mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-07-06 12:37:54 +02:00
Kevin Thomas
78 lines
3.4 KiB
XML
78 lines
3.4 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
|
|
<style>
|
|
.bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
|
|
.title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
|
|
.sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
|
|
.txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
|
|
.dim{font:20px 'Courier New',monospace;fill:#888}
|
|
.grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
|
|
.red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
|
|
.cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
|
|
.amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
|
|
.badge{stroke:#00ff41;rx:14}
|
|
</style>
|
|
<rect class="bg" width="1200" height="800"/>
|
|
<rect class="hdr" x="0" y="0" width="1200" height="100" rx="0"/>
|
|
<text class="title" x="600" y="52" text-anchor="middle">Vector Table</text>
|
|
<text class="dim" x="600" y="88" text-anchor="middle">Finding Reset_Handler and main()</text>
|
|
|
|
<!-- Vector Table Structure -->
|
|
<rect class="pnl" x="30" y="110" width="555" height="280" rx="8"/>
|
|
<text class="sub" x="50" y="150">ARM Vector Table</text>
|
|
<text class="dim" x="50" y="178">Base address: 0x10000000</text>
|
|
|
|
<text class="amb" x="50" y="215">Offset</text>
|
|
<text class="amb" x="180" y="215">Contents</text>
|
|
<text class="amb" x="400" y="215">Purpose</text>
|
|
<line x1="50" y1="225" x2="565" y2="225" stroke="#1a1a2e" stroke-width="1"/>
|
|
|
|
<text class="grn" x="50" y="255">0x00</text>
|
|
<text class="txt" x="180" y="255">Initial SP</text>
|
|
<text class="dim" x="400" y="255">Stack ptr</text>
|
|
|
|
<text class="grn" x="50" y="290">0x04</text>
|
|
<text class="cyn" x="180" y="290">Reset_Handler</text>
|
|
<text class="dim" x="400" y="290">Entry point</text>
|
|
|
|
<text class="grn" x="50" y="325">0x08</text>
|
|
<text class="txt" x="180" y="325">NMI_Handler</text>
|
|
<text class="dim" x="400" y="325">NMI</text>
|
|
|
|
<text class="grn" x="50" y="360">0x0C</text>
|
|
<text class="txt" x="180" y="360">HardFault</text>
|
|
<text class="dim" x="400" y="360">Fault</text>
|
|
|
|
<!-- Little-Endian + Thumb Bit -->
|
|
<rect class="pnl" x="615" y="110" width="555" height="280" rx="8"/>
|
|
<text class="sub" x="635" y="150">Decoding the Address</text>
|
|
|
|
<text class="txt" x="635" y="190">At 0x10000004:</text>
|
|
<text class="grn" x="635" y="225">Bytes: 5d 01 00 10</text>
|
|
|
|
<text class="amb" x="635" y="265">Step 1: Reverse (little-endian)</text>
|
|
<text class="txt" x="635" y="295">10 00 01 5d = 0x1000015d</text>
|
|
|
|
<text class="amb" x="635" y="330">Step 2: Remove Thumb bit</text>
|
|
<text class="txt" x="635" y="360">0x1000015d - 1 = 0x1000015c</text>
|
|
|
|
<!-- Reset_Handler Flow -->
|
|
<rect class="pnl" x="30" y="410" width="1140" height="350" rx="8"/>
|
|
<text class="sub" x="50" y="450">Reset_Handler --> main()</text>
|
|
|
|
<text class="dim" x="50" y="485">Reset_Handler at 0x1000015c calls 3 functions:</text>
|
|
|
|
<rect x="50" y="505" width="1100" height="230" rx="6" fill="#0a0a0f" stroke="#1a1a2e"/>
|
|
<text class="txt" x="70" y="540">Call 1: some_init()</text>
|
|
<text class="dim" x="450" y="540">Hardware initialization</text>
|
|
|
|
<text class="cyn" x="70" y="580">Call 2: main()</text>
|
|
<text class="amb" x="450" y="580">THIS IS WHAT WE WANT</text>
|
|
<text class="dim" x="450" y="605">Address: 0x10000234</text>
|
|
|
|
<text class="txt" x="70" y="645">Call 3: exit()</text>
|
|
<text class="dim" x="450" y="645">Never returns</text>
|
|
|
|
<text class="dim" x="70" y="685">The MIDDLE function call is always main()</text>
|
|
<text class="dim" x="70" y="710">Navigate to 0x10000234 in Ghidra to find it</text>
|
|
</svg>
|
