リセットとフリーズで解析する電子辞書リバエン記 / reverse-engineer-e-dictionaries-with-reset-and-freeze

Kernel/VM 探検隊 online part4 LT
小説版: https://www.zopfco.de/entry/reset_freeze_re

Transcript

1. Kernel/VM online part
   4
   LT
   @puhitaku
   

   View Slide

2. Takumi Sueda @puhitaku
   
   
   
   
   NICT
   

   HOMMA Inc.
   

   
   
   Twitter
   

   
   
   
   
   
   
   
   
   
   
   
   
   

   View Slide

3. SHARP Brain
   SHARP Windows CE
   
   

   CE exe (PE)
   
   
   
   
   2011
   
   
   TOSHIBA TMPA
   9 10
   CRAXBG (armv
   5
   tej) +
   64
   MiB DRAM
   
   
   Windows CE
   
   
   2012 2020
   
   
   NXP i.MX
   2
   83
   (armv
   5
   tej) +
   12
   8
   MiB DRAM
   
   
   Windows CE
   
   
   2021
   
   
   ???
   SHARP Brain
   3
   https://jp.sharp/edictionary/products/pwsh
   1
   _overviiew.html
   

   View Slide

4. SHARP Brain
   2019 2020 SHARP Brain PW-SH
   1
   Linux
   
   
   +
   i.MX
   283
   
   Raspberry Pi Brain
   Linux SD
   Brain Linux
   4
   https://jp.sharp/edictionary/products/pwsh
   1
   _overviiew.html
   

   View Slide

5. 2021 1
   
   
   Brain
   

   View Slide

6. Brain
   https://jp.sharp/edictionary/topics/
   6
   

   View Slide

7. Brain
   https://brain-library.com/
   7
   

   View Slide

8. Brain
   OS
   

   SoC i.MX
   283
   
   
   
   
   8
   

   View Slide

9. Brain 9
   

   View Slide

10. Brain 10
    

    View Slide

11. Brain 11
    

    View Slide

12. Brain
    SoC NXP i.MX
    7
    ULP i.MX
    7
    ULP = Cortex-A
    7
    + Cortex-M
    4
    12
    

    View Slide

13. Brain
    (Windows CE PE)
    
    
    
    
    OS
    
    
    13
    

    View Slide

14. View Slide

15. 

    objdump
    
    
    0 Arm
    15
    

    View Slide

16. 

    as ELF .text
    16
    

    View Slide

17. View Slide

18. 
    
    
    resource hog
    
    
    18
    

    

    View Slide

19. _start return
    19
    

    View Slide

20. View Slide

21. 0x
    00
    0000
    00 

    21
    

    View Slide

22. 
    
    return
    
    
    0
    x
    0
    00000 0
    0
    22
    
    
    

    View Slide

23. U-Boot
    

    View Slide

24. U-Boot
    1
    . MMU
    
    
    2
    . MMU U-Boot
    
    
    
    
    U-Boot
    24
    

    View Slide

25. U-Boot
    & OS API
    
    
    JTAG
    
    
    UART TX UART
    
    
    

    I/O
    25
    

    View Slide

26. U-Boot
    
    
    
 

    1bit
    
    
    
    
    26
    

    View Slide

27. U-Boot
    
    
    1 MMU
    

    View Slide

28. U-Boot MMU
    MMU mrc SCTSR MMU
    mcr
    MMU
    28
    SCTSR
    

    View Slide

29. U-Boot MMU
    mrc
    

    29
    

    View Slide

30. U-Boot MMU 30
    

    View Slide

31. U-Boot MMU
    mrc SCTSR return
    31
    
    
    

    View Slide

32. U-Boot
    
    
    2 U-Boot
    

    View Slide

33. U-Boot U-Boot
    U-Boot MMU
    

    U-Boot
    3 :
    
    
    1
    . Brain
    
    
    2
    . DRAM 1. 1.
    
    
    3
    . 2. 64 KiB (large page) 1.
    U-Boot
    33
    

    View Slide

34. U-Boot
    
    
    2 U-Boot
    
    
    1
    

    View Slide

35. U-Boot U-Boot
    1
    35
    Brain
    1
    MiB
    NOP
    
    
    mov pc, lr
    NOP = mov r0, r0
    

    View Slide

36. U-Boot U-Boot
    1
    36
    
    
    1
    5
    MiB
    Brain
    15 MiB
    
    
    1 (
    4
    Bytes)
    
    
    1
    5
    MiB DRAM 128 MiB 11.7%
    

    View Slide

37. U-Boot
    
    
    2 U-Boot
    
    
    2
    

    

    View Slide

38. U-Boot U-Boot 38
    NOP
    MMU
    
    
    NOP
    1
    NOP
    6
    4
    KiB
    NOP NOP
    ………
    2 1
    

    View Slide

39. U-Boot U-Boot
    2
    39
    Virtual
    

    Memory
    
    
    1
    5
    MiB
    1
    MMU
    Physical
    

    Memory
    MMU
    
    
    

    View Slide

40. U-Boot U-Boot
    2
    40
    1
    Physical
    

    Memory
    0
    x
    6000
    000
    0
    0
    x
    6800
    000
    0
    1
    

    !"#$ %&'( !"#$
    1
    
    
    

    View Slide

41. U-Boot U-Boot
    2
    41
    1
    Physical
    

    Memory
    0
    x
    6
    78000 0
    0
    DRAM 15 MiB
    

    %&'(
    0
    x
    6000
    000
    0
    0
    x
    6800
    000
    0
    

    View Slide

42. U-Boot
    
    
    2 U-Boot
    
    
    3
    

    

    View Slide

43. U-Boot U-Boot 43
    2
    

    MMU
    
    
    NOP NOP
    6
    4
    KiB
    NOP
    3 1
    NOP NOP NOP NOP
    

    View Slide

44. U-Boot U-Boot 44
    112 64 KiB
    NOP NOP
    6
    4
    KiB
    3 1
    NOP NOP NOP NOP
    112
    …
    

    View Slide

45. U-Boot U-Boot
    1
    . ✅ U-Boot
    
    
    2
    . ✅ MMU
    
    
    3
    . ✅ MMU U-Boot
    
    
    1
    5
    MiB 0x
    7 0
    0 0
    0 0
    u-boot.bin
    

    0x
    67
    800000
    U-Boot
    U-Boot
    45
    

    View Slide

46. U-Boot
    

    View Slide

47. U-Boot
    i.MX
    7
    ULP con
    fi
    g
    

    
    
    
    47
    

    View Slide

48. U-Boot 48
    

    View Slide

49. U-Boot
    U-Boot shell
    49
    

    View Slide

50. Linux
    

    View Slide

51. Linux
    U-Boot Image
    
    
    printk UART
    
    
    Linux
    51
    

    View Slide

52. Linux
    @pepepper_cpp Mailbox Unit
    Linux MU
    
    
    
    
    NXP upstream MU
    merge
    52
    

    View Slide

53. Linux
    Linux
    
    
    Linux
    53
    

    View Slide

54. View Slide

55. μITRON RTOS
    
    
    
    
    I/O I/O
    
    
    
    
    55
    

    View Slide

56. &
    
    
    Speakerdeck
    56
    

    View Slide