diff --git a/WEEK04/WEEK04-BN.md b/WEEK04/WEEK04-BN.md index e90e210..d9bb928 100644 --- a/WEEK04/WEEK04-BN.md +++ b/WEEK04/WEEK04-BN.md @@ -562,6 +562,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length and handles step-over itself. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. Stops are reported as `Breakpoint` (not `SingleStep`). > @@ -1725,9 +1734,11 @@ That is the UART transmit-FIFO drain loop inside `printf`, so the core is runnin If Binary Ninja has created a function at `0x1000320c` (for example because the debugger stopped at that PC), the decompiler shows garbage: registers named `entry_r4`/`entry_r5`, and stores to invented constants like `0x3a` and `0xfffffff6`. Delete that bogus function (right-click it -> `Delete Function`, or put the cursor on it and press `U` to undefine) and reanalyze. The real function is `stdio_uart_out_flush` at `0x10003208`. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### `Connect to Remote Process` is greyed out and Pause does nothing diff --git a/WEEK04/WEEK04-BN.pdf b/WEEK04/WEEK04-BN.pdf index 0ea48d6..a77e1af 100644 Binary files a/WEEK04/WEEK04-BN.pdf and b/WEEK04/WEEK04-BN.pdf differ diff --git a/WEEK05/WEEK05-BN.md b/WEEK05/WEEK05-BN.md index 201ecd0..5e9fe5c 100644 --- a/WEEK05/WEEK05-BN.md +++ b/WEEK05/WEEK05-BN.md @@ -636,6 +636,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length and handles step-over itself. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. Stops are reported as `Breakpoint` (not `SingleStep`). > @@ -1896,9 +1905,11 @@ That is the UART transmit-FIFO drain loop inside `printf`, so the core is runnin **`0x10003214` is not a function.** It is one instruction inside `stdio_uart_out_flush`, which starts at `0x10003210`. If Binary Ninja has created a function at `0x10003214` (for example because the debugger stopped at that PC), the decompiler shows garbage. Delete that bogus function (right-click it -> `Delete Function`, or put the cursor on it and press `U` to undefine) and reanalyze. The real function is `stdio_uart_out_flush` at `0x10003210`. (In Project 2 the same drain loop is at `0x1000321c`.) -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### `Connect to Remote Process` is greyed out and Pause does nothing diff --git a/WEEK05/WEEK05-BN.pdf b/WEEK05/WEEK05-BN.pdf index 8856166..0d542c8 100644 Binary files a/WEEK05/WEEK05-BN.pdf and b/WEEK05/WEEK05-BN.pdf differ diff --git a/WEEK06/WEEK06-BN.md b/WEEK06/WEEK06-BN.md index 5b3d3db..2b5742b 100644 --- a/WEEK06/WEEK06-BN.md +++ b/WEEK06/WEEK06-BN.md @@ -533,6 +533,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length and handles step-over itself. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. Stops are reported as `Breakpoint` (not `SingleStep`). > @@ -1303,9 +1312,11 @@ That is the UART transmit-FIFO drain loop inside `printf`, so the core is runnin **`0x100032cc` is not a function.** It is one instruction inside `stdio_uart_out_flush`, which starts at `0x100032c8`. If Binary Ninja has created a function at `0x100032cc` (for example because the debugger stopped at that PC), the decompiler shows garbage. Delete that bogus function (right-click it -> `Delete Function`, or put the cursor on it and press `U` to undefine) and reanalyze. The real function is `stdio_uart_out_flush` at `0x100032c8`. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### `Connect to Remote Process` is greyed out and Pause does nothing diff --git a/WEEK06/WEEK06-BN.pdf b/WEEK06/WEEK06-BN.pdf index 014bed2..85324eb 100644 Binary files a/WEEK06/WEEK06-BN.pdf and b/WEEK06/WEEK06-BN.pdf differ diff --git a/WEEK07/WEEK07-BN.md b/WEEK07/WEEK07-BN.md index 829d2cd..5255385 100644 --- a/WEEK07/WEEK07-BN.md +++ b/WEEK07/WEEK07-BN.md @@ -539,6 +539,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length and handles step-over itself. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. Stops are reported as `Breakpoint` (not `SingleStep`). > @@ -1409,9 +1418,11 @@ That is the UART transmit-FIFO drain loop inside `printf`, so the core is runnin **`0x10003ab4` is not a function.** It is one instruction inside `stdio_uart_out_flush`, which starts at `0x10003ab0`. If Binary Ninja has created a function at `0x10003ab4` (for example because the debugger stopped at that PC), the decompiler shows garbage. Delete that bogus function (right-click it -> `Delete Function`, or put the cursor on it and press `U` to undefine) and reanalyze. The real function is `stdio_uart_out_flush` at `0x10003ab0`. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### `Connect to Remote Process` is greyed out and Pause does nothing diff --git a/WEEK07/WEEK07-BN.pdf b/WEEK07/WEEK07-BN.pdf index 50f45a0..ac65051 100644 Binary files a/WEEK07/WEEK07-BN.pdf and b/WEEK07/WEEK07-BN.pdf differ diff --git a/WEEK09/WEEK09-BN.md b/WEEK09/WEEK09-BN.md index 711b4d1..5dc12e0 100644 --- a/WEEK09/WEEK09-BN.md +++ b/WEEK09/WEEK09-BN.md @@ -551,6 +551,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length and handles step-over itself. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. Stops are reported as `Breakpoint` (not `SingleStep`). > @@ -1442,9 +1451,11 @@ Prevention: That is where the core sits while the UART drains, so the core is running `main`'s loop and simply spends nearly all its time there. The breakpoint at `main` did not fire because `main`'s entry runs exactly **once per reset**. If you arm the breakpoint after the reset, or set it while the target is already running and just resume, the core is already past `main` and will never re-execute it. Either arm the breakpoint **before** resetting, or break inside the loop at `0x10000272`, which fires every iteration. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### `Connect to Remote Process` is greyed out and Pause does nothing diff --git a/WEEK09/WEEK09-BN.pdf b/WEEK09/WEEK09-BN.pdf index 69309f3..905c439 100644 Binary files a/WEEK09/WEEK09-BN.pdf and b/WEEK09/WEEK09-BN.pdf differ diff --git a/WEEK10/WEEK10-BN.md b/WEEK10/WEEK10-BN.md index e4d47c8..3e6c4ae 100644 --- a/WEEK10/WEEK10-BN.md +++ b/WEEK10/WEEK10-BN.md @@ -574,6 +574,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. @@ -1791,9 +1800,11 @@ Reading `/dev/cu.usbmodem*` with a bare `read()` returns garbage. Set **raw term The main cause is **driving the core from the OpenOCD command port while Binary Ninja is connected**. If you must reset, **Detach first**, reset, then reconnect. Never leave a breakpoint on the PC you are about to step or resume from. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### The decompiler still shows the old value after patching diff --git a/WEEK10/WEEK10-BN.pdf b/WEEK10/WEEK10-BN.pdf index dd812db..e7dae46 100644 Binary files a/WEEK10/WEEK10-BN.pdf and b/WEEK10/WEEK10-BN.pdf differ diff --git a/WEEK11/WEEK11-BN.md b/WEEK11/WEEK11-BN.md index 37ba25f..26a7640 100644 --- a/WEEK11/WEEK11-BN.md +++ b/WEEK11/WEEK11-BN.md @@ -584,6 +584,15 @@ Info : Listening on port 3333 for gdb connections | Windows x64 | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` (Pico extension), or `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\14.2 rel1\bin\arm-none-eabi-gdb.exe` | | Linux x64 | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` (Pico extension), or the `bin/` directory of the extracted `arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi` tarball | 6. Click **Accept**. +7. Restrict the GDB memory map (prevents OpenOCD SWD faults and reconnect loops): + In the bottom console panel, click the **Debugger Console** tab (or `View -> Tabs -> Debugger Console`) and enter: + ```gdb + source pico-gdb-memory.gdb + ``` + *(If not running from the repository root, enter the absolute path to `pico-gdb-memory.gdb`.)* + Confirm `info mem` displays the Flash (`0x10000000 0x10400000 ro`) and SRAM (`0x20000000 0x20082000 rw`) ranges. + +> **Why `source pico-gdb-memory.gdb` is required.** Binary Ninja's register widget automatically previews memory pointed to by registers. When a register contains an unmapped address (such as uninitialized data or constants like `0x69000000`), Binary Ninja probes it. Without a bounded memory map, OpenOCD attempts to read that invalid address over SWD, faults, and reconnects the debug port (`Info : SWD DPIDR 0x4c013477`). Sourcing `pico-gdb-memory.gdb` sets `inaccessible-by-default on` in GDB, causing GDB to intercept and reject invalid reads locally before any packet reaches OpenOCD, eliminating SWD reconnect storms. > **Use the GDB MI adapter.** It launches a real `arm-none-eabi-gdb --interpreter=mi2` and lets Binary Ninja drive it, so breakpoints and stepping go through real GDB — which sends the correct 2-byte breakpoint length. Verified working end to end: connect, GUI breakpoints (**Add Hardware Breakpoint...**, hardware execute), **Step Into** / **Step Over**, and register edits. @@ -1804,9 +1813,11 @@ Reading `/dev/cu.usbmodem*` with a bare `read()` returns garbage. Set **raw term The main cause is **driving the core from the OpenOCD command port while Binary Ninja is connected**. If you must reset, **Detach first**, reset, then reconnect. Never leave a breakpoint on the PC you are about to step or resume from. -### The console floods with `Failed to read memory at 0xf0000000` +### The console floods with `Failed to read memory` or `SWD DPIDR` reconnects -Core1 is exposed. The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +Two causes: +1. **Core 1 is exposed.** The scripts must run with `USE_CORE=0`. Stop the server, confirm only `core0` is reported, restart, then restart Binary Ninja. +2. **Binary Ninja probed an unmapped address for a register preview.** When a register holds an arbitrary integer or uninitialized value (e.g. `0x69000000`), Binary Ninja tries to preview that memory address, triggering an OpenOCD SWD fault and debug-port reconnect (`SWD DPIDR 0x4c013477`). In the **Debugger Console**, run `source pico-gdb-memory.gdb`. This restricts GDB to valid Flash and SRAM, filtering invalid reads locally so OpenOCD's SWD connection stays completely stable. ### The decompiler still shows the old value after patching diff --git a/WEEK11/WEEK11-BN.pdf b/WEEK11/WEEK11-BN.pdf index 9514fe9..4564551 100644 Binary files a/WEEK11/WEEK11-BN.pdf and b/WEEK11/WEEK11-BN.pdf differ diff --git a/debug-server.ps1 b/debug-server.ps1 index 1f01f90..454f801 100644 --- a/debug-server.ps1 +++ b/debug-server.ps1 @@ -81,6 +81,13 @@ broken debugger or a broken firmware. It is neither: it is a configuration mismatch, and hiding core1 removes it completely. + Note on Core 0 register previews (pico-gdb-memory.gdb): + Even with USE_CORE=0, whenever a Core 0 register holds an arbitrary integer + or unmapped value (e.g. 0x69000000), Binary Ninja's UI probes that address + for memory previews. In OpenOCD, failed SWD reads trigger the same SWD DPIDR + reconnect behavior. Source "pico-gdb-memory.gdb" in Binary Ninja's Debugger + Console to restrict GDB to valid Flash and SRAM, filtering invalid reads locally. + Why reset run (the target must be released, not halted) On RP2350, halting during reset stops the core at the boot ROM stub BEFORE the stack pointer is loaded: diff --git a/debug-server.sh b/debug-server.sh index 4246d8d..85dde19 100755 --- a/debug-server.sh +++ b/debug-server.sh @@ -77,6 +77,13 @@ # broken debugger or a broken firmware. It is neither: it is a configuration # mismatch, and hiding core1 removes it completely. # +# Note on Core 0 register previews (pico-gdb-memory.gdb): +# Even with USE_CORE=0, whenever a Core 0 register holds an arbitrary integer +# or unmapped value (e.g. 0x69000000), Binary Ninja's UI probes that address +# for memory previews. In OpenOCD, failed SWD reads trigger the same SWD DPIDR +# reconnect behavior. Source "pico-gdb-memory.gdb" in Binary Ninja's Debugger +# Console to restrict GDB to valid Flash and SRAM, filtering invalid reads locally. +# # Why reset run (the target must be released, not halted) # On RP2350, halting during reset stops the core at the boot ROM stub BEFORE # the stack pointer is loaded: diff --git a/pico-gdb-memory.gdb b/pico-gdb-memory.gdb new file mode 100644 index 0000000..4589317 --- /dev/null +++ b/pico-gdb-memory.gdb @@ -0,0 +1,14 @@ +# pico-gdb-memory.gdb - Restrict GDB memory access to valid RP2350 / Pico 2 W memory ranges. +# +# Prevents Binary Ninja register-value preview dereferences and out-of-bounds reads +# from triggering OpenOCD SWD faults and debug port reconnects (SWD DPIDR storms). +# +# In Binary Ninja's Debugger Console (with GDB MI adapter connected), run: +# source pico-gdb-memory.gdb +# (or provide the full path to this file). + +delete mem +mem 0x10000000 0x10400000 ro +mem 0x20000000 0x20082000 rw +set mem inaccessible-by-default on +info mem