mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-08-29 22:30:44 +02:00
Refactor E and S
This commit is contained in:
+10
-10
@@ -1,13 +1,13 @@
|
||||
# Embedded Systems Reverse Engineering
|
||||
# Embedded Systems Reverse Engineering
|
||||
[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
|
||||
|
||||
## Week 6
|
||||
Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics
|
||||
|
||||
### Exercise 3: Make the Overflow Happen Faster
|
||||
### Non-Credit Practice Exercise 3: Make the Overflow Happen Faster
|
||||
|
||||
#### Objective
|
||||
Patch the `adds r3, #0x1` instruction — which increments `static_fav_num` by 1 each loop iteration — to `adds r3, #0xa` so the variable increments by 10 instead. Use GDB to locate the instruction, calculate the hex editor file offset, patch the binary, and verify on hardware that the `uint8_t` overflow occurs roughly 10 times sooner.
|
||||
Patch the `adds r3, #0x1` instruction — which increments `static_fav_num` by 1 each loop iteration — to `adds r3, #0xa` so the variable increments by 10 instead. Use GDB to locate the instruction, calculate the hex editor file offset, patch the binary, and verify on hardware that the `uint8_t` overflow occurs roughly 10 times sooner.
|
||||
|
||||
#### Prerequisites
|
||||
- Completed Week 6 tutorial (GDB and hex editor sections)
|
||||
@@ -61,7 +61,7 @@ Look for this sequence:
|
||||
```
|
||||
0x10000278: ldrb r3, [r4, #0] ; Load static_fav_num from RAM
|
||||
0x1000027a: movs r2, #16 ; LED GPIO pin number
|
||||
0x1000027c: adds r3, #1 ; Increment by 1 ← THIS IS OUR TARGET
|
||||
0x1000027c: adds r3, #1 ; Increment by 1 ? THIS IS OUR TARGET
|
||||
0x1000027e: strb r3, [r4, #0] ; Store back to RAM
|
||||
```
|
||||
|
||||
@@ -116,10 +116,10 @@ For the `adds r3, #0x1` instruction at its address, calculate the offset.
|
||||
2. Press **Ctrl+G** (Go to offset) and enter the calculated offset
|
||||
3. You should see the byte `01` followed by `33`
|
||||
4. Change `01` to `0A` (10 in decimal)
|
||||
5. Verify: the bytes should now read `0A 33` — encoding `adds r3, #0xa`
|
||||
6. Click **File** → **Save As** → `0x0014_static-variables-h.bin` (in the same `build` directory)
|
||||
5. Verify: the bytes should now read `0A 33` — encoding `adds r3, #0xa`
|
||||
6. Click **File** ? **Save As** ? `0x0014_static-variables-h.bin` (in the same `build` directory)
|
||||
|
||||
> 🔍 **Why this works:** In Thumb `adds rD, #imm8` encoding, the immediate value is stored in the first byte. The `#imm8` field accepts values 0-255, so changing 1 to 10 is safe.
|
||||
> ?? **Why this works:** In Thumb `adds rD, #imm8` encoding, the immediate value is stored in the first byte. The `#imm8` field accepts values 0-255, so changing 1 to 10 is safe.
|
||||
|
||||
##### Step 7: Convert to UF2 and Flash
|
||||
|
||||
@@ -139,7 +139,7 @@ python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --fam
|
||||
regular_fav_num: 42
|
||||
static_fav_num: 42
|
||||
regular_fav_num: 42
|
||||
static_fav_num: 52 ← Jumped by 10!
|
||||
static_fav_num: 52 ? Jumped by 10!
|
||||
regular_fav_num: 42
|
||||
static_fav_num: 62
|
||||
...
|
||||
@@ -148,10 +148,10 @@ static_fav_num: 242
|
||||
regular_fav_num: 42
|
||||
static_fav_num: 252
|
||||
regular_fav_num: 42
|
||||
static_fav_num: 6 ← Overflow! 252 + 10 = 262, but uint8_t wraps: 262 - 256 = 6
|
||||
static_fav_num: 6 ? Overflow! 252 + 10 = 262, but uint8_t wraps: 262 - 256 = 6
|
||||
```
|
||||
|
||||
Notice the overflow now happens much sooner, and the wrap value is no longer 0 — it's 6 because `252 + 10 = 262` which wraps to `262 mod 256 = 6`.
|
||||
Notice the overflow now happens much sooner, and the wrap value is no longer 0 — it's 6 because `252 + 10 = 262` which wraps to `262 mod 256 = 6`.
|
||||
|
||||
#### Expected Output
|
||||
|
||||
|
||||
Reference in New Issue
Block a user