Update WEEK06

This commit is contained in:
Kevin Thomas
2026-05-30 16:50:15 -04:00
parent af0d84f9cc
commit f22ef2907e
21 changed files with 1554 additions and 425 deletions
+21 -24
View File
@@ -1,6 +1,6 @@
# Week 1: Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts
# Week 1: Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts
## 🎯 What You'll Learn This Week
## What You'll Learn This Week
By the end of this week, you will be able to:
- Understand what a microcontroller is and how it works
@@ -71,11 +71,11 @@ The two Arm ABI documents we verified give the formal proof for these rules. In
```
Higher Memory Address (0x20082000)
+------------------+
| | Stack starts here (empty)
| | ← Stack starts here (empty)
+------------------+
| Pushed Item 1 | SP points here after 1 push
| Pushed Item 1 | ← SP points here after 1 push
+------------------+
| Pushed Item 2 | SP points here after 2 pushes
| Pushed Item 2 | ← SP points here after 2 pushes
+------------------+
Lower Memory Address (0x20081FF8)
```
@@ -87,13 +87,13 @@ When you call a function, the processor needs to remember where to come back to.
**Example:**
```
main() calls print_hello()
↓
LR = address right after the call in main()
↓
print_hello() runs
↓
print_hello() finishes, looks at LR
↓
Jumps back to main() at the address stored in LR
```
@@ -265,26 +265,22 @@ Before we start, make sure you have:
Open a terminal and start OpenOCD:
```powershell
openocd ^
-s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^
-f interface/cmsis-dap.cfg ^
-f target/rp2350.cfg ^
-c "adapter speed 5000"
```cmd
openocd -s "%USERPROFILE%\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000"
```
### Connecting to Your Pico 2 with GDB
Open another terminal and start GDB with your binary:
```powershell
```cmd
arm-none-eabi-gdb build\0x0001_hello-world.elf
```
Connect to your target:
```powershell
(gdb) target extended-remote localhost:3333
```cmd
(gdb) target extended-remote :3333
(gdb) monitor reset halt
```
@@ -528,7 +524,7 @@ Notice the difference between inspecting memory at `$sp` and inspecting `$lr`.
---
## 🔬 Part 5: Static Analysis with Ghidra
## Part 5: Static Analysis with Ghidra
### Setting Up Your First Ghidra Project
@@ -622,7 +618,7 @@ int main(void)
}
```
> 🎯 **Notice how Ghidra reconstructed our original C code!** The decompiler recognized the infinite loop and the `puts` call (the compiler optimized `printf` to `puts` since we're just printing a simple string).
> **Notice how Ghidra reconstructed our original C code!** The decompiler recognized the infinite loop and the `puts` call (the compiler optimized `printf` to `puts` since we're just printing a simple string).
##### Why We Start with .elf Files
@@ -635,7 +631,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
---
## 📊 Part 6: Summary and Review
## Part 6: Summary and Review
### What We Learned
@@ -655,7 +651,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
| Command | What It Does |
| --------------------- | -------------------------------------- |
| `target remote :3333` | Connect to OpenOCD debug server |
| `target extended-remote :3333` | Connect to OpenOCD debug server |
| `monitor reset halt` | Reset and halt the processor |
| `b main` | Set breakpoint at main function |
| `c` | Continue running until breakpoint |
@@ -697,7 +693,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
---
## 🎓 Key Takeaways
## Key Takeaways
1. **Reverse engineering combines static and dynamic analysis** - we look at the code (static with Ghidra) and run it to see what happens (dynamic with GDB).
@@ -711,7 +707,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
---
## 📖 Glossary
## Glossary
| Term | Definition |
| ------------------- | --------------------------------------------------------- |
@@ -728,3 +724,4 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
| **XIP** | Execute In Place - running code directly from flash |