diy arm debugger for wi-fi chips using nexmon to … · diy arm debugger for wi-fi chips using...

DIY ARM Debugger for Wi-Fi ChipsUsing Nexmon to Perform Single-Step Debugging and More on Proprietary Wi-Fi Chips

Matthias Schulz

Powered by:

Matthias Schulz | SEEMOO | TU Darmstadt | DIY ARM Debugger for Wi-Fi Chips 1

Debugger

ARM Cortex-R4

Broadcom FullMACWi-Fi Chips

HardwareBreakpoints

ExceptionHandling

OperationModes

Assembly

MemoryWatchpoints

Nexus 5

Firmware PatchingFramework

C-based

Monitor Mode

Frame Injection

Open Source

Lot’s ofProjects

Wi-Fi Chips in Smartphones


Nexus 5



Apps

Nexus 5



Linux Kernel

Apps

Nexus 5



Linux Kernel

Apps

Wi-Fi Chip

Nexus 5



Linux Kernel

Apps

Physical Layer

Wi-Fi Chip

Nexus 5



Linux Kernel

Apps

Low Level Hardware Control

Physical Layer

Wi-Fi Chip

Nexus 5



Linux Kernel

Apps


MAC Sublayer Management Entity (MLME)

Physical Layer

Wi-Fi Chip

Nexus 5

Ethernet-to-Wi-Fi Bridge



Linux Kernel

Apps



Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host


Generate TCP/UDP traffic

Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host



Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host



Packs data in Ethernet frames

Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host




Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host




FullMAC firmware handles Wi-Fi connectionand replaces Ethernet headers by Wi-Fi headers

Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host





Physical Layer

Wi-Fi Chip

Nexus 5


Wi-Fi Firmware Handling


Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM


Firmware Analysis and Patching


Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis

Creating Firmware Patches




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

bcmonmonmob

Related Work




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware


Static vs. Dynamic Code Analysis


Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis

What about dynamic analysis?




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Copyright © 2006-2011 ARM Limited. All rights reserved.

ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4

Technical Reference Manual




Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Debug CoreJTAG


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Debug CoreJTAG

JTAG Debugger


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Debug CoreJTAG

JTAG Debugger

Pins notaccessible


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

Loading forAnalysis


PatchingFirmware

Static Analysis


ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

Wi-Fi Chip

Nexus 5

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Halting vs. Monitor Debug-Mode



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


0x50: MOV R0, #100x52: MOV R1, #30x54: ADD R0, R0, R10x56: B 0x50

R0 = UNDEFR1 = UNDEF...PC = 0x50

Example Program Registers




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = UNDEF...PC = 0x52





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x54





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 13R1 = 3...PC = 0x56





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 13R1 = 3...PC = 0x50





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x52





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x52


HaltingDebug-Mode

Control handedto external debugger




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x52


HaltingDebug-Mode

MonitorDebug-Mode


Abort Exception Execution continues

in exception handler




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x52


HaltingDebug-Mode

MonitorDebug-Mode







Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



R0 = 10R1 = 3...PC = 0x52


HaltingDebug-Mode

MonitorDebug-Mode




What happens when an abort

exception occurs?

Abort Exception Handling



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


R0 = 10R1 = 3...PC = 0x52



MonitorDebug-Mode



Abort Exception Handling



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


R0 = 10R1 = 3...PC = 0x52


0x00: B reset_hdl0x04: B undef_inst_hdl0x08: B sw_intr_hdl0x0C: B pref_abt_hdl0x10: B data_abt_hdl...

MonitorDebug-Mode




ResetUndef. Instr.Software Intr.Abort (prefetch)Abort (data)...

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

OperatingModes

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

OperatingModes

Regular Firmware Execution

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

OperatingModes


For Handling Abort Exceptions

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

OperatingModes


For Handling Abort Exceptions

Abort ModeSystem Mode

Operating Modes



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C


Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

Banked Registers

Stack Pointer (SP)

Link Register (LR)

Saved Program Status Register


Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C

Banked Registers

Stack Pointer (SP)

Link Register (LR)



Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C


Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C


SP>R13_abtLR>R14_abt

Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





R0 = 10R1 = 3...PC = 0x0C



We can call functionswithin our Abort Handler without overwriting theregluar Stack Pointer andLink Register!

Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode



0x50: MOV R0, #100x52: MOV R1, #30x54: ADD R0, R0, R10x56: B 0x50...0x80: MOV SP, LR...0x86: SRSDB SP!, #0x1F0x8C: CPS #0x1F...0x90: B handle_exceptions


pref_abt_hdl

R0 = 10R1 = 3...PC = 0x0C




Banked Registers



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x80




Prefetch Abort Handler



ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x86




SRSDB Instruction

SRSDB SP!, #0x1F

SRS Store Return State (LR, SPSR)onto a Stack

DB Decrement address beforeeach transfer

! Write final address back to SPof mode 0x1F (system mode)




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x8C







ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x8C




CPS Instruction

CPS #0x1F

CPS Change Processor State#0x1F target mode = 0x1F

(system mode)




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90


SP>R13LR>R14




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90


SP>R13LR>R14

Original Wi-Fi firmwarealways changes to System mode

handle_exceptionshandles all exceptions




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90


SP>R13LR>R14



ToDos to Create DIY Debugger

• Stay in Abort Mode• Save Register State to Abort Mode Stack

• Initialize ABT Stack Pointer• Analyze handle_exceptions function• Implement a breakpoint handler• Activate breakpoints




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90


SP>R13LR>R14









ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90







✓SP>R13_abtLR>R14_abt




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




MonitorDebug-Mode





pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90







✓SP>R13_abtLR>R14_abt

✓

#0x17


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers

R0 = 10R1 = 3...PC = 0x90SP>R13LR>R14SP>R13_abtLR>R14_abt

Example Program


MonitorDebug-Mode





Initialize Abort Stack Pointer





✓✓


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers

R0 = 10R1 = 3...PC = 0x90SP>R13LR>R14SP>R13_abtLR>R14_abt

Example Program


MonitorDebug-Mode










✓✓


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers

R0 = UNDEFR1 = UNDEF...PC = 0x00SP>R13LR>R14SP>R13_svcLR>R14_svc

Example Program


MonitorDebug-Mode









✓✓

Supervisor ModeAbort ModeSystem Mode


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓


0x30: Check exception vectors0x32: Change to System Mode0x34: B setup


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers

R0 = ...R1 = ......PC = 0x32SP>R13LR>R14SP>R13_svcLR>R14_svc

Example Program


MonitorDebug-Mode









✓✓




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers

R0 = ...R1 = ......PC = 0x32SP>R13LR>R14SP>R13LR>R14

Example Program


MonitorDebug-Mode









✓✓




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓


0x30: Check exception vectors0x32: Change to System Mode0x34: B setup...0x40: Initialize processor0x42: B c_main


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓




ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓



...0x60: Initialize the „driver“0x62: Activate interrupts0x64: Wait for interrupts

c_main


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓


0x30: Check exception vectors0x32: Change to System Mode0x34: B setup...0x40: Initialize processor0x42: B c_main c_main_hook


c_main


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓




c_main

c_main_hook:0x60: PUSH {R0-R3,LR}0x62: BL set_abort_SP0x64: POP {R0-R3,LR}0x66: B c_main


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Registers


Example Program


MonitorDebug-Mode









✓✓




c_main


MonitorDebug-Mode








✓✓


...0x40: Initialize processor0x42: B c_main c_main_hook


c_main


MonitorDebug-Mode








✓✓




c_main


uint32 stack_abt[256] = { 0x54424153 };

void __attribute__((optimize("O0")))set_abort_SP(void) {

register uint32 sp_abt asm("r0") = (uint32) &stack_abt[255];

dbg_change_processor_mode(DBG_PROCESSOR_MODE_ABT);asm("mov sp, %[value]" : : [value] "r" (sp_abt));dbg_change_processor_mode(DBG_PROCESSOR_MODE_SYS);

}

MonitorDebug-Mode








✓✓




c_main


uint32 stack_abt[256] = { 0x54424153 };




}

Change to Abort Mode

MonitorDebug-Mode








✓✓




c_main


uint32 stack_abt[256] = { 0x54424153 };




}

Change to Abort ModeSet Stack Pointer to end of stack_abt array

MonitorDebug-Mode








✓✓




c_main


uint32 stack_abt[256] = { 0x54424153 };




}


Change to System Mode

MonitorDebug-Mode








✓✓




c_main


uint32 stack_abt[256] = { 0x54424153 };




}✓



MonitorDebug-Mode








✓✓


✓


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



0x00: B reset_hdl0x04: B undef_inst_hdl0x08: B sw_intr_hdl0x0C: B pref_abt_hdl0x10: B data_abt_hdl...0x50: MOV R0, #100x52: MOV R1, #30x54: ADD R0, R0, R10x56: B 0x50...0x80: MOV SP, LR...0x86: SRSDB SP!, #0x1F0x8C: CPS #0x1F...0x90: B handle_exceptions


pref_abt_hdl

R0 = 10R1 = 3...PC = 0x90SP>R13LR>R14




#0x17

Analyzing Handle Exceptions Function


MonitorDebug-Mode






✓✓

✓


Example Program



Our Prefetch Abort Handler


MonitorDebug-Mode






✓✓

✓


Example Program



...0x80: MOV SP, LR...0x86: SRSDB SP!, #0x1F0x8C: CPS #0x1F...0x90: B handle_exceptions

pref_abt_hdl#0x17



MonitorDebug-Mode






✓✓

✓


Example Program





MonitorDebug-Mode






✓✓

✓


0x80: SUB LR, LR, #40x82: SRSDB SP!, #0x170x84: PUSH {R0}0x86: PUSH {LR}0x88: SUB SP, SP, #240x8A: PUSH {R0-R7}0x8C: MOV R0, #30x8E: B handle_exceptions

Example Program





MonitorDebug-Mode






✓✓

✓



Example Program





MonitorDebug-Mode






✓✓

✓



LR = Breakpoint‘s PC Address + 4LR (new) := Breakpoint‘s PC Address

Example Program





MonitorDebug-Mode






✓✓

✓




Example Program





MonitorDebug-Mode






✓✓

✓



LR = Breakpoint‘s PC Address + 4LR (new) := Breakpoint‘s PC AddressSRSDB Instruction

SRSDB SP!, #0x17



! Write final address back to SPof mode 0x17 (abort mode)

Example Program





MonitorDebug-Mode






✓✓

✓




SRSDB SP!, #0x17




Abort Stack

Example Program





MonitorDebug-Mode






✓✓

✓




SRSDB SP!, #0x17




Abort StackSPSR = CPSR_SYS

LR = PC_SYS

Example Program





MonitorDebug-Mode






✓✓

✓





LR = PC_SYS

Example Program





MonitorDebug-Mode






✓✓

✓





LR = PC_SYSR0

Example Program





MonitorDebug-Mode






✓✓

✓





LR = PC_SYSR0

LR_ABT

Example Program





MonitorDebug-Mode






✓✓

✓




LR = PC_SYSR0

LR_ABT

R7R6R5R4R3R2R1R0

Example Program





MonitorDebug-Mode






✓✓

✓




LR = PC_SYSR0

LR_ABT

R7R6R5R4R3R2R1R0

R0 := Exception ID (3 Prefetch Abort)

Example Program





MonitorDebug-Mode






✓✓

✓




LR = PC_SYSR0

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

R0 := Exception ID (3 Prefetch Abort)

Analyzing handle_exceptions


MonitorDebug-Mode






✓✓

✓



LR = PC_SYSR0

LR_ABT

R7R6R5R4R3R2R1R0

Registers

0xA0: MOV R4, SP0xA2: ADD R4, R4, #640xA4: LDMIA R4!, {R1,R3}0xA6: MRS R2, CPSR0xA8: PUSH {R0-R3}0xAA: SUB R4, R4, #120xAC: STR R1, [R4]0xAE: AND R1, R3, #640xB0: MOV R7, SP0xB2: ADD R7, R7, #880xB4: MOV R6, R120xB6: MOV R5, R110xB8: MOV R4, R100xBA: MOV R3, R90xBC: MOV R2, R80xBE: ADD SP, SP, #720xC0: PUSH {R2-R7}0xC2: SUB SP, SP, #480xC4: BL choose_exception_handler

handle_exceptions

R0 = 3



MonitorDebug-Mode






✓✓

✓



LR = PC_SYSR0

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SPSR = CPSR_SYSLR = PC_SYS

R0PC_SYS



MonitorDebug-Mode







Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

✓✓

✓


R0PC_SYS



MonitorDebug-Mode







Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓


R0PC_SYS



MonitorDebug-Mode







Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8Processor state when

breakpoint was triggered✓✓

✓


R0PC_SYS



MonitorDebug-Mode







Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


R0PC_SYS



MonitorDebug-Mode




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers


handle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID


breakpoint was triggered



• Initialize ABT Stack Pointer• Analyze handle_exceptions function

• Fix LR/SP_ABT LR/SP_SYS• Implement a breakpoint handler• Activate breakpoints

✓✓

✓

0xA0: MOV R4, SP0xA2: ADD R4, R4, #640xA4: LDMIA R4!, {R1,R3}0xA6: MRS R2, CPSR0xA8: PUSH {R0-R3}0xAA: SUB R4, R4, #120xAC: STR R1, [R4]0xAE: AND R1, R3, #640xB0: MOV R7, SP0xB2: ADD R7, R7, #880xB4: MOV R6, R120xB6: MOV R5, R110xB8: MOV R4, R100xBA: MOV R3, R90xBC: MOV R2, R80xBE: ADD SP, SP, #720xC0: PUSH {R2-R7}0xC2: SUB SP, SP, #480xC4: BL choose_exception_handler0xC6: CPSID IF0xC8: ADD SP, SP, #480xCA: POP {R0-R6}

MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registershandle_exceptions

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓

0xA6: MRS R2, CPSR0xA8: PUSH {R0-R3}0xAA: SUB R4, R4, #120xAC: STR R1, [R4]0xAE: AND R1, R3, #640xB0: MOV R7, SP0xB2: ADD R7, R7, #880xB4: MOV R6, R120xB6: MOV R5, R110xB8: MOV R4, R100xBA: MOV R3, R90xBC: MOV R2, R80xBE: ADD SP, SP, #720xC0: PUSH {R2-R7}0xC2: SUB SP, SP, #480xC4: BL choose_exception_handler0xC6: CPSID IF0xC8: ADD SP, SP, #480xCA: POP {R0-R6}0xCC: MOV R8, R00xCE: MOV R9, R10xD0: MOV R10, R20xD2: MOV R11, R30xD4: MOV R12, R40xD6: MOV LR, R60xD8: SUB SP, SP, #600xDA: POP {R0-R7}0xDC: ADD SP, SP, #320xDE: RFEFD SP!

MonitorDebug-Mode







R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓

Restores saved registers


MonitorDebug-Mode







R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


RFEFD Instruction

RFEFD SP!

RFE Return From Exception: writesPC and CPSR back

FD Fulldescending stackSP Points at PC and CPSRSP! Write final address back to SP


MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


RFEFD Instruction

RFEFD SP!




MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


RFEFD Instruction

RFEFD SP!



After handling an exceptionwe can return to regularprogram execution


MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


RFEFD Instruction

RFEFD SP!



✓



MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0


R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID



✓


✓


MonitorDebug-Mode








R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓

choose_exception _handler

0x0F4: CMP R0, #60x0F6: BNE 0xFE0x0F8: CMP R1, #640x0FA: BEQ 0xFE0x0FC: CPSIE F0x0FE: MOV R0, SP0x100: PUSH {LR}0x102: POP {LR}0x104: B handle_FIQ_or_trigger_trap


choose_exception _handlerMonitorDebug-Mode








R0PC_SYS

Calling Prefetch Abort Handler



Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓










R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓

Check whetherException ID (R0) equals 6 (fast interrupt/FIQ)










R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓


Handles FIQ or printsdebug informationand stops execution










R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓


Handles FIQ or printsdebug informationand stops execution

We want tohandle ourbreakpointinstead oftriggeringthe trap










R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓



0x0F0: CMP R0, #30x0F2: BEQ pref_abort









R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓












R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓


pref_abort:0x106: MOV R0, SP0x108: PUSH {LR}0x10A: POP {LR}0x10C: B handle_pref_abort_exception











R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓













R0PC_SYS




Abort Stack

LR_ABT

R7R6R5R4R3R2R1R0

Registers

R0 = 3

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓



First argument points to trace

MonitorDebug-Mode








R0PC_SYS

Fixing LR and SP in Trace



LR_ABT

R7R6R5R4R3R2R1R0

CPSR_SYSCPSR_ABT

PC_SYSException ID

SP_ABTR12R11R10R9R8

✓✓

✓✓

voidhandle_pref_abort_exception(struct trace *trace) {

fix_sp_lr(trace);...

}

voidfix_sp_lr(struct trace *trace){

register unsigned int sp_sys asm("r1");register unsigned int lr_sys asm("r2");

dbg_disable_monitor_mode_debugging();dbg_change_processor_mode(DBG_PROCESSOR_MODE_SYS);asm("mov %[result], sp" : [result] "=r" (sp_sys));asm("mov %[result], lr" : [result] "=r" (lr_sys));dbg_change_processor_mode(DBG_PROCESSOR_MODE_ABT);dbg_enable_monitor_mode_debugging();

trace->lr = lr_sys;trace->sp = sp_sys;

}

Trace

SP_ABT


R0PC_SYSLR_ABT

MonitorDebug-Mode









Trace

R7R6R5R4R3R2R1R0

CPSR_SYSCPSR_ABT

PC_SYSException ID

R12R11R10R9R8

✓✓

✓✓



}





}

Disable debugger and enter System Mode


SP_ABT


R0PC_SYSLR_ABT

MonitorDebug-Mode









Trace

R7R6R5R4R3R2R1R0

CPSR_SYSCPSR_ABT

PC_SYSException ID

R12R11R10R9R8

✓✓

✓✓



}





}


Store SP_SYS and LR_SYS in R1 and R2


SP_ABT


R0PC_SYSLR_ABT

MonitorDebug-Mode









Trace

R7R6R5R4R3R2R1R0

CPSR_SYSCPSR_ABT

PC_SYSException ID

R12R11R10R9R8

✓✓

✓✓



}





}



Return to Abort Mode and re-enable debugger


SP_ABT


R0PC_SYSLR_ABTLR_SYSSP_SYS

MonitorDebug-Mode









Trace

R7R6R5R4R3R2R1R0

CPSR_SYSCPSR_ABT

PC_SYSException ID

R12R11R10R9R8

✓✓

✓✓



}





}



Return to Abort Mode and re-enable debugger

Update Trace

✓


MonitorDebug-Mode







Handling Breakpoints


✓✓

✓✓

✓



}








✓✓

✓✓

✓


fix_sp_lr(trace);

...}

// Do for any of the four hardware breakpointsif(dbg_is_breakpoint_enabled(0)) {

if (dbg_triggers_on_breakpoint_address(0, trace->pc)) {

// Handle Breakpoint:// - Print information// - Change register values in trace

dbg_disable_breakpoint(0);}

}

Simplest ImplementationBreakpoint triggers only once

start:MOV R0, #1MOV R0, #3B start

Supervisor ModeAbort ModeSystem ModeAbort ModeSystem Mode







✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}










✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}


Check whether breakpoint is enabled









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}


Check whether breakpoint is enabledCheck whether breakpoint address equals the

program counter of the system mode









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}




Write code to handle the breakpoint









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}





Disable the breakpoint









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}






Continue firmware execution









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}















✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}







✓






• Fix LR/SP_ABT LR/SP_SYS• Implement a breakpoint handler

• Handle and reset breakpoints• Perform Single-Stepping

• Activate breakpoints



✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}







✓











✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}







✓











✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}






✓



Simplest ImplementationBreakpoint triggers multiple times









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}







✓











✓✓

✓✓

✓


fix_sp_lr(trace);

...}





}







✓



We are in an endlessdebuggingloop

Address Mismatch ImplementationBreakpoint triggers multiple times









✓✓

✓✓

✓


fix_sp_lr(trace);

...}

// Do for any of the four hardware breakpointsif (dbg_is_breakpoint_enabled(0)) {

if (dbg_triggers_on_breakpoint_address (0, trace->pc)) {

// Handle Breakpoint:

breakpoint_hit |= DBGBP0;dbg_set_breakpoint_type_to_instr_addr_mismatch(0);

} else if (breakpoint_hit & DBGBP0) {dbg_set_breakpoint_type_to_instr_addr_match(0);breakpoint_hit &= ~DBGBP0;

}}

✓













✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}


✓













✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}

Check whether breakpoint is enabledCheck whether breakpoint address equals PC_SYS

✓













✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}



✓













✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}



Remember which breakpoint was hit

✓













✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}




✓




Set breakpoint to trigger on address mismatch










✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓














✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓




Set breakpoint to trigger on address mismatchCheck whether we remember that breakpoint was set










✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓





Set breakpoint to trigger on address match










✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓





Set breakpoint to trigger on address matchForget that breakpoint was set










✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓















✓✓

✓✓

✓


fix_sp_lr(trace);

...}






}}





✓





✓

Single-Stepping ImplementationBreakpoint triggers multiple times









✓✓

✓✓

✓


fix_sp_lr(trace);

...}





} else if (breakpoint_hit & DBGBP0) {

// Handle Breakpoint

dbg_set_breakpoint_for_addr_mismatch(0, trace->pc);}

}

✓



✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}


✓



✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}


Write code to handle the first breakpoint

✓



✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}




✓



✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}




✓




✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}





✓




✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}





✓




Write code to handle the single-stepping breakpoint✓










✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}





✓















✓✓

✓✓

✓


fix_sp_lr(trace);

...}








}





✓






✓

Activating Breakpoints



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Debug

ARM DDI 0363G Copyright © 2006-2011 ARM Limited. All rights reserved. 12-14

ID041111 Non-Confidential

12.4.5 CP14 c1, Debug Status and Control Register

The DBGDSCR Register characteristics are:

Purpose Contains status and control information about the debug unit.

Usage constraints See DTR access mode on page 12-18.

Configurations Available in all processor configurations.

Attributes See Table 12-10.

Figure 12-5 shows the DBGDSCR bit assignments.

Figure 12-5 DBGDSCR Register bit assignments

Table 12-10 shows the DBGDSCR bit assignments.

31 30 29 28 16 15 14 13 12 11 10 6 5 2 1 0

MOE

9 78

Core halted

Core restarted

26 25 24 23

PipeAdv

InstrCompl-l

22 21 20 19 18

Monitor debug-mode

Halting debug-mode

ARM

DbgAck

IntDis

Comms

Sticky imprecise abort

Sticky Undefined

Reserved

Sticky precise abort

DTR access

Discard

imprecise

abort

27

Reserved

DTRTXfull

DTRRXfull

Reserved

Reserved

Reserved

DTRTXfull-l

DTRRXfull-l

Table 12-10 DBGDSCR Register bit assignments

Bits Name Function

[31] - RAZ on reads, SBZP on writes.

[30] DTRRXfull The DTRRXfull flag:

0 = Read-DTR, DBGDTRRX is empty. This is the reset value

1 = Read-DTR, DBGDTRRX is full.

When set, this flag indicates to the processor that there is data available to read from the

DBGDTRRX. It is automatically set on writes to the DBGDTRRX by the debugger, and

is cleared when the processor reads the DBGDTRRX over the CP14 interface. If the flag

is not set, reads from the DBGDTRRX return an Unpredictable value.

[29] DTRTXfull The DTRTXfull flag:

0 = Write-DTR, DBGDTRTX is empty. This is the reset value.

1 = Write-DTR, DBGDTRTX is full.

When clear, this flag indicates to the processor that the DBGDTRTX is ready to receive

data. It is automatically cleared on reads of the DBGDTRTX by the debugger, and is set

when the processor writes to the DBGDTRTX over the CP14 interface. If this bit is set and

the processor attempts to write to the DBGDTRTX, the register contents are overwritten

and the DTRRXfull flag remains set.




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Debug












31 30 29 28 16 15 14 13 12 11 10 6 5 2 1 0

MOE

9 78

Core halted

Core restarted

26 25 24 23

PipeAdv

InstrCompl-l

22 21 20 19 18

Monitor debug-mode

Halting debug-mode

ARM

DbgAck

IntDis

Comms


Sticky Undefined

Reserved


DTR access

Discard

imprecise

abort

27

Reserved

DTRTXfull

DTRRXfull

Reserved

Reserved

Reserved

DTRTXfull-l

DTRRXfull-l


Bits Name Function




















Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Debug












31 30 29 28 16 15 14 13 12 11 10 6 5 2 1 0

MOE

9 78

Core halted

Core restarted

26 25 24 23

PipeAdv

InstrCompl-l

22 21 20 19 18

Monitor debug-mode

Halting debug-mode

ARM

DbgAck

IntDis

Comms


Sticky Undefined

Reserved


DTR access

Discard

imprecise

abort

27

Reserved

DTRTXfull

DTRRXfull

Reserved

Reserved

Reserved

DTRTXfull-l

DTRRXfull-l


Bits Name Function

















To which addresses arethe debugging registersmapped?




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

RAM

0x00180000

0x00240000

Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

RAM

0x00180000

0x00240000

Memory MappedPeripherals

0x18000000

0x????????

Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

RAM

0x00180000

0x00240000


0x18000000

0x????????

0x????????

0x????????

Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

RAM

0x00180000

0x00240000


0x18000000

0x????????

0x18007000

0x18007FFC

✓

Memory Map



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



ROM

0x00000000

0x000A0000

RAM

0x00180000

0x00240000


0x18000000

0x????????

0x18007000

0x18007FFC

✓Reminder: We need tounlock debug registers!

Accessing Debug Core



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution Events

Reminder: We need tounlock debug registers!




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4

Technical Reference ManualInitialize Hardware






Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts

Events





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts

Go to SleepWait for Interrupts

Events





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL

Wake up to handle IOCTL





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL


Handle Response





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL


Handle Response

Send IOCTL





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL


Handle Response

Send IOCTL

Wake up to handle IOCTL:DBGLAR = 0xC5ACCE55;

// unlock debug registers





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL


Handle Response

Send IOCTL



Firmware crashes





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4


Firmware Execution

Enable Interrupts


Events

Send IOCTL


Handle Response

Send IOCTL



Firmware crashes

Why can‘t we accessthe debug registers?Is the debug coreeven available?





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4





Reminder: We need tounlock debug registers! Accessing Debug Core



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware

Hook c_main call:DBGLAR = 0xC5ACCE55;





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware



Firmware keeps running

✓Reminder: We need tounlock debug registers! Accessing Debug Core



Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware







Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware




Add code before enabling interrupts:DBGLAR = 0xC5ACCE55;





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware






Firmware crashes




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware






Firmware crashes

Somewhenin betweenaccess todebug corebreaks




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware






Firmware crashes





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware






Firmware crashes


This instruction disabledthe debugging core




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4




Initialize Hardware






Firmware crashes





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Initialize Hardware







Firmware crashes

Somewhenin betweenaccess todebug corebreakssub_184968(v2, 5, 16, 0);




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Initialize Hardware







Firmware crashes





Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Initialize Hardware












Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Initialize Hardware








We managed toreactivate accessto the debuggingcore.




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4



Initialize Hardware






Firmware Crashes



We managed toreactivate accessto the debuggingcore.







✓✓

✓✓

✓✓✓

✓

// Called by c_main_hookvoid set_debug_registers(void) {

dbg_unlock_debug_registers();dbg_disable_breakpoint(0);dbg_disable_breakpoint(1);dbg_disable_breakpoint(2);dbg_disable_breakpoint(3);dbg_enable_monitor_mode_debugging();

dbg_set_breakpoint_for_addr_match(0, 0x126f0);

dbg_set_watchpoint_for_addr_match(0, 0x1FC2A4);}




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓





Unlock access to debugging registers

/* DBGLAR - Lock Access Register */#define DBGLAR (*(volatile int *) (DBGBASE + 0xFB0))#define DBGLAR_UNLOCK_CODE (0xC5ACCE55)

#define dbg_unlock_debug_registers() do { \DBGLAR = DBGLAR_UNLOCK_CODE; \

} while (0)




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓






#define dbg_disable_breakpoint(number) do { \DBGBCR ## number = UPDATE_DBG_REG(DBGBCR ## number, \GET_DBG_MASK(DBGBCR_E), SET_DBG_VALUE(DBGBCR_E, \DBGBCR_E_DISABLED)); \

} while (0)

Disable all four hardware breakpoints




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓






#define dbg_enable_monitor_mode_debugging() do { \DBGDSCR = UPDATE_DBG_REG(DBGDSCR, \GET_DBG_MASK(DBGDSCR_MDBGen), \SET_DBG_VALUE(DBGDSCR_MDBGen, \DBGDSCR_MDBGen_ENABLED)); \

} while (0)


Enable monitor-debug mode




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓






#define dbg_set_breakpoint_for_addr_match(number, address) do { \DBGBCR ## number = 0x0; \DBGBVR ## number = (address) & DBGBVR_ADDRMASK; \DBGBCR ## number = \

SET_DBG_VALUE(DBGBCR_BT, DBGBCR_BT_UNLINKED_INSTR_ADDR_MATCH) | \SET_DBG_VALUE(DBGBCR_MASK, DBGBCR_MASK_NO_MASK) | \SET_DBG_VALUE(DBGBCR_E, DBGBCR_E_ENABLED) | \SET_DBG_VALUE(DBGBCR_SSC_HMC_PMC, DBGBCR_SSC_HMC_PMC__PL0_SUP_SYS) | \SET_DBG_VALUE(DBGBCR_BAS, GET_BAS_FOR_THUMB_ADDR(address)); \

} while (0)



Set breakpoint at beginning of printf function




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core


ARM DDI 0363G (ID041111)

Cortex™

-R4 and Cortex-R4F

Revision: r1p4








✓✓

✓✓

✓✓✓

✓






#define dbg_set_watchpoint_for_addr_match(number, address) do { \DBGWCR ## number = 0x0; \DBGWVR ## number = (address) & DBGWVR_ADDRMASK; \DBGWCR ## number = \

SET_DBG_VALUE(DBGWCR_WT, DBGWCR_WT_UNLINKED_DATA_ADDR_MATCH) | \SET_DBG_VALUE(DBGWCR_MASK, DBGWCR_MASK_NO_MASK) | \SET_DBG_VALUE(DBGWCR_E, DBGWCR_E_ENABLED) | \SET_DBG_VALUE(DBGWCR_SSC_HMC_PAC, DBGWCR_SSC_HMC_PAC__ALL) | \SET_DBG_VALUE(DBGWCR_LSC, DBGWCR_LSC_MATCH_ALL) | \SET_DBG_VALUE(DBGWCR_BAS_4BIT, 0xF); \

} while (0)




Set memory watchpoint on address of“%s: Broadcom SDPCMD CDC driver“




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core







✓✓

✓✓

✓✓✓

✓



RTE (USB-SDIO-CDC) 6.37.32.RC23.34.43 (r639704) on BCM4339 r1 @ 37.4/161.3/161.3MHz000000.010 WP hit pc=00012b3a000000.013 WP hit pc=00012b3a000000.010 sdpcmdcdc0: Broadcom SDPCMD CDC driver000000.141 reclaim section 0: Returned 31688 bytes to the heap000000.189 nexmon_ver: 63fb-dirty-14000000.192 wl_nd_ra_filter_init: Enter..000000.196 TCAM: 256 used: 198 exceed:0000000.200 WP hit pc=000126c2000000.203 reclaim section 1: Returned 71844 bytes to the heap000000.208 BP0 step 0: pc=000126f0 *r1=sdpcmd_dpc000000.213 BP0 step 1: pc=000126f2000000.216 BP0 step 2: pc=000126f4000000.219 BP0 step 3: pc=000126f6000000.223 BP0 step 4: pc=000126fa000000.226 BP0 single-stepping done000000.229 sdpcmd_dpc: Enable000000.234 wl0: wlc_bmac_ucodembss_hwcap: Insuff mem for MBSS: templ memblks 192 fifo ...000000.249 wl0: wlc_enable_probe_req: state down, deferring setting of host flags000000.295 wl0: wlc_enable_probe_req: state down, deferring setting of host flags000000.303 wl0: wlc_enable_probe_req: state down, deferring setting of host flags




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core







✓✓

✓✓

✓✓✓

✓







Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core







✓✓

✓✓

✓✓✓

✓




Why did it not triggeron other printf calls?




Linux Kernel

Apps


Interface to Host


Physical Layer

ARM Microcontroller

ROM RAM

ARM Cortex-R4

Debug Core







✓✓

✓✓

✓✓✓

✓




Why did it not triggeron other printf calls?

✓

Run the Debugger on Your Own!


.org



Clone repository

.org

• buildtools (e.g., compiler)• firmwares (e.g., for BCM4339)• patches

• <chip>• bcm4339

• <firmware version>• 6_37_34_43

• <patch name>• nexmon (monitormode + frame injection)• …

• Makefile• setup_env.sh• …



Clone repository

.org






.org/debugger



Clone repository

.org






.org/debugger

• src• patch.c (basic nexmon initialization)• debugger_base.c (common patches)• debugger.c (particular implementation)• …

• Makefile (build and install patch)• patch.ld (linker file to place patches)• …

Clone repository



Clone repository

.org






.org/debugger

• src• patch.c (basic nexmon initialization)• debugger_base.c (common patches)• debugger.c (particular implementation)• …

• Makefile (build and install patch)• patch.ld (linker file to place patches)• …

Clone repository

nexmon> make && source setup_env.shnexmon> cd patches/bcm4339/ 6_37_34_43/debuggernexmon> make install-firmware

Firmware Patching


patch.asmcontains patches written in ARM assembler

Firmware Patching



Assemblerassembles source files

patch.bincontains machine code binary files of patches

Firmware Patching





firmware.bincontains original firmware for Wi-Fi chip

Firmware Patching





Patching ToolsPython based collection of firmware patching tools

patched_firmware.bincontains patched firmware for Wi-Fi chip


C Based Firmware Patching


C filescontain source code for patches




Compiler

Object filescontain compiled functions and variables with partially unresolved symbols




Compiler


NexmonGCCPlugin

nexmon.precontains extracted address information




Compiler


NexmonGCCPlugin


C




Compiler


NexmonGCCPlugin


__attribute__((at(0x2220A, ”flashpatch”, CHIP_..., FW_...)))BLPatch(hook_name, target_function_name);

C




Compiler


NexmonGCCPlugin



C




Compiler


NexmonGCCPlugin





Compiler


NexmonGCCPlugin


Linker filescontain address information to place functions




Compiler


NexmonGCCPlugin



Makefiles filescontain commands to extract functions and variables from linker output and insert them into the firmware




Compiler


NexmonGCCPlugin




Linker

patch.elf filecontains placed functions and variables with resolved symbols




Compiler


NexmonGCCPlugin




Linker


firmware.binoriginal firmware file




Compiler


NexmonGCCPlugin




Linker


firmware.binoriginal firmware file

patched_fw.binmodified firmware file

Makefile

Patch Placement


C

#pragma NEXMON targetregion "patch"

void target_function_name(int a) {so_something(a);

}

__attribute__((at(0x2220A, ”flashpatch", CHIP_..., FW_...)))BLPatch(hook_name, target_function_name);

Patch Placement


C

RAM of a BCM4339 in Nexus 5:



}


Patch Placement


C


free



}


Patch Placement


C


free

RAM of most other BCM chips:



}


Patch Placement


C


free




}


Patch Placement


C


free




}


D11 firmware

D11 firmware

Patch Placement


C


free




}


D11 firmware

D11 firmware

D11 comp. fw

D11 comp. fw

free

free

Patch Placement


C


free




}


D11 firmware

D11 firmware

D11 comp. fw

D11 comp. fw

free

free

generally assigned to heap

Applications using Nexmon


Massive Reactive Smartphone-Based

Jamming using Arbitrary Waveforms and Adaptive

Power Control,Best Paper at WiSec’17

Nexmon Penetration Testing App with Monitor Mode, Frame

Injection, Airodump View and Wireshark Dissection,

Google Play Store

Compressive Millimeter-Wave Sector Selection in

Off-the-Shelf IEEE 802.11ad Devices,

CoNEXT’17

SourceCode and

Results availableat https://nexmon.org

Third-Party Applications using Nexmon


Reversing IoT: Xiaomi EcosystemGain cloud independence and

additional functionality by firmware modification,

Recon BRX ‘18

Breaking Fitness Records without Moving:Reverse Engineering and Spoofing Fitbit,

RAID‘18

100 stepsat a time

More Exciting Nexmon Results


My PhD defenseFebruary 26, 2018 at 1 pm@ TU Darmstadt, Germany


Matthias SchulzDepartment of Computer Science

SEEMOOMornewegstr. 3264293 Darmstadt/[email protected]

Twitter @nexmon_devPhone +49 6151 16-25478Fax +49 6151 16-25471www.seemoo.tu-darmstadt.de

diy arm debugger for wi-fi chips using nexmon to … · diy arm debugger for wi-fi chips using...

Documents