This commit is contained in:
2026-10-23 10:48:05 +02:00
commit 9615b5d42f
10 changed files with 529 additions and 0 deletions
+231
View File
@@ -0,0 +1,231 @@
pwndbg: loaded 199 pwndbg commands. Type pwndbg [filter] for a list.
pwndbg: created 12 GDB functions (can be used with print/break). Type help function to see them.
Reading symbols from firmware.elf...
------- tip of the day (disable with set show-tips off) -------
Try splitting the context output into multiple TUI windows using layout pwndbg (tui disable or ctrl-x + a to go back to CLI mode)
Remote debugging using /dev/ttyACM0
0x0000028c in ?? ()
Warning: Avoided exploring possible address 0x200003fc.
You can explicitly explore it with `vmmap-explore 0x20000000` or disable automatic exploration with `set auto-explore-pages no`.
Warning: Avoided exploring possible address 0x674.
You can explicitly explore it with `vmmap-explore 0x0` or disable automatic exploration with `set auto-explore-pages no`.
Unknown register: 'a6'
Unknown register: 'a7'
Unknown register: 's2'
Unknown register: 's3'
Unknown register: 's4'
Unknown register: 's5'
Unknown register: 's6'
Unknown register: 's7'
Unknown register: 's8'
Unknown register: 's9'
Unknown register: 's10'
Unknown register: 's11'
Unknown register: 't3'
Unknown register: 't4'
Unknown register: 't5'
Unknown register: 't6'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────────────────────────────────
GP 0x200003fc ◂— 0x8733c872
TP 0x95596104
T0 0x674 ◂— 0xffffffff
T1 1 (InterruptVectorDefault+1) ◂— 0xfa000
T2 0x20740c40 ('@\x0ct ')
S0 0x129031c0
S1 0x98029234
A0 0x2046a5c8
A1 0xfffc0600
A2 0x16e360
A3 0x40011000
A4 0xe000f000
A5 0x40011400
SP 0x200007fc —▸ 0x3ee ◂— 0xffffffff
RA 0x21e (main+6) ◂— 0x40021737
PC 0x28c ◂— 0x8d89470c
───────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / rv32 / set emulate on ]───────────────────────────────────────────────────────────────────────────────────────────────────────
► 0x28c c.lw a1, 8(a4) <Cannot dereference [0xe000f008]>
0x28e c.sub a1, a0
0x290 bltz a1, 0x28c <0x28c>
0x294 c.lui a1, InterruptVectorDefault+16 A1 => 0x10000
0x296 c.sw a1, 0x10(a5)
0x298 lui a0, handle_reset+6 A0 => 0x100000
0x29c c.sw a0, 0x10(a5)
0x29e lui a0, 0x400 A0 => 0x400000
0x2a2 c.sw a0, 0x10(a5)
0x2a4 c.sw a1, 0x10(a3)
0x2a6 c.lw a0, 8(a4)
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ sp 0x200007fc —▸ 0x3ee ◂— 0xffffffff
<Could not read memory at 0x20000800>
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
► 0 0x28c
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Loading section .init, size 0xa0 lma 0x0
Loading section .text, size 0x1cc lma 0xa0
Start address 0x00000000, load size 620
Transfer rate: 5 KB/sec, 310 bytes/write.
❌️ Target does not support this command.
Starting program: /home/lukas/code/ch32v003/ch32fun-template/firmware.elf
Program received signal SIGTRAP, Trace/breakpoint trap.
0x00000262 in DelaySysTick (n=0x16e360) at /home/lukas/code/ch32fun/ch32fun/ch32fun.c:1890
1890 while( ((int32_t)( SysTick->CNT - targend )) < 0 );
Warning: Avoided exploring possible address 0x200003fc.
You can explicitly explore it with `vmmap-explore 0x20000000` or disable automatic exploration with `set auto-explore-pages no`.
Warning: Avoided exploring possible address 0x674.
You can explicitly explore it with `vmmap-explore 0x0` or disable automatic exploration with `set auto-explore-pages no`.
Unknown register: 'a6'
Unknown register: 'a7'
Unknown register: 's2'
Unknown register: 's3'
Unknown register: 's4'
Unknown register: 's5'
Unknown register: 's6'
Unknown register: 's7'
Unknown register: 's8'
Unknown register: 's9'
Unknown register: 's10'
Unknown register: 's11'
Unknown register: 't3'
Unknown register: 't4'
Unknown register: 't5'
Unknown register: 't6'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────────────────────────────────
GP 0x200003fc ◂— 0x8733c872
TP 0x95596104
T0 0x674 ◂— 0xffffffff
T1 1 (InterruptVectorDefault+1) ◂— 0xfa000
T2 0x20740c40 ('@\x0ct ')
S0 0 (InterruptVectorDefault) ◂— j handle_reset /* 'o' */
S1 0x98029234
A0 0x10000
A1 0x2a5250d0
A2 0xfff49eb2
A3 0x16e360
A4 0xe000f000
A5 0x40011400
SP 0x200007fc —▸ 0x21e (main+6) ◂— 0x40021737
RA 0x21e (main+6) ◂— 0x40021737
PC 0x262 (main+74) ◂— 0x8e0d4710
───────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / rv32 / set emulate on ]───────────────────────────────────────────────────────────────────────────────────────────────────────
► 0x262 <main+74> c.lw a2, 8(a4) <Cannot dereference [0xe000f008]>
0x264 <main+76> c.sub a2, a1
0x266 <main+78> bltz a2, main+74 <main+74>
0x26a <main+82> c.j main+52 <main+52>
↓
0x24c <main+52> sw t1, 0x10(a5)
0x250 <main+56> c.lw a1, 8(a4)
0x252 <main+58> c.add a1, a3
0x254 <main+60> c.lw a2, 8(a4)
0x256 <main+62> c.sub a2, a1
0x258 <main+64> bltz a2, main+60 <main+60>
0x25c <main+68> c.sw a0, 0x10(a5)
───────────────────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/lukas/code/ch32fun/ch32fun/ch32fun.c:1890
1884 #endif
1885
1886 void DelaySysTick( uint32_t n )
1887 {
1888 #if defined(CH32V003) || defined(CH32V00x)
1889 uint32_t targend = SysTick->CNT + n;
► 1890 while( ((int32_t)( SysTick->CNT - targend )) < 0 );
1891 #elif defined(CH32V20x) || defined(CH32V30x) || defined(CH32X03x) || defined(CH32L103) || defined(CH582_CH583) || defined(CH591_CH592)
1892 uint64_t targend = SysTick->CNT + n;
1893 while( ((int64_t)( SysTick->CNT - targend )) < 0 );
1894 #elif defined(CH32V10x) || defined(CH570_CH572) || defined(CH584_CH585) || defined(CH32H41x)
1895 uint32_t targend = SysTick->CNTL + n;
1896 while( ((int32_t)( SysTick->CNTL - targend )) < 0 );
1897 #elif defined(CH571_CH573)
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ sp 0x200007fc —▸ 0x21e (main+6) ◂— 0x40021737
<Could not read memory at 0x20000800>
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
► 0 0x262 main+74
1 0x262 main+74
2 0x21e main+6
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Continuing.
Program received signal SIGTRAP, Trace/breakpoint trap.
0x00000264 in DelaySysTick (n=0x16e360) at /home/lukas/code/ch32fun/ch32fun/ch32fun.c:1890
1890 while( ((int32_t)( SysTick->CNT - targend )) < 0 );
Unknown register: 'a6'
Unknown register: 'a7'
Unknown register: 's2'
Unknown register: 's3'
Unknown register: 's4'
Unknown register: 's5'
Unknown register: 's6'
Unknown register: 's7'
Unknown register: 's8'
Unknown register: 's9'
Unknown register: 's10'
Unknown register: 's11'
Unknown register: 't3'
Unknown register: 't4'
Unknown register: 't5'
Unknown register: 't6'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────────────────────────────────
GP 0x200003fc ◂— 0x8733c872
TP 0x95596104
T0 0x674 ◂— 0xffffffff
T1 1 (InterruptVectorDefault+1) ◂— 0xfa000
T2 0x20740c40 ('@\x0ct ')
S0 0 (InterruptVectorDefault) ◂— j handle_reset /* 'o' */
S1 0x98029234
A0 0x10000
*A1 0x2c77a1eb
*A2 0x2c6fd6a6
A3 0x16e360
A4 0xe000f000
A5 0x40011400
SP 0x200007fc —▸ 0x21e (main+6) ◂— 0x40021737
RA 0x21e (main+6) ◂— 0x40021737
*PC 0x264 (main+76) ◂— 0x4ee38e0d
───────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / rv32 / set emulate on ]───────────────────────────────────────────────────────────────────────────────────────────────────────
0x262 <main+74> c.lw a2, 8(a4) <Cannot dereference [0xe000f008]>
► 0x264 <main+76> c.sub a2, a1 A2 => 0xfff834bb (0x2c6fd6a6 - 0x2c77a1eb)
0x266 <main+78> ✔ bltz a2, main+74 <main+74>
↓
0x262 <main+74> c.lw a2, 8(a4) <Cannot dereference [0xe000f008]>
0x264 <main+76> c.sub a2, a1 A2 => 0x2c6fd6a6 - 0x2c77a1eb
0x266 <main+78> bltz a2, main+74 <main+74>
0x26a <main+82> c.j main+52 <main+52>
↓
0x24c <main+52> sw t1, 0x10(a5)
0x250 <main+56> c.lw a1, 8(a4)
0x252 <main+58> c.add a1, a3
0x254 <main+60> c.lw a2, 8(a4)
───────────────────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/lukas/code/ch32fun/ch32fun/ch32fun.c:1890
1884 #endif
1885
1886 void DelaySysTick( uint32_t n )
1887 {
1888 #if defined(CH32V003) || defined(CH32V00x)
1889 uint32_t targend = SysTick->CNT + n;
► 1890 while( ((int32_t)( SysTick->CNT - targend )) < 0 );
1891 #elif defined(CH32V20x) || defined(CH32V30x) || defined(CH32X03x) || defined(CH32L103) || defined(CH582_CH583) || defined(CH591_CH592)
1892 uint64_t targend = SysTick->CNT + n;
1893 while( ((int64_t)( SysTick->CNT - targend )) < 0 );
1894 #elif defined(CH32V10x) || defined(CH570_CH572) || defined(CH584_CH585) || defined(CH32H41x)
1895 uint32_t targend = SysTick->CNTL + n;
1896 while( ((int32_t)( SysTick->CNTL - targend )) < 0 );
1897 #elif defined(CH571_CH573)
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ sp 0x200007fc —▸ 0x21e (main+6) ◂— 0x40021737
<Could not read memory at 0x20000800>
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
► 0 0x264 main+76
1 0x264 main+76
2 0x21e main+6
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Detaching from program: /home/lukas/code/ch32v003/ch32fun-template/firmware.elf, Remote target
[Inferior 1 (Remote target) detached]