milo-d/libvmcu-virtual-mcu-library

A Library for Static and Dynamic Analysis of AVR binaries.

libvmcu-virtual-mcu-library's Issues

memprop.h

Move memprop.h to system directory. This would make more sense.

LSR Instruction Bug

The LSR instruction needs a fix.

• Disassembler creates a wrong comment

• Instruction does not work properly on register value 0xFF

CLI Performance

Only refresh screen once (after filling buffer).

headless mode !! mdx community demands

{
  "sysprop":{
     "SRAM":2048,
     "Flash":32768
  },
 "simulation_status":"terminated",
  "registers":{
   "r1":"0x04",
   "r2":"0x04",
   "r3":"0x04",
   "r4":"0x04",
   "r5":"0x04",
   "r6":"0x04",
    "...":"..."
  },
  "sreg":{
    "...":"..."
  },
  "sram":{
    "0":"0x04",
    "1":"0x32"
  },
  "eeprom":{
    "0":"0x54"
  }
}

jc (Jump Cycles)

It could be pretty useful to be able to jump forward n cycles with a command like 'jc' (jump cycles). For example jc < n > to fast forward next n cycles in the simulation. Some usecases would be:

• fast forwarding internal timers
• fast forwarding EEPROM write access time
• and many more...

Enhancement: Peripherals and SFRs

SFR behaviour (on read/write access) should be moved to peripheral modules. For example, write_TCCR0B should call timer8_write_tccr0b.

Headless Mode

Headless Mode is adding a "," right after the last element when generating a json file.

Minor Indentation Problem

Having a minor indentation problem when replacing jump offsets with labels.

This problem only occurs on some jump/branch instructions while disassembling the hex file.

Performance Enhancement

There are some simple optimizations which could drastically improve the execution speed. For example the translation of flash address to table address could be optimized.

Currently MDX is able to simulate up to 8.000.000 instructions per second (8 MHz) (on an Intel Core i5). The goal is to increase the execution speed, so that it can execute atleast 20.000.000 instructions per second (20 MHz). The first (and probably the biggest) step would be to make the translation of flash address to table address more efficient.

The next step could focus on reducing allocations and memory usage per iteration.

Detaching engine from debugger

I am going to detach the engine from the debugger, in order to create a statically linked library, called libvmcu.

I will also take a snapshot of the latest version (v.0.6.0) and move it to another repository, so that this debugger can be still used.

TCNT0 does not increment when executing illegal opcode

Timer0 (TCNT0) does not increment when stepping over illegal opcodes. This bug will be fixed soon.

Systemprinter Refactor

Create seperate modules (directories) within src/systemprinter/ and include/systemprinter/, so that every printer function (ex. eeprom-printer) has its own file.

CLI Enhancement

Will focus on a large CLI Enhancement in the next days.

Inserting Labels on jumped addresses

Rewriting MDX in C

Currently rewriting MDX in C

Fix memory leaks of Sys Class

Currently working on some memory leaks.

Future Work on MDX

After rewriting this repository to C, there are several enhancements planned:

1. Table enhancement

The table will be structured differently. It will use a single list of n-tuples for breakpoints, flash address, instruction line, etc. Further the table class will be included into the system class. So there is only one instance to manage during debug state (instead of managing table and system).

2. XD/XE/XDC/XEC

Currently it is not possible to use the e(x)amine commands in combination with lowercase letters in the addresses. This can be easily fixed by making small changes to the base conversion functions. It will be fixed soon.

3. Commandline Interface

There will be some enhancements for the CLI, for example fixing minor glitches.

4. Instruction Set Support

Of course one of the main goals is to provide a full support for the official AVR assembly instruction set. Currently MDX supports approx. 65 instructions. In order to support 32-bit instructions, the decoder needs some small changes.

5. Codeflow Graph

It would be very interesting to implement a graph generator, which takes the source code and turns it into a graph on the sidepanel.

6. Watchpoints

Adding watchpoints while debugging might be useful, too.

---

Note that this is not a full list of goals and the enumeration has nothing to do with the priority order.

Skip Instructions (sbis, etc.)

sbis (and all the other skip instructions) won't work when combined with a following 32-bit instructions. That is because I implemented sbis before supporting 32-bit Instruction.

I will be working as soon as possible on a fix to this.

Shifting bits out of 8 bit integer

Shifting bits out of int8_t in some instructions. Going to fix this today.

Syntax Highlighter for Assembly Instructions

Working on Syntax Highlighting for disassembled Source Code.

BRLO Issue

Instruction "brlo" has a minor implementation mistype leading to this issue.

Change:

if(sys->read_sreg(ZF) == 0x01)
return;

to:

if(sys->read_sreg(ZF) == 0x00)
return;

Will fix this later.

"def" command does not work currently

The "def" command is not working right now. It has been deactivated until a fix is available.

jc - Jump Cycles

It could be pretty useful to be able to jump forward n cycles with a command like 'jc' (jump cycles). For example jc < n > to fast forward next n cycles in the simulation. Some usecases would be:

• fast forwarding internal timers
• fast forwarding EEPROM write access time
• and many more...

No full register view under Raspbarry OS

No full register view under Raspbarry OS

Despite the very small font, not all registers are displayed in the register window.

This is probably due to the excessive spacing or fixed character positions. 01 instead of 1 would also be better so that it always sits one below the other and a smaller distance of 3-4 characters should also be enough so that you can get more informations.

Suggestion:

R01: xxx   ...
R02: xxx   R09: xxx
R03: xxx   R10: xxx
R04: xxx   R11: xxx

Otherwise I would like to be able to switch the register view between hex and dec by command, e.g. with rd or rh

Split the Source Files into different Subfolders.

Resize Bug

There is a bug when trying to resize mainwindow/debugwindow (due to overwriting prompt-instance address). This will be fixed today.

Cleanup Hex Dump

Disassembler and '.org' assembly directive

Disassembler generates Labels but does not insert them when using the .org assembly directive in between the jump/call and its destination. For example:

rjmp start

.org 0x002a
start:
ldi r18, LOW(RAMEND)
out SPL, r18
ldi r18, HIGH(RAMEND)
out SPH, r18
rjmp exit

exit:
rjmp exit

This bug is caused by following code snippet (disassembler.c:98):

if(t_addr + offs >= buffer->size || t_addr + offs < 0) {

    tuple_dtor(t);
    continue;
 }

It is pretty easy to fix, and it is no major bug, since it does not influence the execution.

Remove equivalent instructions

Some instructions in the AVR instruction-set share the same opcode but have a different mnemonic.

Remove:

• bclr (we already have cl)
• brcs (we already have brlo)

There might be more, but I have to find them first.

SREG should be accessible through the Dataspace

The Statusregister should be accessible through the Dataspace. For example, due to the memorymapping of registers in dataspace,

in r16, 0x3f

should load the content of the SREG into R16 and, vice versa,

out 0x3f, r16

should store the value of R16 in SREG. This is pretty easy to fix (adding an extra condition before writing to dataspace), and will be fixed in the following days.

i want an mdx conf

like in a file, such as mdx.conf

def temp1 r16
def temp2 r17

😄

DEC Instruction Issue

Decrement Instruction fails on underflow.

Rewrite JSON Writer

Rewrite jsonwriter.cpp/jsonwriter.hpp.

Small bug in Label Analyzer Module

Label Analyzer does not find potential label at address 0x0000 if it was target of a relative branch/jump. For example:

loop:
ldi r16, 0xff
ldi r17, 0xff
rjmp loop

In this special case the label analyzer wont find "loop" label.

Looking for contributors

This project is currently looking for contributors. Following "subsystems" need further work:

Driver

Drivers are (small) programs/utilities demonstrating the usage of libvmcu. For example the driver "findisr" which is able to find the interrupt vector table and its ISRs. For examples on how to create a driver, see driver/skeleton/

Bindings

Or you could work on some bindings for different languages. Currently @pointbazaar is the maintainer of the Java Binding.

For more information, take a look at the "Contributing" section in README.md

Bug when entering empty string

MDX crashes when entering an empty string while simulating. This will be fixed today.

32-bit Decoder/Disassembler

Currently working on the decoder in order to (finally) support 32-bit instruction decoding and disassembling.

This feature might be available in the next day(s).

Prevent Decoder/Disassembler from reading corrupted Hex Files.

Add the following to fix:

In Disassembler (lmap_loop (ln. 49)):

if(t_addr >= source.size())
return source;

In Decoder:

bool validate_hex(std::string line); // check general hex rules (length, starting symbol)

if(instr < 0)
// handle

Last page of source-code panel

There is a bug in the paging of the sourcecode. When switching pages of the side panel, the last page may (in some rare cases) not be visible. A temporary fix would be to change the font size (ctrl-), so that the last couple lines are visible.

I am working on a real fix for this issue.

Conversion of Hexadecimal Numbers

Conversion of hexadecimal numbers should cover both, capital and non-capital letters.

Page Next (pn) on empty Hex File.

Simple Bug (Division by zero) occurs when hitting 'pn' on an empty hex file in TableView.

MCU Cycle-Count does not increment

Cycle-Count does not increment when branching with negative offset, thus affecting elapsed system time.

Address Bug when decoding .eep.hex files

A bug might occur if storing some data to the eeprom via .eep.hex. Byte position might be wrong decoded.

I will fix this asap.

Minor Bug in an Assembly Algorithm

Fix minor bug during execution of a certain assembly algorithm.

Unexpected Stack Behaviour

Stack shows unexpected Behaviour while looping and pushing values on it.

Details: Pushing Values (0xff - 0x00) in a loop. The Bug occurs when trying to push 0xa0 / 0x9f.
Stackpointer: SP jumped from 0x0800 to 0x06ff. SP splitting does not work properly.

Test File: /test/data/hex.asm

i want backstepping !!!

😄

Reduce Heap Usage

The overall heap usage of the UI and disassembler should be reduced in order to

• reduce memory consumption
• improve performance of the UI/disassembler

Currently both the UI and disassembler are wasting too much heap memory because of unnecessary allocations. The biggest factor here is probably the collection (especially the queue) which is allocating way too much.

I've replaced the queue with a stringstream on a local version of MDX. As soon as I finish this, memory usage should drop.

Disassembler should not generate Labels when its address is out of disassembly

.ORG 0x0000

ldi r16, 0xff
ldi r17, 0x00
jmp 0xab

In this example the disassembler will try to generate a label for the address 0xab but this address is out of disassembly since there are only 3 instructions (0x0000, 0x0001, 0x0002/0x0003). So a label will be generated by lmap, in this case L0, and then the address will be replaced

.ORG 0x0000

ldi r16, 0xff
ldi r17, 0x00
jmp L0

But since the address is out of disassembly, the disassembler wont insert L0:, leaving us with non-valid avr-assembly.

This one is a minor bug and should be easy to fix. The check, whether or not a label can be found in disassembly, should happen before replacing the address with the generated label and not just right before inserting the actual label.

CLI Enhancement II

Longterm goals for the CLI:

1. CLI Refactor
2. Fix CLI-related Issue #41
3. New panels for different modes (Hexdump, Pinview, just to name few possible examples)
4. Customization via config files

Wrong redraw under Raspberry OS after zoom out

If you want to zoom out under Raspberry OS in the terminal window with CTRL + Shift + -, the terminal window is reduced, but only the frames are rebuilt instead of the characters and if you then want to perform a step with n and Enter to bring about an update, MDX with after a memory error message.