From eab75146db8dfe2f09f5eed02af3c62073280911 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 17 Feb 2016 09:12:17 +0000 Subject: [PATCH] Document the tests a little better. --- dtbfinder.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/dtbfinder.py b/dtbfinder.py index 90595aff9..cad653e8e 100644 --- a/dtbfinder.py +++ b/dtbfinder.py @@ -33,17 +33,24 @@ class DtbTest(object): value = ctx.memory.read('data', page_offset + (self.ptr_reference * self.ptr_size), self.ptr_size) ptr = self.unpack(value) - if ptr != 0 and (ptr & 0xFFFFFFFFFFFFF000 == page_offset) and (ptr & 0xFF0 == 0x60): + # The value *must* be present (bit 0) since it's a mapped page + # It's almost always writable (bit 1) + # It's occasionally Super, but not reliably so, haven't checked when/why not + # The top 3-bits are usually ignore (which in practice means 0 + # Need to find out why the middle 3-bits are usually 6 (0110) + if ptr != 0 and (ptr & 0xFFFFFFFFFFFFF000 == page_offset) & (ptr & 0xFF1 == 0x61): dtb = (ptr & 0xFFFFFFFFFFFFF000) return self.second_pass(dtb, ctx) def second_pass(self, dtb, ctx): data = ctx.memory.read("data", dtb, PAGE_SIZE) - usr_count = 0 + usr_count, sup_count = 0, 0 for i in range(0, PAGE_SIZE, self.ptr_size): val = self.unpack(data[i:i + self.ptr_size]) if val & 0x1: + sup_count += 0 if (val & 0x4) else 1 usr_count += 1 if (val & 0x4) else 0 + # print(hex(dtb), usr_count, sup_count, usr_count + sup_count) if usr_count: return usr_count, dtb