eigenform/libstfu

An emulator for the ARM core in the Nintendo Wii, implemented with Unicorn

"What's on my agenda recently?"

• Doing independent security research
• Learning about microarchitecture
• Playing with microscopes

libstfu's Issues

Implement memory mirrors

In order to run through boot2 (and beyond), need to hook up bits to toggle the SRAM mirror and boot ROM mappings.

Logging for syscall names and resolving arguments

Virtual memory not working correctly?

It seems like Unicorn doesn't make a distinction between virtual and physical addresses.
After the MMU bit in CP15 register 1 is enabled, you can see calls to get_phys_addr_v5_armeb in gdb on all accesses.

However, we never actually reach that code for accesses on 0x20000000, which indicates that for all memory accesses Unicorn first assumes that physical memory must exist at that address in order for the access to be valid.

Unmapped write on 20009000
starlet.c:250:__handle_halt_code(): Died with halt_code=00000007, pc=ffff7a7c, lr=ffff78f7

Emulate the whole boot process

Some milestones we want to hit for getting through the whole boot process:

• Execute through boot0
• Execute through boot1
• Execution in boot2
• Actually loop in the kernel forever
• PowerPC bring-up

Emulate interrupts, exceptions, and interrupt controller register behaviour

• Handle exceptions blocking further progress (aborts, undef instructions)
• Handle system calls with the undef instruction exception handler
• Implement IRQs from I/O devices

Interrupts prevent us from executing any further in boot2 (this is a data abort interrupt).
starlet.c:229:__handle_halt_code(): Died with halt_code=00000015, pc=ffff23a0

SEEPROM/GPIO emulation

I think ARM talks to the SEEPROM via the GPIOs. Eventually we'll have to implement that?

Implement a GDB stub