Ledger-Donjon / rainbow

Makes Unicorn traces. Generic Side-Channel and Fault Injection simulator
GNU Lesser General Public License v3.0
172 stars 34 forks source link

SecAESSTM32 causes exceptions with default addresses #56

Closed schaefflerf closed 1 year ago

schaefflerf commented 1 year ago

The default settings of SecAESSTM32/go.py causes following exception:

8000482 add r3, pc ; 8000484 ldr r2, [r3, r2] ; 8000486 ldr r3, [r2] ;Traceback (most recent call last): File "/home/user/.local/lib/python3.10/site-packages/rainbow/rainbow.py", line 275, in start self.emu.emu_start(begin, end, timeout=timeout, count=count) File "/home/user/.local/lib/python3.10/site-packages/unicorn/unicorn.py", line 547, in emu_start raise UcError(status) unicorn.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "/mnt/c/Users/user/Desktop/rainbow/rainbow/examples/SecAESSTM32/go.py", line 76, in f_aes(e, key, randbytes(16)) File "/mnt/c/Users/user/Desktop/rainbow/rainbow/examples/SecAESSTM32/go.py", line 47, in f_aes e.start(e.functions['aes'] | 1, 0) File "/home/user/.local/lib/python3.10/site-packages/rainbow/generics/arm.py", line 47, in start return super().start(begin | self.thumb_bit, *args, **kwargs) File "/home/userr/.local/lib/python3.10/site-packages/rainbow/rainbow.py", line 279, in start raise RuntimeError(f"Emulation crashed at 0x{pc:X}") from e RuntimeError: Emulation crashed at 0x8000486

Changing key_p = 0xcafe1000 for example to key_p =0x8001165 fixes the problem and the GUI runs. But i guess it is still not the expected output.

Output after fix: (more output above...) 80012E2 mov r0, r5 ; 80012E4 add sp, #0x24 ; 80012E6 pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc};ERROR ! Nope : b'00000000000000000000000000000000' b'cfc7b7a45573d5b37f691be60a8a9c72' WARNING: could not determine DPI

If you can help me out i would appreciate it!

Greetings

yhql commented 1 year ago

Hello and thanks for reporting all these, now #57 should explain the problem and fix it