg, hex(self.read_reg(each_reg)), new_line) + + for each_reg in filter(lambda r: len(r) == 2, self.ql.reg.register_mapping.keys()): + if each_reg in new_line: + new_line = re.sub(each_reg, hex(self.read_reg(each_reg)), new_line) + + checker = AST_checker() + ast_tree = ast.parse(new_line) + + checker.visit(ast_tree) + + prophecy.where = eval(new_line) + + elif line.op_str in self.ql.reg.register_mapping: + prophecy.where = getattr(self.ql.reg, line.op_str) + + else: + prophecy.where = read_int(line.op_str) else: - ret_addr = read_reg_val(line.op_str) + prophecy.where = cur_addr + line.size - if regdst_eq_pc(line.op_str): - next_addr = cur_addr + line.size - n2_addr = next_addr + len(read_inst(next_addr)) - ret_addr += len(read_inst(n2_addr)) + len(read_inst(next_addr)) + return prophecy - elif line.mnemonic.startswith("it"): - # handle IT block here - - cond_met = { - "eq": lambda V, C, Z, N: (Z == 1), - "ne": lambda V, C, Z, N: (Z == 0), - "ge": lambda V, C, Z, N: (N == V), - "hs": lambda V, C, Z, N: (C == 1), - "lo": lambda V, C, Z, N: (C == 0), - "mi": lambda V, C, Z, N: (N == 1), - "pl": lambda V, C, Z, N: (N == 0), - "ls": lambda V, C, Z, N: (C == 0 or Z == 1), - "le": lambda V, C, Z, N: (Z == 1 or N != V), - "hi": lambda V, C, Z, N: (Z == 0 and C == 1), - }.get(line.op_str)(*get_cpsr(ql.reg.cpsr)) - - it_block_range = [each_char for each_char in line.mnemonic[1:]] - - next_addr = cur_addr + ARM_THUMB_INST_SIZE - for each in it_block_range: - _inst = read_inst(next_addr) - n2_addr = handle_bnj_arm(ql, next_addr) - - if (cond_met and each == "t") or (not cond_met and each == "e"): - if n2_addr != (next_addr+len(_inst)): # branch detected - break - - next_addr += len(_inst) - - ret_addr = next_addr - - elif line.mnemonic in ("ldr",): - - if regdst_eq_pc(line.op_str): - _, _, rn_offset = line.op_str.partition(", ") - r, _, imm = rn_offset.strip("[]!").partition(", #") - - if "]" in rn_offset.split(", ")[1]: # pre-indexed immediate - ret_addr = ql.unpack32(ql.mem.read(_parse_int(imm) + read_reg_val(r), ARM_INST_SIZE)) - - else: # post-indexed immediate - # FIXME: weired behavior, immediate here does not apply - ret_addr = ql.unpack32(ql.mem.read(read_reg_val(r), ARM_INST_SIZE)) - - elif line.mnemonic in ("addls", "addne", "add") and regdst_eq_pc(line.op_str): - V, C, Z, N = get_cpsr(ql.reg.cpsr) - r0, r1, r2, *imm = line.op_str.split(", ") - - # program counter is awalys 8 bytes ahead when it comes with pc, need to add extra 8 bytes - extra = 8 if 'pc' in (r0, r1, r2) else 0 - - if imm: - expr = imm[0].split() - # TODO: should support more bit shifting and rotating operation - if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 - - if line.mnemonic == "addls" and (C == 0 or Z == 1): - ret_addr = extra + read_reg_val(r1) + read_reg_val(r2) * n - - elif line.mnemonic == "add" or (line.mnemonic == "addne" and Z == 0): - ret_addr = extra + read_reg_val(r1) + (read_reg_val(r2) * n if imm else read_reg_val(r2)) - - elif line.mnemonic in ("tbh", "tbb"): - - cur_addr += ARM_INST_SIZE - r0, r1, *imm = line.op_str.strip("[]").split(", ") - - if imm: - expr = imm[0].split() - if expr[0] == "lsl": # logical shift left - n = _parse_int(expr[-1].strip("#")) * 2 - - if line.mnemonic == "tbh": - - r1 = read_reg_val(r1) * n - - elif line.mnemonic == "tbb": - - r1 = read_reg_val(r1) - - to_add = int.from_bytes(ql.mem.read(cur_addr+r1, 2 if line.mnemonic == "tbh" else 1), byteorder="little") * n - ret_addr = cur_addr + to_add - - elif line.mnemonic.startswith("pop") and "pc" in line.op_str: - - ret_addr = ql.stack_read(line.op_str.strip("{}").split(", ").index("pc") * ARM_INST_SIZE) - if not { # step to next instruction if cond does not meet - "pop" : lambda *_: True, - "pop.w": lambda *_: True, - "popeq": lambda V, C, Z, N: (Z == 1), - "popne": lambda V, C, Z, N: (Z == 0), - "pophi": lambda V, C, Z, N: (C == 1), - "popge": lambda V, C, Z, N: (N == V), - "poplt": lambda V, C, Z, N: (N != V), - }.get(line.mnemonic)(*get_cpsr(ql.reg.cpsr)): - - ret_addr = cur_addr + ARM_INST_SIZE - - elif line.mnemonic == "sub" and regdst_eq_pc(line.op_str): - _, r, imm = line.op_str.split(", ") - ret_addr = read_reg_val(r) - _parse_int(imm.strip("#")) - - elif line.mnemonic == "mov" and regdst_eq_pc(line.op_str): - _, r = line.op_str.split(", ") - ret_addr = read_reg_val(r) - - if ret_addr & 1: - ret_addr -= 1 - - return (to_jump, ret_addr) - - -def handle_bnj_mips(ql: Qiling, cur_addr: str) -> int: - MIPS_INST_SIZE = 4 - - def _read_reg(regs, _reg): - return signed_val(getattr(regs, _reg.strip('$').replace("fp", "s8"))) - - read_reg_val = partial(_read_reg, ql.reg) - - line = disasm(ql, cur_addr) - - if line.mnemonic == "break": # indicates program extied - return CODE_END - - # default breakpoint address if no jumps and branches here - ret_addr = cur_addr + MIPS_INST_SIZE - - to_jump = False - if line.mnemonic.startswith('j') or line.mnemonic.startswith('b'): - - # make sure at least delay slot executed - ret_addr += MIPS_INST_SIZE - - # get registers or memory address from op_str - targets = [ - read_reg_val(each) - if '$' in each else _parse_int(each) - for each in line.op_str.split(", ") - ] - - to_jump = { - "j" : (lambda _: True), # uncontitional jump - "jr" : (lambda _: True), # uncontitional jump - "jal" : (lambda _: True), # uncontitional jump - "jalr" : (lambda _: True), # uncontitional jump - "b" : (lambda _: True), # unconditional branch - "bl" : (lambda _: True), # unconditional branch - "bal" : (lambda _: True), # unconditional branch - "beq" : (lambda r0, r1, _: r0 == r1), # branch on equal - "bne" : (lambda r0, r1, _: r0 != r1), # branch on not equal - "blt" : (lambda r0, r1, _: r0 < r1), # branch on r0 less than r1 - "bgt" : (lambda r0, r1, _: r0 > r1), # branch on r0 greater than r1 - "ble" : (lambda r0, r1, _: r0 <= r1), # brach on r0 less than or equal to r1 - "bge" : (lambda r0, r1, _: r0 >= r1), # branch on r0 greater than or equal to r1 - "beqz" : (lambda r, _: r == 0), # branch on equal to zero - "bnez" : (lambda r, _: r != 0), # branch on not equal to zero - "bgtz" : (lambda r, _: r > 0), # branch on greater than zero - "bltz" : (lambda r, _: r < 0), # branch on less than zero - "bltzal" : (lambda r, _: r < 0), # branch on less than zero and link - "blez" : (lambda r, _: r <= 0), # branch on less than or equal to zero - "bgez" : (lambda r, _: r >= 0), # branch on greater than or equal to zero - "bgezal" : (lambda r, _: r >= 0), # branch on greater than or equal to zero and link - }.get(line.mnemonic)(*targets) - - if to_jump: - # target address is always the rightmost one - ret_addr = targets[-1] - - return (to_jump, ret_addr) +class BranchPredictor_CORTEX_M(BranchPredictor_ARM): + def __init__(self, ql): + super().__init__(ql) class Breakpoint(object): """ dummy class for breakpoint """ - def __init__(self, address: int): - self.addr = address + def __init__(self, addr): + self.addr = addr self.hitted = False - self.hook = None class TempBreakpoint(Breakpoint): """ dummy class for temporay breakpoint """ - def __init__(self, address): - super().__init__(address) + def __init__(self, addr): + super().__init__(addr) + +class ParseError(Exception): + pass if __name__ == "__main__": diff --git a/qiling/extensions/afl/__init__.py b/qiling/extensions/afl/__init__.py new file mode 100644 index 00000000..05f5d6fc --- /dev/null +++ b/qiling/extensions/afl/__init__.py @@ -0,0 +1 @@ +from .afl import ql_afl_fuzz \ No newline at end of file diff --git a/qiling/extensions/afl/afl.py b/qiling/extensions/afl/afl.py new file mode 100644 index 00000000..8693145f --- /dev/null +++ b/qiling/extensions/afl/afl.py @@ -0,0 +1,59 @@ +from typing import List, Callable +from qiling.core import Qiling +from unicornafl import * +from qiling.exception import QlErrorNotImplemented + +def ql_afl_fuzz(ql: Qiling, + input_file: str, + place_input_callback: Callable[["Qiling", bytes, int], bool], + exits: List[int], + validate_crash_callback: Callable[["Qiling", bytes, int], bool] = None, + always_validate: bool = False, + persistent_iters: int = 1): + """ Fuzz a range of code with afl++. + This function wraps some common logic with unicornafl.uc_afl_fuzz. + NOTE: If no afl-fuzz instance is found, this function is almost identical to ql.run. + :param Qiling ql: The Qiling instance. + :param str input_file: This usually is the input file name provided by the command argument. + :param Callable place_input_callback: This callback is triggered every time a new child is + generated. It returns True if the input is accepted, or the input would be skipped. + :param list exits: All possible exits. + :param Callable validate_crash_callback: This callback is triggered every time to check if we are crashed. + :param bool always_validate: If this is set to False, validate_crash_callback will be only triggered if + uc_emu_start (which is called internally by afl_fuzz) returns an error. Or the validate_crash_callback will + be triggered every time. + :param int persistent_iters: Fuzz how many times before forking a new child. + :raises UcAflError: If something wrong happens with the fuzzer. + """ + + def _ql_afl_place_input_wrapper(uc, input_bytes, iters, data): + (ql, cb, _) = data + + return cb(ql, input_bytes, iters) + + def _ql_afl_validate_wrapper(uc, input_bytes, iters, data): + (ql, _, cb) = data + + return cb(ql, input_bytes, iters) + + data = (ql, place_input_callback, validate_crash_callback) + try: + # uc_afl_fuzz will never return non-zero value. + uc_afl_fuzz(ql.uc, + input_file=input_file, + place_input_callback=_ql_afl_place_input_wrapper, + exits=exits, + validate_crash_callback=_ql_afl_validate_wrapper, + always_validate=always_validate, + persistent_iters=persistent_iters, + data=data) + except NameError as ex: + raise QlErrorNotImplemented("unicornafl is not installed or AFL++ is not supported on this platform") from ex + except UcAflError as ex: + if ex.errno != UC_AFL_RET_CALLED_TWICE: + # This one is special. Many fuzzing scripts start fuzzing in a Unicorn UC_HOOK_CODE callback and + # starts execution on the current address, which results in a duplicate UC_HOOK_CODE callback. To + # make unicornafl easy to use, we handle this siliently. + # + # For other exceptions, we raise them. + raise \ No newline at end of file diff --git a/qiling/extensions/mcu/atmel/__init__.py b/qiling/extensions/mcu/atmel/__init__.py new file mode 100644 index 00000000..245839d1 --- /dev/null +++ b/qiling/extensions/mcu/atmel/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .sam3x8e import sam3x8e diff --git a/qiling/extensions/mcu/atmel/sam3x8e.py b/qiling/extensions/mcu/atmel/sam3x8e.py new file mode 100644 index 00000000..1be34c01 --- /dev/null +++ b/qiling/extensions/mcu/atmel/sam3x8e.py @@ -0,0 +1,410 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +sam3x8e = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x200000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000 , + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM3SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM3Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM3Scb", + "type": "core" + }, + "FLASH": { + "base": 0x80000, + "size": 0x80000, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x10000, + "type": "memory" + }, + "RAM": { + "base": 0x20070000, + "size": 0x18000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "HSMCI": { + "base": 0x40000000, + "struct": "SAM3xaHsmci", + "type": "peripheral", + "kwargs": { + "intn": 0x15 + } + }, + "SSC": { + "base": 0x40004000, + "struct": "SAM3xaSsc", + "type": "peripheral", + "kwargs": { + "intn": 0x1a + } + }, + "SPI0": { + "base": 0x40008000, + "struct": "SAM3xaSpi", + "type": "peripheral", + "kwargs": { + "intn": 0x18 + } + }, + "TC0": { + "base": 0x40080000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1b + } + }, + "TC1": { + "base": 0x40084000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1c + } + }, + "TC2": { + "base": 0x40088000, + "struct": "SAM3xaTc", + "type": "peripheral", + "kwargs": { + "intn": 0x1d + } + }, + "TWI0": { + "base": 0x4008c000, + "struct": "SAM3xaTwi", + "type": "peripheral", + "kwargs": { + "intn": 0x16 + } + }, + "PDC_TWI0": { + "base": 0x4008c100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "TWI1": { + "base": 0x40090000, + "struct": "SAM3xaTwi", + "type": "peripheral", + "kwargs": { + "intn": 0x17 + } + }, + "PDC_TWI1": { + "base": 0x40090100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "PWM": { + "base": 0x40094000, + "struct": "SAM3xaPwm", + "type": "peripheral", + "kwargs": { + "intn": 0x24 + } + }, + "PDC_PWM": { + "base": 0x40094100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART0": { + "base": 0x40098000, + "struct": "SAM3xaUsart", + "type": "peripheral", + "kwargs": { + "intn": 0x11 + } + }, + "PDC_USART0": { + "base": 0x40098100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART1": { + "base": 0x4009c000, + "struct": "SAM3xaUsart", + "type": "peripheral", + "kwargs": { + "intn": 0x12 + } + }, + "PDC_USART1": { + "base": 0x4009c100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART2": { + "base": 0x400a0000, + "struct": "SAM3xaUsart", + "type": "peripheral", + "kwargs": { + "intn": 0x13 + } + }, + "PDC_USART2": { + "base": 0x400a0100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "USART3": { + "base": 0x400a4000, + "struct": "SAM3xaUsart", + "type": "peripheral", + "kwargs": { + "intn": 0x14 + } + }, + "PDC_USART3": { + "base": 0x400a4100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "UOTGHS": { + "base": 0x400ac000, + "struct": "SAM3xaUotghs", + "type": "peripheral", + "kwargs": { + "intn": 0x28 + } + }, + "EMAC": { + "base": 0x400b0000, + "struct": "SAM3xaEmac", + "type": "peripheral", + "kwargs": { + "intn": 0x2a + } + }, + "CAN0": { + "base": 0x400b4000, + "struct": "SAM3xaCan", + "type": "peripheral", + "kwargs": { + "intn": 0x2b + } + }, + "CAN1": { + "base": 0x400b8000, + "struct": "SAM3xaCan", + "type": "peripheral", + "kwargs": { + "intn": 0x2c + } + }, + "TRNG": { + "base": 0x400bc000, + "struct": "SAM3xaTrng", + "type": "peripheral", + "kwargs": { + "intn": 0x29 + } + }, + "ADC": { + "base": 0x400c0000, + "struct": "SAM3xaAdc", + "type": "peripheral", + "kwargs": { + "intn": 0x25 + } + }, + "PDC_ADC": { + "base": 0x400c0100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "DMAC": { + "base": 0x400c4000, + "struct": "SAM3xaDmac", + "type": "peripheral", + "kwargs": { + "intn": 0x27 + } + }, + "DACC": { + "base": 0x400c8000, + "struct": "SAM3xaDacc", + "type": "peripheral", + "kwargs": { + "intn": 0x26 + } + }, + "PDC_DACC": { + "base": 0x400c8100, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "SMC": { + "base": 0x400e0000, + "struct": "SAM3xaSmc", + "type": "peripheral", + "kwargs": { + "intn": 0x9 + } + }, + "MATRIX": { + "base": 0x400e0400, + "struct": "SAM3xaMatrix", + "type": "peripheral" + }, + "PMC": { + "base": 0x400e0600, + "struct": "SAM3xaPmc", + "type": "peripheral", + "kwargs": { + "intn": 0x5 + } + }, + "UART": { + "base": 0x400e0800, + "struct": "SAM3xaUart", + "type": "peripheral", + "kwargs": { + "intn": 0x8 + } + }, + "PDC_UART": { + "base": 0x400e0900, + "struct": "SAM3xaPdc", + "type": "peripheral" + }, + "CHIPID": { + "base": 0x400e0940, + "struct": "SAM3xaChipid", + "type": "peripheral" + }, + "EFC0": { + "base": 0x400e0a00, + "struct": "SAM3xaEfc", + "type": "peripheral", + "kwargs": { + "intn": 0x6 + } + }, + "EFC1": { + "base": 0x400e0c00, + "struct": "SAM3xaEfc", + "type": "peripheral", + "kwargs": { + "intn": 0x7 + } + }, + "PIOA": { + "base": 0x400e0e00, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xb + } + }, + "PIOB": { + "base": 0x400e1000, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xc + } + }, + "PIOC": { + "base": 0x400e1200, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xd + } + }, + "PIOD": { + "base": 0x400e1400, + "struct": "SAM3xaPio", + "type": "peripheral", + "kwargs": { + "intn": 0xe + } + }, + "RSTC": { + "base": 0x400e1a00, + "struct": "SAM3xaRstc", + "type": "peripheral", + "kwargs": { + "intn": 0x1 + } + }, + "SUPC": { + "base": 0x400e1a10, + "struct": "SAM3xaSupc", + "type": "peripheral", + "kwargs": { + "intn": 0x0 + } + }, + "RTT": { + "base": 0x400e1a30, + "struct": "SAM3xaRtt", + "type": "peripheral", + "kwargs": { + "intn": 0x3 + } + }, + "WDT": { + "base": 0x400e1a50, + "struct": "SAM3xaWdt", + "type": "peripheral", + "kwargs": { + "intn": 0x4 + } + }, + "RTC": { + "base": 0x400e1a60, + "struct": "SAM3xaRtc", + "type": "peripheral", + "kwargs": { + "intn": 0x2 + } + }, + "GPBR": { + "base": 0x400e1a90, + "struct": "SAM3xaGpbr", + "type": "peripheral" + }, + "CODE": { + "base": 0x80000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" + } +} \ No newline at end of file diff --git a/qiling/extensions/mcu/gd32vf1/gd32vf103.py b/qiling/extensions/mcu/gd32vf1/gd32vf103.py index c81e3bc5..647e0414 100644 --- a/qiling/extensions/mcu/gd32vf1/gd32vf103.py +++ b/qiling/extensions/mcu/gd32vf1/gd32vf103.py @@ -4,45 +4,180 @@ # gd32vf103 = { - "ADC0": { - "base": 0x40012400, - "struct": "GD32VF1xxAdc", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" + "ECLIC": { + "base": 0xd2000000, + "struct": "GD32VF1xxEclic", + "type": "core" }, - "ADC1": { - "base": 0x40012800, - "struct": "GD32VF1xxAdc", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "AFIO": { - "base": 0x40010000, - "struct": "GD32VF1xxAfio", - "type": "peripheral" - }, - "BKP": { - "base": 0x40006c00, - "struct": "GD32VF1xxBkp", - "type": "peripheral" + "FLASH": { + "base": 0x8000000, + "size": 0x20000, + "type": "memory" }, "BOOT": { "base": 0x1fffb000, "size": 0x5000, "type": "memory" }, + "SRAM": { + "base": 0x20000000, + "size": 0x18000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x40000, + "type": "mmio" + }, + "USBFS": { + "base": 0x50000000, + "size": 0x40000, + "type": "mmio" + }, + "TIMER1": { + "base": 0x40000000, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x2f + }, + "type": "peripheral" + }, + "TIMER2": { + "base": 0x40000400, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x30 + }, + "type": "peripheral" + }, + "TIMER3": { + "base": 0x40000800, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "TIMER4": { + "base": 0x40000c00, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x45 + }, + "type": "peripheral" + }, + "TIMER5": { + "base": 0x40001000, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x49 + }, + "type": "peripheral" + }, + "TIMER6": { + "base": 0x40001400, + "struct": "GD32VF1xxTimer", + "kwargs": { + "intn": 0x4a + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "GD32VF1xxRtc", + "kwargs": { + "alarm_intn": 0x3c, + "intn": 0x16 + }, + "type": "peripheral" + }, + "WWDGT": { + "base": 0x40002c00, + "struct": "GD32VF1xxWwdgt", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "FWDGT": { + "base": 0x40003000, + "struct": "GD32VF1xxFwdgt", + "type": "peripheral" + }, + "SPI1": { + "base": 0x40003800, + "struct": "GD32VF1xxSpi", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003c00, + "struct": "GD32VF1xxSpi", + "kwargs": { + "intn": 0x46 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40004400, + "struct": "GD32VF1xxUsart", + "kwargs": { + "intn": 0x39 + }, + "type": "peripheral" + }, + "USART2": { + "base": 0x40004800, + "struct": "GD32VF1xxUsart", + "kwargs": { + "intn": 0x3a + }, + "type": "peripheral" + }, + "UART3": { + "base": 0x40004c00, + "struct": "GD32VF1xxUart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40005000, + "struct": "GD32VF1xxUart", + "kwargs": { + "intn": 0x48 + }, + "type": "peripheral" + }, + "I2C0": { + "base": 0x40005400, + "struct": "GD32VF1xxI2c", + "kwargs": { + "er_intn": 0x33, + "ev_intn": 0x32 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005800, + "struct": "GD32VF1xxI2c", + "kwargs": { + "er_intn": 0x35, + "ev_intn": 0x34 + }, + "type": "peripheral" + }, "CAN0": { "base": 0x40006400, "struct": "GD32VF1xxCan", "kwargs": { - "ewmc_intn": 41, - "rx0_intn": 39, - "rx1_intn": 40, - "tx_intn": 38 + "ewmc_intn": 0x29, + "rx0_intn": 0x27, + "rx1_intn": 0x28, + "tx_intn": 0x26 }, "type": "peripheral" }, @@ -50,16 +185,21 @@ gd32vf103 = { "base": 0x40006800, "struct": "GD32VF1xxCan", "kwargs": { - "ewmc_intn": 85, - "rx0_intn": 83, - "rx1_intn": 84, - "tx_intn": 82 + "ewmc_intn": 0x55, + "rx0_intn": 0x53, + "rx1_intn": 0x54, + "tx_intn": 0x52 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "GD32VF1xxCrc", + "BKP": { + "base": 0x40006c00, + "struct": "GD32VF1xxBkp", + "type": "peripheral" + }, + "PMU": { + "base": 0x40007000, + "struct": "GD32VF1xxPmu", "type": "peripheral" }, "DAC": { @@ -67,79 +207,25 @@ gd32vf103 = { "struct": "GD32VF1xxDac", "type": "peripheral" }, - "DBG": { - "base": 0xe0042000, - "struct": "GD32VF1xxDbg", - "type": "peripheral" - }, - "DMA0": { - "base": 0x40020000, - "struct": "GD32VF1xxDma", - "kwargs": { - "stream0_intn": 30, - "stream1_intn": 31, - "stream2_intn": 32, - "stream3_intn": 33, - "stream4_intn": 34, - "stream5_intn": 35, - "stream6_intn": 36 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40020400, - "struct": "GD32VF1xxDma", - "kwargs": { - "stream0_intn": 75, - "stream1_intn": 76, - "stream2_intn": 77, - "stream3_intn": 78, - "stream4_intn": 79 - }, - "type": "peripheral" - }, - "ECLIC": { - "base": 0xd2000000, - "struct": "GD32VF1xxEclic", - "type": "core peripheral" - }, - "EXMC": { - "base": 0xa0000000, - "struct": "GD32VF1xxExmc", + "AFIO": { + "base": 0x40010000, + "struct": "GD32VF1xxAfio", "type": "peripheral" }, "EXTI": { "base": 0x40010400, "struct": "GD32VF1xxExti", "kwargs": { - "line0_intn": 25, - "line15_10_intn": 59, - "line1_intn": 26, - "line2_intn": 27, - "line3_intn": 28, - "line4_intn": 29, - "line9_5_intn": 42 + "line0_intn": 0x19, + "line15_10_intn": 0x3b, + "line1_intn": 0x1a, + "line2_intn": 0x1b, + "line3_intn": 0x1c, + "line4_intn": 0x1d, + "line9_5_intn": 0x2a }, "type": "peripheral" }, - "FLASH": { - "base": 0x08000000, - "size": 0x20000, - "type": "memory" - }, - "FMC": { - "base": 0x40022000, - "struct": "GD32VF1xxFmc", - "kwargs": { - "intn": 23 - }, - "type": "peripheral" - }, - "FWDGT": { - "base": 0x40003000, - "struct": "GD32VF1xxFwdgt", - "type": "peripheral" - }, "GPIOA": { "base": 0x40010800, "struct": "GD32VF1xxGpio", @@ -165,48 +251,30 @@ gd32vf103 = { "struct": "GD32VF1xxGpio", "type": "peripheral" }, - "I2C0": { - "base": 0x40005400, - "struct": "GD32VF1xxI2c", + "ADC0": { + "base": 0x40012400, + "struct": "GD32VF1xxAdc", "kwargs": { - "er_intn": 51, - "ev_intn": 50 + "intn": 0x25 }, "type": "peripheral" }, - "I2C1": { - "base": 0x40005800, - "struct": "GD32VF1xxI2c", + "ADC1": { + "base": 0x40012800, + "struct": "GD32VF1xxAdc", "kwargs": { - "er_intn": 53, - "ev_intn": 52 + "intn": 0x25 }, "type": "peripheral" }, - "PERIP": { - "base": 0x40000000, - "size": 0x40000, - "type": "mmio" - }, - "PMU": { - "base": 0x40007000, - "struct": "GD32VF1xxPmu", - "type": "peripheral" - }, - "RCU": { - "base": 0x40021000, - "struct": "GD32VF1xxRcu", + "TIMER0": { + "base": 0x40012c00, + "struct": "GD32VF1xxTimer", "kwargs": { - "intn": 24 - }, - "type": "peripheral" - }, - "RTC": { - "base": 0x40002800, - "struct": "GD32VF1xxRtc", - "kwargs": { - "alarm_intn": 60, - "intn": 22 + "brk_intn": 0x2b, + "channel_intn": 0x2e, + "trg_cmt_intn": 0x2d, + "up_intn": 0x2c }, "type": "peripheral" }, @@ -214,103 +282,7 @@ gd32vf103 = { "base": 0x40013000, "struct": "GD32VF1xxSpi", "kwargs": { - "intn": 54 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40003800, - "struct": "GD32VF1xxSpi", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003c00, - "struct": "GD32VF1xxSpi", - "kwargs": { - "intn": 70 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x18000, - "type": "memory" - }, - "TIMER0": { - "base": 0x40012c00, - "struct": "GD32VF1xxTimer", - "kwargs": { - "brk_intn": 43, - "channel_intn": 46, - "trg_cmt_intn": 45, - "up_intn": 44 - }, - "type": "peripheral" - }, - "TIMER1": { - "base": 0x40000000, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 47 - }, - "type": "peripheral" - }, - "TIMER2": { - "base": 0x40000400, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 48 - }, - "type": "peripheral" - }, - "TIMER3": { - "base": 0x40000800, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "TIMER4": { - "base": 0x40000c00, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 69 - }, - "type": "peripheral" - }, - "TIMER5": { - "base": 0x40001000, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 73 - }, - "type": "peripheral" - }, - "TIMER6": { - "base": 0x40001400, - "struct": "GD32VF1xxTimer", - "kwargs": { - "intn": 74 - }, - "type": "peripheral" - }, - "UART3": { - "base": 0x40004c00, - "struct": "GD32VF1xxUart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40005000, - "struct": "GD32VF1xxUart", - "kwargs": { - "intn": 72 + "intn": 0x36 }, "type": "peripheral" }, @@ -318,34 +290,55 @@ gd32vf103 = { "base": 0x40013800, "struct": "GD32VF1xxUsart", "kwargs": { - "intn": 56 + "intn": 0x38 }, "type": "peripheral" }, - "USART1": { - "base": 0x40004400, - "struct": "GD32VF1xxUsart", + "DMA0": { + "base": 0x40020000, + "struct": "GD32VF1xxDma", "kwargs": { - "intn": 57 + "stream0_intn": 0x1e, + "stream1_intn": 0x1f, + "stream2_intn": 0x20, + "stream3_intn": 0x21, + "stream4_intn": 0x22, + "stream5_intn": 0x23, + "stream6_intn": 0x24 }, "type": "peripheral" }, - "USART2": { - "base": 0x40004800, - "struct": "GD32VF1xxUsart", + "DMA1": { + "base": 0x40020400, + "struct": "GD32VF1xxDma", "kwargs": { - "intn": 58 + "stream0_intn": 0x4b, + "stream1_intn": 0x4c, + "stream2_intn": 0x4d, + "stream3_intn": 0x4e, + "stream4_intn": 0x4f }, "type": "peripheral" }, - "USBFS": { - "base": 0x50000000, - "size": 0x40000, - "type": "mmio" + "RCU": { + "base": 0x40021000, + "struct": "GD32VF1xxRcu", + "kwargs": { + "intn": 0x18 + }, + "type": "peripheral" }, - "USBFS_DEVICE": { - "base": 0x50000800, - "struct": "GD32VF1xxUsbfs", + "FMC": { + "base": 0x40022000, + "struct": "GD32VF1xxFmc", + "kwargs": { + "intn": 0x17 + }, + "type": "peripheral" + }, + "CRC": { + "base": 0x40023000, + "struct": "GD32VF1xxCrc", "type": "peripheral" }, "USBFS_GLOBAL": { @@ -358,17 +351,24 @@ gd32vf103 = { "struct": "GD32VF1xxUsbfs", "type": "peripheral" }, + "USBFS_DEVICE": { + "base": 0x50000800, + "struct": "GD32VF1xxUsbfs", + "type": "peripheral" + }, "USBFS_PWRCLK": { "base": 0x50000e00, "struct": "GD32VF1xxUsbfs", "type": "peripheral" }, - "WWDGT": { - "base": 0x40002c00, - "struct": "GD32VF1xxWwdgt", - "kwargs": { - "intn": 0 - }, + "EXMC": { + "base": 0xa0000000, + "struct": "GD32VF1xxExmc", + "type": "peripheral" + }, + "DBG": { + "base": 0xe0042000, + "struct": "GD32VF1xxDbg", "type": "peripheral" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f1/__init__.py b/qiling/extensions/mcu/stm32f1/__init__.py new file mode 100644 index 00000000..14fd6f33 --- /dev/null +++ b/qiling/extensions/mcu/stm32f1/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .stm32f103 import stm32f103 diff --git a/qiling/extensions/mcu/stm32f1/stm32f103.py b/qiling/extensions/mcu/stm32f1/stm32f103.py new file mode 100644 index 00000000..a7331ffe --- /dev/null +++ b/qiling/extensions/mcu/stm32f1/stm32f103.py @@ -0,0 +1,316 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +stm32f103 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM3SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM3Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM3Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x20000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1ffff000, + "size": 0x1000, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x5000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "type": "peripheral", + "base": 0x40000000, + "struct": "STM32F1xxTim", + "kwargs": { + "intn": 0x1c + } + }, + "TIM3": { + "type": "peripheral", + "base": 0x40000400, + "struct": "STM32F1xxTim", + "kwargs": { + "intn": 0x1d + } + }, + "TIM4": { + "type": "peripheral", + "base": 0x40000800, + "struct": "STM32F1xxTim", + "kwargs": { + "intn": 0x1e + } + }, + "RTC": { + "type": "peripheral", + "base": 0x40002800, + "struct": "STM32F1xxRtc", + "kwargs": { + "intn": 0x3, + "alarm_intn": 0x29 + } + }, + "WWDG": { + "type": "peripheral", + "base": 0x40002c00, + "struct": "STM32F1xxWwdg", + "kwargs": { + "intn": 0x0 + } + }, + "IWDG": { + "type": "peripheral", + "base": 0x40003000, + "struct": "STM32F1xxIwdg" + }, + "SPI2": { + "type": "peripheral", + "base": 0x40003800, + "struct": "STM32F1xxSpi", + "kwargs": { + "intn": 0x24 + } + }, + "USART2": { + "type": "peripheral", + "base": 0x40004400, + "struct": "STM32F1xxUsart", + "kwargs": { + "intn": 0x26 + } + }, + "USART3": { + "type": "peripheral", + "base": 0x40004800, + "struct": "STM32F1xxUsart", + "kwargs": { + "intn": 0x27 + } + }, + "I2C1": { + "type": "peripheral", + "base": 0x40005400, + "struct": "STM32F1xxI2c", + "kwargs": { + "ev_intn": 0x1f, + "er_intn": 0x20 + } + }, + "I2C2": { + "type": "peripheral", + "base": 0x40005800, + "struct": "STM32F1xxI2c", + "kwargs": { + "ev_intn": 0x21, + "er_intn": 0x22 + } + }, + "USB": { + "type": "peripheral", + "base": 0x40005c00, + "struct": "STM32F1xxUsb", + "kwargs": { + "hp_can1_tx_intn": 0x13, + "lp_can1_rx0_intn": 0x14, + "hp_intn": 0x13, + "lp_intn": 0x14 + } + }, + "CAN1": { + "type": "peripheral", + "base": 0x40006400, + "struct": "STM32F1xxCan", + "kwargs": { + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13, + "rx0_intn": 0x14 + } + }, + "BKP": { + "type": "peripheral", + "base": 0x40006c00, + "struct": "STM32F1xxBkp" + }, + "PWR": { + "type": "peripheral", + "base": 0x40007000, + "struct": "STM32F1xxPwr" + }, + "AFIO": { + "type": "peripheral", + "base": 0x40010000, + "struct": "STM32F1xxAfio" + }, + "EXTI": { + "type": "peripheral", + "base": 0x40010400, + "struct": "STM32F1xxExti", + "kwargs": { + "exti0_intn": 6, + "exti1_intn": 7, + "exti2_intn": 8, + "exti3_intn": 9, + "exti4_intn": 10, + "exti9_5_intn": 23, + "exti15_10_intn": 40, + } + }, + "GPIOA": { + "type": "peripheral", + "base": 0x40010800, + "struct": "STM32F1xxGpio" + }, + "GPIOB": { + "type": "peripheral", + "base": 0x40010c00, + "struct": "STM32F1xxGpio" + }, + "GPIOC": { + "type": "peripheral", + "base": 0x40011000, + "struct": "STM32F1xxGpio" + }, + "GPIOD": { + "type": "peripheral", + "base": 0x40011400, + "struct": "STM32F1xxGpio" + }, + "GPIOE": { + "type": "peripheral", + "base": 0x40011800, + "struct": "STM32F1xxGpio" + }, + "ADC1": { + "type": "peripheral", + "base": 0x40012400, + "struct": "STM32F1xxAdc", + "kwargs": { + "intn": 0x12 + } + }, + "ADC2": { + "type": "peripheral", + "base": 0x40012800, + "struct": "STM32F1xxAdc" + }, + "TIM1": { + "type": "peripheral", + "base": 0x40012c00, + "struct": "STM32F1xxTim", + "kwargs": { + "brk_intn": 0x18, + "up_intn": 0x19, + "trg_com_intn": 0x1a, + "cc_intn": 0x1b, + "brk_tim15_intn": 0x18, + "brk_tim9_intn": 0x18, + "trg_com_tim17_intn": 0x1a, + "trg_com_tim11_intn": 0x1a, + "up_tim16_intn": 0x19, + "up_tim10_intn": 0x19 + } + }, + "SPI1": { + "type": "peripheral", + "base": 0x40013000, + "struct": "STM32F1xxSpi", + "kwargs": { + "intn": 0x23 + } + }, + "USART1": { + "type": "peripheral", + "base": 0x40013800, + "struct": "STM32F1xxUsart", + "kwargs": { + "intn": 0x25 + } + }, + "DMA1": { + "type": "peripheral", + "base": 0x40020000, + "struct": "STM32F1xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + }, + "RCC": { + "type": "peripheral", + "base": 0x40021000, + "struct": "STM32F1xxRcc", + "kwargs": { + "intn": 0x5 + } + }, + "FLASH INTERFACE": { + "type": "peripheral", + "base": 0x40022000, + "struct": "STM32F1xxFlash", + "kwargs": { + "intn": 0x4 + } + }, + "CRC": { + "type": "peripheral", + "base": 0x40023000, + "struct": "STM32F1xxCrc" + }, + "DBGMCU": { + "type": "peripheral", + "base": 0xe0042000, + "struct": "STM32F1xxDbgmcu" + }, + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" + } +} \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f401.py b/qiling/extensions/mcu/stm32f4/stm32f401.py index ad6c63de..a030de27 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f401.py +++ b/qiling/extensions/mcu/stm32f4/stm32f401.py @@ -4,89 +4,264 @@ # stm32f401 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x10000, - "alias": 0x0, - "type": "remap" - }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x80000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c }, "type": "peripheral" }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, "GPIOA": { "base": 0x40020000, "struct": "STM32F4xxGpio", @@ -117,250 +292,69 @@ stm32f401 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 49 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 35 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f405.py b/qiling/extensions/mcu/stm32f4/stm32f405.py index 880feaa0..eb9d86b9 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f405.py +++ b/qiling/extensions/mcu/stm32f4/stm32f405.py @@ -4,6 +4,303 @@ # stm32f405 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,74 +316,25 @@ stm32f405 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -94,28 +342,19 @@ stm32f405 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -163,79 +402,54 @@ stm32f405 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -243,236 +457,22 @@ stm32f405 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f407.py b/qiling/extensions/mcu/stm32f4/stm32f407.py index 1f08ee1c..7ed14c4c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f407.py +++ b/qiling/extensions/mcu/stm32f4/stm32f407.py @@ -4,6 +4,303 @@ # stm32f407 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,91 +316,25 @@ stm32f407 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -111,28 +342,19 @@ stm32f407 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -180,79 +402,71 @@ stm32f407 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -260,236 +474,22 @@ stm32f407 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f410.py b/qiling/extensions/mcu/stm32f4/stm32f410.py index fe5ecc9f..70ada507 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f410.py +++ b/qiling/extensions/mcu/stm32f4/stm32f410.py @@ -4,85 +4,140 @@ # stm32f410 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x20000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x20000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 }, "type": "peripheral" }, @@ -90,8 +145,86 @@ stm32f410 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV2", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -115,68 +248,54 @@ stm32f410 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV4", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -184,141 +303,22 @@ stm32f410 = { "base": 0x40080000, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV2", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_intn": 25 - }, - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f411.py b/qiling/extensions/mcu/stm32f4/stm32f411.py index 830a6441..7b527ee0 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f411.py +++ b/qiling/extensions/mcu/stm32f4/stm32f411.py @@ -4,80 +4,269 @@ # stm32f411 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x80000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -111,258 +300,69 @@ stm32f411 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 49 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 35 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f412.py b/qiling/extensions/mcu/stm32f4/stm32f412.py index e45ff23a..39af8726 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f412.py +++ b/qiling/extensions/mcu/stm32f4/stm32f412.py @@ -4,102 +4,214 @@ # stm32f412 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" - }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" - }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" - }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x100000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -107,8 +219,135 @@ stm32f412 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV2", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 }, "type": "peripheral" }, @@ -152,87 +391,54 @@ stm32f412 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -240,236 +446,30 @@ stm32f412 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 49 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV2", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f413.py b/qiling/extensions/mcu/stm32f4/stm32f413.py index 641685a6..477b68fe 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f413.py +++ b/qiling/extensions/mcu/stm32f4/stm32f413.py @@ -4,118 +4,238 @@ # stm32f413 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "CAN3": { - "base": 0x40006c00, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 75, - "rx1_intn": 76, - "sce_intn": 77, - "tx_intn": 74 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x180000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x180000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -123,8 +243,191 @@ stm32f413 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CAN3": { + "base": 0x40006c00, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x4b, + "rx1_intn": 0x4c, + "sce_intn": 0x4d, + "tx_intn": 0x4a + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART9": { + "base": 0x40011800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x58 + }, + "type": "peripheral" + }, + "UART10": { + "base": 0x40011c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x59 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV1", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -168,95 +471,54 @@ stm32f413 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, @@ -264,292 +526,30 @@ stm32f413 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV1", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART10": { - "base": 0x40011c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 89 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "UART9": { - "base": 0x40011800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 88 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x180000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f415.py b/qiling/extensions/mcu/stm32f4/stm32f415.py index 18922b4a..7c47e814 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f415.py +++ b/qiling/extensions/mcu/stm32f4/stm32f415.py @@ -4,6 +4,303 @@ # stm32f415 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,82 +316,25 @@ stm32f415 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -102,28 +342,19 @@ stm32f415 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -171,87 +402,70 @@ stm32f415 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -260,232 +474,18 @@ stm32f415 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f417.py b/qiling/extensions/mcu/stm32f4/stm32f417.py index 8111285a..22a25c06 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f417.py +++ b/qiling/extensions/mcu/stm32f4/stm32f417.py @@ -4,6 +4,303 @@ # stm32f417 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x100000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2cV1", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +316,25 @@ stm32f417 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,28 +342,19 @@ stm32f417 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x100000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x100000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", - "kwargs": { - "intn": 4, - }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", "type": "peripheral" }, "GPIOA": { @@ -188,87 +402,87 @@ stm32f417 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2cV1", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV2", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -277,232 +491,18 @@ stm32f417 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, + "CODE": { + "base": 0x8000000, "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f423.py b/qiling/extensions/mcu/stm32f4/stm32f423.py index e4ef4bb8..f6904cc5 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f423.py +++ b/qiling/extensions/mcu/stm32f4/stm32f423.py @@ -4,126 +4,238 @@ # stm32f423 = { - "ADC1": { - "base": 0x40012000, - "struct": "STM32F4xxAdc", - "type": "peripheral" + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" }, - "AES": { - "base": 0x50060000, - "struct": "STM32F423Aes", - "kwargs": { - "intn": 79 - }, - "type": "peripheral" + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 - }, - "type": "peripheral" + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 - }, - "type": "peripheral" + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" }, - "CAN3": { - "base": 0x40006c00, - "struct": "STM32F4xxCan", - "kwargs": { - "rx0_intn": 75, - "rx1_intn": 76, - "sce_intn": 77, - "tx_intn": 74 - }, - "type": "peripheral" + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "EXTI": { - "base": 0x40013c00, - "struct": "STM32F4xxExti", - "type": "peripheral" - }, - "CODE": { - "base": 0x08000000, - "size": 0x180000, - "alias": 0x0, - "type": "remap" - }, "FLASH": { - "base": 0x08000000, + "base": 0x8000000, "size": 0x180000, "type": "memory" }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, "FLASH OTP": { "base": 0x1fff7800, "size": 0x400, "type": "memory" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", "kwargs": { - "intn": 4, + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "LPTIM1": { + "base": 0x40002400, + "struct": "STM32F4xxLptim", + "kwargs": { + "intn": 0x61 + }, + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 }, "type": "peripheral" }, @@ -131,8 +243,191 @@ stm32f423 = { "base": 0x40006000, "struct": "STM32F4xxFmpi2c", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CAN3": { + "base": 0x40006c00, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x4b, + "rx1_intn": 0x4c, + "sce_intn": 0x4d, + "tx_intn": 0x4a + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, + "UART9": { + "base": 0x40011800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x58 + }, + "type": "peripheral" + }, + "UART10": { + "base": 0x40011c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x59 + }, + "type": "peripheral" + }, + "ADC1": { + "base": 0x40012000, + "struct": "STM32F4xxAdc", + "type": "peripheral" + }, + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", + "kwargs": { + "intn": 0x31 + }, + "type": "peripheral" + }, + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x23 + }, + "type": "peripheral" + }, + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x54 + }, + "type": "peripheral" + }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfgV1", + "type": "peripheral" + }, + "EXTI": { + "base": 0x40013c00, + "struct": "STM32F4xxExti", + "type": "peripheral" + }, + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x55 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -176,95 +471,62 @@ stm32f423 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LPTIM1": { - "base": 0x40002400, - "struct": "STM32F4xxLptim", - "kwargs": { - "intn": 97 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV1", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "AES": { + "base": 0x50060000, + "struct": "STM32F423Aes", + "kwargs": { + "intn": 0x4f }, "type": "peripheral" }, @@ -272,292 +534,30 @@ stm32f423 = { "base": 0x50060800, "struct": "STM32F4xxRng", "kwargs": { - "intn": 80 + "intn": 0x50 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5c }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfgV1", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART10": { - "base": 0x40011c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 89 - }, - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "UART9": { - "base": 0x40011800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 88 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x180000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f427.py b/qiling/extensions/mcu/stm32f4/stm32f427.py index f16a8700..5bcd1f35 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f427.py +++ b/qiling/extensions/mcu/stm32f4/stm32f427.py @@ -4,6 +4,319 @@ # stm32f427 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +332,33 @@ stm32f427 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,27 +366,42 @@ stm32f427 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -198,79 +460,79 @@ stm32f427 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -279,280 +541,18 @@ stm32f427 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f429.py b/qiling/extensions/mcu/stm32f4/stm32f429.py index 2fe71f81..bf87d82c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f429.py +++ b/qiling/extensions/mcu/stm32f4/stm32f429.py @@ -4,6 +4,319 @@ # stm32f429 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,99 +332,33 @@ stm32f429 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -119,27 +366,51 @@ stm32f429 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 }, "type": "peripheral" }, @@ -198,88 +469,79 @@ stm32f429 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -288,280 +550,18 @@ stm32f429 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f437.py b/qiling/extensions/mcu/stm32f4/stm32f437.py index 98500a2e..ebe5c80c 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f437.py +++ b/qiling/extensions/mcu/stm32f4/stm32f437.py @@ -4,6 +4,319 @@ # stm32f437 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f437 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,42 @@ stm32f437 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 }, "type": "peripheral" }, @@ -206,87 +460,95 @@ stm32f437 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -295,280 +557,18 @@ stm32f437 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f439.py b/qiling/extensions/mcu/stm32f4/stm32f439.py index 64da47b1..779fcd29 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f439.py +++ b/qiling/extensions/mcu/stm32f4/stm32f439.py @@ -4,6 +4,319 @@ # stm32f439 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f439 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,51 @@ stm32f439 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 }, "type": "peripheral" }, @@ -206,96 +469,95 @@ stm32f439 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -304,280 +566,18 @@ stm32f439 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "dev_id": 0x413 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", - "kwargs": { - "intn": 87 - }, - "type": "peripheral" - }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f446.py b/qiling/extensions/mcu/stm32f4/stm32f446.py index cc8f6b08..4d0fa0fc 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f446.py +++ b/qiling/extensions/mcu/stm32f4/stm32f446.py @@ -4,6 +4,315 @@ # stm32f446 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x80000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "SPDIFRX": { + "base": 0x40004000, + "struct": "STM32F446Spdifrx", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "FMPI2C1": { + "base": 0x40006000, + "struct": "STM32F4xxFmpi2c", + "kwargs": { + "er_intn": 0x60, + "ev_intn": 0x5f + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "CEC": { + "base": 0x40006c00, + "struct": "STM32F446Cec", + "kwargs": { + "intn": 0x5d + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,90 +328,33 @@ stm32f446 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CEC": { - "base": 0x40006c00, - "struct": "STM32F446Cec", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 93 + "intn": 0x54 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F446Syscfg", "type": "peripheral" }, "EXTI": { @@ -110,36 +362,34 @@ stm32f446 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x80000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x80000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", "kwargs": { - "intn": 4, + "intn": 0x57 }, "type": "peripheral" }, - "FMPI2C1": { - "base": 0x40006000, - "struct": "STM32F4xxFmpi2c", + "SAI2": { + "base": 0x40015c00, + "struct": "STM32F4xxSai", "kwargs": { - "er_intn": 96, - "ev_intn": 95 + "intn": 0x5b }, "type": "peripheral" }, @@ -183,335 +433,85 @@ stm32f446 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 92 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F446Rcc", "kwargs": { - "intn": 5 + "intn": 0x5 }, "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x4 }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 87 + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f }, "type": "peripheral" }, - "SAI2": { - "base": 0x40015c00, - "struct": "STM32F4xxSai", + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", "kwargs": { - "intn": 91 + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", "kwargs": { - "intn": 49 + "intn": 0x4e }, "type": "peripheral" }, - "SPDIFRX": { - "base": 0x40004000, - "struct": "STM32F446Spdifrx", - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "intn": 35 + "intn": 0x5c }, "type": "peripheral" }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 36 + "dev_id": 0x413 }, "type": "peripheral" }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F446Syscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x80000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f469.py b/qiling/extensions/mcu/stm32f4/stm32f469.py index a9664367..527aa390 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f469.py +++ b/qiling/extensions/mcu/stm32f4/stm32f469.py @@ -4,6 +4,319 @@ # stm32f469 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,107 +332,33 @@ stm32f469 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 + "intn": 0x54 }, "type": "peripheral" }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "DSI": { - "base": 0x40016c00, - "struct": "STM32F4xxDsi", - "kwargs": { - "intn": 92 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -127,27 +366,59 @@ stm32f469 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 + }, + "type": "peripheral" + }, + "DSI": { + "base": 0x40016c00, + "struct": "STM32F4xxDsi", + "kwargs": { + "intn": 0x5c }, "type": "peripheral" }, @@ -206,96 +477,79 @@ stm32f469 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 91 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e }, "type": "peripheral" }, @@ -304,280 +558,26 @@ stm32f469 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5b }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/extensions/mcu/stm32f4/stm32f479.py b/qiling/extensions/mcu/stm32f4/stm32f479.py index 9a605bf3..6a504fe5 100644 --- a/qiling/extensions/mcu/stm32f4/stm32f479.py +++ b/qiling/extensions/mcu/stm32f4/stm32f479.py @@ -4,6 +4,319 @@ # stm32f479 = { + "SRAM BB": { + "alias": 0x22000000, + "base": 0x20000000, + "size": 0x100000, + "type": "bitband" + }, + "PERIP BB": { + "alias": 0x42000000, + "base": 0x40000000, + "size": 0x100000, + "type": "bitband" + }, + "SYSTICK": { + "base": 0xe000e010, + "struct": "CortexM4SysTick", + "type": "core" + }, + "NVIC": { + "base": 0xe000e100, + "struct": "CortexM4Nvic", + "type": "core" + }, + "SCB": { + "base": 0xe000ed00, + "struct": "CortexM4Scb", + "type": "core" + }, + "FLASH": { + "base": 0x8000000, + "size": 0x200000, + "type": "memory" + }, + "SYSTEM": { + "base": 0x1fff0000, + "size": 0x7800, + "type": "memory" + }, + "FLASH OTP": { + "base": 0x1fff7800, + "size": 0x400, + "type": "memory" + }, + "SRAM": { + "base": 0x20000000, + "size": 0x20000, + "type": "memory" + }, + "PERIP": { + "base": 0x40000000, + "size": 0x100000, + "type": "mmio" + }, + "PPB": { + "base": 0xe0000000, + "size": 0x100000, + "type": "mmio" + }, + "TIM2": { + "base": 0x40000000, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1c + }, + "type": "peripheral" + }, + "TIM3": { + "base": 0x40000400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1d + }, + "type": "peripheral" + }, + "TIM4": { + "base": 0x40000800, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x1e + }, + "type": "peripheral" + }, + "TIM5": { + "base": 0x40000c00, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x32 + }, + "type": "peripheral" + }, + "TIM6": { + "base": 0x40001000, + "struct": "STM32F4xxTim", + "kwargs": { + "dac_intn": 0x36 + }, + "type": "peripheral" + }, + "TIM7": { + "base": 0x40001400, + "struct": "STM32F4xxTim", + "kwargs": { + "intn": 0x37 + }, + "type": "peripheral" + }, + "TIM12": { + "base": 0x40001800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM13": { + "base": 0x40001c00, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "TIM14": { + "base": 0x40002000, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "RTC": { + "base": 0x40002800, + "struct": "STM32F4xxRtc", + "kwargs": { + "alarm_intn": 0x29, + "wkup_intn": 0x3 + }, + "type": "peripheral" + }, + "WWDG": { + "base": 0x40002c00, + "struct": "STM32F4xxWwdg", + "kwargs": { + "intn": 0x0 + }, + "type": "peripheral" + }, + "IWDG": { + "base": 0x40003000, + "struct": "STM32F4xxIwdg", + "type": "peripheral" + }, + "I2S2ext": { + "base": 0x40003400, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "SPI2": { + "base": 0x40003800, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x24 + }, + "type": "peripheral" + }, + "SPI3": { + "base": 0x40003c00, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x33 + }, + "type": "peripheral" + }, + "I2S3ext": { + "base": 0x40004000, + "struct": "STM32F4xxSpi", + "type": "peripheral" + }, + "USART2": { + "base": 0x40004400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x26 + }, + "type": "peripheral" + }, + "USART3": { + "base": 0x40004800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x27 + }, + "type": "peripheral" + }, + "UART4": { + "base": 0x40004c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x34 + }, + "type": "peripheral" + }, + "UART5": { + "base": 0x40005000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x35 + }, + "type": "peripheral" + }, + "I2C1": { + "base": 0x40005400, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x20, + "ev_intn": 0x1f + }, + "type": "peripheral" + }, + "I2C2": { + "base": 0x40005800, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x22, + "ev_intn": 0x21 + }, + "type": "peripheral" + }, + "I2C3": { + "base": 0x40005c00, + "struct": "STM32F4xxI2c", + "kwargs": { + "er_intn": 0x49, + "ev_intn": 0x48 + }, + "type": "peripheral" + }, + "CAN1": { + "base": 0x40006400, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x14, + "rx1_intn": 0x15, + "sce_intn": 0x16, + "tx_intn": 0x13 + }, + "type": "peripheral" + }, + "CAN2": { + "base": 0x40006800, + "struct": "STM32F4xxCan", + "kwargs": { + "rx0_intn": 0x40, + "rx1_intn": 0x41, + "sce_intn": 0x42, + "tx_intn": 0x3f + }, + "type": "peripheral" + }, + "PWR": { + "base": 0x40007000, + "struct": "STM32F4xxPwr", + "type": "peripheral" + }, + "DAC1": { + "base": 0x40007400, + "struct": "STM32F4xxDac", + "type": "peripheral" + }, + "UART7": { + "base": 0x40007800, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x52 + }, + "type": "peripheral" + }, + "UART8": { + "base": 0x40007c00, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x53 + }, + "type": "peripheral" + }, + "TIM1": { + "base": 0x40010000, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim9_intn": 0x18, + "cc_intn": 0x1b, + "trg_com_tim11_intn": 0x1a, + "up_tim10_intn": 0x19 + }, + "type": "peripheral" + }, + "TIM8": { + "base": 0x40010400, + "struct": "STM32F4xxTim", + "kwargs": { + "brk_tim12_intn": 0x2b, + "cc_intn": 0x2e, + "trg_com_tim14_intn": 0x2d, + "up_tim13_intn": 0x2c + }, + "type": "peripheral" + }, + "USART1": { + "base": 0x40011000, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x25 + }, + "type": "peripheral" + }, + "USART6": { + "base": 0x40011400, + "struct": "STM32F4xxUsart", + "kwargs": { + "intn": 0x47 + }, + "type": "peripheral" + }, "ADC1": { "base": 0x40012000, "struct": "STM32F4xxAdc", @@ -19,115 +332,33 @@ stm32f479 = { "struct": "STM32F4xxAdc", "type": "peripheral" }, - "CAN1": { - "base": 0x40006400, - "struct": "STM32F4xxCan", + "SDIO": { + "base": 0x40012c00, + "struct": "STM32F4xxSdio", "kwargs": { - "rx0_intn": 20, - "rx1_intn": 21, - "sce_intn": 22, - "tx_intn": 19 + "intn": 0x31 }, "type": "peripheral" }, - "CAN2": { - "base": 0x40006800, - "struct": "STM32F4xxCan", + "SPI1": { + "base": 0x40013000, + "struct": "STM32F4xxSpi", "kwargs": { - "rx0_intn": 64, - "rx1_intn": 65, - "sce_intn": 66, - "tx_intn": 63 + "intn": 0x23 }, "type": "peripheral" }, - "CRC": { - "base": 0x40023000, - "struct": "STM32F4xxCrc", - "type": "peripheral" - }, - "CRYP": { - "base": 0x50060000, - "struct": "STM32F4xxCryp", + "SPI4": { + "base": 0x40013400, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 79 + "intn": 0x54 }, "type": "peripheral" }, - "DAC1": { - "base": 0x40007400, - "struct": "STM32F4xxDac", - "type": "peripheral" - }, - "DBGMCU": { - "base": 0xe0042000, - "struct": "STM32F4xxDbgmcu", - "kwargs": { - "dev_id": 0x413, - }, - "type": "core peripheral" - }, - "DCMI": { - "base": 0x50050000, - "struct": "STM32F4xxDcmi", - "kwargs": { - "intn": 78 - }, - "type": "peripheral" - }, - "DMA1": { - "base": 0x40026000, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 11, - "stream1_intn": 12, - "stream2_intn": 13, - "stream3_intn": 14, - "stream4_intn": 15, - "stream5_intn": 16, - "stream6_intn": 17, - "stream7_intn": 47 - }, - "type": "peripheral" - }, - "DMA2": { - "base": 0x40026400, - "struct": "STM32F4xxDma", - "kwargs": { - "stream0_intn": 56, - "stream1_intn": 57, - "stream2_intn": 58, - "stream3_intn": 59, - "stream4_intn": 60, - "stream5_intn": 68, - "stream6_intn": 69, - "stream7_intn": 70 - }, - "type": "peripheral" - }, - "DMA2D": { - "base": 0x4002b000, - "struct": "STM32F4xxDma2d", - "kwargs": { - "intn": 90 - }, - "type": "peripheral" - }, - "DSI": { - "base": 0x40016c00, - "struct": "STM32F4xxDsi", - "kwargs": { - "intn": 92 - }, - "type": "peripheral" - }, - "ETH": { - "base": 0x40028000, - "struct": "STM32F4xxEth", - "kwargs": { - "intn": 61, - "wkup_intn": 62 - }, + "SYSCFG": { + "base": 0x40013800, + "struct": "STM32F4xxSyscfg", "type": "peripheral" }, "EXTI": { @@ -135,27 +366,59 @@ stm32f479 = { "struct": "STM32F4xxExti", "type": "peripheral" }, - "CODE": { - "base": 0x08000000, - "size": 0x200000, - "alias": 0x0, - "type": "remap" - }, - "FLASH": { - "base": 0x08000000, - "size": 0x200000, - "type": "memory" + "TIM9": { + "base": 0x40014000, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH OTP": { - "base": 0x1fff7800, - "size": 0x400, - "type": "memory" + "TIM10": { + "base": 0x40014400, + "struct": "STM32F4xxTim", + "type": "peripheral" }, - "FLASH INTERFACE": { - "base": 0x40023c00, - "struct": "STM32F4xxFlash", + "TIM11": { + "base": 0x40014800, + "struct": "STM32F4xxTim", + "type": "peripheral" + }, + "SPI5": { + "base": 0x40015000, + "struct": "STM32F4xxSpi", "kwargs": { - "intn": 4, + "intn": 0x55 + }, + "type": "peripheral" + }, + "SPI6": { + "base": 0x40015400, + "struct": "STM32F4xxSpi", + "kwargs": { + "intn": 0x56 + }, + "type": "peripheral" + }, + "SAI1": { + "base": 0x40015800, + "struct": "STM32F4xxSai", + "kwargs": { + "intn": 0x57 + }, + "type": "peripheral" + }, + "LTDC": { + "base": 0x40016800, + "struct": "STM32F4xxLtdc", + "kwargs": { + "er_intn": 0x59, + "intn": 0x58 + }, + "type": "peripheral" + }, + "DSI": { + "base": 0x40016c00, + "struct": "STM32F4xxDsi", + "kwargs": { + "intn": 0x5c }, "type": "peripheral" }, @@ -214,104 +477,95 @@ stm32f479 = { "struct": "STM32F4xxGpio", "type": "peripheral" }, - "HASH": { - "base": 0x50060400, - "struct": "STM32F4xxHash", - "kwargs": { - "rng_intn": 80 - }, - "type": "peripheral" - }, - "I2C1": { - "base": 0x40005400, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 32, - "ev_intn": 31 - }, - "type": "peripheral" - }, - "I2C2": { - "base": 0x40005800, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 34, - "ev_intn": 33 - }, - "type": "peripheral" - }, - "I2C3": { - "base": 0x40005c00, - "struct": "STM32F4xxI2c", - "kwargs": { - "er_intn": 73, - "ev_intn": 72 - }, - "type": "peripheral" - }, - "I2S2ext": { - "base": 0x40003400, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "I2S3ext": { - "base": 0x40004000, - "struct": "STM32F4xxSpi", - "type": "peripheral" - }, - "IWDG": { - "base": 0x40003000, - "struct": "STM32F4xxIwdg", - "type": "peripheral" - }, - "LTDC": { - "base": 0x40016800, - "struct": "STM32F4xxLtdc", - "kwargs": { - "er_intn": 89, - "intn": 88 - }, - "type": "peripheral" - }, - "NVIC": { - "base": 0xe000e100, - "struct": "CortexM4Nvic", - "type": "core peripheral" - }, - "PERIP": { - "base": 0x40000000, - "size": 0x100000, - "type": "mmio" - }, - "PERIP BB": { - "alias": 0x42000000, - "base": 0x40000000, - "size": 0x100000, - "type": "bitband" - }, - "PPB": { - "base": 0xe0000000, - "size": 0x100000, - "type": "mmio" - }, - "PWR": { - "base": 0x40007000, - "struct": "STM32F4xxPwr", - "type": "peripheral" - }, - "QUADSPI": { - "base": 0xa0001000, - "struct": "STM32F4xxQuadspi", - "kwargs": { - "intn": 91 - }, + "CRC": { + "base": 0x40023000, + "struct": "STM32F4xxCrc", "type": "peripheral" }, "RCC": { "base": 0x40023800, "struct": "STM32F4xxRccV3", "kwargs": { - "intn": 5 + "intn": 0x5 + }, + "type": "peripheral" + }, + "FLASH INTERFACE": { + "base": 0x40023c00, + "struct": "STM32F4xxFlash", + "kwargs": { + "intn": 0x4 + }, + "type": "peripheral" + }, + "DMA1": { + "base": 0x40026000, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0xb, + "stream1_intn": 0xc, + "stream2_intn": 0xd, + "stream3_intn": 0xe, + "stream4_intn": 0xf, + "stream5_intn": 0x10, + "stream6_intn": 0x11, + "stream7_intn": 0x2f + }, + "type": "peripheral" + }, + "DMA2": { + "base": 0x40026400, + "struct": "STM32F4xxDma", + "kwargs": { + "stream0_intn": 0x38, + "stream1_intn": 0x39, + "stream2_intn": 0x3a, + "stream3_intn": 0x3b, + "stream4_intn": 0x3c, + "stream5_intn": 0x44, + "stream6_intn": 0x45, + "stream7_intn": 0x46 + }, + "type": "peripheral" + }, + "ETH": { + "base": 0x40028000, + "struct": "STM32F4xxEth", + "kwargs": { + "intn": 0x3d, + "wkup_intn": 0x3e + }, + "type": "peripheral" + }, + "DMA2D": { + "base": 0x4002b000, + "struct": "STM32F4xxDma2d", + "kwargs": { + "intn": 0x5a + }, + "type": "peripheral" + }, + "DCMI": { + "base": 0x50050000, + "struct": "STM32F4xxDcmi", + "kwargs": { + "intn": 0x4e + }, + "type": "peripheral" + }, + "CRYP": { + "base": 0x50060000, + "struct": "STM32F4xxCryp", + "kwargs": { + "intn": 0x4f + }, + "type": "peripheral" + }, + "HASH": { + "base": 0x50060400, + "struct": "STM32F4xxHash", + "kwargs": { + "rng_intn": 0x50 }, "type": "peripheral" }, @@ -320,280 +574,26 @@ stm32f479 = { "struct": "STM32F4xxRng", "type": "peripheral" }, - "RTC": { - "base": 0x40002800, - "struct": "STM32F4xxRtc", + "QUADSPI": { + "base": 0xa0001000, + "struct": "STM32F4xxQuadspi", "kwargs": { - "alarm_intn": 41, - "wkup_intn": 3 + "intn": 0x5b }, "type": "peripheral" }, - "SAI1": { - "base": 0x40015800, - "struct": "STM32F4xxSai", + "DBGMCU": { + "base": 0xe0042000, + "struct": "STM32F4xxDbgmcu", "kwargs": { - "intn": 87 + "dev_id": 0x413 }, "type": "peripheral" }, - "SCB": { - "base": 0xe000ed00, - "struct": "CortexM4Scb", - "type": "core peripheral" - }, - "SDIO": { - "base": 0x40012c00, - "struct": "STM32F4xxSdio", - "kwargs": { - "intn": 49 - }, - "type": "peripheral" - }, - "SPI1": { - "base": 0x40013000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 35 - }, - "type": "peripheral" - }, - "SPI2": { - "base": 0x40003800, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 36 - }, - "type": "peripheral" - }, - "SPI3": { - "base": 0x40003c00, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 51 - }, - "type": "peripheral" - }, - "SPI4": { - "base": 0x40013400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 84 - }, - "type": "peripheral" - }, - "SPI5": { - "base": 0x40015000, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 85 - }, - "type": "peripheral" - }, - "SPI6": { - "base": 0x40015400, - "struct": "STM32F4xxSpi", - "kwargs": { - "intn": 86 - }, - "type": "peripheral" - }, - "SRAM": { - "base": 0x20000000, - "size": 0x20000, - "type": "memory" - }, - "SRAM BB": { - "alias": 0x22000000, - "base": 0x20000000, - "size": 0x100000, - "type": "bitband" - }, - "SYSCFG": { - "base": 0x40013800, - "struct": "STM32F4xxSyscfg", - "type": "peripheral" - }, - "SYSTEM": { - "base": 0x1fff0000, - "size": 0x7800, - "type": "memory" - }, - "SYSTICK": { - "base": 0xe000e010, - "struct": "CortexM4SysTick", - "type": "core peripheral" - }, - "TIM1": { - "base": 0x40010000, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim9_intn": 24, - "cc_intn": 27, - "trg_com_tim11_intn": 26, - "up_tim10_intn": 25 - }, - "type": "peripheral" - }, - "TIM10": { - "base": 0x40014400, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM11": { - "base": 0x40014800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM12": { - "base": 0x40001800, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM13": { - "base": 0x40001c00, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM14": { - "base": 0x40002000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "TIM2": { - "base": 0x40000000, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 28 - }, - "type": "peripheral" - }, - "TIM3": { - "base": 0x40000400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 29 - }, - "type": "peripheral" - }, - "TIM4": { - "base": 0x40000800, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 30 - }, - "type": "peripheral" - }, - "TIM5": { - "base": 0x40000c00, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 50 - }, - "type": "peripheral" - }, - "TIM6": { - "base": 0x40001000, - "struct": "STM32F4xxTim", - "kwargs": { - "dac_intn": 54 - }, - "type": "peripheral" - }, - "TIM7": { - "base": 0x40001400, - "struct": "STM32F4xxTim", - "kwargs": { - "intn": 55 - }, - "type": "peripheral" - }, - "TIM8": { - "base": 0x40010400, - "struct": "STM32F4xxTim", - "kwargs": { - "brk_tim12_intn": 43, - "cc_intn": 46, - "trg_com_tim14_intn": 45, - "up_tim13_intn": 44 - }, - "type": "peripheral" - }, - "TIM9": { - "base": 0x40014000, - "struct": "STM32F4xxTim", - "type": "peripheral" - }, - "UART4": { - "base": 0x40004c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 52 - }, - "type": "peripheral" - }, - "UART5": { - "base": 0x40005000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 53 - }, - "type": "peripheral" - }, - "UART7": { - "base": 0x40007800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 82 - }, - "type": "peripheral" - }, - "UART8": { - "base": 0x40007c00, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 83 - }, - "type": "peripheral" - }, - "USART1": { - "base": 0x40011000, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 37 - }, - "type": "peripheral" - }, - "USART2": { - "base": 0x40004400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 38 - }, - "type": "peripheral" - }, - "USART3": { - "base": 0x40004800, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 39 - }, - "type": "peripheral" - }, - "USART6": { - "base": 0x40011400, - "struct": "STM32F4xxUsart", - "kwargs": { - "intn": 71 - }, - "type": "peripheral" - }, - "WWDG": { - "base": 0x40002c00, - "struct": "STM32F4xxWwdg", - "kwargs": { - "intn": 0 - }, - "type": "peripheral" + "CODE": { + "base": 0x8000000, + "size": 0x200000, + "alias": 0x0, + "type": "remap" } } \ No newline at end of file diff --git a/qiling/hw/__init__.py b/qiling/hw/__init__.py index 0ab9cef3..1edb4b43 100644 --- a/qiling/hw/__init__.py +++ b/qiling/hw/__init__.py @@ -3,8 +3,10 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .adc import * from .char import * from .dma import * +from .flash import * from .gpio import * from .i2c import * from .intc import * diff --git a/qiling/hw/adc/__init__.py b/qiling/hw/adc/__init__.py new file mode 100644 index 00000000..446ef249 --- /dev/null +++ b/qiling/hw/adc/__init__.py @@ -0,0 +1,6 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .sam3xa_adc import SAM3xaAdc diff --git a/qiling/hw/adc/sam3xa_adc.py b/qiling/hw/adc/sam3xa_adc.py new file mode 100644 index 00000000..47f009a6 --- /dev/null +++ b/qiling/hw/adc/sam3xa_adc.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaAdc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), # (Adc Offset: 0x00) Control Register + ("MR" , ctypes.c_uint32), # (Adc Offset: 0x04) Mode Register + ("SEQR1" , ctypes.c_uint32), # (Adc Offset: 0x08) Channel Sequence Register 1 + ("SEQR2" , ctypes.c_uint32), # (Adc Offset: 0x0C) Channel Sequence Register 2 + ("CHER" , ctypes.c_uint32), # (Adc Offset: 0x10) Channel Enable Register + ("CHDR" , ctypes.c_uint32), # (Adc Offset: 0x14) Channel Disable Register + ("CHSR" , ctypes.c_uint32), # (Adc Offset: 0x18) Channel Status Register + ("Reserved1", ctypes.c_uint32), # + ("LCDR" , ctypes.c_uint32), # (Adc Offset: 0x20) Last Converted Data Register + ("IER" , ctypes.c_uint32), # (Adc Offset: 0x24) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Adc Offset: 0x28) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Adc Offset: 0x2C) Interrupt Mask Register + ("ISR" , ctypes.c_uint32), # (Adc Offset: 0x30) Interrupt Status Register + ("Reserved2", ctypes.c_uint32 * 2), # + ("OVER" , ctypes.c_uint32), # (Adc Offset: 0x3C) Overrun Status Register + ("EMR" , ctypes.c_uint32), # (Adc Offset: 0x40) Extended Mode Register + ("CWR" , ctypes.c_uint32), # (Adc Offset: 0x44) Compare Window Register + ("CGR" , ctypes.c_uint32), # (Adc Offset: 0x48) Channel Gain Register + ("COR" , ctypes.c_uint32), # (Adc Offset: 0x4C) Channel Offset Register + ("CDR" , ctypes.c_uint32 * 16), # (Adc Offset: 0x50) Channel Data Register + ("Reserved3", ctypes.c_uint32), # + ("ACR" , ctypes.c_uint32), # (Adc Offset: 0x94) Analog Control Register + ("Reserved4", ctypes.c_uint32 * 19), # + ("WPMR" , ctypes.c_uint32), # (Adc Offset: 0xE4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Adc Offset: 0xE8) Write Protect Status Register + ("Reserved5", ctypes.c_uint32 * 5), # + ("RPR" , ctypes.c_uint32), # (Adc Offset: 0x100) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Adc Offset: 0x104) Receive Counter Register + ("Reserved6", ctypes.c_uint32 * 2), # + ("RNPR" , ctypes.c_uint32), # (Adc Offset: 0x110) Receive Next Pointer Register + ("RNCR" , ctypes.c_uint32), # (Adc Offset: 0x114) Receive Next Counter Register + ("Reserved7", ctypes.c_uint32 * 2), # + ("PTCR" , ctypes.c_uint32), # (Adc Offset: 0x120) Transfer Control Register + ("PTSR" , ctypes.c_uint32), # (Adc Offset: 0x124) Transfer Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.adc = self.struct() + self.intn = intn diff --git a/qiling/hw/char/__init__.py b/qiling/hw/char/__init__.py index 4fb762c0..444f179f 100644 --- a/qiling/hw/char/__init__.py +++ b/qiling/hw/char/__init__.py @@ -3,5 +3,8 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .stm32f1xx_usart import STM32F1xxUsart from .stm32f4xx_usart import STM32F4xxUsart -from .gd32vf1xx_usart import GD32VF1xxUsart \ No newline at end of file +from .gd32vf1xx_usart import GD32VF1xxUsart +from .sam3xa_uotghs import SAM3xaUotghs +from .sam3xa_uart import SAM3xaUart diff --git a/qiling/hw/char/sam3xa_uart.py b/qiling/hw/char/sam3xa_uart.py new file mode 100644 index 00000000..1ea3f6a2 --- /dev/null +++ b/qiling/hw/char/sam3xa_uart.py @@ -0,0 +1,58 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.connectivity import QlConnectivityPeripheral +from qiling.hw.const.sam3xa_uart import SR + + +class SAM3xaUart(QlConnectivityPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), # (Uart Offset: 0x0000) Control Register + ("MR" , ctypes.c_uint32), # (Uart Offset: 0x0004) Mode Register + ("IER" , ctypes.c_uint32), # (Uart Offset: 0x0008) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Uart Offset: 0x000C) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Uart Offset: 0x0010) Interrupt Mask Register + ("SR" , ctypes.c_uint32), # (Uart Offset: 0x0014) Status Register + ("RHR" , ctypes.c_uint32), # (Uart Offset: 0x0018) Receive Holding Register + ("THR" , ctypes.c_uint32), # (Uart Offset: 0x001C) Transmit Holding Register + ("BRGR" , ctypes.c_uint32), # (Uart Offset: 0x0020) Baud Rate Generator Register + ("Reserved1", ctypes.c_uint32 * 55), # + ("RPR" , ctypes.c_uint32), # (Uart Offset: 0x100) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Uart Offset: 0x104) Receive Counter Register + ("TPR" , ctypes.c_uint32), # (Uart Offset: 0x108) Transmit Pointer Register + ("TCR" , ctypes.c_uint32), # (Uart Offset: 0x10C) Transmit Counter Register + ("RNPR" , ctypes.c_uint32), # (Uart Offset: 0x110) Receive Next Pointer Register + ("RNCR" , ctypes.c_uint32), # (Uart Offset: 0x114) Receive Next Counter Register + ("TNPR" , ctypes.c_uint32), # (Uart Offset: 0x118) Transmit Next Pointer Register + ("TNCR" , ctypes.c_uint32), # (Uart Offset: 0x11C) Transmit Next Counter Register + ("PTCR" , ctypes.c_uint32), # (Uart Offset: 0x120) Transfer Control Register + ("PTSR" , ctypes.c_uint32), # (Uart Offset: 0x124) Transfer Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.uart = self.struct( + SR = SR.TXRDY + ) + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.uart) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.THR.offset: + self.send_to_user(value) + + data = (value).to_bytes(size, byteorder='little') + ctypes.memmove(ctypes.addressof(self.uart) + offset, data, size) diff --git a/qiling/hw/char/sam3xa_uotghs.py b/qiling/hw/char/sam3xa_uotghs.py new file mode 100644 index 00000000..0903fcab --- /dev/null +++ b/qiling/hw/char/sam3xa_uotghs.py @@ -0,0 +1,121 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + + +from qiling.hw.connectivity import QlConnectivityPeripheral +from qiling.hw.peripheral import QlPeripheral + +from qiling.hw.const.sam3xa_uotghs import CTRL, SR + + +class UotghsDevdma(ctypes.Structure): + _fields_ = [ + ("DEVDMANXTDSC", ctypes.c_uint32), + ("DEVDMAADDRESS", ctypes.c_uint32), + ("DEVDMACONTROL", ctypes.c_uint32), + ("DEVDMASTATUS", ctypes.c_uint32), + ] + +class UotghsHstdma(ctypes.Structure): + _fields_ = [ + ("HSTDMANXTDSC", ctypes.c_uint32), + ("HSTDMAADDRESS", ctypes.c_uint32), + ("HSTDMACONTROL", ctypes.c_uint32), + ("HSTDMASTATUS", ctypes.c_uint32), + ] + +class SAM3xaUotghs(QlConnectivityPeripheral): + """ USB On-The-Go Interface """ + class Type(ctypes.Structure): + _fields_ = [ + ("DEVCTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0000) Device General Control Register + ("DEVISR" , ctypes.c_uint32), # (Uotghs Offset: 0x0004) Device Global Interrupt Status Register + ("DEVICR" , ctypes.c_uint32), # (Uotghs Offset: 0x0008) Device Global Interrupt Clear Register + ("DEVIFR" , ctypes.c_uint32), # (Uotghs Offset: 0x000C) Device Global Interrupt Set Register + ("DEVIMR" , ctypes.c_uint32), # (Uotghs Offset: 0x0010) Device Global Interrupt Mask Register + ("DEVIDR" , ctypes.c_uint32), # (Uotghs Offset: 0x0014) Device Global Interrupt Disable Register + ("DEVIER" , ctypes.c_uint32), # (Uotghs Offset: 0x0018) Device Global Interrupt Enable Register + ("DEVEPT" , ctypes.c_uint32), # (Uotghs Offset: 0x001C) Device Endpoint Register + ("DEVFNUM" , ctypes.c_uint32), # (Uotghs Offset: 0x0020) Device Frame Number Register + ("Reserved1" , ctypes.c_uint32 * 55), # + ("DEVEPTCFG" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x100) Device Endpoint Configuration Register (n = 0) + ("Reserved2" , ctypes.c_uint32 * 2), # + ("DEVEPTISR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x130) Device Endpoint Status Register (n = 0) + ("Reserved3" , ctypes.c_uint32 * 2), # + ("DEVEPTICR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x160) Device Endpoint Clear Register (n = 0) + ("Reserved4" , ctypes.c_uint32 * 2), # + ("DEVEPTIFR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x190) Device Endpoint Set Register (n = 0) + ("Reserved5" , ctypes.c_uint32 * 2), # + ("DEVEPTIMR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x1C0) Device Endpoint Mask Register (n = 0) + ("Reserved6" , ctypes.c_uint32 * 2), # + ("DEVEPTIER" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x1F0) Device Endpoint Enable Register (n = 0) + ("Reserved7" , ctypes.c_uint32 * 2), # + ("DEVEPTIDR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x220) Device Endpoint Disable Register (n = 0) + ("Reserved8" , ctypes.c_uint32 * 50), # + ("DEVDMA" , UotghsDevdma * 7), # (Uotghs Offset: 0x310) n = 1 .. 7 + ("Reserved9" , ctypes.c_uint32 * 32), # + ("HSTCTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0400) Host General Control Register + ("HSTISR" , ctypes.c_uint32), # (Uotghs Offset: 0x0404) Host Global Interrupt Status Register + ("HSTICR" , ctypes.c_uint32), # (Uotghs Offset: 0x0408) Host Global Interrupt Clear Register + ("HSTIFR" , ctypes.c_uint32), # (Uotghs Offset: 0x040C) Host Global Interrupt Set Register + ("HSTIMR" , ctypes.c_uint32), # (Uotghs Offset: 0x0410) Host Global Interrupt Mask Register + ("HSTIDR" , ctypes.c_uint32), # (Uotghs Offset: 0x0414) Host Global Interrupt Disable Register + ("HSTIER" , ctypes.c_uint32), # (Uotghs Offset: 0x0418) Host Global Interrupt Enable Register + ("HSTPIP" , ctypes.c_uint32), # (Uotghs Offset: 0x0041C) Host Pipe Register + ("HSTFNUM" , ctypes.c_uint32), # (Uotghs Offset: 0x0420) Host Frame Number Register + ("HSTADDR1" , ctypes.c_uint32), # (Uotghs Offset: 0x0424) Host Address 1 Register + ("HSTADDR2" , ctypes.c_uint32), # (Uotghs Offset: 0x0428) Host Address 2 Register + ("HSTADDR3" , ctypes.c_uint32), # (Uotghs Offset: 0x042C) Host Address 3 Register + ("Reserved10", ctypes.c_uint32 * 52), # + ("HSTPIPCFG" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x500) Host Pipe Configuration Register (n = 0) + ("Reserved11", ctypes.c_uint32 * 2), # + ("HSTPIPISR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x530) Host Pipe Status Register (n = 0) + ("Reserved12", ctypes.c_uint32 * 2), # + ("HSTPIPICR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x560) Host Pipe Clear Register (n = 0) + ("Reserved13", ctypes.c_uint32 * 2), # + ("HSTPIPIFR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x590) Host Pipe Set Register (n = 0) + ("Reserved14", ctypes.c_uint32 * 2), # + ("HSTPIPIMR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x5C0) Host Pipe Mask Register (n = 0) + ("Reserved15", ctypes.c_uint32 * 2), # + ("HSTPIPIER" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x5F0) Host Pipe Enable Register (n = 0) + ("Reserved16", ctypes.c_uint32 * 2), # + ("HSTPIPIDR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x620) Host Pipe Disable Register (n = 0) + ("Reserved17", ctypes.c_uint32 * 2), # + ("HSTPIPINRQ", ctypes.c_uint32 * 10), # (Uotghs Offset: 0x650) Host Pipe IN Request Register (n = 0) + ("Reserved18", ctypes.c_uint32 * 2), # + ("HSTPIPERR" , ctypes.c_uint32 * 10), # (Uotghs Offset: 0x680) Host Pipe Error Register (n = 0) + ("Reserved19", ctypes.c_uint32 * 26), # + ("HSTDMA" , UotghsHstdma * 7), # (Uotghs Offset: 0x710) n = 1 .. 7 + ("Reserved20", ctypes.c_uint32 * 32), # + ("CTRL" , ctypes.c_uint32), # (Uotghs Offset: 0x0800) General Control Register + ("SR" , ctypes.c_uint32), # (Uotghs Offset: 0x0804) General Status Register + ("SCR" , ctypes.c_uint32), # (Uotghs Offset: 0x0808) General Status Clear Register + ("SFR" , ctypes.c_uint32), # (Uotghs Offset: 0x080C) General Status Set Register + ("Reserved21", ctypes.c_uint32 * 7), # + ("FSM" , ctypes.c_uint32), # (Uotghs Offset: 0x082C) General Finite State Machine Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.uotghs = self.struct() + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.uotghs) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.CTRL.offset: + if value & CTRL.OTGPADE == 0: + self.uotghs.SR |= SR.CLKUSABLE + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.uotghs) + offset, data, size) diff --git a/qiling/hw/char/stm32f1xx_usart.py b/qiling/hw/char/stm32f1xx_usart.py new file mode 100644 index 00000000..fa8d57f8 --- /dev/null +++ b/qiling/hw/char/stm32f1xx_usart.py @@ -0,0 +1,30 @@ +import ctypes + +from qiling.hw.char.stm32f4xx_usart import STM32F4xxUsart + + +class STM32F1xxUsart(STM32F4xxUsart): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("SR" , ctypes.c_uint32), #USART Status register, Address offset: 0x00 + ("DR" , ctypes.c_uint32), #USART Data register, Address offset: 0x04 + ("BRR" , ctypes.c_uint32), #USART Baud rate register, Address offset: 0x08 + ("CR1" , ctypes.c_uint32), #USART Control register 1, Address offset: 0x0C + ("CR2" , ctypes.c_uint32), #USART Control register 2, Address offset: 0x10 + ("CR3" , ctypes.c_uint32), #USART Control register 3, Address offset: 0x14 + ("GTPR", ctypes.c_uint32), #USART Guard time and prescaler register, Address offset: 0x18 + ] diff --git a/qiling/hw/const/sam3xa_pmc.py b/qiling/hw/const/sam3xa_pmc.py new file mode 100644 index 00000000..68155b96 --- /dev/null +++ b/qiling/hw/const/sam3xa_pmc.py @@ -0,0 +1,313 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class SCER(IntEnum): + UOTGCLK = 0x1 << 5 # Enable USB OTG Clock (48 MHz, USB_48M) for UTMI + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Enable + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Enable + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Enable + +class SCDR(IntEnum): + UOTGCLK = 0x1 << 5 # Disable USB OTG Clock (48 MHz, USB_48M) for UTMI + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Disable + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Disable + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Disable + +class SCSR(IntEnum): + UOTGCLK = 0x1 << 5 # USB OTG Clock (48 MHz, USB_48M) Clock Status + PCK0 = 0x1 << 8 # Programmable Clock 0 Output Status + PCK1 = 0x1 << 9 # Programmable Clock 1 Output Status + PCK2 = 0x1 << 10 # Programmable Clock 2 Output Status + +class PCER0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Enable + PID3 = 0x1 << 3 # Peripheral Clock 3 Enable + PID4 = 0x1 << 4 # Peripheral Clock 4 Enable + PID5 = 0x1 << 5 # Peripheral Clock 5 Enable + PID6 = 0x1 << 6 # Peripheral Clock 6 Enable + PID7 = 0x1 << 7 # Peripheral Clock 7 Enable + PID8 = 0x1 << 8 # Peripheral Clock 8 Enable + PID9 = 0x1 << 9 # Peripheral Clock 9 Enable + PID10 = 0x1 << 10 # Peripheral Clock 10 Enable + PID11 = 0x1 << 11 # Peripheral Clock 11 Enable + PID12 = 0x1 << 12 # Peripheral Clock 12 Enable + PID13 = 0x1 << 13 # Peripheral Clock 13 Enable + PID14 = 0x1 << 14 # Peripheral Clock 14 Enable + PID15 = 0x1 << 15 # Peripheral Clock 15 Enable + PID16 = 0x1 << 16 # Peripheral Clock 16 Enable + PID17 = 0x1 << 17 # Peripheral Clock 17 Enable + PID18 = 0x1 << 18 # Peripheral Clock 18 Enable + PID19 = 0x1 << 19 # Peripheral Clock 19 Enable + PID20 = 0x1 << 20 # Peripheral Clock 20 Enable + PID21 = 0x1 << 21 # Peripheral Clock 21 Enable + PID22 = 0x1 << 22 # Peripheral Clock 22 Enable + PID23 = 0x1 << 23 # Peripheral Clock 23 Enable + PID24 = 0x1 << 24 # Peripheral Clock 24 Enable + PID25 = 0x1 << 25 # Peripheral Clock 25 Enable + PID26 = 0x1 << 26 # Peripheral Clock 26 Enable + PID27 = 0x1 << 27 # Peripheral Clock 27 Enable + PID28 = 0x1 << 28 # Peripheral Clock 28 Enable + PID29 = 0x1 << 29 # Peripheral Clock 29 Enable + PID30 = 0x1 << 30 # Peripheral Clock 30 Enable + PID31 = 0x1 << 31 # Peripheral Clock 31 Enable + +class PCDR0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Disable + PID3 = 0x1 << 3 # Peripheral Clock 3 Disable + PID4 = 0x1 << 4 # Peripheral Clock 4 Disable + PID5 = 0x1 << 5 # Peripheral Clock 5 Disable + PID6 = 0x1 << 6 # Peripheral Clock 6 Disable + PID7 = 0x1 << 7 # Peripheral Clock 7 Disable + PID8 = 0x1 << 8 # Peripheral Clock 8 Disable + PID9 = 0x1 << 9 # Peripheral Clock 9 Disable + PID10 = 0x1 << 10 # Peripheral Clock 10 Disable + PID11 = 0x1 << 11 # Peripheral Clock 11 Disable + PID12 = 0x1 << 12 # Peripheral Clock 12 Disable + PID13 = 0x1 << 13 # Peripheral Clock 13 Disable + PID14 = 0x1 << 14 # Peripheral Clock 14 Disable + PID15 = 0x1 << 15 # Peripheral Clock 15 Disable + PID16 = 0x1 << 16 # Peripheral Clock 16 Disable + PID17 = 0x1 << 17 # Peripheral Clock 17 Disable + PID18 = 0x1 << 18 # Peripheral Clock 18 Disable + PID19 = 0x1 << 19 # Peripheral Clock 19 Disable + PID20 = 0x1 << 20 # Peripheral Clock 20 Disable + PID21 = 0x1 << 21 # Peripheral Clock 21 Disable + PID22 = 0x1 << 22 # Peripheral Clock 22 Disable + PID23 = 0x1 << 23 # Peripheral Clock 23 Disable + PID24 = 0x1 << 24 # Peripheral Clock 24 Disable + PID25 = 0x1 << 25 # Peripheral Clock 25 Disable + PID26 = 0x1 << 26 # Peripheral Clock 26 Disable + PID27 = 0x1 << 27 # Peripheral Clock 27 Disable + PID28 = 0x1 << 28 # Peripheral Clock 28 Disable + PID29 = 0x1 << 29 # Peripheral Clock 29 Disable + PID30 = 0x1 << 30 # Peripheral Clock 30 Disable + PID31 = 0x1 << 31 # Peripheral Clock 31 Disable + +class PCSR0(IntEnum): + PID2 = 0x1 << 2 # Peripheral Clock 2 Status + PID3 = 0x1 << 3 # Peripheral Clock 3 Status + PID4 = 0x1 << 4 # Peripheral Clock 4 Status + PID5 = 0x1 << 5 # Peripheral Clock 5 Status + PID6 = 0x1 << 6 # Peripheral Clock 6 Status + PID7 = 0x1 << 7 # Peripheral Clock 7 Status + PID8 = 0x1 << 8 # Peripheral Clock 8 Status + PID9 = 0x1 << 9 # Peripheral Clock 9 Status + PID10 = 0x1 << 10 # Peripheral Clock 10 Status + PID11 = 0x1 << 11 # Peripheral Clock 11 Status + PID12 = 0x1 << 12 # Peripheral Clock 12 Status + PID13 = 0x1 << 13 # Peripheral Clock 13 Status + PID14 = 0x1 << 14 # Peripheral Clock 14 Status + PID15 = 0x1 << 15 # Peripheral Clock 15 Status + PID16 = 0x1 << 16 # Peripheral Clock 16 Status + PID17 = 0x1 << 17 # Peripheral Clock 17 Status + PID18 = 0x1 << 18 # Peripheral Clock 18 Status + PID19 = 0x1 << 19 # Peripheral Clock 19 Status + PID20 = 0x1 << 20 # Peripheral Clock 20 Status + PID21 = 0x1 << 21 # Peripheral Clock 21 Status + PID22 = 0x1 << 22 # Peripheral Clock 22 Status + PID23 = 0x1 << 23 # Peripheral Clock 23 Status + PID24 = 0x1 << 24 # Peripheral Clock 24 Status + PID25 = 0x1 << 25 # Peripheral Clock 25 Status + PID26 = 0x1 << 26 # Peripheral Clock 26 Status + PID27 = 0x1 << 27 # Peripheral Clock 27 Status + PID28 = 0x1 << 28 # Peripheral Clock 28 Status + PID29 = 0x1 << 29 # Peripheral Clock 29 Status + PID30 = 0x1 << 30 # Peripheral Clock 30 Status + PID31 = 0x1 << 31 # Peripheral Clock 31 Status + +class CKGR_UCKR(IntEnum): + UPLLEN = 0x1 << 16 # UTMI PLL Enable + UPLLCOUNT = 0xf << 20 # UTMI PLL Start-up Time + +class CKGR_MOR(IntEnum): + MOSCXTEN = 0x1 << 0 # Main Crystal Oscillator Enable + MOSCXTBY = 0x1 << 1 # Main Crystal Oscillator Bypass + MOSCRCEN = 0x1 << 3 # Main On-Chip RC Oscillator Enable + MOSCRCF = 0x7 << 4 # Main On-Chip RC Oscillator Frequency Selection + MOSCXTST = 0xff << 8 # Main Crystal Oscillator Start-up Time + KEY = 0xff << 16 # Password + MOSCSEL = 0x1 << 24 # Main Oscillator Selection + CFDEN = 0x1 << 25 # Clock Failure Detector Enable + +class CKGR_MCFR(IntEnum): + MAINF = 0xffff << 0 # Main Clock Frequency + MAINFRDY = 0x1 << 16 # Main Clock Ready + +class CKGR_PLLAR(IntEnum): + DIVA = 0xff << 0 # Divider + PLLACOUNT = 0x3f << 8 # PLLA Counter + MULA = 0x7ff << 16 # PLLA Multiplier + ONE = 0x1 << 29 # Must Be Set to 1 + +class MCKR(IntEnum): + CSS = 0x3 << 0 # Master Clock Source Selection + PRES = 0x7 << 4 # Processor Clock Prescaler + PLLADIV2 = 0x1 << 12 # PLLA Divisor by 2 + UPLLDIV2 = 0x1 << 13 # + +class USB(IntEnum): + USBS = 0x1 << 0 # USB Input Clock Selection + USBDIV = 0xf << 8 # Divider for USB Clock. + +class PCK(IntEnum): + CSS = 0x7 << 0 # Master Clock Source Selection + PRES = 0x7 << 4 # Programmable Clock Prescaler + +class IER(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Enable + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Enable + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Enable + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Enable + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Enable + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Enable + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Enable + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Enable + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Enable + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Enable + +class IDR(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Disable + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Disable + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Disable + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Disable + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Disable + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Disable + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Disable + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Disable + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Disable + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Disable + +class SR(IntEnum): + MOSCXTS = 0x1 << 0 # Main XTAL Oscillator Status + LOCKA = 0x1 << 1 # PLLA Lock Status + MCKRDY = 0x1 << 3 # Master Clock Status + LOCKU = 0x1 << 6 # UTMI PLL Lock Status + OSCSELS = 0x1 << 7 # Slow Clock Oscillator Selection + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready Status + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready Status + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready Status + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status + MOSCRCS = 0x1 << 17 # Main On-Chip RC Oscillator Status + CFDEV = 0x1 << 18 # Clock Failure Detector Event + CFDS = 0x1 << 19 # Clock Failure Detector Status + FOS = 0x1 << 20 # Clock Failure Detector Fault Output Status + +class IMR(IntEnum): + MOSCXTS = 0x1 << 0 # Main Crystal Oscillator Status Interrupt Mask + LOCKA = 0x1 << 1 # PLLA Lock Interrupt Mask + MCKRDY = 0x1 << 3 # Master Clock Ready Interrupt Mask + LOCKU = 0x1 << 6 # UTMI PLL Lock Interrupt Mask + PCKRDY0 = 0x1 << 8 # Programmable Clock Ready 0 Interrupt Mask + PCKRDY1 = 0x1 << 9 # Programmable Clock Ready 1 Interrupt Mask + PCKRDY2 = 0x1 << 10 # Programmable Clock Ready 2 Interrupt Mask + MOSCSELS = 0x1 << 16 # Main Oscillator Selection Status Interrupt Mask + MOSCRCS = 0x1 << 17 # Main On-Chip RC Status Interrupt Mask + CFDEV = 0x1 << 18 # Clock Failure Detector Event Interrupt Mask + +class FSMR(IntEnum): + FSTT0 = 0x1 << 0 # Fast Startup Input Enable 0 + FSTT1 = 0x1 << 1 # Fast Startup Input Enable 1 + FSTT2 = 0x1 << 2 # Fast Startup Input Enable 2 + FSTT3 = 0x1 << 3 # Fast Startup Input Enable 3 + FSTT4 = 0x1 << 4 # Fast Startup Input Enable 4 + FSTT5 = 0x1 << 5 # Fast Startup Input Enable 5 + FSTT6 = 0x1 << 6 # Fast Startup Input Enable 6 + FSTT7 = 0x1 << 7 # Fast Startup Input Enable 7 + FSTT8 = 0x1 << 8 # Fast Startup Input Enable 8 + FSTT9 = 0x1 << 9 # Fast Startup Input Enable 9 + FSTT10 = 0x1 << 10 # Fast Startup Input Enable 10 + FSTT11 = 0x1 << 11 # Fast Startup Input Enable 11 + FSTT12 = 0x1 << 12 # Fast Startup Input Enable 12 + FSTT13 = 0x1 << 13 # Fast Startup Input Enable 13 + FSTT14 = 0x1 << 14 # Fast Startup Input Enable 14 + FSTT15 = 0x1 << 15 # Fast Startup Input Enable 15 + RTTAL = 0x1 << 16 # RTT Alarm Enable + RTCAL = 0x1 << 17 # RTC Alarm Enable + USBAL = 0x1 << 18 # USB Alarm Enable + LPM = 0x1 << 20 # Low Power Mode + +class FSPR(IntEnum): + FSTP0 = 0x1 << 0 # Fast Startup Input Polarityx + FSTP1 = 0x1 << 1 # Fast Startup Input Polarityx + FSTP2 = 0x1 << 2 # Fast Startup Input Polarityx + FSTP3 = 0x1 << 3 # Fast Startup Input Polarityx + FSTP4 = 0x1 << 4 # Fast Startup Input Polarityx + FSTP5 = 0x1 << 5 # Fast Startup Input Polarityx + FSTP6 = 0x1 << 6 # Fast Startup Input Polarityx + FSTP7 = 0x1 << 7 # Fast Startup Input Polarityx + FSTP8 = 0x1 << 8 # Fast Startup Input Polarityx + FSTP9 = 0x1 << 9 # Fast Startup Input Polarityx + FSTP10 = 0x1 << 10 # Fast Startup Input Polarityx + FSTP11 = 0x1 << 11 # Fast Startup Input Polarityx + FSTP12 = 0x1 << 12 # Fast Startup Input Polarityx + FSTP13 = 0x1 << 13 # Fast Startup Input Polarityx + FSTP14 = 0x1 << 14 # Fast Startup Input Polarityx + FSTP15 = 0x1 << 15 # Fast Startup Input Polarityx + +class FOCR(IntEnum): + FOCLR = 0x1 << 0 # Fault Output Clear + +class WPMR(IntEnum): + WPEN = 0x1 << 0 # Write Protect Enable + WPKEY = 0xffffff << 8 # Write Protect KEY + +class WPSR(IntEnum): + WPVS = 0x1 << 0 # Write Protect Violation Status + WPVSRC = 0xffff << 8 # Write Protect Violation Source + +class PCER1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Enable + PID33 = 0x1 << 1 # Peripheral Clock 33 Enable + PID34 = 0x1 << 2 # Peripheral Clock 34 Enable + PID35 = 0x1 << 3 # Peripheral Clock 35 Enable + PID36 = 0x1 << 4 # Peripheral Clock 36 Enable + PID37 = 0x1 << 5 # Peripheral Clock 37 Enable + PID38 = 0x1 << 6 # Peripheral Clock 38 Enable + PID39 = 0x1 << 7 # Peripheral Clock 39 Enable + PID40 = 0x1 << 8 # Peripheral Clock 40 Enable + PID41 = 0x1 << 9 # Peripheral Clock 41 Enable + PID42 = 0x1 << 10 # Peripheral Clock 42 Enable + PID43 = 0x1 << 11 # Peripheral Clock 43 Enable + PID44 = 0x1 << 12 # Peripheral Clock 44 Enable + +class PCDR1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Disable + PID33 = 0x1 << 1 # Peripheral Clock 33 Disable + PID34 = 0x1 << 2 # Peripheral Clock 34 Disable + PID35 = 0x1 << 3 # Peripheral Clock 35 Disable + PID36 = 0x1 << 4 # Peripheral Clock 36 Disable + PID37 = 0x1 << 5 # Peripheral Clock 37 Disable + PID38 = 0x1 << 6 # Peripheral Clock 38 Disable + PID39 = 0x1 << 7 # Peripheral Clock 39 Disable + PID40 = 0x1 << 8 # Peripheral Clock 40 Disable + PID41 = 0x1 << 9 # Peripheral Clock 41 Disable + PID42 = 0x1 << 10 # Peripheral Clock 42 Disable + PID43 = 0x1 << 11 # Peripheral Clock 43 Disable + PID44 = 0x1 << 12 # Peripheral Clock 44 Disable + +class PCSR1(IntEnum): + PID32 = 0x1 << 0 # Peripheral Clock 32 Status + PID33 = 0x1 << 1 # Peripheral Clock 33 Status + PID34 = 0x1 << 2 # Peripheral Clock 34 Status + PID35 = 0x1 << 3 # Peripheral Clock 35 Status + PID36 = 0x1 << 4 # Peripheral Clock 36 Status + PID37 = 0x1 << 5 # Peripheral Clock 37 Status + PID38 = 0x1 << 6 # Peripheral Clock 38 Status + PID39 = 0x1 << 7 # Peripheral Clock 39 Status + PID40 = 0x1 << 8 # Peripheral Clock 40 Status + PID41 = 0x1 << 9 # Peripheral Clock 41 Status + PID42 = 0x1 << 10 # Peripheral Clock 42 Status + PID43 = 0x1 << 11 # Peripheral Clock 43 Status + PID44 = 0x1 << 12 # Peripheral Clock 44 Status + +class PCR(IntEnum): + PID = 0x3f << 0 # Peripheral ID + CMD = 0x1 << 12 # Command + DIV = 0x3 << 16 # Divisor Value + EN = 0x1 << 28 # Enable + diff --git a/qiling/hw/const/sam3xa_uart.py b/qiling/hw/const/sam3xa_uart.py new file mode 100644 index 00000000..5358e92e --- /dev/null +++ b/qiling/hw/const/sam3xa_uart.py @@ -0,0 +1,78 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class CR(IntEnum): + RSTRX = 0x1 << 2 # Reset Receiver + RSTTX = 0x1 << 3 # Reset Transmitter + RXEN = 0x1 << 4 # Receiver Enable + RXDIS = 0x1 << 5 # Receiver Disable + TXEN = 0x1 << 6 # Transmitter Enable + TXDIS = 0x1 << 7 # Transmitter Disable + RSTSTA = 0x1 << 8 # Reset Status Bits + +class MR(IntEnum): + PAR = 0x7 << 9 # Parity Type + CHMODE = 0x3 << 14 # Channel Mode + +class IER(IntEnum): + RXRDY = 0x1 << 0 # Enable RXRDY Interrupt + TXRDY = 0x1 << 1 # Enable TXRDY Interrupt + ENDRX = 0x1 << 3 # Enable End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Enable End of Transmit Interrupt + OVRE = 0x1 << 5 # Enable Overrun Error Interrupt + FRAME = 0x1 << 6 # Enable Framing Error Interrupt + PARE = 0x1 << 7 # Enable Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Enable TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Enable Buffer Empty Interrupt + RXBUFF = 0x1 << 12 # Enable Buffer Full Interrupt + +class IDR(IntEnum): + RXRDY = 0x1 << 0 # Disable RXRDY Interrupt + TXRDY = 0x1 << 1 # Disable TXRDY Interrupt + ENDRX = 0x1 << 3 # Disable End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Disable End of Transmit Interrupt + OVRE = 0x1 << 5 # Disable Overrun Error Interrupt + FRAME = 0x1 << 6 # Disable Framing Error Interrupt + PARE = 0x1 << 7 # Disable Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Disable TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Disable Buffer Empty Interrupt + RXBUFF = 0x1 << 12 # Disable Buffer Full Interrupt + +class IMR(IntEnum): + RXRDY = 0x1 << 0 # Mask RXRDY Interrupt + TXRDY = 0x1 << 1 # Disable TXRDY Interrupt + ENDRX = 0x1 << 3 # Mask End of Receive Transfer Interrupt + ENDTX = 0x1 << 4 # Mask End of Transmit Interrupt + OVRE = 0x1 << 5 # Mask Overrun Error Interrupt + FRAME = 0x1 << 6 # Mask Framing Error Interrupt + PARE = 0x1 << 7 # Mask Parity Error Interrupt + TXEMPTY = 0x1 << 9 # Mask TXEMPTY Interrupt + TXBUFE = 0x1 << 11 # Mask TXBUFE Interrupt + RXBUFF = 0x1 << 12 # Mask RXBUFF Interrupt + +class SR(IntEnum): + RXRDY = 0x1 << 0 # Receiver Ready + TXRDY = 0x1 << 1 # Transmitter Ready + ENDRX = 0x1 << 3 # End of Receiver Transfer + ENDTX = 0x1 << 4 # End of Transmitter Transfer + OVRE = 0x1 << 5 # Overrun Error + FRAME = 0x1 << 6 # Framing Error + PARE = 0x1 << 7 # Parity Error + TXEMPTY = 0x1 << 9 # Transmitter Empty + TXBUFE = 0x1 << 11 # Transmission Buffer Empty + RXBUFF = 0x1 << 12 # Receive Buffer Full + +class PTCR(IntEnum): + RXTEN = 0x1 << 0 # Receiver Transfer Enable + RXTDIS = 0x1 << 1 # Receiver Transfer Disable + TXTEN = 0x1 << 8 # Transmitter Transfer Enable + TXTDIS = 0x1 << 9 # Transmitter Transfer Disable + +class PTSR(IntEnum): + RXTEN = 0x1 << 0 # Receiver Transfer Enable + TXTEN = 0x1 << 8 # Transmitter Transfer Enable diff --git a/qiling/hw/const/sam3xa_uotghs.py b/qiling/hw/const/sam3xa_uotghs.py new file mode 100644 index 00000000..416e23b6 --- /dev/null +++ b/qiling/hw/const/sam3xa_uotghs.py @@ -0,0 +1,997 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class DEVCTRL(IntEnum): + UADD = 0x7f << 0 # USB Address + ADDEN = 0x1 << 7 # Address Enable + DETACH = 0x1 << 8 # Detach + RMWKUP = 0x1 << 9 # Remote Wake-Up + SPDCONF = 0x3 << 10 # Mode Configuration + LS = 0x1 << 12 # Low-Speed Mode Force + TSTJ = 0x1 << 13 # Test mode J + TSTK = 0x1 << 14 # Test mode K + TSTPCKT = 0x1 << 15 # Test packet mode + OPMODE2 = 0x1 << 16 # Specific Operational mode + +class DEVISR(IntEnum): + SUSP = 0x1 << 0 # Suspend Interrupt + MSOF = 0x1 << 1 # Micro Start of Frame Interrupt + SOF = 0x1 << 2 # Start of Frame Interrupt + EORST = 0x1 << 3 # End of Reset Interrupt + WAKEUP = 0x1 << 4 # Wake-Up Interrupt + EORSM = 0x1 << 5 # End of Resume Interrupt + UPRSM = 0x1 << 6 # Upstream Resume Interrupt + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt + +class DEVICR(IntEnum): + SUSPC = 0x1 << 0 # Suspend Interrupt Clear + MSOFC = 0x1 << 1 # Micro Start of Frame Interrupt Clear + SOFC = 0x1 << 2 # Start of Frame Interrupt Clear + EORSTC = 0x1 << 3 # End of Reset Interrupt Clear + WAKEUPC = 0x1 << 4 # Wake-Up Interrupt Clear + EORSMC = 0x1 << 5 # End of Resume Interrupt Clear + UPRSMC = 0x1 << 6 # Upstream Resume Interrupt Clear + +class DEVIFR(IntEnum): + SUSPS = 0x1 << 0 # Suspend Interrupt Set + MSOFS = 0x1 << 1 # Micro Start of Frame Interrupt Set + SOFS = 0x1 << 2 # Start of Frame Interrupt Set + EORSTS = 0x1 << 3 # End of Reset Interrupt Set + WAKEUPS = 0x1 << 4 # Wake-Up Interrupt Set + EORSMS = 0x1 << 5 # End of Resume Interrupt Set + UPRSMS = 0x1 << 6 # Upstream Resume Interrupt Set + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Set + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Set + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Set + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Set + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Set + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Set + +class DEVIMR(IntEnum): + SUSPE = 0x1 << 0 # Suspend Interrupt Mask + MSOFE = 0x1 << 1 # Micro Start of Frame Interrupt Mask + SOFE = 0x1 << 2 # Start of Frame Interrupt Mask + EORSTE = 0x1 << 3 # End of Reset Interrupt Mask + WAKEUPE = 0x1 << 4 # Wake-Up Interrupt Mask + EORSME = 0x1 << 5 # End of Resume Interrupt Mask + UPRSME = 0x1 << 6 # Upstream Resume Interrupt Mask + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Mask + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Mask + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Mask + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Mask + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Mask + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Mask + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Mask + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Mask + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Mask + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Mask + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Mask + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Mask + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Mask + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Mask + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Mask + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Mask + +class DEVIDR(IntEnum): + SUSPEC = 0x1 << 0 # Suspend Interrupt Disable + MSOFEC = 0x1 << 1 # Micro Start of Frame Interrupt Disable + SOFEC = 0x1 << 2 # Start of Frame Interrupt Disable + EORSTEC = 0x1 << 3 # End of Reset Interrupt Disable + WAKEUPEC = 0x1 << 4 # Wake-Up Interrupt Disable + EORSMEC = 0x1 << 5 # End of Resume Interrupt Disable + UPRSMEC = 0x1 << 6 # Upstream Resume Interrupt Disable + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Disable + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Disable + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Disable + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Disable + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Disable + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Disable + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Disable + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Disable + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Disable + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Disable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Disable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Disable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Disable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Disable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Disable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Disable + +class DEVIER(IntEnum): + SUSPES = 0x1 << 0 # Suspend Interrupt Enable + MSOFES = 0x1 << 1 # Micro Start of Frame Interrupt Enable + SOFES = 0x1 << 2 # Start of Frame Interrupt Enable + EORSTES = 0x1 << 3 # End of Reset Interrupt Enable + WAKEUPES = 0x1 << 4 # Wake-Up Interrupt Enable + EORSMES = 0x1 << 5 # End of Resume Interrupt Enable + UPRSMES = 0x1 << 6 # Upstream Resume Interrupt Enable + PEP_0 = 0x1 << 12 # Endpoint 0 Interrupt Enable + PEP_1 = 0x1 << 13 # Endpoint 1 Interrupt Enable + PEP_2 = 0x1 << 14 # Endpoint 2 Interrupt Enable + PEP_3 = 0x1 << 15 # Endpoint 3 Interrupt Enable + PEP_4 = 0x1 << 16 # Endpoint 4 Interrupt Enable + PEP_5 = 0x1 << 17 # Endpoint 5 Interrupt Enable + PEP_6 = 0x1 << 18 # Endpoint 6 Interrupt Enable + PEP_7 = 0x1 << 19 # Endpoint 7 Interrupt Enable + PEP_8 = 0x1 << 20 # Endpoint 8 Interrupt Enable + PEP_9 = 0x1 << 21 # Endpoint 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class DEVEPT(IntEnum): + EPEN0 = 0x1 << 0 # Endpoint 0 Enable + EPEN1 = 0x1 << 1 # Endpoint 1 Enable + EPEN2 = 0x1 << 2 # Endpoint 2 Enable + EPEN3 = 0x1 << 3 # Endpoint 3 Enable + EPEN4 = 0x1 << 4 # Endpoint 4 Enable + EPEN5 = 0x1 << 5 # Endpoint 5 Enable + EPEN6 = 0x1 << 6 # Endpoint 6 Enable + EPEN7 = 0x1 << 7 # Endpoint 7 Enable + EPEN8 = 0x1 << 8 # Endpoint 8 Enable + EPRST0 = 0x1 << 16 # Endpoint 0 Reset + EPRST1 = 0x1 << 17 # Endpoint 1 Reset + EPRST2 = 0x1 << 18 # Endpoint 2 Reset + EPRST3 = 0x1 << 19 # Endpoint 3 Reset + EPRST4 = 0x1 << 20 # Endpoint 4 Reset + EPRST5 = 0x1 << 21 # Endpoint 5 Reset + EPRST6 = 0x1 << 22 # Endpoint 6 Reset + EPRST7 = 0x1 << 23 # Endpoint 7 Reset + EPRST8 = 0x1 << 24 # Endpoint 8 Reset + +class DEVFNUM(IntEnum): + MFNUM = 0x7 << 0 # Micro Frame Number + FNUM = 0x7ff << 3 # Frame Number + FNCERR = 0x1 << 15 # Frame Number CRC Error + +class DEVEPTCFG(IntEnum): + ALLOC = 0x1 << 1 # Endpoint Memory Allocate + EPBK = 0x3 << 2 # Endpoint Banks + EPSIZE = 0x7 << 4 # Endpoint Size + EPDIR = 0x1 << 8 # Endpoint Direction + AUTOSW = 0x1 << 9 # Automatic Switch + EPTYPE = 0x3 << 11 # Endpoint Type + NBTRANS = 0x3 << 13 # Number of transaction per microframe for isochronous endpoint + +class DEVEPTISR(IntEnum): + TXINI = 0x1 << 0 # Transmitted IN Data Interrupt + RXOUTI = 0x1 << 1 # Received OUT Data Interrupt + RXSTPI = 0x1 << 2 # Received SETUP Interrupt + UNDERFI = 0x1 << 2 # Underflow Interrupt + NAKOUTI = 0x1 << 3 # NAKed OUT Interrupt + HBISOINERRI = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt + NAKINI = 0x1 << 4 # NAKed IN Interrupt + HBISOFLUSHI = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt + OVERFI = 0x1 << 5 # Overflow Interrupt + STALLEDI = 0x1 << 6 # STALLed Interrupt + CRCERRI = 0x1 << 6 # CRC Error Interrupt + SHORTPACKET = 0x1 << 7 # Short Packet Interrupt + DTSEQ = 0x3 << 8 # Data Toggle Sequence + ERRORTRANS = 0x1 << 10 # High-bandwidth isochronous OUT endpoint transaction error Interrupt + NBUSYBK = 0x3 << 12 # Number of Busy Banks + CURRBK = 0x3 << 14 # Current Bank + RWALL = 0x1 << 16 # Read-write Allowed + CTRLDIR = 0x1 << 17 # Control Direction + CFGOK = 0x1 << 18 # Configuration OK Status + BYCT = 0x7ff << 20 # Byte Count + +class DEVEPTICR(IntEnum): + TXINIC = 0x1 << 0 # Transmitted IN Data Interrupt Clear + RXOUTIC = 0x1 << 1 # Received OUT Data Interrupt Clear + RXSTPIC = 0x1 << 2 # Received SETUP Interrupt Clear + UNDERFIC = 0x1 << 2 # Underflow Interrupt Clear + NAKOUTIC = 0x1 << 3 # NAKed OUT Interrupt Clear + HBISOINERRIC = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt Clear + NAKINIC = 0x1 << 4 # NAKed IN Interrupt Clear + HBISOFLUSHIC = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Clear + OVERFIC = 0x1 << 5 # Overflow Interrupt Clear + STALLEDIC = 0x1 << 6 # STALLed Interrupt Clear + CRCERRIC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETC = 0x1 << 7 # Short Packet Interrupt Clear + +class DEVEPTIFR(IntEnum): + TXINIS = 0x1 << 0 # Transmitted IN Data Interrupt Set + RXOUTIS = 0x1 << 1 # Received OUT Data Interrupt Set + RXSTPIS = 0x1 << 2 # Received SETUP Interrupt Set + UNDERFIS = 0x1 << 2 # Underflow Interrupt Set + NAKOUTIS = 0x1 << 3 # NAKed OUT Interrupt Set + HBISOINERRIS = 0x1 << 3 # High bandwidth isochronous IN Underflow Error Interrupt Set + NAKINIS = 0x1 << 4 # NAKed IN Interrupt Set + HBISOFLUSHIS = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Set + OVERFIS = 0x1 << 5 # Overflow Interrupt Set + STALLEDIS = 0x1 << 6 # STALLed Interrupt Set + CRCERRIS = 0x1 << 6 # CRC Error Interrupt Set + SHORTPACKETS = 0x1 << 7 # Short Packet Interrupt Set + NBUSYBKS = 0x1 << 12 # Number of Busy Banks Interrupt Set + +class DEVEPTIMR(IntEnum): + TXINE = 0x1 << 0 # Transmitted IN Data Interrupt + RXOUTE = 0x1 << 1 # Received OUT Data Interrupt + RXSTPE = 0x1 << 2 # Received SETUP Interrupt + UNDERFE = 0x1 << 2 # Underflow Interrupt + NAKOUTE = 0x1 << 3 # NAKed OUT Interrupt + HBISOINERRE = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt + NAKINE = 0x1 << 4 # NAKed IN Interrupt + HBISOFLUSHE = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt + OVERFE = 0x1 << 5 # Overflow Interrupt + STALLEDE = 0x1 << 6 # STALLed Interrupt + CRCERRE = 0x1 << 6 # CRC Error Interrupt + SHORTPACKETE = 0x1 << 7 # Short Packet Interrupt + MDATAE = 0x1 << 8 # MData Interrupt + DATAXE = 0x1 << 9 # DataX Interrupt + ERRORTRANSE = 0x1 << 10 # Transaction Error Interrupt + NBUSYBKE = 0x1 << 12 # Number of Busy Banks Interrupt + KILLBK = 0x1 << 13 # Kill IN Bank + FIFOCON = 0x1 << 14 # FIFO Control + EPDISHDMA = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request + NYETDIS = 0x1 << 17 # NYET Token Disable + RSTDT = 0x1 << 18 # Reset Data Toggle + STALLRQ = 0x1 << 19 # STALL Request + +class DEVEPTIER(IntEnum): + TXINES = 0x1 << 0 # Transmitted IN Data Interrupt Enable + RXOUTES = 0x1 << 1 # Received OUT Data Interrupt Enable + RXSTPES = 0x1 << 2 # Received SETUP Interrupt Enable + UNDERFES = 0x1 << 2 # Underflow Interrupt Enable + NAKOUTES = 0x1 << 3 # NAKed OUT Interrupt Enable + HBISOINERRES = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt Enable + NAKINES = 0x1 << 4 # NAKed IN Interrupt Enable + HBISOFLUSHES = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Enable + OVERFES = 0x1 << 5 # Overflow Interrupt Enable + STALLEDES = 0x1 << 6 # STALLed Interrupt Enable + CRCERRES = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETES = 0x1 << 7 # Short Packet Interrupt Enable + MDATAES = 0x1 << 8 # MData Interrupt Enable + DATAXES = 0x1 << 9 # DataX Interrupt Enable + ERRORTRANSES = 0x1 << 10 # Transaction Error Interrupt Enable + NBUSYBKES = 0x1 << 12 # Number of Busy Banks Interrupt Enable + KILLBKS = 0x1 << 13 # Kill IN Bank + EPDISHDMAS = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request Enable + NYETDISS = 0x1 << 17 # NYET Token Disable Enable + RSTDTS = 0x1 << 18 # Reset Data Toggle Enable + STALLRQS = 0x1 << 19 # STALL Request Enable + +class DEVEPTIDR(IntEnum): + TXINEC = 0x1 << 0 # Transmitted IN Interrupt Clear + RXOUTEC = 0x1 << 1 # Received OUT Data Interrupt Clear + RXSTPEC = 0x1 << 2 # Received SETUP Interrupt Clear + UNDERFEC = 0x1 << 2 # Underflow Interrupt Clear + NAKOUTEC = 0x1 << 3 # NAKed OUT Interrupt Clear + HBISOINERREC = 0x1 << 3 # High Bandwidth Isochronous IN Error Interrupt Clear + NAKINEC = 0x1 << 4 # NAKed IN Interrupt Clear + HBISOFLUSHEC = 0x1 << 4 # High Bandwidth Isochronous IN Flush Interrupt Clear + OVERFEC = 0x1 << 5 # Overflow Interrupt Clear + STALLEDEC = 0x1 << 6 # STALLed Interrupt Clear + CRCERREC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETEC = 0x1 << 7 # Shortpacket Interrupt Clear + MDATEC = 0x1 << 8 # MData Interrupt Clear + DATAXEC = 0x1 << 9 # DataX Interrupt Clear + ERRORTRANSEC = 0x1 << 10 # Transaction Error Interrupt Clear + NBUSYBKEC = 0x1 << 12 # Number of Busy Banks Interrupt Clear + FIFOCONC = 0x1 << 14 # FIFO Control Clear + EPDISHDMAC = 0x1 << 16 # Endpoint Interrupts Disable HDMA Request Clear + NYETDISC = 0x1 << 17 # NYET Token Disable Clear + STALLRQC = 0x1 << 19 # STALL Request Clear + +class DEVDMANXTDSC1(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS1(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC2(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS2(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC3(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS3(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC4(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS4(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC5(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS5(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC6(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS6(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class DEVDMANXTDSC7(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class DEVDMAADDRESS7(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class DEVDMACONTROL7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable Control + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class DEVDMASTATUS7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTCTRL(IntEnum): + SOFE = 0x1 << 8 # Start of Frame Generation Enable + RESET = 0x1 << 9 # Send USB Reset + RESUME = 0x1 << 10 # Send USB Resume + SPDCONF = 0x3 << 12 # Mode Configuration + +class HSTISR(IntEnum): + DCONNI = 0x1 << 0 # Device Connection Interrupt + DDISCI = 0x1 << 1 # Device Disconnection Interrupt + RSTI = 0x1 << 2 # USB Reset Sent Interrupt + RSMEDI = 0x1 << 3 # Downstream Resume Sent Interrupt + RXRSMI = 0x1 << 4 # Upstream Resume Received Interrupt + HSOFI = 0x1 << 5 # Host Start of Frame Interrupt + HWUPI = 0x1 << 6 # Host Wake-Up Interrupt + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt + +class HSTICR(IntEnum): + DCONNIC = 0x1 << 0 # Device Connection Interrupt Clear + DDISCIC = 0x1 << 1 # Device Disconnection Interrupt Clear + RSTIC = 0x1 << 2 # USB Reset Sent Interrupt Clear + RSMEDIC = 0x1 << 3 # Downstream Resume Sent Interrupt Clear + RXRSMIC = 0x1 << 4 # Upstream Resume Received Interrupt Clear + HSOFIC = 0x1 << 5 # Host Start of Frame Interrupt Clear + HWUPIC = 0x1 << 6 # Host Wake-Up Interrupt Clear + +class HSTIFR(IntEnum): + DCONNIS = 0x1 << 0 # Device Connection Interrupt Set + DDISCIS = 0x1 << 1 # Device Disconnection Interrupt Set + RSTIS = 0x1 << 2 # USB Reset Sent Interrupt Set + RSMEDIS = 0x1 << 3 # Downstream Resume Sent Interrupt Set + RXRSMIS = 0x1 << 4 # Upstream Resume Received Interrupt Set + HSOFIS = 0x1 << 5 # Host Start of Frame Interrupt Set + HWUPIS = 0x1 << 6 # Host Wake-Up Interrupt Set + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Set + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Set + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Set + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Set + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Set + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Set + +class HSTIMR(IntEnum): + DCONNIE = 0x1 << 0 # Device Connection Interrupt Enable + DDISCIE = 0x1 << 1 # Device Disconnection Interrupt Enable + RSTIE = 0x1 << 2 # USB Reset Sent Interrupt Enable + RSMEDIE = 0x1 << 3 # Downstream Resume Sent Interrupt Enable + RXRSMIE = 0x1 << 4 # Upstream Resume Received Interrupt Enable + HSOFIE = 0x1 << 5 # Host Start of Frame Interrupt Enable + HWUPIE = 0x1 << 6 # Host Wake-Up Interrupt Enable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Enable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Enable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Enable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Enable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Enable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Enable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Enable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Enable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Enable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class HSTIDR(IntEnum): + DCONNIEC = 0x1 << 0 # Device Connection Interrupt Disable + DDISCIEC = 0x1 << 1 # Device Disconnection Interrupt Disable + RSTIEC = 0x1 << 2 # USB Reset Sent Interrupt Disable + RSMEDIEC = 0x1 << 3 # Downstream Resume Sent Interrupt Disable + RXRSMIEC = 0x1 << 4 # Upstream Resume Received Interrupt Disable + HSOFIEC = 0x1 << 5 # Host Start of Frame Interrupt Disable + HWUPIEC = 0x1 << 6 # Host Wake-Up Interrupt Disable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Disable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Disable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Disable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Disable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Disable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Disable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Disable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Disable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Disable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Disable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Disable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Disable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Disable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Disable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Disable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Disable + +class HSTIER(IntEnum): + DCONNIES = 0x1 << 0 # Device Connection Interrupt Enable + DDISCIES = 0x1 << 1 # Device Disconnection Interrupt Enable + RSTIES = 0x1 << 2 # USB Reset Sent Interrupt Enable + RSMEDIES = 0x1 << 3 # Downstream Resume Sent Interrupt Enable + RXRSMIES = 0x1 << 4 # Upstream Resume Received Interrupt Enable + HSOFIES = 0x1 << 5 # Host Start of Frame Interrupt Enable + HWUPIES = 0x1 << 6 # Host Wake-Up Interrupt Enable + PEP_0 = 0x1 << 8 # Pipe 0 Interrupt Enable + PEP_1 = 0x1 << 9 # Pipe 1 Interrupt Enable + PEP_2 = 0x1 << 10 # Pipe 2 Interrupt Enable + PEP_3 = 0x1 << 11 # Pipe 3 Interrupt Enable + PEP_4 = 0x1 << 12 # Pipe 4 Interrupt Enable + PEP_5 = 0x1 << 13 # Pipe 5 Interrupt Enable + PEP_6 = 0x1 << 14 # Pipe 6 Interrupt Enable + PEP_7 = 0x1 << 15 # Pipe 7 Interrupt Enable + PEP_8 = 0x1 << 16 # Pipe 8 Interrupt Enable + PEP_9 = 0x1 << 17 # Pipe 9 Interrupt Enable + DMA_1 = 0x1 << 25 # DMA Channel 1 Interrupt Enable + DMA_2 = 0x1 << 26 # DMA Channel 2 Interrupt Enable + DMA_3 = 0x1 << 27 # DMA Channel 3 Interrupt Enable + DMA_4 = 0x1 << 28 # DMA Channel 4 Interrupt Enable + DMA_5 = 0x1 << 29 # DMA Channel 5 Interrupt Enable + DMA_6 = 0x1 << 30 # DMA Channel 6 Interrupt Enable + +class HSTPIP(IntEnum): + PEN0 = 0x1 << 0 # Pipe 0 Enable + PEN1 = 0x1 << 1 # Pipe 1 Enable + PEN2 = 0x1 << 2 # Pipe 2 Enable + PEN3 = 0x1 << 3 # Pipe 3 Enable + PEN4 = 0x1 << 4 # Pipe 4 Enable + PEN5 = 0x1 << 5 # Pipe 5 Enable + PEN6 = 0x1 << 6 # Pipe 6 Enable + PEN7 = 0x1 << 7 # Pipe 7 Enable + PEN8 = 0x1 << 8 # Pipe 8 Enable + PRST0 = 0x1 << 16 # Pipe 0 Reset + PRST1 = 0x1 << 17 # Pipe 1 Reset + PRST2 = 0x1 << 18 # Pipe 2 Reset + PRST3 = 0x1 << 19 # Pipe 3 Reset + PRST4 = 0x1 << 20 # Pipe 4 Reset + PRST5 = 0x1 << 21 # Pipe 5 Reset + PRST6 = 0x1 << 22 # Pipe 6 Reset + PRST7 = 0x1 << 23 # Pipe 7 Reset + PRST8 = 0x1 << 24 # Pipe 8 Reset + +class HSTFNUM(IntEnum): + MFNUM = 0x7 << 0 # Micro Frame Number + FNUM = 0x7ff << 3 # Frame Number + FLENHIGH = 0xff << 16 # Frame Length + +class HSTADDR1(IntEnum): + HSTADDRP0 = 0x7f << 0 # USB Host Address + HSTADDRP1 = 0x7f << 8 # USB Host Address + HSTADDRP2 = 0x7f << 16 # USB Host Address + HSTADDRP3 = 0x7f << 24 # USB Host Address + +class HSTADDR2(IntEnum): + HSTADDRP4 = 0x7f << 0 # USB Host Address + HSTADDRP5 = 0x7f << 8 # USB Host Address + HSTADDRP6 = 0x7f << 16 # USB Host Address + HSTADDRP7 = 0x7f << 24 # USB Host Address + +class HSTADDR3(IntEnum): + HSTADDRP8 = 0x7f << 0 # USB Host Address + HSTADDRP9 = 0x7f << 8 # USB Host Address + +class HSTPIPCFG(IntEnum): + ALLOC = 0x1 << 1 # Pipe Memory Allocate + PBK = 0x3 << 2 # Pipe Banks + PSIZE = 0x7 << 4 # Pipe Size + PTOKEN = 0x3 << 8 # Pipe Token + AUTOSW = 0x1 << 10 # Automatic Switch + PTYPE = 0x3 << 12 # Pipe Type + PEPNUM = 0xf << 16 # Pipe Endpoint Number + PINGEN = 0x1 << 20 # Ping Enable + INTFRQ = 0xff << 24 # Pipe Interrupt Request Frequency + BINTERVAL = 0xff << 24 # bInterval parameter for the Bulk-Out/Ping transaction + +class HSTPIPISR(IntEnum): + RXINI = 0x1 << 0 # Received IN Data Interrupt + TXOUTI = 0x1 << 1 # Transmitted OUT Data Interrupt + TXSTPI = 0x1 << 2 # Transmitted SETUP Interrupt + UNDERFI = 0x1 << 2 # Underflow Interrupt + PERRI = 0x1 << 3 # Pipe Error Interrupt + NAKEDI = 0x1 << 4 # NAKed Interrupt + OVERFI = 0x1 << 5 # Overflow Interrupt + RXSTALLDI = 0x1 << 6 # Received STALLed Interrupt + CRCERRI = 0x1 << 6 # CRC Error Interrupt + SHORTPACKETI = 0x1 << 7 # Short Packet Interrupt + DTSEQ = 0x3 << 8 # Data Toggle Sequence + NBUSYBK = 0x3 << 12 # Number of Busy Banks + CURRBK = 0x3 << 14 # Current Bank + RWALL = 0x1 << 16 # Read-write Allowed + CFGOK = 0x1 << 18 # Configuration OK Status + PBYCT = 0x7ff << 20 # Pipe Byte Count + +class HSTPIPICR(IntEnum): + RXINIC = 0x1 << 0 # Received IN Data Interrupt Clear + TXOUTIC = 0x1 << 1 # Transmitted OUT Data Interrupt Clear + TXSTPIC = 0x1 << 2 # Transmitted SETUP Interrupt Clear + UNDERFIC = 0x1 << 2 # Underflow Interrupt Clear + NAKEDIC = 0x1 << 4 # NAKed Interrupt Clear + OVERFIC = 0x1 << 5 # Overflow Interrupt Clear + RXSTALLDIC = 0x1 << 6 # Received STALLed Interrupt Clear + CRCERRIC = 0x1 << 6 # CRC Error Interrupt Clear + SHORTPACKETIC = 0x1 << 7 # Short Packet Interrupt Clear + +class HSTPIPIFR(IntEnum): + RXINIS = 0x1 << 0 # Received IN Data Interrupt Set + TXOUTIS = 0x1 << 1 # Transmitted OUT Data Interrupt Set + TXSTPIS = 0x1 << 2 # Transmitted SETUP Interrupt Set + UNDERFIS = 0x1 << 2 # Underflow Interrupt Set + PERRIS = 0x1 << 3 # Pipe Error Interrupt Set + NAKEDIS = 0x1 << 4 # NAKed Interrupt Set + OVERFIS = 0x1 << 5 # Overflow Interrupt Set + RXSTALLDIS = 0x1 << 6 # Received STALLed Interrupt Set + CRCERRIS = 0x1 << 6 # CRC Error Interrupt Set + SHORTPACKETIS = 0x1 << 7 # Short Packet Interrupt Set + NBUSYBKS = 0x1 << 12 # Number of Busy Banks Set + +class HSTPIPIMR(IntEnum): + RXINE = 0x1 << 0 # Received IN Data Interrupt Enable + TXOUTE = 0x1 << 1 # Transmitted OUT Data Interrupt Enable + TXSTPE = 0x1 << 2 # Transmitted SETUP Interrupt Enable + UNDERFIE = 0x1 << 2 # Underflow Interrupt Enable + PERRE = 0x1 << 3 # Pipe Error Interrupt Enable + NAKEDE = 0x1 << 4 # NAKed Interrupt Enable + OVERFIE = 0x1 << 5 # Overflow Interrupt Enable + RXSTALLDE = 0x1 << 6 # Received STALLed Interrupt Enable + CRCERRE = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETIE = 0x1 << 7 # Short Packet Interrupt Enable + NBUSYBKE = 0x1 << 12 # Number of Busy Banks Interrupt Enable + FIFOCON = 0x1 << 14 # FIFO Control + PDISHDMA = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Enable + PFREEZE = 0x1 << 17 # Pipe Freeze + RSTDT = 0x1 << 18 # Reset Data Toggle + +class HSTPIPIER(IntEnum): + RXINES = 0x1 << 0 # Received IN Data Interrupt Enable + TXOUTES = 0x1 << 1 # Transmitted OUT Data Interrupt Enable + TXSTPES = 0x1 << 2 # Transmitted SETUP Interrupt Enable + UNDERFIES = 0x1 << 2 # Underflow Interrupt Enable + PERRES = 0x1 << 3 # Pipe Error Interrupt Enable + NAKEDES = 0x1 << 4 # NAKed Interrupt Enable + OVERFIES = 0x1 << 5 # Overflow Interrupt Enable + RXSTALLDES = 0x1 << 6 # Received STALLed Interrupt Enable + CRCERRES = 0x1 << 6 # CRC Error Interrupt Enable + SHORTPACKETIES = 0x1 << 7 # Short Packet Interrupt Enable + NBUSYBKES = 0x1 << 12 # Number of Busy Banks Enable + PDISHDMAS = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Enable + PFREEZES = 0x1 << 17 # Pipe Freeze Enable + RSTDTS = 0x1 << 18 # Reset Data Toggle Enable + +class HSTPIPIDR(IntEnum): + RXINEC = 0x1 << 0 # Received IN Data Interrupt Disable + TXOUTEC = 0x1 << 1 # Transmitted OUT Data Interrupt Disable + TXSTPEC = 0x1 << 2 # Transmitted SETUP Interrupt Disable + UNDERFIEC = 0x1 << 2 # Underflow Interrupt Disable + PERREC = 0x1 << 3 # Pipe Error Interrupt Disable + NAKEDEC = 0x1 << 4 # NAKed Interrupt Disable + OVERFIEC = 0x1 << 5 # Overflow Interrupt Disable + RXSTALLDEC = 0x1 << 6 # Received STALLed Interrupt Disable + CRCERREC = 0x1 << 6 # CRC Error Interrupt Disable + SHORTPACKETIEC = 0x1 << 7 # Short Packet Interrupt Disable + NBUSYBKEC = 0x1 << 12 # Number of Busy Banks Disable + FIFOCONC = 0x1 << 14 # FIFO Control Disable + PDISHDMAC = 0x1 << 16 # Pipe Interrupts Disable HDMA Request Disable + PFREEZEC = 0x1 << 17 # Pipe Freeze Disable + +class HSTPIPINRQ(IntEnum): + INRQ = 0xff << 0 # IN Request Number before Freeze + INMODE = 0x1 << 8 # IN Request Mode + +class HSTPIPERR(IntEnum): + DATATGL = 0x1 << 0 # Data Toggle Error + DATAPID = 0x1 << 1 # Data PID Error + PID = 0x1 << 2 # PID Error + TIMEOUT = 0x1 << 3 # Time-Out Error + CRC16 = 0x1 << 4 # CRC16 Error + COUNTER = 0x3 << 5 # Error Counter + +class HSTDMANXTDSC1(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS1(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS1(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC2(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS2(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS2(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC3(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS3(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS3(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC4(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS4(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS4(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC5(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS5(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS5(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC6(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS6(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS6(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class HSTDMANXTDSC7(IntEnum): + NXT_DSC_ADD = 0xffffffff << 0 # Next Descriptor Address + +class HSTDMAADDRESS7(IntEnum): + BUFF_ADD = 0xffffffff << 0 # Buffer Address + +class HSTDMACONTROL7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Command + LDNXT_DSC = 0x1 << 1 # Load Next Channel Transfer Descriptor Enable Command + END_TR_EN = 0x1 << 2 # End of Transfer Enable (Control) + END_B_EN = 0x1 << 3 # End of Buffer Enable Control + END_TR_IT = 0x1 << 4 # End of Transfer Interrupt Enable + END_BUFFIT = 0x1 << 5 # End of Buffer Interrupt Enable + DESC_LD_IT = 0x1 << 6 # Descriptor Loaded Interrupt Enable + BURST_LCK = 0x1 << 7 # Burst Lock Enable + BUFF_LENGTH = 0xffff << 16 # Buffer Byte Length (Write-only) + +class HSTDMASTATUS7(IntEnum): + CHANN_ENB = 0x1 << 0 # Channel Enable Status + CHANN_ACT = 0x1 << 1 # Channel Active Status + END_TR_ST = 0x1 << 4 # End of Channel Transfer Status + END_BF_ST = 0x1 << 5 # End of Channel Buffer Status + DESC_LDST = 0x1 << 6 # Descriptor Loaded Status + BUFF_COUNT = 0xffff << 16 # Buffer Byte Count + +class CTRL(IntEnum): + IDTE = 0x1 << 0 # ID Transition Interrupt Enable + VBUSTE = 0x1 << 1 # VBus Transition Interrupt Enable + SRPE = 0x1 << 2 # SRP Interrupt Enable + VBERRE = 0x1 << 3 # VBus Error Interrupt Enable + BCERRE = 0x1 << 4 # B-Connection Error Interrupt Enable + ROLEEXE = 0x1 << 5 # Role Exchange Interrupt Enable + HNPERRE = 0x1 << 6 # HNP Error Interrupt Enable + STOE = 0x1 << 7 # Suspend Time-Out Interrupt Enable + VBUSHWC = 0x1 << 8 # VBus Hardware Control + SRPSEL = 0x1 << 9 # SRP Selection + SRPREQ = 0x1 << 10 # SRP Request + HNPREQ = 0x1 << 11 # HNP Request + OTGPADE = 0x1 << 12 # OTG Pad Enable + VBUSPO = 0x1 << 13 # VBus Polarity Off + FRZCLK = 0x1 << 14 # Freeze USB Clock + USBE = 0x1 << 15 # UOTGHS Enable + TIMVALUE = 0x3 << 16 # Timer Value + TIMPAGE = 0x3 << 20 # Timer Page + UNLOCK = 0x1 << 22 # Timer Access Unlock + UIDE = 0x1 << 24 # UOTGID Pin Enable + UIMOD = 0x1 << 25 # UOTGHS Mode + +class SR(IntEnum): + IDTI = 0x1 << 0 # ID Transition Interrupt + VBUSTI = 0x1 << 1 # VBus Transition Interrupt + SRPI = 0x1 << 2 # SRP Interrupt + VBERRI = 0x1 << 3 # VBus Error Interrupt + BCERRI = 0x1 << 4 # B-Connection Error Interrupt + ROLEEXI = 0x1 << 5 # Role Exchange Interrupt + HNPERRI = 0x1 << 6 # HNP Error Interrupt + STOI = 0x1 << 7 # Suspend Time-Out Interrupt + VBUSRQ = 0x1 << 9 # VBus Request + ID = 0x1 << 10 # UOTGID Pin State + VBUS = 0x1 << 11 # VBus Level + SPEED = 0x3 << 12 # Speed Status + CLKUSABLE = 0x1 << 14 # UTMI Clock Usable + +class SCR(IntEnum): + IDTIC = 0x1 << 0 # ID Transition Interrupt Clear + VBUSTIC = 0x1 << 1 # VBus Transition Interrupt Clear + SRPIC = 0x1 << 2 # SRP Interrupt Clear + VBERRIC = 0x1 << 3 # VBus Error Interrupt Clear + BCERRIC = 0x1 << 4 # B-Connection Error Interrupt Clear + ROLEEXIC = 0x1 << 5 # Role Exchange Interrupt Clear + HNPERRIC = 0x1 << 6 # HNP Error Interrupt Clear + STOIC = 0x1 << 7 # Suspend Time-Out Interrupt Clear + VBUSRQC = 0x1 << 9 # VBus Request Clear + +class SFR(IntEnum): + IDTIS = 0x1 << 0 # ID Transition Interrupt Set + VBUSTIS = 0x1 << 1 # VBus Transition Interrupt Set + SRPIS = 0x1 << 2 # SRP Interrupt Set + VBERRIS = 0x1 << 3 # VBus Error Interrupt Set + BCERRIS = 0x1 << 4 # B-Connection Error Interrupt Set + ROLEEXIS = 0x1 << 5 # Role Exchange Interrupt Set + HNPERRIS = 0x1 << 6 # HNP Error Interrupt Set + STOIS = 0x1 << 7 # Suspend Time-Out Interrupt Set + VBUSRQS = 0x1 << 9 # VBus Request Set + +class FSM(IntEnum): + DRDSTATE = 0xf << 0 # + diff --git a/qiling/hw/const/stm32f1xx_dma.py b/qiling/hw/const/stm32f1xx_dma.py new file mode 100644 index 00000000..a848428e --- /dev/null +++ b/qiling/hw/const/stm32f1xx_dma.py @@ -0,0 +1,97 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from enum import IntEnum + + +class DMA_ISR(IntEnum): + GIF1 = 1 << 0 + TCIF1 = 1 << 1 + HTIF1 = 1 << 2 + TEIF1 = 1 << 3 + GIF2 = 1 << 4 + TCIF2 = 1 << 5 + HTIF2 = 1 << 6 + TEIF2 = 1 << 7 + GIF3 = 1 << 8 + TCIF3 = 1 << 9 + HTIF3 = 1 << 10 + TEIF3 = 1 << 11 + GIF4 = 1 << 12 + TCIF4 = 1 << 13 + HTIF4 = 1 << 14 + TEIF4 = 1 << 15 + GIF5 = 1 << 16 + TCIF5 = 1 << 17 + HTIF5 = 1 << 18 + TEIF5 = 1 << 19 + GIF6 = 1 << 20 + TCIF6 = 1 << 21 + HTIF6 = 1 << 22 + TEIF6 = 1 << 23 + GIF7 = 1 << 24 + TCIF7 = 1 << 25 + HTIF7 = 1 << 26 + TEIF7 = 1 << 27 + +class DMA_IFCR(IntEnum): + CGIF1 = 1 << 0 + CTCIF1 = 1 << 1 + CHTIF1 = 1 << 2 + CTEIF1 = 1 << 3 + CGIF2 = 1 << 4 + CTCIF2 = 1 << 5 + CHTIF2 = 1 << 6 + CTEIF2 = 1 << 7 + CGIF3 = 1 << 8 + CTCIF3 = 1 << 9 + CHTIF3 = 1 << 10 + CTEIF3 = 1 << 11 + CGIF4 = 1 << 12 + CTCIF4 = 1 << 13 + CHTIF4 = 1 << 14 + CTEIF4 = 1 << 15 + CGIF5 = 1 << 16 + CTCIF5 = 1 << 17 + CHTIF5 = 1 << 18 + CTEIF5 = 1 << 19 + CGIF6 = 1 << 20 + CTCIF6 = 1 << 21 + CHTIF6 = 1 << 22 + CTEIF6 = 1 << 23 + CGIF7 = 1 << 24 + CTCIF7 = 1 << 25 + CHTIF7 = 1 << 26 + CTEIF7 = 1 << 27 + +class DMA_CR(IntEnum): + EN = 1 << 0 + TCIE = 1 << 1 + HTIE = 1 << 2 + TEIE = 1 << 3 + DIR = 1 << 4 + CIRC = 1 << 5 + PINC = 1 << 6 + MINC = 1 << 7 + PSIZE_0 = 1 << 8 + PSIZE_1 = 2 << 8 + PSIZE = 0x3 << 8 + MSIZE_0 = 1 << 10 + MSIZE_1 = 2 << 10 + MSIZE = 0x3 << 10 + PL = 0x3 << 12 + MEM2MEM = 1 << 14 + +class DMA(IntEnum): + PERIPH_TO_MEMORY = 0 + MEMORY_TO_PERIPH = DMA_CR.DIR + + PDATAALIGN_BYTE = 0 + PDATAALIGN_HALFWORD = DMA_CR.PSIZE_0 + PDATAALIGN_WORD = DMA_CR.PSIZE_1 + + MDATAALIGN_BYTE = 0 + MDATAALIGN_HALFWORD = DMA_CR.MSIZE_0 + MDATAALIGN_WORD = DMA_CR.MSIZE_1 diff --git a/qiling/hw/const/stm32f4xx_dma.py b/qiling/hw/const/stm32f4xx_dma.py index 0a86062d..e4852701 100644 --- a/qiling/hw/const/stm32f4xx_dma.py +++ b/qiling/hw/const/stm32f4xx_dma.py @@ -146,10 +146,14 @@ class DMA_SxM1AR(IntEnum): M1A = 0xffffffff << 0 class DMA(IntEnum): - PERIPH_TO_MEMORY = 0 - MEMORY_TO_PERIPH = DMA_SxCR.DIR_0 - MEMORY_TO_MEMORY = DMA_SxCR.DIR_1 + PERIPH_TO_MEMORY = 0 + MEMORY_TO_PERIPH = DMA_SxCR.DIR_0 + MEMORY_TO_MEMORY = DMA_SxCR.DIR_1 - PDATAALIGN_BYTE = 0 - PDATAALIGN_HALFWORD = DMA_SxCR.MSIZE_0 - PDATAALIGN_WORD = DMA_SxCR.MSIZE_1 \ No newline at end of file + PDATAALIGN_BYTE = 0 + PDATAALIGN_HALFWORD = DMA_SxCR.PSIZE_0 + PDATAALIGN_WORD = DMA_SxCR.PSIZE_1 + + MDATAALIGN_BYTE = 0 + MDATAALIGN_HALFWORD = DMA_SxCR.MSIZE_0 + MDATAALIGN_WORD = DMA_SxCR.MSIZE_1 diff --git a/qiling/hw/const/stm32f4xx_rcc.py b/qiling/hw/const/stm32fxxx_rcc.py similarity index 100% rename from qiling/hw/const/stm32f4xx_rcc.py rename to qiling/hw/const/stm32fxxx_rcc.py diff --git a/qiling/hw/dma/__init__.py b/qiling/hw/dma/__init__.py index 1f4f5c50..2f5ea331 100644 --- a/qiling/hw/dma/__init__.py +++ b/qiling/hw/dma/__init__.py @@ -3,5 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .sam3xa_pdc import SAM3xaPdc +from .stm32f1xx_dma import STM32F1xxDma from .stm32f4xx_dma import STM32F4xxDma from .gd32vf1xx_dma import GD32VF1xxDma \ No newline at end of file diff --git a/qiling/hw/dma/sam3xa_pdc.py b/qiling/hw/dma/sam3xa_pdc.py new file mode 100644 index 00000000..d68079a5 --- /dev/null +++ b/qiling/hw/dma/sam3xa_pdc.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaPdc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("RPR" , ctypes.c_uint32), # (Pdc Offset: 0x0) Receive Pointer Register + ("RCR" , ctypes.c_uint32), # (Pdc Offset: 0x4) Receive Counter Register + ("TPR" , ctypes.c_uint32), # (Pdc Offset: 0x8) Transmit Pointer Register + ("TCR" , ctypes.c_uint32), # (Pdc Offset: 0xC) Transmit Counter Register + ("RNPR", ctypes.c_uint32), # (Pdc Offset: 0x10) Receive Next Pointer Register + ("RNCR", ctypes.c_uint32), # (Pdc Offset: 0x14) Receive Next Counter Register + ("TNPR", ctypes.c_uint32), # (Pdc Offset: 0x18) Transmit Next Pointer Register + ("TNCR", ctypes.c_uint32), # (Pdc Offset: 0x1C) Transmit Next Counter Register + ("PTCR", ctypes.c_uint32), # (Pdc Offset: 0x20) Transfer Control Register + ("PTSR", ctypes.c_uint32), # (Pdc Offset: 0x24) Transfer Status Register + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.pdc = self.struct() diff --git a/qiling/hw/dma/stm32f1xx_dma.py b/qiling/hw/dma/stm32f1xx_dma.py new file mode 100644 index 00000000..49e2a02e --- /dev/null +++ b/qiling/hw/dma/stm32f1xx_dma.py @@ -0,0 +1,172 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.const.stm32f1xx_dma import DMA_CR, DMA + + +class Stream(ctypes.Structure): + _fields_ = [ + ("CR" , ctypes.c_uint32), + ("NDTR", ctypes.c_uint32), + ("PAR" , ctypes.c_uint32), + ("MAR" , ctypes.c_uint32), + ("RESEVERED" , ctypes.c_uint32), + ] + + def enable(self): + return self.CR & DMA_CR.EN + + def transfer_direction(self): + return self.CR & DMA_CR.DIR + + def transfer_peripheral_size(self): + PSIZE = self.CR & DMA_CR.PSIZE + if PSIZE == DMA.PDATAALIGN_BYTE: + return 1 + if PSIZE == DMA.PDATAALIGN_HALFWORD: + return 2 + if PSIZE == DMA.PDATAALIGN_WORD: + return 4 + + def transfer_memory_size(self): + MSIZE = self.CR & DMA_CR.MSIZE + if MSIZE == DMA.MDATAALIGN_BYTE: + return 1 + if MSIZE == DMA.MDATAALIGN_HALFWORD: + return 2 + if MSIZE == DMA.MDATAALIGN_WORD: + return 4 + + def step(self, mem): + if self.NDTR == 0: + return + + dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH + + psize = self.transfer_peripheral_size() + msize = self.transfer_memory_size() + + src, dst = (self.MAR, self.PAR) if dir_flag else (self.PAR, self.MAR) + src_size, dst_size = (msize, psize) if dir_flag else (psize, msize) + + data = bytes(mem.read(src, src_size)).ljust(dst_size)[:dst_size] + mem.write(dst, data) + + self.NDTR -= 1 + if self.CR & DMA_CR.MINC: + self.MAR += msize + if self.CR & DMA_CR.PINC: + self.PAR += psize + + if self.NDTR == 0: + self.CR &= ~DMA_CR.EN + return True + + +class STM32F1xxDma(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("ISR" , ctypes.c_uint32), + ("IFCR", ctypes.c_uint32), + ("stream", Stream * 8), + ] + + def __init__(self, ql, label, + stream0_intn=None, + stream1_intn=None, + stream2_intn=None, + stream3_intn=None, + stream4_intn=None, + stream5_intn=None, + stream6_intn=None, + stream7_intn=None, + ): + super().__init__(ql, label) + + self.dma = self.struct() + + self.intn = [ + stream0_intn, + stream1_intn, + stream2_intn, + stream3_intn, + stream4_intn, + stream5_intn, + stream6_intn, + stream7_intn, + ] + + def find_field(self, offset: int, size: int) -> str: + field_list = [] + if offset < self.struct.stream.offset: + field_list.append(super().find_field(offset, min(size, self.struct.stream.offset - offset))) + + if offset >= self.struct.stream.offset: + for i in range(8): + prefix_offset = self.struct.stream.offset + ctypes.sizeof(Stream) * i + + for name, _ in Stream._fields_: + field = getattr(Stream, name) + field_offset = field.offset + prefix_offset + + lbound = max(0, offset - field_offset) + ubound = min(offset + size - field_offset, field.size) + if lbound < ubound: + if lbound == 0 and ubound == field.size: + field_list.append(f'stream[{i}].{name}') + else: + field_list.append(f'stream[{i}].{name}[{lbound}:{ubound}]') + + return ','.join(field_list) + + @QlPeripheral.monitor(width=15) + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.dma) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor(width=15) + def write(self, offset: int, size: int, value: int): + if offset == self.struct.ISR.offset: + return + + elif offset == self.struct.IFCR.offset: + self.dma.ISR &= ~value + + else: + data = (value).to_bytes(size, byteorder='little') + ctypes.memmove(ctypes.addressof(self.dma) + offset, data, size) + + def transfer_complete(self, id): + tc_bits = [1, 5, 9, 13, 17, 21, 25] + self.dma.ISR |= 1 << tc_bits[id] + + if self.intn[id] is not None: + self.ql.hw.nvic.set_pending(self.intn[id]) + + def step(self): + for id, stream in enumerate(self.dma.stream): + if not stream.enable(): + continue + + if stream.step(self.ql.mem): + self.transfer_complete(id) diff --git a/qiling/hw/dma/stm32f4xx_dma.py b/qiling/hw/dma/stm32f4xx_dma.py index 8aebfbc0..93a95c16 100644 --- a/qiling/hw/dma/stm32f4xx_dma.py +++ b/qiling/hw/dma/stm32f4xx_dma.py @@ -23,7 +23,7 @@ class Stream(ctypes.Structure): def transfer_direction(self): return self.CR & DMA_SxCR.DIR - def transfer_size(self): + def transfer_peripheral_size(self): PSIZE = self.CR & DMA_SxCR.PSIZE if PSIZE == DMA.PDATAALIGN_BYTE: return 1 @@ -32,22 +32,35 @@ class Stream(ctypes.Structure): if PSIZE == DMA.PDATAALIGN_WORD: return 4 + def transfer_memory_size(self): + MSIZE = self.CR & DMA_SxCR.MSIZE + if MSIZE == DMA.MDATAALIGN_BYTE: + return 1 + if MSIZE == DMA.MDATAALIGN_HALFWORD: + return 2 + if MSIZE == DMA.MDATAALIGN_WORD: + return 4 + def step(self, mem): if self.NDTR == 0: return - dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH - - size = self.transfer_size() - src, dst = (self.M0AR, self.PAR) if dir_flag else (self.PAR, self.M0AR) + dir_flag = self.transfer_direction() == DMA.MEMORY_TO_PERIPH - mem.write(dst, bytes(mem.read(src, size))) + psize = self.transfer_peripheral_size() + msize = self.transfer_memory_size() + src, dst = (self.M0AR, self.PAR) if dir_flag else (self.PAR, self.M0AR) + src_size, dst_size = (msize, psize) if dir_flag else (psize, msize) + + data = bytes(mem.read(src, src_size)).ljust(dst_size)[:dst_size] + mem.write(dst, data) + self.NDTR -= 1 if self.CR & DMA_SxCR.MINC: - self.M0AR += size + self.M0AR += msize if self.CR & DMA_SxCR.PINC: - self.PAR += size + self.PAR += psize if self.NDTR == 0: self.CR &= ~DMA_SxCR.EN @@ -104,10 +117,7 @@ class STM32F4xxDma(QlPeripheral): super().__init__(ql, label) self.dma = self.struct() - - self.stream_base = 0x10 - self.stream_size = ctypes.sizeof(Stream) - + self.intn = [ stream0_intn, stream1_intn, @@ -119,15 +129,11 @@ class STM32F4xxDma(QlPeripheral): stream7_intn, ] - def stream_index(self, offset): - return (offset - self.stream_base) // self.stream_size - @QlPeripheral.monitor(width=15) def read(self, offset: int, size: int) -> int: buf = ctypes.create_string_buffer(size) ctypes.memmove(buf, ctypes.addressof(self.dma) + offset, size) - retval = int.from_bytes(buf.raw, byteorder='little') - return retval + return int.from_bytes(buf.raw, byteorder='little') @QlPeripheral.monitor(width=15) def write(self, offset: int, size: int, value: int): @@ -138,8 +144,6 @@ class STM32F4xxDma(QlPeripheral): self.dma.HISR &= ~value elif offset > self.struct.HIFCR.offset: - stream_id = self.stream_index(offset) - data = (value).to_bytes(size, byteorder='little') ctypes.memmove(ctypes.addressof(self.dma) + offset, data, size) diff --git a/qiling/hw/flash/__init__.py b/qiling/hw/flash/__init__.py new file mode 100644 index 00000000..ac107f06 --- /dev/null +++ b/qiling/hw/flash/__init__.py @@ -0,0 +1,8 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from .stm32f1xx_flash import STM32F1xxFlash +from .stm32f4xx_flash import STM32F4xxFlash +from .sam3xa_efc import SAM3xaEfc \ No newline at end of file diff --git a/qiling/hw/flash/sam3xa_efc.py b/qiling/hw/flash/sam3xa_efc.py new file mode 100644 index 00000000..0a6c6c07 --- /dev/null +++ b/qiling/hw/flash/sam3xa_efc.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaEfc(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ("FMR", ctypes.c_uint32), # (Efc Offset: 0x00) EEFC Flash Mode Register + ("FCR", ctypes.c_uint32), # (Efc Offset: 0x04) EEFC Flash Command Register + ("FSR", ctypes.c_uint32), # (Efc Offset: 0x08) EEFC Flash Status Register + ("FRR", ctypes.c_uint32), # (Efc Offset: 0x0C) EEFC Flash Result Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.efc = self.struct() + self.intn = intn diff --git a/qiling/hw/flash/stm32f1xx_flash.py b/qiling/hw/flash/stm32f1xx_flash.py new file mode 100644 index 00000000..46afeed2 --- /dev/null +++ b/qiling/hw/flash/stm32f1xx_flash.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes +from qiling.core import Qiling + +from qiling.hw.peripheral import QlPeripheral + + +class STM32F1xxFlash(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f102xb + stm32f103xb + stm32f103xe + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("ACR" , ctypes.c_uint32), + ("KEYR" , ctypes.c_uint32), + ("OPTKEYR" , ctypes.c_uint32), + ("SR" , ctypes.c_uint32), + ("CR" , ctypes.c_uint32), + ("AR" , ctypes.c_uint32), + ("RESERVED", ctypes.c_uint32), + ("OBR" , ctypes.c_uint32), + ("WRPR" , ctypes.c_uint32), + ] + + def __init__(self, ql: Qiling, label: str, intn: int = None): + super().__init__(ql, label) + + self.intn = intn + self.flash = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.flash) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.flash) + offset, data, size) + diff --git a/qiling/hw/misc/stm32f4xx_flash.py b/qiling/hw/flash/stm32f4xx_flash.py similarity index 100% rename from qiling/hw/misc/stm32f4xx_flash.py rename to qiling/hw/flash/stm32f4xx_flash.py diff --git a/qiling/hw/gpio/__init__.py b/qiling/hw/gpio/__init__.py index a6828608..ecc8c804 100644 --- a/qiling/hw/gpio/__init__.py +++ b/qiling/hw/gpio/__init__.py @@ -3,5 +3,8 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .stm32f1xx_gpio import STM32F1xxGpio +from .stm32f1xx_afio import STM32F1xxAfio from .stm32f4xx_gpio import STM32F4xxGpio -from .gd32vf1xx_gpio import GD32VF1xxGpio \ No newline at end of file +from .gd32vf1xx_gpio import GD32VF1xxGpio +from .sam3xa_pio import SAM3xaPio diff --git a/qiling/hw/gpio/sam3xa_pio.py b/qiling/hw/gpio/sam3xa_pio.py new file mode 100644 index 00000000..11fa572d --- /dev/null +++ b/qiling/hw/gpio/sam3xa_pio.py @@ -0,0 +1,76 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes +from qiling.hw.gpio.hooks import GpioHooks +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaPio(QlPeripheral, GpioHooks): + class Type(ctypes.Structure): + _fields_ = [ + ("PER" , ctypes.c_uint32), # (Pio Offset: 0x0000) PIO Enable Register + ("PDR" , ctypes.c_uint32), # (Pio Offset: 0x0004) PIO Disable Register + ("PSR" , ctypes.c_uint32), # (Pio Offset: 0x0008) PIO Status Register + ("Reserved1" , ctypes.c_uint32), # + ("OER" , ctypes.c_uint32), # (Pio Offset: 0x0010) Output Enable Register + ("ODR" , ctypes.c_uint32), # (Pio Offset: 0x0014) Output Disable Register + ("OSR" , ctypes.c_uint32), # (Pio Offset: 0x0018) Output Status Register + ("Reserved2" , ctypes.c_uint32), # + ("IFER" , ctypes.c_uint32), # (Pio Offset: 0x0020) Glitch Input Filter Enable Register + ("IFDR" , ctypes.c_uint32), # (Pio Offset: 0x0024) Glitch Input Filter Disable Register + ("IFSR" , ctypes.c_uint32), # (Pio Offset: 0x0028) Glitch Input Filter Status Register + ("Reserved3" , ctypes.c_uint32), # + ("SODR" , ctypes.c_uint32), # (Pio Offset: 0x0030) Set Output Data Register + ("CODR" , ctypes.c_uint32), # (Pio Offset: 0x0034) Clear Output Data Register + ("ODSR" , ctypes.c_uint32), # (Pio Offset: 0x0038) Output Data Status Register + ("PDSR" , ctypes.c_uint32), # (Pio Offset: 0x003C) Pin Data Status Register + ("IER" , ctypes.c_uint32), # (Pio Offset: 0x0040) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Pio Offset: 0x0044) Interrupt Disable Register + ("IMR" , ctypes.c_uint32), # (Pio Offset: 0x0048) Interrupt Mask Register + ("ISR" , ctypes.c_uint32), # (Pio Offset: 0x004C) Interrupt Status Register + ("MDER" , ctypes.c_uint32), # (Pio Offset: 0x0050) Multi-driver Enable Register + ("MDDR" , ctypes.c_uint32), # (Pio Offset: 0x0054) Multi-driver Disable Register + ("MDSR" , ctypes.c_uint32), # (Pio Offset: 0x0058) Multi-driver Status Register + ("Reserved4" , ctypes.c_uint32), # + ("PUDR" , ctypes.c_uint32), # (Pio Offset: 0x0060) Pull-up Disable Register + ("PUER" , ctypes.c_uint32), # (Pio Offset: 0x0064) Pull-up Enable Register + ("PUSR" , ctypes.c_uint32), # (Pio Offset: 0x0068) Pad Pull-up Status Register + ("Reserved5" , ctypes.c_uint32), # + ("ABSR" , ctypes.c_uint32), # (Pio Offset: 0x0070) Peripheral AB Select Register + ("Reserved6" , ctypes.c_uint32 * 3), # + ("SCIFSR" , ctypes.c_uint32), # (Pio Offset: 0x0080) System Clock Glitch Input Filter Select Register + ("DIFSR" , ctypes.c_uint32), # (Pio Offset: 0x0084) Debouncing Input Filter Select Register + ("IFDGSR" , ctypes.c_uint32), # (Pio Offset: 0x0088) Glitch or Debouncing Input Filter Clock Selection Status Register + ("SCDR" , ctypes.c_uint32), # (Pio Offset: 0x008C) Slow Clock Divider Debouncing Register + ("Reserved7" , ctypes.c_uint32 * 4), # + ("OWER" , ctypes.c_uint32), # (Pio Offset: 0x00A0) Output Write Enable + ("OWDR" , ctypes.c_uint32), # (Pio Offset: 0x00A4) Output Write Disable + ("OWSR" , ctypes.c_uint32), # (Pio Offset: 0x00A8) Output Write Status Register + ("Reserved8" , ctypes.c_uint32), # + ("AIMER" , ctypes.c_uint32), # (Pio Offset: 0x00B0) Additional Interrupt Modes Enable Register + ("AIMDR" , ctypes.c_uint32), # (Pio Offset: 0x00B4) Additional Interrupt Modes Disables Register + ("AIMMR" , ctypes.c_uint32), # (Pio Offset: 0x00B8) Additional Interrupt Modes Mask Register + ("Reserved9" , ctypes.c_uint32), # + ("ESR" , ctypes.c_uint32), # (Pio Offset: 0x00C0) Edge Select Register + ("LSR" , ctypes.c_uint32), # (Pio Offset: 0x00C4) Level Select Register + ("ELSR" , ctypes.c_uint32), # (Pio Offset: 0x00C8) Edge/Level Status Register + ("Reserved10", ctypes.c_uint32), # + ("FELLSR" , ctypes.c_uint32), # (Pio Offset: 0x00D0) Falling Edge/Low Level Select Register + ("REHLSR" , ctypes.c_uint32), # (Pio Offset: 0x00D4) Rising Edge/ High Level Select Register + ("FRLHSR" , ctypes.c_uint32), # (Pio Offset: 0x00D8) Fall/Rise - Low/High Status Register + ("Reserved11", ctypes.c_uint32), # + ("LOCKSR" , ctypes.c_uint32), # (Pio Offset: 0x00E0) Lock Status + ("WPMR" , ctypes.c_uint32), # (Pio Offset: 0x00E4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Pio Offset: 0x00E8) Write Protect Status Register + ] + + def __init__(self, ql, label, intn = None): + QlPeripheral.__init__(self, ql, label) + GpioHooks.__init__(self, ql, 16) + + self.pio = self.struct() + self.intn = intn diff --git a/qiling/hw/gpio/stm32f1xx_afio.py b/qiling/hw/gpio/stm32f1xx_afio.py new file mode 100644 index 00000000..c0305833 --- /dev/null +++ b/qiling/hw/gpio/stm32f1xx_afio.py @@ -0,0 +1,57 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class STM32F1xxAfio(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("EVCR" , ctypes.c_uint32), + ("MAPR" , ctypes.c_uint32), + ("EXTICR" , ctypes.c_uint32 * 4), + ("RESERVED0", ctypes.c_uint32), + ("MAPR2" , ctypes.c_uint32), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.afio = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.afio) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.afio) + offset, data, size) + + def exti(self, index): + """ Get EXTI{index} mapping information """ + + port_index = self.afio.EXTICR[index // 4] >> ((index & 3) * 4) + port_name = 'gpio' + 'abcdefg'[port_index] + + return getattr(self.ql.hw, port_name, None) diff --git a/qiling/hw/gpio/stm32f1xx_gpio.py b/qiling/hw/gpio/stm32f1xx_gpio.py new file mode 100644 index 00000000..5b30c6c8 --- /dev/null +++ b/qiling/hw/gpio/stm32f1xx_gpio.py @@ -0,0 +1,98 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.gpio.hooks import GpioHooks + + +class STM32F1xxGpio(QlPeripheral, GpioHooks): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("CRL" , ctypes.c_uint32), + ("CRH" , ctypes.c_uint32), + ("IDR" , ctypes.c_uint32), + ("ODR" , ctypes.c_uint32), + ("BSRR", ctypes.c_uint32), + ("BRR" , ctypes.c_uint32), + ("LCKR", ctypes.c_uint32), + ] + + def __init__(self, ql, label): + QlPeripheral.__init__(self, ql, label) + GpioHooks.__init__(self, ql, 16) + + self.gpio = self.struct() + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + if offset == self.struct.BSRR.offset: + return 0x00 + + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.gpio) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.IDR.offset: + return + + if offset == self.struct.BSRR.offset: + for i in range(32): + if ((value >> i) & 1) == 0: + continue + if i < 16: + self.set_pin(i) + else: + self.reset_pin(i - 16) + + return + + if offset == self.struct.ODR.offset: + for i in range(16): + new_bit = (value >> i) & 1 + old_bit = (self.gpio.ODR >> i) & 1 + + if new_bit != old_bit: + if new_bit: + self.set_pin(i) + else: + self.reset_pin(i) + + return + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.gpio) + offset, data, size) + + def set_pin(self, i): + self.ql.log.debug(f'[{self.label}] Set P{self.label[-1].upper()}{i}') + + self.gpio.ODR |= 1 << i + self.call_hook_set(i) + + def reset_pin(self, i): + self.ql.log.debug(f'[{self.label}] Reset P{self.label[-1].upper()}{i}') + + self.gpio.ODR &= ~(1 << i) + self.call_hook_reset(i) + + def pin(self, index): + return (self.gpio.ODR >> index) & 1 \ No newline at end of file diff --git a/qiling/hw/gpio/stm32f4xx_gpio.py b/qiling/hw/gpio/stm32f4xx_gpio.py index 89ad20de..de00d172 100644 --- a/qiling/hw/gpio/stm32f4xx_gpio.py +++ b/qiling/hw/gpio/stm32f4xx_gpio.py @@ -5,11 +5,12 @@ import ctypes +from qiling.hw.gpio.stm32f1xx_gpio import STM32F1xxGpio from qiling.hw.peripheral import QlPeripheral from qiling.hw.gpio.hooks import GpioHooks -class STM32F4xxGpio(QlPeripheral, GpioHooks): +class STM32F4xxGpio(STM32F1xxGpio): class Type(ctypes.Structure): """ the structure available in : stm32f413xx.h @@ -63,59 +64,3 @@ class STM32F4xxGpio(QlPeripheral, GpioHooks): OSPEEDR = ospeedr_reset, PUPDR = pupdr_reset, ) - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - if offset == self.struct.BSRR.offset: - return 0x00 - - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.gpio) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - if offset == self.struct.IDR.offset: - return - - if offset == self.struct.BSRR.offset: - for i in range(32): - if ((value >> i) & 1) == 0: - continue - if i < 16: - self.set_pin(i) - else: - self.reset_pin(i - 16) - - return - - if offset == self.struct.ODR.offset: - for i in range(16): - new_bit = (value >> i) & 1 - old_bit = (self.gpio.ODR >> i) & 1 - - if new_bit != old_bit: - if new_bit: - self.set_pin(i) - else: - self.reset_pin(i) - - return - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.gpio) + offset, data, size) - - def set_pin(self, i): - self.ql.log.debug(f'[{self.label}] Set P{self.label[-1].upper()}{i}') - - self.gpio.ODR |= 1 << i - self.call_hook_set(i) - - def reset_pin(self, i): - self.ql.log.debug(f'[{self.label}] Reset P{self.label[-1].upper()}{i}') - - self.gpio.ODR &= ~(1 << i) - self.call_hook_reset(i) - - def pin(self, index): - return (self.gpio.ODR >> index) & 1 diff --git a/qiling/hw/intc/__init__.py b/qiling/hw/intc/__init__.py index c7321929..6493d709 100644 --- a/qiling/hw/intc/__init__.py +++ b/qiling/hw/intc/__init__.py @@ -3,6 +3,8 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_nvic import CortexM3Nvic from .cm4_nvic import CortexM4Nvic +from .stm32f1xx_exti import STM32F1xxExti from .stm32f4xx_exti import STM32F4xxExti from .gd32vf1xx_eclic import GD32VF1xxEclic diff --git a/qiling/hw/intc/cm3_nvic.py b/qiling/hw/intc/cm3_nvic.py new file mode 100644 index 00000000..24d12ffa --- /dev/null +++ b/qiling/hw/intc/cm3_nvic.py @@ -0,0 +1,9 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from qiling.hw.intc.cm_nvic import CortexMNvic + +class CortexM3Nvic(CortexMNvic): + pass diff --git a/qiling/hw/intc/cm4_nvic.py b/qiling/hw/intc/cm4_nvic.py index 1d28276b..423859f3 100644 --- a/qiling/hw/intc/cm4_nvic.py +++ b/qiling/hw/intc/cm4_nvic.py @@ -3,142 +3,7 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -import ctypes +from qiling.hw.intc.cm_nvic import CortexMNvic -from qiling.hw.peripheral import QlPeripheral - - -class CortexM4Nvic(QlPeripheral): - class Type(ctypes.Structure): - _fields_ = [ - ('ISER' , ctypes.c_uint32 * 8), - ('RESERVED0', ctypes.c_uint32 * 24), - ('ICER' , ctypes.c_uint32 * 8), - ('RESERVED1', ctypes.c_uint32 * 24), - ('ISPR' , ctypes.c_uint32 * 8), - ('RESERVED2', ctypes.c_uint32 * 24), - ('ICPR' , ctypes.c_uint32 * 8), - ('RESERVED3', ctypes.c_uint32 * 24), - ('IABR' , ctypes.c_uint32 * 8), - ('RESERVED4', ctypes.c_uint32 * 56), - ('IPR' , ctypes.c_uint8 * 240), - ('RESERVED5', ctypes.c_uint32 * 644), - ('STIR' , ctypes.c_uint32 * 8), - ] - - def __init__(self, ql, label): - super().__init__(ql, label) - - # reference: - # https://www.youtube.com/watch?v=uFBNf7F3l60 - # https://developer.arm.com/documentation/ddi0439/b/Nested-Vectored-Interrupt-Controller - - self.nvic = self.struct() - - ## The max number of interrupt request - self.IRQN_MAX = self.struct.ISER.size * 8 - - ## The ISER unit size - self.MASK = self.IRQN_MAX // len(self.nvic.ISER) - 1 - self.OFFSET = self.MASK.bit_length() - - ## special write behavior - self.triggers = [ - (self.struct.ISER, self.enable), - (self.struct.ICER, self.disable), - (self.struct.ISPR, self.set_pending), - (self.struct.ICPR, self.clear_pending), - ] - - self.intrs = [] - self.interrupt_handler = self.ql.arch.hard_interrupt_handler - - def enable(self, IRQn): - if IRQn >= 0: - self.nvic.ISER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - self.nvic.ICER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - else: - self.ql.hw.scb.enable(IRQn) - - def disable(self, IRQn): - if IRQn >= 0: - self.nvic.ISER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - self.nvic.ICER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - else: - self.ql.hw.scb.disable(IRQn) - - def get_enable(self, IRQn): - if IRQn >= 0: - return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 - else: - return self.ql.hw.scb.get_enable(IRQn) - - def set_pending(self, IRQn): - if IRQn >= 0: - self.nvic.ISPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - self.nvic.ICPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) - else: - self.ql.hw.scb.set_pending(IRQn) - - if self.get_enable(IRQn): - self.intrs.append(IRQn) - - def clear_pending(self, IRQn): - if IRQn >= 0: - self.nvic.ISPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - self.nvic.ICPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) - else: - self.ql.hw.scb.clear_pending(IRQn) - - def get_pending(self, IRQn): - if IRQn >= 0: - return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 - else: - return self.ql.hw.scb.get_pending(IRQn) - - def get_priority(self, IRQn): - if IRQn >= 0: - return self.nvic.IPR[IRQn] - else: - return self.ql.hw.scb.get_priority(IRQn) - - def step(self): - if not self.intrs: - return - - self.intrs.sort(key=lambda x: self.get_priority(x)) - - while self.intrs: - IRQn = self.intrs.pop(0) - self.clear_pending(IRQn) - self.interrupt_handler(self.ql, IRQn) - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.nvic) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - def write_byte(ofs, byte): - for var, func in self.triggers: - if var.offset <= ofs < var.offset + var.size: - for i in range(8): - if (byte >> i) & 1: - func(i + (ofs - var.offset) * 8) - break - else: - ipr = self.struct.IPR - if ipr.offset <= ofs < ipr.offset + ipr.size: - byte &= 0xf0 # IPR[3: 0] reserved - - ctypes.memmove(ctypes.addressof(self.nvic) + ofs, bytes([byte]), 1) - - for ofs in range(offset, offset + size): - write_byte(ofs, value & 0xff) - value >>= 8 - - @property - def region(self): - return [(0, self.struct.RESERVED5.offset), (self.struct.STIR.offset, ctypes.sizeof(self.struct))] \ No newline at end of file +class CortexM4Nvic(CortexMNvic): + pass diff --git a/qiling/hw/intc/cm_nvic.py b/qiling/hw/intc/cm_nvic.py new file mode 100644 index 00000000..f52b31f3 --- /dev/null +++ b/qiling/hw/intc/cm_nvic.py @@ -0,0 +1,144 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class CortexMNvic(QlPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ('ISER' , ctypes.c_uint32 * 8), + ('RESERVED0', ctypes.c_uint32 * 24), + ('ICER' , ctypes.c_uint32 * 8), + ('RESERVED1', ctypes.c_uint32 * 24), + ('ISPR' , ctypes.c_uint32 * 8), + ('RESERVED2', ctypes.c_uint32 * 24), + ('ICPR' , ctypes.c_uint32 * 8), + ('RESERVED3', ctypes.c_uint32 * 24), + ('IABR' , ctypes.c_uint32 * 8), + ('RESERVED4', ctypes.c_uint32 * 56), + ('IPR' , ctypes.c_uint8 * 240), + ('RESERVED5', ctypes.c_uint32 * 644), + ('STIR' , ctypes.c_uint32 * 8), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + # reference: + # https://www.youtube.com/watch?v=uFBNf7F3l60 + # https://developer.arm.com/documentation/ddi0439/b/Nested-Vectored-Interrupt-Controller + + self.nvic = self.struct() + + ## The max number of interrupt request + self.IRQN_MAX = self.struct.ISER.size * 8 + + ## The ISER unit size + self.MASK = self.IRQN_MAX // len(self.nvic.ISER) - 1 + self.OFFSET = self.MASK.bit_length() + + ## special write behavior + self.triggers = [ + (self.struct.ISER, self.enable), + (self.struct.ICER, self.disable), + (self.struct.ISPR, self.set_pending), + (self.struct.ICPR, self.clear_pending), + ] + + self.intrs = [] + self.interrupt_handler = self.ql.arch.hard_interrupt_handler + + def enable(self, IRQn): + if IRQn >= 0: + self.nvic.ISER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + self.nvic.ICER[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + else: + self.ql.hw.scb.enable(IRQn) + + def disable(self, IRQn): + if IRQn >= 0: + self.nvic.ISER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + self.nvic.ICER[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + else: + self.ql.hw.scb.disable(IRQn) + + def get_enable(self, IRQn): + if IRQn >= 0: + return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 + else: + return self.ql.hw.scb.get_enable(IRQn) + + def set_pending(self, IRQn): + if IRQn >= 0: + self.nvic.ISPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + self.nvic.ICPR[IRQn >> self.OFFSET] |= 1 << (IRQn & self.MASK) + else: + self.ql.hw.scb.set_pending(IRQn) + + if self.get_enable(IRQn): + self.intrs.append(IRQn) + + def clear_pending(self, IRQn): + if IRQn >= 0: + self.nvic.ISPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + self.nvic.ICPR[IRQn >> self.OFFSET] &= self.MASK ^ (1 << (IRQn & self.MASK)) + else: + self.ql.hw.scb.clear_pending(IRQn) + + def get_pending(self, IRQn): + if IRQn >= 0: + return (self.nvic.ISER[IRQn >> self.OFFSET] >> (IRQn & self.MASK)) & 1 + else: + return self.ql.hw.scb.get_pending(IRQn) + + def get_priority(self, IRQn): + if IRQn >= 0: + return self.nvic.IPR[IRQn] + else: + return self.ql.hw.scb.get_priority(IRQn) + + def step(self): + if not self.intrs: + return + + self.intrs.sort(key=lambda x: self.get_priority(x)) + + while self.intrs: + IRQn = self.intrs.pop(0) + self.clear_pending(IRQn) + self.interrupt_handler(self.ql, IRQn) + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.nvic) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + def write_byte(ofs, byte): + for var, func in self.triggers: + if var.offset <= ofs < var.offset + var.size: + for i in range(8): + if (byte >> i) & 1: + func(i + (ofs - var.offset) * 8) + break + else: + ipr = self.struct.IPR + if ipr.offset <= ofs < ipr.offset + ipr.size: + byte &= 0xf0 # IPR[3: 0] reserved + + ctypes.memmove(ctypes.addressof(self.nvic) + ofs, bytes([byte]), 1) + + for ofs in range(offset, offset + size): + write_byte(ofs, value & 0xff) + value >>= 8 + + @property + def region(self): + return [(0, self.struct.RESERVED5.offset), (self.struct.STIR.offset, ctypes.sizeof(self.struct))] \ No newline at end of file diff --git a/qiling/hw/intc/stm32f1xx_exti.py b/qiling/hw/intc/stm32f1xx_exti.py new file mode 100644 index 00000000..cea43ad7 --- /dev/null +++ b/qiling/hw/intc/stm32f1xx_exti.py @@ -0,0 +1,86 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class STM32F1xxExti(QlPeripheral): + class Type(ctypes.Structure): + """ the structure available in : + stm32f100xb + stm32f100xe + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + stm32f105xc + stm32f107xc + """ + + _fields_ = [ + ("IMR" , ctypes.c_uint32), + ("EMR" , ctypes.c_uint32), + ("RTSR" , ctypes.c_uint32), + ("FTSR" , ctypes.c_uint32), + ("SWIER", ctypes.c_uint32), + ("PR" , ctypes.c_uint32), + ] + + def __init__(self, ql, label, + exti0_intn = None, + exti1_intn = None, + exti2_intn = None, + exti3_intn = None, + exti4_intn = None, + exti9_5_intn = None, + exti15_10_intn = None, + ): + super().__init__(ql, label) + + self.exti = self.struct() + self.intn = [ + exti0_intn , exti1_intn , exti2_intn , exti3_intn, + exti4_intn , exti9_5_intn , exti9_5_intn , exti9_5_intn, + exti9_5_intn , exti9_5_intn , exti15_10_intn, exti15_10_intn, + exti15_10_intn, exti15_10_intn, exti15_10_intn, exti15_10_intn + ] + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.exti) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.SWIER.offset: + value = value & self.exti.IMR & 0x7ffff + for i in range(20): + if ((self.exti.SWIER >> i) & 1) == 0 and ((value >> i) & 1) == 1: + self.send_interrupt(i) + + elif offset == self.struct.PR.offset: + for i in range(20): + if (value >> i) & 1: + self.exti.PR &= ~(1 << i) + self.exti.SWIER &= ~(1 << i) + + return + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.exti) + offset, data, size) + + def send_interrupt(self, index): + if 0 <= index < 20 and (self.exti.IMR >> index) & 1: + self.exti.PR |= 1 << index + + if index < 16: + self.ql.hw.afio.exti(index).set_pin(index) + self.ql.hw.nvic.set_pending(self.intn[index]) diff --git a/qiling/hw/misc/__init__.py b/qiling/hw/misc/__init__.py index 9a290150..1c8390b8 100644 --- a/qiling/hw/misc/__init__.py +++ b/qiling/hw/misc/__init__.py @@ -3,7 +3,9 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_scb import CortexM3Scb from .cm4_scb import CortexM4Scb +from .stm32f1xx_rcc import STM32F1xxRcc from .stm32f4xx_rcc import STM32F4xxRcc from .stm32f4xx_rcc_derive import ( STM32F4xxRccV1, STM32F4xxRccV2, @@ -11,6 +13,5 @@ from .stm32f4xx_rcc_derive import ( STM32F446Rcc, STM32F412Rcc, ) from .stm32f4xx_syscfg import STM32F4xxSyscfg -from .stm32f4xx_flash import STM32F4xxFlash from .stm32f4xx_dbg import STM32F4xxDbgmcu from .gd32vf1xx_rcu import GD32VF1xxRcu diff --git a/qiling/hw/misc/cm3_scb.py b/qiling/hw/misc/cm3_scb.py new file mode 100644 index 00000000..148bca83 --- /dev/null +++ b/qiling/hw/misc/cm3_scb.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes + +from qiling.hw.misc.cm_scb import CortexMScb + + +class CortexM3Scb(CortexMScb): + class Type(ctypes.Structure): + _fields_ = [ + ('CPUID' , ctypes.c_uint32), + ('ICSR' , ctypes.c_uint32), + ('VTOR' , ctypes.c_uint32), + ('AIRCR' , ctypes.c_uint32), + ('SCR' , ctypes.c_uint32), + ('CCR' , ctypes.c_uint32), + ('SHP' , ctypes.c_uint8 * 12), + ('SHCSR' , ctypes.c_uint32), + ('CFSR' , ctypes.c_uint32), + ('HFSR' , ctypes.c_uint32), + ('DFSR' , ctypes.c_uint32), + ('MMFAR' , ctypes.c_uint32), + ('BFSR' , ctypes.c_uint32), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.scb = self.struct( + CPUID = 0x411FC231, + AIRCR = 0xFA050000, + ) diff --git a/qiling/hw/misc/cm4_scb.py b/qiling/hw/misc/cm4_scb.py index 85077c9e..7cf2de0b 100644 --- a/qiling/hw/misc/cm4_scb.py +++ b/qiling/hw/misc/cm4_scb.py @@ -6,10 +6,10 @@ import ctypes -from qiling.hw.peripheral import QlPeripheral -from qiling.arch.cortex_m_const import IRQ +from qiling.hw.misc.cm_scb import CortexMScb -class CortexM4Scb(QlPeripheral): + +class CortexM4Scb(CortexMScb): class Type(ctypes.Structure): _fields_ = [ ('CPUID' , ctypes.c_uint32), @@ -36,98 +36,3 @@ class CortexM4Scb(QlPeripheral): AIRCR = 0xFA050000, CCR = 0x00000200, ) - - def enable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR |= 1 << 18 - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR |= 1 << 17 - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR |= 1 << 16 - - def disable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR &= ~(1 << 18) - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR &= ~(1 << 17) - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR &= ~(1 << 16) - - def get_enable(self, IRQn): - if IRQn == IRQ.USAGE_FAULT: - return (self.scb.SHCSR >> 18) & 1 - if IRQn == IRQ.BUS_FAULT: - return (self.scb.SHCSR >> 17) & 1 - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - return (self.scb.SHCSR >> 16) & 1 - return 1 - - def set_pending(self, IRQn): - if IRQn == IRQ.NMI: - self.scb.ICSR |= 1 << 31 - if IRQn == IRQ.PENDSV: - self.scb.ICSR |= 3 << 27 # set-bit and clear-bit - if IRQn == IRQ.SYSTICK: - self.scb.ICSR |= 3 << 25 # set-bit and clear-bit - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR |= 1 << 13 - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR |= 1 << 14 - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR |= 1 << 12 - if IRQn == IRQ.SVCALL: - self.scb.SHCSR |= 1 << 15 - - def clear_pending(self, IRQn): - if IRQn == IRQ.NMI: - self.scb.ICSR &= ~(1 << 31) - if IRQn == IRQ.PENDSV: - self.scb.ICSR &= ~(3 << 27) - if IRQn == IRQ.SYSTICK: - self.scb.ICSR &= ~(3 << 25) - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - self.scb.SHCSR &= ~(1 << 13) - if IRQn == IRQ.BUS_FAULT: - self.scb.SHCSR &= ~(1 << 14) - if IRQn == IRQ.USAGE_FAULT: - self.scb.SHCSR &= ~(1 << 12) - if IRQn == IRQ.SVCALL: - self.scb.SHCSR &= ~(1 << 15) - - def get_pending(self, IRQn): - if IRQn == IRQ.NMI: - return (self.scb.ICSR >> 31) & 1 - if IRQn == IRQ.PENDSV: - return (self.scb.ICSR >> 28) & 1 - if IRQn == IRQ.SYSTICK: - return (self.scb.ICSR >> 26) & 1 - - if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: - return (self.scb.SHCSR >> 13) & 1 - if IRQn == IRQ.BUS_FAULT: - return (self.scb.SHCSR >> 14) & 1 - if IRQn == IRQ.USAGE_FAULT: - return (self.scb.SHCSR >> 12) & 1 - if IRQn == IRQ.SVCALL: - return (self.scb.SHCSR >> 15) & 1 - return 0 - - def get_priority(self, IRQn): - return self.scb.SHP[(IRQn & 0xf) - 4] - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.scb) + offset, size) - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - if offset == self.struct.ICSR.offset: - if (value >> 28) & 1: - self.ql.hw.nvic.set_pending(IRQ.PENDSV) - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.scb) + offset, data, size) diff --git a/qiling/hw/misc/cm_scb.py b/qiling/hw/misc/cm_scb.py new file mode 100644 index 00000000..a98a0eef --- /dev/null +++ b/qiling/hw/misc/cm_scb.py @@ -0,0 +1,107 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + + +import ctypes + +from qiling.hw.peripheral import QlPeripheral +from qiling.arch.cortex_m_const import IRQ + + +class CortexMScb(QlPeripheral): + def enable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR |= 1 << 18 + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR |= 1 << 17 + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR |= 1 << 16 + + def disable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR &= ~(1 << 18) + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR &= ~(1 << 17) + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR &= ~(1 << 16) + + def get_enable(self, IRQn): + if IRQn == IRQ.USAGE_FAULT: + return (self.scb.SHCSR >> 18) & 1 + if IRQn == IRQ.BUS_FAULT: + return (self.scb.SHCSR >> 17) & 1 + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + return (self.scb.SHCSR >> 16) & 1 + return 1 + + def set_pending(self, IRQn): + if IRQn == IRQ.NMI: + self.scb.ICSR |= 1 << 31 + if IRQn == IRQ.PENDSV: + self.scb.ICSR |= 3 << 27 # set-bit and clear-bit + if IRQn == IRQ.SYSTICK: + self.scb.ICSR |= 3 << 25 # set-bit and clear-bit + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR |= 1 << 13 + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR |= 1 << 14 + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR |= 1 << 12 + if IRQn == IRQ.SVCALL: + self.scb.SHCSR |= 1 << 15 + + def clear_pending(self, IRQn): + if IRQn == IRQ.NMI: + self.scb.ICSR &= ~(1 << 31) + if IRQn == IRQ.PENDSV: + self.scb.ICSR &= ~(3 << 27) + if IRQn == IRQ.SYSTICK: + self.scb.ICSR &= ~(3 << 25) + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + self.scb.SHCSR &= ~(1 << 13) + if IRQn == IRQ.BUS_FAULT: + self.scb.SHCSR &= ~(1 << 14) + if IRQn == IRQ.USAGE_FAULT: + self.scb.SHCSR &= ~(1 << 12) + if IRQn == IRQ.SVCALL: + self.scb.SHCSR &= ~(1 << 15) + + def get_pending(self, IRQn): + if IRQn == IRQ.NMI: + return (self.scb.ICSR >> 31) & 1 + if IRQn == IRQ.PENDSV: + return (self.scb.ICSR >> 28) & 1 + if IRQn == IRQ.SYSTICK: + return (self.scb.ICSR >> 26) & 1 + + if IRQn == IRQ.MEMORY_MANAGEMENT_FAULT: + return (self.scb.SHCSR >> 13) & 1 + if IRQn == IRQ.BUS_FAULT: + return (self.scb.SHCSR >> 14) & 1 + if IRQn == IRQ.USAGE_FAULT: + return (self.scb.SHCSR >> 12) & 1 + if IRQn == IRQ.SVCALL: + return (self.scb.SHCSR >> 15) & 1 + return 0 + + def get_priority(self, IRQn): + return self.scb.SHP[(IRQn & 0xf) - 4] + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.scb) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.ICSR.offset: + if (value >> 28) & 1: + self.ql.hw.nvic.set_pending(IRQ.PENDSV) + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.scb) + offset, data, size) diff --git a/qiling/hw/misc/stm32f1xx_rcc.py b/qiling/hw/misc/stm32f1xx_rcc.py new file mode 100644 index 00000000..aff4323e --- /dev/null +++ b/qiling/hw/misc/stm32f1xx_rcc.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.const.stm32fxxx_rcc import RCC_CR, RCC_CFGR, RCC_CSR + + +class STM32F1xxRcc(QlPeripheral): + class Type(ctypes.Structure): + """ the structure is available in : + stm32f101xb + stm32f101xe + stm32f101xg + stm32f102xb + stm32f103xb + stm32f103xe + stm32f103xg + """ + + _fields_ = [ + ("CR" , ctypes.c_uint32), + ("CFGR" , ctypes.c_uint32), + ("CIR" , ctypes.c_uint32), + ("APB2RSTR", ctypes.c_uint32), + ("APB1RSTR", ctypes.c_uint32), + ("AHBENR" , ctypes.c_uint32), + ("APB2ENR" , ctypes.c_uint32), + ("APB1ENR" , ctypes.c_uint32), + ("BDCR" , ctypes.c_uint32), + ("CSR" , ctypes.c_uint32), + ] + + def __init__(self, ql, label, intn=None): + super().__init__(ql, label) + + self.rcc = self.struct( + CR = 0x00000083, + AHBENR = 0x00000014, + CSR = 0x0C000000, + ) + + self.rdyon = { + 'CR': [ + (RCC_CR.HSIRDY , RCC_CR.HSION ), + (RCC_CR.HSERDY , RCC_CR.HSEON ), + (RCC_CR.PLLRDY , RCC_CR.PLLON ), + (RCC_CR.PLLI2SRDY, RCC_CR.PLLI2SON), + ], + 'CFGR': [ + (RCC_CFGR.SWS_0, RCC_CFGR.SW_0), + (RCC_CFGR.SWS_1, RCC_CFGR.SW_1), + ], + 'CSR': [ + (RCC_CSR.LSIRDY, RCC_CSR.LSION) + ] + } + + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.rcc) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.rcc) + offset, data, size) + + def step(self): + for reg, rdyon in self.rdyon.items(): + value = getattr(self.rcc, reg) + for rdy, on in rdyon: + if value & on: + value |= rdy + else: + value &= ~rdy + setattr(self.rcc, reg, value) diff --git a/qiling/hw/misc/stm32f4xx_rcc.py b/qiling/hw/misc/stm32f4xx_rcc.py index f259eab0..ac45168c 100644 --- a/qiling/hw/misc/stm32f4xx_rcc.py +++ b/qiling/hw/misc/stm32f4xx_rcc.py @@ -5,7 +5,7 @@ import ctypes from qiling.hw.peripheral import QlPeripheral -from qiling.hw.const.stm32f4xx_rcc import RCC_CR, RCC_CFGR, RCC_CSR +from qiling.hw.const.stm32fxxx_rcc import RCC_CR, RCC_CFGR, RCC_CSR class STM32F4xxRcc(QlPeripheral): diff --git a/qiling/hw/power/__init__.py b/qiling/hw/power/__init__.py index bfe04cda..b16158d8 100644 --- a/qiling/hw/power/__init__.py +++ b/qiling/hw/power/__init__.py @@ -3,4 +3,5 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -from .stm32f4xx_pwr import STM32F4xxPwr \ No newline at end of file +from .stm32f4xx_pwr import STM32F4xxPwr +from .sam3xa_pmc import SAM3xaPmc diff --git a/qiling/hw/power/sam3xa_pmc.py b/qiling/hw/power/sam3xa_pmc.py new file mode 100644 index 00000000..df010a36 --- /dev/null +++ b/qiling/hw/power/sam3xa_pmc.py @@ -0,0 +1,95 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.core import Qiling +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.const.sam3xa_pmc import CKGR_MOR, SR, MCKR, CKGR_PLLAR, CKGR_UCKR + +class SAM3xaPmc(QlPeripheral): + """ + The Power Management Controller (PMC) optimizes power consumption by controlling all system and user + peripheral clocks. The PMC enables/disables the clock inputs to many of the peripherals and the Cortex-M3 + Processor. + + The Supply Controller selects between the 32 kHz RC oscillator or the crystal oscillator. The unused oscillator is + disabled automatically so that power consumption is optimized. + + By default, at startup the chip runs out of the Master Clock using the Fast RC oscillator running at 4 MHz. + The user can trim the 8 and 12 MHz RC Oscillator frequencies by software. + """ + + class Type(ctypes.Structure): + _fields_ = [ + ("SCER" , ctypes.c_uint32), # (Pmc Offset: 0x0000) System Clock Enable Register + ("SCDR" , ctypes.c_uint32), # (Pmc Offset: 0x0004) System Clock Disable Register + ("SCSR" , ctypes.c_uint32), # (Pmc Offset: 0x0008) System Clock Status Register + ("Reserved1" , ctypes.c_uint32), # + ("PCER0" , ctypes.c_uint32), # (Pmc Offset: 0x0010) Peripheral Clock Enable Register 0 + ("PCDR0" , ctypes.c_uint32), # (Pmc Offset: 0x0014) Peripheral Clock Disable Register 0 + ("PCSR0" , ctypes.c_uint32), # (Pmc Offset: 0x0018) Peripheral Clock Status Register 0 + ("CKGR_UCKR" , ctypes.c_uint32), # (Pmc Offset: 0x001C) UTMI Clock Register + ("CKGR_MOR" , ctypes.c_uint32), # (Pmc Offset: 0x0020) Main Oscillator Register + ("CKGR_MCFR" , ctypes.c_uint32), # (Pmc Offset: 0x0024) Main Clock Frequency Register + ("CKGR_PLLAR", ctypes.c_uint32), # (Pmc Offset: 0x0028) PLLA Register + ("Reserved2" , ctypes.c_uint32), # + ("MCKR" , ctypes.c_uint32), # (Pmc Offset: 0x0030) Master Clock Register + ("Reserved3" , ctypes.c_uint32), # + ("USB" , ctypes.c_uint32), # (Pmc Offset: 0x0038) USB Clock Register + ("Reserved4" , ctypes.c_uint32), # + ("PCK" , ctypes.c_uint32 * 3), # (Pmc Offset: 0x0040) Programmable Clock 0 Register + ("Reserved5" , ctypes.c_uint32 * 5), # + ("IER" , ctypes.c_uint32), # (Pmc Offset: 0x0060) Interrupt Enable Register + ("IDR" , ctypes.c_uint32), # (Pmc Offset: 0x0064) Interrupt Disable Register + ("SR" , ctypes.c_uint32), # (Pmc Offset: 0x0068) Status Register + ("IMR" , ctypes.c_uint32), # (Pmc Offset: 0x006C) Interrupt Mask Register + ("FSMR" , ctypes.c_uint32), # (Pmc Offset: 0x0070) Fast Startup Mode Register + ("FSPR" , ctypes.c_uint32), # (Pmc Offset: 0x0074) Fast Startup Polarity Register + ("FOCR" , ctypes.c_uint32), # (Pmc Offset: 0x0078) Fault Output Clear Register + ("Reserved6" , ctypes.c_uint32 * 26), # + ("WPMR" , ctypes.c_uint32), # (Pmc Offset: 0x00E4) Write Protect Mode Register + ("WPSR" , ctypes.c_uint32), # (Pmc Offset: 0x00E8) Write Protect Status Register + ("Reserved7" , ctypes.c_uint32 * 5), # + ("PCER1" , ctypes.c_uint32), # (Pmc Offset: 0x0100) Peripheral Clock Enable Register 1 + ("PCDR1" , ctypes.c_uint32), # (Pmc Offset: 0x0104) Peripheral Clock Disable Register 1 + ("PCSR1" , ctypes.c_uint32), # (Pmc Offset: 0x0108) Peripheral Clock Status Register 1 + ("PCR" , ctypes.c_uint32), # (Pmc Offset: 0x010C) Peripheral Control Register + ] + + def __init__(self, ql: Qiling, label: str, intn = None): + super().__init__(ql, label) + + self.pmc = self.struct() + self.intn = intn + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.pmc) + offset, size) + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + if offset == self.struct.CKGR_MOR.offset: + if value & CKGR_MOR.MOSCXTEN: + self.pmc.SR |= SR.MOSCXTS + if value & CKGR_MOR.MOSCSEL: + self.pmc.SR |= SR.MOSCSELS + + elif offset == self.struct.MCKR.offset: + if value & MCKR.CSS: + self.pmc.SR |= SR.MCKRDY + + elif offset == self.struct.CKGR_PLLAR.offset: + if value & CKGR_PLLAR.ONE: + self.pmc.SR |= SR.LOCKA + + elif offset == self.struct.CKGR_UCKR.offset: + if value & CKGR_UCKR.UPLLEN: + self.pmc.SR |= SR.LOCKU + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.pmc) + offset, data, size) \ No newline at end of file diff --git a/qiling/hw/timer/__init__.py b/qiling/hw/timer/__init__.py index bbf2dc95..cbd21e55 100644 --- a/qiling/hw/timer/__init__.py +++ b/qiling/hw/timer/__init__.py @@ -3,8 +3,10 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # +from .cm3_systick import CortexM3SysTick from .cm4_systick import CortexM4SysTick from .stm32f4xx_rtc import STM32F4xxRtc from .stm32f4xx_tim import STM32F4xxTim from .gd32vf1xx_rtc import GD32VF1xxRtc from .gd32vf1xx_timer import GD32VF1xxTimer +from .sam3xa_wdt import SAM3xaWdt diff --git a/qiling/hw/timer/cm3_systick.py b/qiling/hw/timer/cm3_systick.py new file mode 100644 index 00000000..b78e6d1d --- /dev/null +++ b/qiling/hw/timer/cm3_systick.py @@ -0,0 +1,10 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +from qiling.hw.timer.cm_systick import CortexMSysTick + + +class CortexM3SysTick(CortexMSysTick): + pass diff --git a/qiling/hw/timer/cm4_systick.py b/qiling/hw/timer/cm4_systick.py index 0d67b1ba..b46712a4 100644 --- a/qiling/hw/timer/cm4_systick.py +++ b/qiling/hw/timer/cm4_systick.py @@ -3,62 +3,8 @@ # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -import ctypes -from qiling.arch.cortex_m_const import IRQ -from qiling.hw.peripheral import QlPeripheral -from qiling.hw.timer.timer import QlTimerPeripheral -from qiling.hw.const.cm4_systick import SYSTICK_CTRL +from qiling.hw.timer.cm_systick import CortexMSysTick -class CortexM4SysTick(QlTimerPeripheral): - class Type(ctypes.Structure): - _fields_ = [ - ('CTRL' , ctypes.c_uint32), - ('LOAD' , ctypes.c_int32), - ('VAL' , ctypes.c_int32), - ('CALIB', ctypes.c_uint32), - ] - - def __init__(self, ql, label): - super().__init__(ql, label) - - self.systick = self.struct( - CALIB = 0xC0000000 - ) - - def step(self): - if not self.systick.CTRL & SYSTICK_CTRL.ENABLE: - return - - if self.systick.VAL <= 0: - self.systick.VAL = self.systick.LOAD - self.systick.CTRL |= SYSTICK_CTRL.COUNTFLAG - - if self.systick.CTRL & SYSTICK_CTRL.TICKINT: - self.ql.hw.nvic.set_pending(IRQ.SYSTICK) - else: - self.systick.VAL -= self.ratio - - @QlPeripheral.monitor() - def read(self, offset: int, size: int) -> int: - buf = ctypes.create_string_buffer(size) - ctypes.memmove(buf, ctypes.addressof(self.systick) + offset, size) - - if offset == self.struct.CTRL.offset: - self.systick.CTRL &= ~SYSTICK_CTRL.COUNTFLAG - return int.from_bytes(buf.raw, byteorder='little') - - @QlPeripheral.monitor() - def write(self, offset: int, size: int, value: int): - # ignore the reserved bit - if offset == self.struct.CTRL.offset: - value &= SYSTICK_CTRL.MASK - else: - value &= 0xffffff # only low-24 bit available - - # restart the timer - if offset == self.struct.LOAD.offset: - self.systick.VAL = value - - data = (value).to_bytes(size, 'little') - ctypes.memmove(ctypes.addressof(self.systick) + offset, data, size) +class CortexM4SysTick(CortexMSysTick): + pass diff --git a/qiling/hw/timer/cm_systick.py b/qiling/hw/timer/cm_systick.py new file mode 100644 index 00000000..81e9bc46 --- /dev/null +++ b/qiling/hw/timer/cm_systick.py @@ -0,0 +1,64 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes +from qiling.arch.cortex_m_const import IRQ +from qiling.hw.peripheral import QlPeripheral +from qiling.hw.timer.timer import QlTimerPeripheral +from qiling.hw.const.cm4_systick import SYSTICK_CTRL + + +class CortexMSysTick(QlTimerPeripheral): + class Type(ctypes.Structure): + _fields_ = [ + ('CTRL' , ctypes.c_uint32), + ('LOAD' , ctypes.c_int32), + ('VAL' , ctypes.c_int32), + ('CALIB', ctypes.c_uint32), + ] + + def __init__(self, ql, label): + super().__init__(ql, label) + + self.systick = self.struct( + CALIB = 0xC0000000 + ) + + def step(self): + if not self.systick.CTRL & SYSTICK_CTRL.ENABLE: + return + + if self.systick.VAL <= 0: + self.systick.VAL = self.systick.LOAD + self.systick.CTRL |= SYSTICK_CTRL.COUNTFLAG + + if self.systick.CTRL & SYSTICK_CTRL.TICKINT: + self.ql.hw.nvic.set_pending(IRQ.SYSTICK) + else: + self.systick.VAL -= self.ratio + + @QlPeripheral.monitor() + def read(self, offset: int, size: int) -> int: + buf = ctypes.create_string_buffer(size) + ctypes.memmove(buf, ctypes.addressof(self.systick) + offset, size) + + if offset == self.struct.CTRL.offset: + self.systick.CTRL &= ~SYSTICK_CTRL.COUNTFLAG + return int.from_bytes(buf.raw, byteorder='little') + + @QlPeripheral.monitor() + def write(self, offset: int, size: int, value: int): + # ignore the reserved bit + if offset == self.struct.CTRL.offset: + value &= SYSTICK_CTRL.MASK + else: + value &= 0xffffff # only low-24 bit available + + # restart the timer + if offset == self.struct.LOAD.offset: + self.systick.VAL = value + + data = (value).to_bytes(size, 'little') + ctypes.memmove(ctypes.addressof(self.systick) + offset, data, size) diff --git a/qiling/hw/timer/sam3xa_wdt.py b/qiling/hw/timer/sam3xa_wdt.py new file mode 100644 index 00000000..0ffe0fd1 --- /dev/null +++ b/qiling/hw/timer/sam3xa_wdt.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python3 +# +# Cross Platform and Multi Architecture Advanced Binary Emulation Framework +# + +import ctypes + +from qiling.hw.peripheral import QlPeripheral + + +class SAM3xaWdt(QlPeripheral): + """ + The Watchdog Timer can be used to prevent system lock-up if the software becomes trapped in a deadlock. It + features a 12-bit down counter that allows a watchdog period of up to 16 seconds (slow clock at 32.768 kHz). It + can generate a general reset or a processor reset only. In addition, it can be stopped while the processor is in + debug mode or idle mode. + """ + + class Type(ctypes.Structure): + _fields_ = [ + ("CR", ctypes.c_uint32), # (Wdt Offset: 0x00) Control Register + ("MR", ctypes.c_uint32), # (Wdt Offset: 0x04) Mode Register + ("SR", ctypes.c_uint32), # (Wdt Offset: 0x08) Status Register + ] + + def __init__(self, ql, label, intn = None): + super().__init__(ql, label) + + self.wdt = self.struct() + self.intn = intn diff --git a/qiling/loader/mcu.py b/qiling/loader/mcu.py index 4cd4b5c7..4b28447a 100644 --- a/qiling/loader/mcu.py +++ b/qiling/loader/mcu.py @@ -5,19 +5,16 @@ import io -import struct from elftools.elf.elffile import ELFFile from qiling.const import * from qiling.core import Qiling from qiling.utils import component_setup - from .loader import QlLoader + class IhexParser: def __init__(self, path): - self.pc = None - self.base = None self.mem = [] self.segments = [] @@ -25,38 +22,38 @@ class IhexParser: for line in f.read().splitlines(): self.parse_line(line.strip()) - begin, end, bindata = 0, 0, b'' + begin, stream = 0, b'' for addr, data in self.mem: - if addr != end: - self.add_segment(begin, end, bindata) - begin, end, bindata = addr, addr + len(data), data + if addr != begin + len(stream): + self.segments.append((begin, stream)) + begin, stream = addr, data + else: - bindata += data - end += len(data) - self.add_segment(begin, end, bindata) - - def add_segment(self, begin, end, bindata): - if len(bindata) > 0 and end - begin == len(bindata): - self.segments.append((begin, end, bindata)) + stream += data + + self.segments.append((begin, stream)) def parse_line(self, line): if len(line) < 9: return + desc = line[7: 9] size = int(line[1: 3], 16) - type = line[7: 9] - + addr = bytes.fromhex(line[3: 7]) - data = bytes.fromhex(line[9: 9 + size * 2]) - - if type == '04': - self.base = struct.unpack('>I', data + b'\x00\x00')[0] - elif type == '05': - self.pc = struct.unpack('>I', data)[0] - elif type == '00': - offset = struct.unpack('>I', b'\x00\x00' + addr)[0] + data = bytes.fromhex(line[9: 9 + size * 2]) + + if desc == '00': # Data + offset = int.from_bytes(addr, byteorder='big') self.mem.append((self.base + offset, data)) + elif desc == '02': # Extended Segment Address + self.base = int.from_bytes(data, byteorder='big') * 0x10 + + elif desc == '04': # Extended Linear Address + self.base = int.from_bytes(data, byteorder='big') * 0x10000 + + class QlLoaderMCU(QlLoader): def __init__(self, ql:Qiling): super().__init__(ql) @@ -102,7 +99,7 @@ class QlLoaderMCU(QlLoader): self.ql.mem.write(self.map_address, f.read()) else: # self.filetype == 'hex': - for begin, _, data in self.ihex.segments: + for begin, data in self.ihex.segments: self.ql.mem.write(begin, data) @@ -137,7 +134,7 @@ class QlLoaderMCU(QlLoader): base = args['base'] self.ql.hw.setup_mmio(base, size, info=f'[{name}]') - if memtype == 'core peripheral': + if memtype == 'core': self.ql.hw.create(name.lower()) def run(self): diff --git a/tests/profiles/stm32f411.yml b/tests/profiles/stm32f411.yml index 96efeee1..400eb410 100644 --- a/tests/profiles/stm32f411.yml +++ b/tests/profiles/stm32f411.yml @@ -15,7 +15,7 @@ "kwargs": { "dev_id": 0x413, }, - "type": "core peripheral" + "type": "peripheral" }, "DMA1": { "base": 0x40026000, @@ -143,7 +143,7 @@ "NVIC": { "base": 0xe000e100, "struct": "CortexM4Nvic", - "type": "core peripheral" + "type": "core" }, "PERIP": { "base": 0x40000000, @@ -186,7 +186,7 @@ "SCB": { "base": 0xe000ed00, "struct": "CortexM4Scb", - "type": "core peripheral" + "type": "core" }, "SDIO": { "base": 0x40012c00, @@ -260,7 +260,7 @@ "SYSTICK": { "base": 0xe000e010, "struct": "CortexM4SysTick", - "type": "core peripheral" + "type": "core" }, "TIM1": { "base": 0x40010000, diff --git a/tests/test_mcu.py b/tests/test_mcu.py index 01e7bec0..140681f5 100644 --- a/tests/test_mcu.py +++ b/tests/test_mcu.py @@ -10,6 +10,8 @@ sys.path.append("..") from qiling.core import Qiling from qiling.const import QL_VERBOSE from qiling.extensions.mcu.stm32f4 import stm32f407, stm32f411 +from qiling.extensions.mcu.stm32f1 import stm32f103 +from qiling.extensions.mcu.atmel import sam3x8e from qiling.extensions.mcu.gd32vf1 import gd32vf103 class MCUTest(unittest.TestCase): @@ -331,6 +333,7 @@ class MCUTest(unittest.TestCase): ql.hw.create('gpiod') ql.hw.create('spi1') ql.hw.create('crc') + ql.hw.create('dbgmcu') flag = False def indicator(ql): @@ -346,6 +349,57 @@ class MCUTest(unittest.TestCase): del ql + def test_mcu_usart_stm32f103(self): + ql = Qiling(["../examples/rootfs/mcu/stm32f103/sctf2020-password-lock-plus.hex"], + archtype="cortex_m", env=stm32f103, verbose=QL_VERBOSE.DEFAULT) + + ql.hw.create('rcc') + ql.hw.create('flash interface') + ql.hw.create('exti') + ql.hw.create('usart1') + ql.hw.create('gpioa') + ql.hw.create('afio') + ql.hw.create('dma1').watch() + + data = [] + def gpio_set_cb(pin): + data.append(pin) + + ql.hw.gpioa.hook_set(1, gpio_set_cb, '1') + ql.hw.gpioa.hook_set(2, gpio_set_cb, '2') + ql.hw.gpioa.hook_set(3, gpio_set_cb, '3') + ql.hw.gpioa.hook_set(4, gpio_set_cb, '4') + + ql.run(count=400000) + + self.assertTrue((''.join(data)).find('1442413') != -1) + self.assertTrue(ql.hw.usart1.recv()[:23] == b'SCTF{that1s___r1ghtflag') + + del ql + + def test_mcu_serial_sam3x8e(self): + ql = Qiling(["../examples/rootfs/mcu/sam3x8e/serial.ino.hex"], + archtype="cortex_m", env=sam3x8e, verbose=QL_VERBOSE.DEFAULT) + + ql.hw.create('wdt') + ql.hw.create('efc0') + ql.hw.create('efc1') + ql.hw.create('pmc') + ql.hw.create('uotghs') + ql.hw.create('pioa') + ql.hw.create('piob') + ql.hw.create('pioc') + ql.hw.create('piod') + ql.hw.create('adc') + ql.hw.create('uart') + ql.hw.create('pdc_uart') + + ql.hw.systick.ratio = 1000 + ql.run(count=100000) + self.assertTrue(ql.hw.uart.recv().startswith(b'hello world\nhello world\n')) + + del ql + if __name__ == "__main__": unittest.main()