nccgroup / depthcharge

A U-Boot hacking toolkit for security researchers and tinkerers
https://depthcharge.readthedocs.io
BSD 3-Clause "New" or "Revised" License
257 stars 14 forks source link

python: Use relocaddr for JT addr mask check, warn but don't error out #85

Closed jynik closed 3 years ago

jynik commented 3 years ago

This address mask check is just intended to provided early warning if our function pointer deductions are incorrect, which will lead to a crash. Erroring out is a bit excessive, so this has just been reduced to a warning. We'll either hit an error at the crash, or the address mask check itself was just wrong. ;)

We'll try to use U-Boot's post relocation address as the basis for our check, followed by the gd address if the former somehow isn't present. On many devices, using either here seems to suffice. However, I found that on an AARCH64 AMLogic device using a fork from 2015, the gd was at 0xd3e2.... whereas the relocaddr was 0xd7e3...., which was more representative of the jump table entries @ 0xd7e9....