Commit 139155c4 authored by George Hotz's avatar George Hotz

move mips stack

parent 0ceffdbc
......@@ -25,6 +25,7 @@ regs = ["at", "v0", "v1", "a0", "a1", "a2", "a3"]
SIZE = 16*1024*1024
heap_start = 0x20000000 # 0x20000000-0x30000000
# input oracle @ 0x30000000
# output oracle @ 0x30000800
......@@ -32,6 +33,7 @@ heap_start = 0x20000000 # 0x20000000-0x30000000
# preimage oracle (read) @ 0x31000000-0x32000000 (16 MB)
brk_start = 0x40000000 # 0x40000000-0x80000000
stack_start = 0x7FFFF000
# hmm, very slow
icount = 0
......@@ -305,26 +307,16 @@ entry = elffile.header.e_entry
print("entrypoint: %x" % entry)
#hexdump(mu.mem_read(entry, 0x10))
mu.reg_write(UC_MIPS_REG_SP, SIZE-0x2000)
mu.reg_write(UC_MIPS_REG_SP, stack_start-0x2000)
# http://articles.manugarg.com/aboutelfauxiliaryvectors.html
_AT_PAGESZ = 6
mu.mem_write(SIZE-0x2000, struct.pack(">IIIIIIII",
mu.mem_write(stack_start-0x2000, struct.pack(">IIIIIIII",
1, # argc
SIZE-0x1000, 0, # argv
SIZE-0x400, 0, # envp
stack_start-0x1000, 0, # argv
stack_start-0x400, 0, # envp
_AT_PAGESZ, 0x1000, 0)) # auxv
# block
#mu.mem_write(SIZE-0x800, b"13284469\x00")
#mu.mem_write(SIZE-0x800, b"13284469\x00")
mu.mem_write(SIZE-0x400, b"GOGC=off\x00")
#hexdump(mu.mem_read(SIZE-0x2000, 0x100))
# nop osinit
#mu.mem_write(0x44524, b"\x03\xe0\x00\x08\x00\x00\x00\x00")
mu.mem_write(stack_start-0x400, b"GOGC=off\x00")
r = RangeTree()
for section in elffile.iter_sections():
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment