Skip to content

Instantly share code, notes, and snippets.

@mmilata
Last active November 19, 2021 17:04
Show Gist options
  • Save mmilata/6d53e922469d261e889e7a241519d497 to your computer and use it in GitHub Desktop.
Save mmilata/6d53e922469d261e889e7a241519d497 to your computer and use it in GitHub Desktop.
arm-none-eabi-objdump -d intermediate_fw/trezor.elf; hexdump -C intermediate_fw/trezor.bin
--- pre.asm 2021-11-19 17:53:12.258136498 +0100
+++ post.asm 2021-11-19 17:54:55.030031716 +0100
@@ -83,8 +83,8 @@
8010600: 6803 ldr r3, [r0, #0]
8010602: 42ab cmp r3, r5
8010604: d001 beq.n 801060a <main+0x86>
- 8010606: f001 fa0f bl 8011a28 <__invalidate_firmware_and_reboot_veneer>
- 801060a: f001 fa11 bl 8011a30 <__reboot_device_veneer>
+ 8010606: f001 fa13 bl 8011a30 <__invalidate_firmware_and_reboot_veneer>
+ 801060a: f001 fa0d bl 8011a28 <__reboot_device_veneer>
801060e: bf00 nop
8010610: 2001fff8 .word 0x2001fff8
8010614: 08011a38 .word 0x08011a38
@@ -2140,13 +2140,13 @@
8011a22: 2100 movs r1, #0
8011a24: f7ff bfaa b.w 801197c <memset>
-08011a28 <__invalidate_firmware_and_reboot_veneer>:
- 8011a28: f85f f000 ldr.w pc, [pc] ; 8011a2c <__invalidate_firmware_and_reboot_veneer+0x4>
- 8011a2c: 200000a1 .word 0x200000a1
-
-08011a30 <__reboot_device_veneer>:
- 8011a30: f85f f000 ldr.w pc, [pc] ; 8011a34 <__reboot_device_veneer+0x4>
- 8011a34: 20000081 .word 0x20000081
+08011a28 <__reboot_device_veneer>:
+ 8011a28: f85f f000 ldr.w pc, [pc] ; 8011a2c <__reboot_device_veneer+0x4>
+ 8011a2c: 20000081 .word 0x20000081
+
+08011a30 <__invalidate_firmware_and_reboot_veneer>:
+ 8011a30: f85f f000 ldr.w pc, [pc] ; 8011a34 <__invalidate_firmware_and_reboot_veneer+0x4>
+ 8011a34: 200000a1 .word 0x200000a1
8011a38: 69736e55 .word 0x69736e55
8011a3c: 64656e67 .word 0x64656e67
8011a40: 72696620 .word 0x72696620
@@ -2346,3 +2346,66 @@
801241c: 080120a8 080120b0 080120b8 080120c0 . ... ... ... ..
801242c: 080120c8 080120d0 080120d8 08011e74 . ... ... ..t...
801243c: 08012144 08011e80 080120e0 08011e90 D!....... ......
+
+Disassembly of section .data:
+
+20000000 <_flash_program_word.constprop.0>:
+20000000: 4b12 ldr r3, [pc, #72] ; (2000004c <_flash_program_word.constprop.0+0x4c>)
+20000002: f8d3 2c0c ldr.w r2, [r3, #3084] ; 0xc0c
+20000006: f412 3280 ands.w r2, r2, #65536 ; 0x10000
+2000000a: d1fa bne.n 20000002 <_flash_program_word.constprop.0+0x2>
+2000000c: f8d3 1c10 ldr.w r1, [r3, #3088] ; 0xc10
+20000010: f421 7140 bic.w r1, r1, #768 ; 0x300
+20000014: f8c3 1c10 str.w r1, [r3, #3088] ; 0xc10
+20000018: f8d3 1c10 ldr.w r1, [r3, #3088] ; 0xc10
+2000001c: f441 7100 orr.w r1, r1, #512 ; 0x200
+20000020: f8c3 1c10 str.w r1, [r3, #3088] ; 0xc10
+20000024: f8d3 1c10 ldr.w r1, [r3, #3088] ; 0xc10
+20000028: f041 0101 orr.w r1, r1, #1
+2000002c: f8c3 1c10 str.w r1, [r3, #3088] ; 0xc10
+20000030: 4b07 ldr r3, [pc, #28] ; (20000050 <_flash_program_word.constprop.0+0x50>)
+20000032: 601a str r2, [r3, #0]
+20000034: 4b05 ldr r3, [pc, #20] ; (2000004c <_flash_program_word.constprop.0+0x4c>)
+20000036: f8d3 2c0c ldr.w r2, [r3, #3084] ; 0xc0c
+2000003a: 03d2 lsls r2, r2, #15
+2000003c: d4fb bmi.n 20000036 <_flash_program_word.constprop.0+0x36>
+2000003e: f8d3 2c10 ldr.w r2, [r3, #3088] ; 0xc10
+20000042: f022 0201 bic.w r2, r2, #1
+20000046: f8c3 2c10 str.w r2, [r3, #3088] ; 0xc10
+2000004a: 4770 bx lr
+2000004c: 40023000 .word 0x40023000
+20000050: 08010000 .word 0x08010000
+
+20000054 <invalidate_firmware>:
+20000054: b508 push {r3, lr}
+20000056: 4808 ldr r0, [pc, #32] ; (20000078 <invalidate_firmware+0x24>)
+20000058: 4b08 ldr r3, [pc, #32] ; (2000007c <invalidate_firmware+0x28>)
+2000005a: f8c0 3c04 str.w r3, [r0, #3076] ; 0xc04
+2000005e: f103 3388 add.w r3, r3, #2290649224 ; 0x88888888
+20000062: f8c0 3c04 str.w r3, [r0, #3076] ; 0xc04
+20000066: f7ff ffcb bl 20000000 <_flash_program_word.constprop.0>
+2000006a: f8d0 3c10 ldr.w r3, [r0, #3088] ; 0xc10
+2000006e: f043 4300 orr.w r3, r3, #2147483648 ; 0x80000000
+20000072: f8c0 3c10 str.w r3, [r0, #3088] ; 0xc10
+20000076: bd08 pop {r3, pc}
+20000078: 40023000 .word 0x40023000
+2000007c: 45670123 .word 0x45670123
+
+20000080 <reboot_device>:
+20000080: b672 cpsid i
+20000082: 4b04 ldr r3, [pc, #16] ; (20000094 <reboot_device+0x14>)
+20000084: 4a04 ldr r2, [pc, #16] ; (20000098 <reboot_device+0x18>)
+20000086: 601a str r2, [r3, #0]
+20000088: f04f 23e0 mov.w r3, #3758153728 ; 0xe000e000
+2000008c: 4a03 ldr r2, [pc, #12] ; (2000009c <reboot_device+0x1c>)
+2000008e: f8c3 2d0c str.w r2, [r3, #3340] ; 0xd0c
+20000092: e7fe b.n 20000092 <reboot_device+0x12>
+20000094: 20010000 .word 0x20010000
+20000098: 0fc35a96 .word 0x0fc35a96
+2000009c: 05fa0004 .word 0x05fa0004
+
+200000a0 <invalidate_firmware_and_reboot>:
+200000a0: b508 push {r3, lr}
+200000a2: f7ff ffd7 bl 20000054 <invalidate_firmware>
+200000a6: f7ff ffeb bl 20000080 <reboot_device>
+200000aa: bf00 nop
--- pre.hex 2021-11-19 18:03:18.050806159 +0100
+++ post.hex 2021-11-19 18:01:35.977845506 +0100
@@ -1,7 +1,7 @@
00000000 54 52 5a 46 67 06 01 08 00 00 00 00 f8 20 00 00 |TRZFg........ ..|
00000010 01 0a 00 00 01 0a 00 00 00 00 00 00 00 00 00 00 |................|
-00000020 1d 4d f1 f2 b6 76 7c cd ab aa 80 d8 bb 49 d5 04 |.M...v|......I..|
-00000030 4b e6 7d d1 33 04 ea fd d4 ee 39 96 42 70 1c 45 |K.}.3.....9.Bp.E|
+00000020 06 4d c2 3f e9 1e 5d ba d7 9e 05 4e 52 b6 fc 23 |.M.?..]....NR..#|
+00000030 2c 5f 53 6c f8 df 49 fa e8 48 ae d8 cb 7a 30 1b |,_Sl..I..H...z0.|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400 f8 ff 01 20 67 06 01 08 85 12 01 08 c9 12 01 08 |... g...........|
@@ -18,7 +18,7 @@
000005d0 2d f8 04 22 21 46 02 20 00 f0 84 f8 11 4b 02 68 |-.."!F. .....K.h|
000005e0 9a 42 12 d0 04 22 21 46 02 20 00 f0 7b f8 0e 4d |.B..."!F. ..{..M|
000005f0 03 68 ab 42 09 d0 04 22 21 46 03 20 00 f0 72 f8 |.h.B..."!F. ..r.|
-00000600 03 68 ab 42 01 d0 01 f0 0f fa 01 f0 11 fa 00 bf |.h.B............|
+00000600 03 68 ab 42 01 d0 01 f0 13 fa 01 f0 0d fa 00 bf |.h.B............|
00000610 f8 ff 01 20 38 1a 01 08 4a 1a 01 08 a0 1b 01 08 |... 8...J.......|
00000620 5c 1a 01 08 54 52 5a 52 4e 52 43 32 70 47 00 00 |\...TRZRNRC2pG..|
00000630 07 b5 09 4b 1b 68 01 93 4f f0 00 03 06 4b 1a 68 |...K.h..O....K.h|
@@ -340,8 +340,8 @@
000019f0 04 5b 93 42 fb d1 0c f0 03 04 2c b1 ca b2 1c 44 |.[.B......,....D|
00001a00 03 f8 01 2b 9c 42 fb d1 30 bd 64 46 13 46 00 2c |...+.B..0.dF.F.,|
00001a10 f4 d1 f9 e7 03 46 14 46 bf e7 1a 46 a4 46 e0 e7 |.....F.F...F.F..|
-00001a20 0a 46 00 21 ff f7 aa bf 5f f8 00 f0 a1 00 00 20 |.F.!...._...... |
-00001a30 5f f8 00 f0 81 00 00 20 55 6e 73 69 67 6e 65 64 |_...... Unsigned|
+00001a20 0a 46 00 21 ff f7 aa bf 5f f8 00 f0 81 00 00 20 |.F.!...._...... |
+00001a30 5f f8 00 f0 a1 00 00 20 55 6e 73 69 67 6e 65 64 |_...... Unsigned|
00001a40 20 66 69 72 6d 77 61 72 65 00 55 6e 70 72 69 76 | firmware.Unpriv|
00001a50 69 6c 65 67 65 64 20 6d 6f 64 65 00 43 61 6e 6e |ileged mode.Cann|
00001a60 6f 74 20 75 70 64 61 74 65 00 00 00 00 00 00 08 |ot update.......|
@@ -512,5 +512,5 @@
000024c0 10 3c 08 bd 00 30 02 40 23 01 67 45 72 b6 04 4b |.<...0.@#.gEr..K|
000024d0 04 4a 1a 60 4f f0 e0 23 03 4a c3 f8 0c 2d fe e7 |.J.`O..#.J...-..|
000024e0 00 00 01 20 96 5a c3 0f 04 00 fa 05 08 b5 ff f7 |... .Z..........|
-000024f0 d7 ff ff f7 eb ff 00 00 |........|
+000024f0 d7 ff ff f7 eb ff 00 bf |........|
000024f8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment