nccgroup / depthcharge

A U-Boot hacking toolkit for security researchers and tinkerers
https://depthcharge.readthedocs.io
BSD 3-Clause "New" or "Revised" License
251 stars 14 forks source link

add option to make depthcharge aware of nagging soft system reset due to watchdog in uboot #110

Open DatZig opened 5 months ago

DatZig commented 5 months ago

Describe new feature I'm trying to repurpose a device that has a nasty watchdog configured which does a soft reset of the system every 15 seconds(imx6 ic) and I have no way to reset it that i know of thus far. I've set bootdelay to -1 so it brings me right back to the U-Boot > prompt, however depthcharge isn't aware so it crashes without finishing inspect.

Describe the solution you'd like would be great if depthcharge could be told to expect the soft reset and if a command it's running fails to retry it a few times before failing (in the chance it gets perfect timing and completes that step/script), or realizes it can't finish and completes with the data it was able to acquire. In my case it gathered all the info except it wasn't able to run the payloads because the soft reset (watchdog reset) interrupted it. After I added -S I was able to get inspect to finish, but would be nice (if possible and if makes sense) to have the additional info if it coul be resilient.

Describe alternatives you've considered not aware of any.

Additional context depthcharge-inspect --arch arm -AR -i /dev/tty.usbserial-B003DLMH:115200 -c dev.cfg

[+] Loading existing config: dev.cfg [] Using default payload base address: ${loadaddr} + 32MiB [] No user-specified prompt provided. Attempting to determine this. [] Identified prompt: U-Boot > [] Retrieving detailed command info via "help" [] Reading environment via "printenv"
[
] Depthcharge payload base (0x12000000) + payload offset (0x02000000) => 0x14000000 [] Version: U-Boot 2013.04 (Feb 18 2021 - 15:55:57) [] Enumerating available MemoryWriter implementations... [] Available: CpMemoryWriter [] Available: CRC32MemoryWriter [!] Excluded: I2CMemoryWriter - Depthcharge companion device required, but none specified. [] Excluded: LoadbMemoryWriter - Host program "ckermit" required but not found in PATH. [] Excluded: LoadxMemoryWriter - Command "loadx" required but not detected. [] Excluded: LoadyMemoryWriter - Host program "sb" required but not found in PATH. [] Available: MmMemoryWriter [] Available: MwMemoryWriter [] Available: NmMemoryWriter [] Enumerating available MemoryReader implementations... [] Available: CpCrashMemoryReader [] Available: CRC32MemoryReader [] Available: GoMemoryReader [!] Excluded: I2CMemoryReader - Depthcharge companion device required, but none specified. [] Available: ItestMemoryReader [] Available: MdMemoryReader [] Available: MmMemoryReader [] Excluded: SetexprMemoryReader - Command "setexpr" required but not detected. [] Enumerating available Executor implementations... [] Available: GoExecutor [] Enumerating available RegisterReader implementations... [] Available: CpCrashRegisterReader [] Available: CRC32CrashRegisterReader [] Available: FDTCrashRegisterReader [] Available: ItestCrashRegisterReader [] Available: MdCrashRegisterReader [] Available: MmCrashRegisterReader [] Available: NmCrashRegisterReader [*] Excluded: SetexprCrashRegisterReader - Command "setexpr" required but not detected. Error: No data abort content found in the following text: 00000001:

jynik commented 4 months ago

Hey there @DatZig - so sorry for the super delayed response. I'm no longer with NCC Group, so I haven't been keeping an eye on things beyond my own usage.

You pose a very interesting question, which I think does certainly come with some challenges. I think it could definitely be possible to catch some errors and insert retries, but that could quickly become a whack-a-mole game in the code when the WDT starts interfering longer operations like multi-command reads and writes. Will try to let this simmer in the back of my mind and will write back if I think of anything. Again, can't guarantee I'll have an answer since I'm no longer active on the project.