search

b1l1s / qemu

QEMU-CTR - see README.md for more info
Other
11 stars 0 forks source link

Crash when trying to execute arm9loaderhax payload #2

Open 916253 opened 7 years ago

916253 commented 7 years ago

Upon attempting to execute an arm9 payload (arm-softmmu/qemu-system-arm -kernel arm9loaderhax.bin -M ctr9) qemu immediately crashes, outputting the following:

qemu: fatal: Trying to execute code outside RAM or ROM at 0x00010000

R00=00000000 R01=000002ff R02=00000100 R03=00000000
R04=00000000 R05=00000000 R06=00000000 R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=00000000 R14=00000000 R15=00010000
PSR=400001d3 -Z-- A svc32
FPSCR: 00000000
Abort trap: 6

I tried the latest release of Luma3DS(7.0.4 at the time of this writing) and the latest GodMode9 (v1.1.3) I tried this on two different systems (first being macOS, second being Debian) to confirm that this wasn't an isolated issue.

b1l1s commented 7 years ago

Looks like the their code is trying to run something at the ITCM mirror at 0x00010000 or you didn't provide the right 'bootrom' and the code nop'ed there from the interrupt vector after an exception. Do you have qemu_ctr_bootrom9.bin in the 3ds_data folder?

Side note: a fake bootrom is provided here at https://github.com/b1l1s/qemu/blob/ctr/3ds-data/qemu_ctr_bootrom9.bin

916253 commented 7 years ago

Yes, qemu_ctr_bootrom9.bin is present