Closed RCayre closed 3 years ago
Looks to me like a crash in the read_ram
function of the firmware. So, in the register state above you can see the PC which probably points to the read_ram
function, and the arguments it has been passed, which include the address 0x00308000
to be read from that fails with the length argument that is probably 0x000000f9
(0xff minus what is needed for the HCI packet header).
Most likely this is because this memory is just not mapped, either permanently or just at the moment. The latter happens on some hardware peripherals. You can adjust the memory map in the fw/...py
and remove that section. Most probably the part that you cannot read here is actually in the hardware peripheral area and not relevant for a ROM+RAM dump.
Moreover, on the S20/S10 chip series, echoing with a shell script into the serial device and then parsing the btsnoop_hci.log
in Python to extract the RAM dump usually works faster, less delay than the Python+netcat stuff in InternalBlue :)
Thank you very much ! problem solved by commenting the last memory region in fw/fw_0x1111.py.
Hello, I'm trying to use internalblue to dump its firmware and patch a samsung galaxy s20 B4375B1 chip. However, the dumpmem command systematically fails at 80% with the following traceback :