| 201 | } |
| 202 | |
| 203 | fn debug_gateway(vm: &mut Vm, debug: DebugConfig) { |
| 204 | let reg_r0 = vm.cpu.arch.sleigh.get_varnode("r0").unwrap(); |
| 205 | let reg_r1 = vm.cpu.arch.sleigh.get_varnode("r1").unwrap(); |
| 206 | let reg_r2 = vm.cpu.arch.sleigh.get_varnode("r2").unwrap(); |
| 207 | let reg_r3 = vm.cpu.arch.sleigh.get_varnode("r3").unwrap(); |
| 208 | |
| 209 | // User provided `pin` argument is not bounds checked. |
| 210 | const SET_PIN_STATE: u64 = 0x08002fc6; |
| 211 | let out = debug.clone(); |
| 212 | vm.hook_address(SET_PIN_STATE, move |cpu, _addr| { |
| 213 | let pin = cpu.read_reg(reg_r1); |
| 214 | if pin >= 60 { |
| 215 | out.error(cpu, &format!("setPinState called with pin >= 60 (pin = {pin})"), 12); |
| 216 | } |
| 217 | }); |
| 218 | |
| 219 | // (false-positive) initialization race in `HAL_UART_TxCpltCallback` |
| 220 | const EXECUTE_TX_CALLBACK: u64 = 0x800878e; |
| 221 | let out = debug.clone(); |
| 222 | vm.hook_address(EXECUTE_TX_CALLBACK, move |cpu, _addr| { |
| 223 | let tx_callback = cpu.read_reg(reg_r3); |
| 224 | if tx_callback == 0 { |
| 225 | out.error(cpu, "(FP) HAL_UART_TxCpltCallback called before init", 21); |
| 226 | } |
| 227 | }); |
| 228 | |
| 229 | // (false-positive) initialization race in `HAL_UART_RxCpltCallback` |
| 230 | const EXECUTE_RX_CALLBACK: u64 = 0x8008768; |
| 231 | let out = debug.clone(); |
| 232 | vm.hook_address(EXECUTE_RX_CALLBACK, move |cpu, _addr| { |
| 233 | let rx_callback = cpu.read_reg(reg_r3); |
| 234 | if rx_callback == 0 { |
| 235 | out.error(cpu, "(FP) HAL_UART_RxCpltCallback called before init", 21); |
| 236 | } |
| 237 | }); |
| 238 | |
| 239 | // Use of dangling pointer set in `pwm_start` |
| 240 | const TIMER2_HANDLER: u64 = 0x80077c0; |
| 241 | const PWM_START_TIMER_INIT: u64 = 0x800716a; |
| 242 | const PWM_START_RETURN: u64 = 0x80071aa; |
| 243 | let pwm_active_flag = vm.cpu.trace.register_store(vec![0_u8]); |
| 244 | vm.hook_address(PWM_START_TIMER_INIT, move |cpu, _addr| { |
| 245 | cpu.trace[pwm_active_flag].data_mut()[0] = 1; |
| 246 | }); |
| 247 | vm.hook_address(PWM_START_RETURN, move |cpu, _addr| { |
| 248 | cpu.trace[pwm_active_flag].data_mut()[0] = 0; |
| 249 | }); |
| 250 | let out = debug.clone(); |
| 251 | vm.hook_address(TIMER2_HANDLER, move |cpu, _addr| { |
| 252 | let is_pwm_active = cpu.trace[pwm_active_flag].data_mut()[0] != 0; |
| 253 | if !is_pwm_active { |
| 254 | out.error(cpu, "use of expired timer_handles[1] reference", 23); |
| 255 | } |
| 256 | }); |
| 257 | |
| 258 | // Unchecked error in `FirmataParser::decodeByteStream` |
| 259 | const RETURN_FROM_BUFFER_AT_POSITION: u64 = 0x800348a; |
| 260 | let out = debug.clone(); |