Package: pyrsp
* pyrsppyrsp is a simple wrapper around the [[https://sourceware.org/gdb/current/onlinedocs/gdb/Remote-Protocol.html#Remote-Protocol][GDB Remote serialprotocol]]. Currently ARM Cortex M3 devices can be tested with the[[https://github.com/gsmcmullin/blackmagic][Blackmagic JTAG debugger]] and i386 and AMD64 qemu targets are supportedwith qemu. But it should be very simple to support other devices thatspeak this protocol e.g. buspirates via OpenOCD.Possible uses: on-device unit testing, fuzzing, reverse engineering.Currently you can load/dump memory, set/clear breakpoints, load extrainformation (symbols, debug info, .text segment) from an elf file,dispatch callbacks on breakpoints, run the binary associated with theelf file and display source code associated with addresses.** depends#+BEGIN_EXAMPLEpip install pyelftools pyserial construct six#+END_EXAMPLE** changes*** v0.4 - Thanks <3 Willem, Vasily and Dmitry from ispras.ru- python3 support- support for debugging multithreading userspace programs- more robust qemu debugging- much improved tests- RLE data handling in protocol- support for new construct api*** v0.3- support for STLink2 devices- rudimentary support for dumping fault status and mpu registers- fixes*** v0.2- refactored rsp parts into elf.py and utils.py- support for i386 and AMD64 qemu targets- timeout in readpkt- extract .text directly from elf, do not require .bin- support slice operator for memory ops- use reported packetSize- threadinfo support** python example#+BEGIN_EXAMPLE pythonfrom rsp import RSPrsp = RSP('/dev/ttyACM0', 'test.elf') # expects test.elf to existrsp.load() # load test.elf into workarea (.text segment)def br_cb(self):# dump regsself.dump_regs()# retrieve some dataprint self.dump(10, 0x20000000)# set up some dataself.store("aaaaa", 0x20000000)# adjust some registerself.set_reg('r0',0)# continue and leave breakpoint intactself.step_over_br()# attach breakpoints to callbacksrsp.set_br('rsp_finish', rsp.finish_cb)rsp.set_br('rsp_dump', rsp.dump_cb)rsp.set_br('my_fun', br_cb)# run binary in mainloop until rsp_finish is hit# or some unhandled signal occursrsp.run()#+END_EXAMPLEshould produce the output in the next part, however a similarresult, barring the custom callback can also be produced byrunning:#+BEGIN_EXAMPLE$ rsp.py /dev/ttyACM0 test#+END_EXAMPLE** Example sessionsee the code running below in example/#+BEGIN_EXAMPLEwork area: 0x20019000entry: 0x20019001Available Targets:No. Att Driver1      STM32F4xxr0       r1       r2       r3       r4       r5       r6       r7       r8       r9      r10      r11      r12       sp       lr       pc     xpsr      msp      psp2001f6b4 00000004 00000000 00000000 2001f6b4 2001f754 00000020 00008000 000000ff 2001fb9c 00000020 00000000 08001f31 2001f6b0 2001902b 20019036 21000003 2001f6b0 00000000load test.binverify test OKset break: @rsp_finish (0x20019036) OKset break: @rsp_dump (0x20019034) OKset new pc: @test (0x20019001) OKcontinuingr0       r1       r2       r3       r4       r5       r6       r7       r8       r9      r10      r11      r12       sp       lr       pc     xpsr      msp      psp2001f6a4 00000004 00000000 00000000 2001f6a4 2001f754 00000020 00008000 000000ff 2001fb9c 00000020 00000000 08001f31 2001f6a0 20019013 20019034 21000003 2001f6a0 00000000breakpoint hit: rsp_dumptest.c:5 rsp_dump((unsigned char*) &number, 4);00000000 ....r0       r1       r2       r3       r4       r5       r6       r7       r8       r9      r10      r11      r12       sp       lr       pc     xpsr      msp      psp20019038 0000000b 00000000 00000000 2001f6a4 2001f754 00000020 00008000 000000ff 2001fb9c 00000020 00000000 08001f31 2001f6a0 2001901b 20019034 21000003 2001f6a0 00000000breakpoint hit: rsp_dumptest.c:6 rsp_dump((unsigned char*) "hello world",11);68656c6c6f20776f 726c64 hello.worldr0       r1       r2       r3       r4       r5       r6       r7       r8       r9      r10      r11      r12       sp       lr       pc     xpsr      msp      psp2001f6a4 00000004 00000000 00000000 2001f6a4 2001f754 00000020 00008000 000000ff 2001fb9c 00000020 00000000 08001f31 2001f6a0 20019027 20019034 21000003 2001f6a0 00000000breakpoint hit: rsp_dumptest.c:8 rsp_dump((unsigned char*) &number, 4);55aa55aa U.U.r0       r1       r2       r3       r4       r5       r6       r7       r8       r9      r10      r11      r12       sp       lr       pc     xpsr      msp      psp2001f6a4 00000004 00000000 00000000 2001f6a4 2001f754 00000020 00008000 000000ff 2001fb9c 00000020 00000000 08001f31 2001f6a0 2001902b 20019036 21000003 2001f6a0 00000000breakpoint hit: rsp_finishclear breakpoint: @rsp_dump (0x20019034) OKclear breakpoint: @rsp_finish (0x20019036) OKcontinuing and detaching#+END_EXAMPLE** Python API#+BEGIN_EXAMPLE pythonRSP(self, port, elffile=None, verbose=False)#+END_EXAMPLEreads the elf file if given by elffile, connects to the debuggingdevice specified by port, and initializes itself.#+BEGIN_EXAMPLE pythonsend(self, data, retries=50)#+END_EXAMPLEsends data via the RSP protocol to the device#+BEGIN_EXAMPLE pythonreadpkt(self, timeout=0)#+END_EXAMPLEblocks until it reads an RSP packet and returns it's data or timeout>0 expires#+BEGIN_EXAMPLE pythonstore(self, data, addr=None)#+END_EXAMPLEstores data at addr if given otherwise at beginning of .text segmentaka self.workarea#+BEGIN_EXAMPLE pythondump(self, size, addr = None)#+END_EXAMPLEdumps data from addr if given otherwise at beginning of .text segmentaka self.workarea#+BEGIN_EXAMPLE pythonfetch(self,data)#+END_EXAMPLEsends data and returns reply#+BEGIN_EXAMPLE pythonfetchOK(self,data,ok='OK')#+END_EXAMPLEsends data and expects success#+BEGIN_EXAMPLE pythonset_reg(self, reg, val)#+END_EXAMPLEsets value of register reg to val on device#+BEGIN_EXAMPLE pythonrefresh_regs(self)#+END_EXAMPLEloads and caches values of the registers on the device#+BEGIN_EXAMPLE pythondump_regs(self)#+END_EXAMPLErefreshes and dumps registers via stdout#+BEGIN_EXAMPLE pythonconnect(self)#+END_EXAMPLEImplements device specific connection procedure, e.g. attaches toblackmagic jtag debugger in swd mode#+BEGIN_EXAMPLE pythonrun(self, start=None)#+END_EXAMPLEsets pc to start if given or to entry address from elf header, passescontrol to the device and handles breakpoints#+BEGIN_EXAMPLE pythonhandle_br(self)#+END_EXAMPLEdumps register on breakpoint/signal, continues if unknown,otherwise it calls the appropriate callback.#+BEGIN_EXAMPLE pythonset_br(self, sym, cb, quiet=False)#+END_EXAMPLEsets a breakpoint at symbol sym, and install callback cb for it#+BEGIN_EXAMPLE pythondel_br(self, addr, quiet=False)#+END_EXAMPLEdeletes breakpoint at address addr#+BEGIN_EXAMPLE pythonfinish_cb(self)#+END_EXAMPLEfinal breakpoint, if hit it deletes all breakpoints, continues runningthe cpu, and detaches from the debugging device#+BEGIN_EXAMPLE pythonget_src_line(self, addr)#+END_EXAMPLEreturns the source-code line associated with address addr#+BEGIN_EXAMPLE pythondump_cb(self)#+END_EXAMPLErsp_dump callback, hit if rsp_dump is called. Outputs to stdout thesource line, and a hexdump of the memory pointed by $r0 with a size of$r1 bytes. Then it resumes running.#+BEGIN_EXAMPLE pythonload(self, verify)#+END_EXAMPLEloads binary belonging to elf to beginning of .text segment (aliasself.workarea), and if verify is set read it back and check if itmatches with the uploaded binary.#+BEGIN_EXAMPLE pythoncall(self, start=None, finish='rsp_finish', dump='rsp_dump', verify=True)#+END_EXAMPLE1. Loads the .text segment given by self.elf into the device at the workarea (.text seg) of the device.2. and starts execution at the function specified by start or elf e_entry.3. After the breakpoint of rsp_dump is hit, r1 bytes are dumped from the buffer pointed to by r0.4. After the breakpoint of rsp_finish is hit, it removes all break points, and detaches#+BEGIN_EXAMPLE pythonget_thread_info()#+END_EXAMPLEreturns a tuple consisting of:- current thread id,- extra thread info,- list of all threads#+BEGIN_EXAMPLE pythonrsp[0:100]#+END_EXAMPLEreturns 1st 100 bytes from memory#+BEGIN_EXAMPLE pythonrsp[100]="hello world"#+END_EXAMPLEStores the string "hello world" at address 100 in memory** trigger functions for breakpointsIf you run your code on an ARMv7, you can call and link the code inrsp.s and rsp.h. It only costs you 4 bytes.If you use C language for instrumentation GCC might optimize out verysimple finish functions, to avoid this you can use the example below:#+BEGIN_EXAMPLE__attribute__ ((noinline)) void rsp_finish(void) {while(1);}__attribute__ ((noinline)) void rsp_dump(void) {__asm__("nop;");}#+END_EXAMPLE