MCPcopy Create free account
hub / github.com/MultiFuzz/MultiFuzz / debug_usb

Function debug_usb

hail-fuzz/src/debugging/check.rs:395–443  ·  view source on GitHub ↗
(vm: &mut Vm, debug: DebugConfig)

Source from the content-addressed store, hash-verified

393}
394
395fn debug_usb(vm: &mut Vm, debug: DebugConfig) {
396 if debug.output.is_some() {
397 const FN_WRITE: u64 = 0x800f1f6;
398 register_write_printer(vm, FN_WRITE, "r1", "r2");
399 }
400
401 const FN_USB_HANDLE_FRAME: u64 = 0x800fc2c;
402 let reg_r2 = vm.cpu.arch.sleigh.get_varnode("r2").unwrap();
403 let out = debug.clone();
404 vm.hook_address(FN_USB_HANDLE_FRAME, move |cpu, _addr| {
405 let endpoint = cpu.read_reg(reg_r2);
406 if endpoint > 1 {
407 out.error(cpu, &format!("fnUSB_handle_frame with iEndpoint={endpoint:#x}"), 45);
408 }
409 });
410
411 const FN_EXTRACT_FIFO: u64 = 0x800d658;
412 let reg_r3 = vm.cpu.arch.sleigh.get_varnode("r3").unwrap();
413 let out = debug.clone();
414 vm.hook_address(FN_EXTRACT_FIFO + 0x6, move |cpu, _addr| {
415 let len = cpu.read_reg(reg_r3);
416 if len > 64 {
417 out.error(cpu, &format!("fnExtractFIFO with length={len:#x}"), 27);
418 }
419 });
420
421 const CALL_NEW_UART_SETTINGS: u64 = 0x8011c10;
422 let reg_r1 = vm.cpu.arch.sleigh.get_varnode("r1").unwrap();
423 let out = debug.clone();
424 vm.hook_address(CALL_NEW_UART_SETTINGS, move |cpu, _addr| {
425 let interface = cpu.read_reg(reg_r1);
426 if interface > 1 {
427 let msg = format!("fnNewUART_settings with iInterface={interface:#0x}");
428 out.error(cpu, &msg, bug(UTASKER_USB, 2));
429 }
430 });
431
432 const FN_SCI_TX_BYTE: u64 = 0x800f0c2;
433 const FN_SCI_RX_BYTE: u64 = 0x800efea;
434 const SERIAL_HANDLE: u64 = 0x20000948;
435 let out = debug;
436 vm.hook_many_addresses(&[FN_SCI_TX_BYTE, FN_SCI_RX_BYTE], move |cpu, addr| {
437 let serial_handle = cpu.mem.read_u8(SERIAL_HANDLE, perm::NONE).unwrap_or(0);
438 if serial_handle == 0 {
439 let msg = format!("{addr:#x} SCI_Interrupt trigged before initialization");
440 out.error(cpu, &msg, bug(UTASKER_USB, 3));
441 }
442 });
443}
444
445fn debug_xml_parser(vm: &mut Vm, debug: DebugConfig) {
446 let mut hook_injected_bug = move |addr: u64, msg: &'static str, code: u64| {

Callers 1

initFunction · 0.85

Calls 4

register_write_printerFunction · 0.85
bugFunction · 0.85
cloneMethod · 0.80
errorMethod · 0.45

Tested by

no test coverage detected