You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When emulating an mcu based on the cortex-m, Qiling never uses the value stored in the Vector Table Offset Register. This register is used to indicate an offset for the base address of the vector table. This produces a bug when emulating a firmware that is using this register to indicate an offset to use its vector table. In my case the vector table is used in the firmware to fetch interrupt handler, the bug makes the firmware trying to fetch interrupt handlers from wrong address.
Expected behavior
Just take into account the value present in the register.
Additional context
Tested on the dev branch.
This register is laying in the SCB part of the CPU memory, as shown in the code above once scb hardware added to the emulation, the memory is perfectly handled, read and write to it works fine (checked by using DISASM debug log).
Suggested correction
For me this was problematic when the firmware uses interruption so here is how I corrected the problem. It has been tested and worked perfectly but I'm not sure this is the right place to implement this correction plus I've hardcoded the address which is very ugly.
In qiling/arch/cortex_m.py in interrupt_handler function :
definterrupt_handler(self, ql: Qiling, intno: int):
basepri=self.regs.basepri&0xf0ifbasepriandbasepri<=ql.hw.nvic.get_priority(intno):
returnifintno>IRQ.HARD_FAULTand (self.regs.primask&0x1):
returnifintno!=IRQ.NMIand (self.regs.faultmask&0x1):
returnifql.verbose>=QL_VERBOSE.DISASM:
ql.log.debug(f'Handle the intno: {intno}')
withQlInterruptContext(ql):
isr=intno+16offset=isr*4# ============= personnal modifications ============= #Here qiling doesn't care about the SCB_VTOR which is not normal for the cortex M SCB_VTOR=int.from_bytes(ql.mem.read(0xe000ed08,4), byteorder='little')
entry=ql.mem.read_ptr(offset+SCB_VTOR)
# ======================================= exc_return=0xFFFFFFFDifself.using_psp() else0xFFFFFFF9self.regs.write('ipsr', isr)
self.regs.write('pc', entry)
self.regs.write('lr', exc_return)
ql.log.debug(hex(self.effective_pc))
self.uc.emu_start(self.effective_pc, 0, 0, 0xffffff)
The text was updated successfully, but these errors were encountered:
Describe the bug
When emulating an mcu based on the cortex-m, Qiling never uses the value stored in the Vector Table Offset Register. This register is used to indicate an offset for the base address of the vector table. This produces a bug when emulating a firmware that is using this register to indicate an offset to use its vector table. In my case the vector table is used in the firmware to fetch interrupt handler, the bug makes the firmware trying to fetch interrupt handlers from wrong address.
Sample Code
Expected behavior
Just take into account the value present in the register.
Additional context
Tested on the dev branch.
This register is laying in the SCB part of the CPU memory, as shown in the code above once scb hardware added to the emulation, the memory is perfectly handled, read and write to it works fine (checked by using DISASM debug log).
Suggested correction
For me this was problematic when the firmware uses interruption so here is how I corrected the problem. It has been tested and worked perfectly but I'm not sure this is the right place to implement this correction plus I've hardcoded the address which is very ugly.
In qiling/arch/cortex_m.py in interrupt_handler function :
The text was updated successfully, but these errors were encountered: