mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-06-01 20:11:47 +02:00
Update WEEK06
This commit is contained in:
+21
-24
@@ -1,6 +1,6 @@
|
||||
# Week 1: Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts
|
||||
# Week 1: Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts
|
||||
|
||||
## 🎯 What You'll Learn This Week
|
||||
## What You'll Learn This Week
|
||||
|
||||
By the end of this week, you will be able to:
|
||||
- Understand what a microcontroller is and how it works
|
||||
@@ -71,11 +71,11 @@ The two Arm ABI documents we verified give the formal proof for these rules. In
|
||||
```
|
||||
Higher Memory Address (0x20082000)
|
||||
+------------------+
|
||||
| | ← Stack starts here (empty)
|
||||
| | ↠Stack starts here (empty)
|
||||
+------------------+
|
||||
| Pushed Item 1 | ← SP points here after 1 push
|
||||
| Pushed Item 1 | ↠SP points here after 1 push
|
||||
+------------------+
|
||||
| Pushed Item 2 | ← SP points here after 2 pushes
|
||||
| Pushed Item 2 | ↠SP points here after 2 pushes
|
||||
+------------------+
|
||||
Lower Memory Address (0x20081FF8)
|
||||
```
|
||||
@@ -87,13 +87,13 @@ When you call a function, the processor needs to remember where to come back to.
|
||||
**Example:**
|
||||
```
|
||||
main() calls print_hello()
|
||||
↓
|
||||
↓
|
||||
LR = address right after the call in main()
|
||||
↓
|
||||
↓
|
||||
print_hello() runs
|
||||
↓
|
||||
↓
|
||||
print_hello() finishes, looks at LR
|
||||
↓
|
||||
↓
|
||||
Jumps back to main() at the address stored in LR
|
||||
```
|
||||
|
||||
@@ -265,26 +265,22 @@ Before we start, make sure you have:
|
||||
|
||||
Open a terminal and start OpenOCD:
|
||||
|
||||
```powershell
|
||||
openocd ^
|
||||
-s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^
|
||||
-f interface/cmsis-dap.cfg ^
|
||||
-f target/rp2350.cfg ^
|
||||
-c "adapter speed 5000"
|
||||
```cmd
|
||||
openocd -s "%USERPROFILE%\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000"
|
||||
```
|
||||
|
||||
### Connecting to Your Pico 2 with GDB
|
||||
|
||||
Open another terminal and start GDB with your binary:
|
||||
|
||||
```powershell
|
||||
```cmd
|
||||
arm-none-eabi-gdb build\0x0001_hello-world.elf
|
||||
```
|
||||
|
||||
Connect to your target:
|
||||
|
||||
```powershell
|
||||
(gdb) target extended-remote localhost:3333
|
||||
```cmd
|
||||
(gdb) target extended-remote :3333
|
||||
(gdb) monitor reset halt
|
||||
```
|
||||
|
||||
@@ -528,7 +524,7 @@ Notice the difference between inspecting memory at `$sp` and inspecting `$lr`.
|
||||
|
||||
---
|
||||
|
||||
## 🔬 Part 5: Static Analysis with Ghidra
|
||||
## Part 5: Static Analysis with Ghidra
|
||||
|
||||
### Setting Up Your First Ghidra Project
|
||||
|
||||
@@ -622,7 +618,7 @@ int main(void)
|
||||
}
|
||||
```
|
||||
|
||||
> 🎯 **Notice how Ghidra reconstructed our original C code!** The decompiler recognized the infinite loop and the `puts` call (the compiler optimized `printf` to `puts` since we're just printing a simple string).
|
||||
> **Notice how Ghidra reconstructed our original C code!** The decompiler recognized the infinite loop and the `puts` call (the compiler optimized `printf` to `puts` since we're just printing a simple string).
|
||||
|
||||
##### Why We Start with .elf Files
|
||||
|
||||
@@ -635,7 +631,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
|
||||
|
||||
---
|
||||
|
||||
## 📊 Part 6: Summary and Review
|
||||
## Part 6: Summary and Review
|
||||
|
||||
### What We Learned
|
||||
|
||||
@@ -655,7 +651,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
|
||||
|
||||
| Command | What It Does |
|
||||
| --------------------- | -------------------------------------- |
|
||||
| `target remote :3333` | Connect to OpenOCD debug server |
|
||||
| `target extended-remote :3333` | Connect to OpenOCD debug server |
|
||||
| `monitor reset halt` | Reset and halt the processor |
|
||||
| `b main` | Set breakpoint at main function |
|
||||
| `c` | Continue running until breakpoint |
|
||||
@@ -697,7 +693,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
|
||||
|
||||
---
|
||||
|
||||
## 🎓 Key Takeaways
|
||||
## Key Takeaways
|
||||
|
||||
1. **Reverse engineering combines static and dynamic analysis** - we look at the code (static with Ghidra) and run it to see what happens (dynamic with GDB).
|
||||
|
||||
@@ -711,7 +707,7 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
|
||||
|
||||
---
|
||||
|
||||
## 📖 Glossary
|
||||
## Glossary
|
||||
|
||||
| Term | Definition |
|
||||
| ------------------- | --------------------------------------------------------- |
|
||||
@@ -728,3 +724,4 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols
|
||||
| **XIP** | Execute In Place - running code directly from flash |
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user