s922x works

source/bootrom_emulator/.vscode/launch.json

@@ -13,12 +13,22 @@
             "justMyCode": false
         },
         {
-            "name": "Run Fuzzer",
+            "name": "Test Fuzzer command S905X3",
             "type": "python",
             "request": "launch",
             "program": "fuzzer.py",
             "console": "integratedTerminal",
             "justMyCode": false,
+            "args": ["--device", "S905X3", "--test"]
+        },
+        {
+            "name": "Test Fuzzer command S922",
+            "type": "python",
+            "request": "launch",
+            "program": "fuzzer.py",
+            "console": "integratedTerminal",
+            "justMyCode": false,
+            "args": ["--device", "S922", "--test"]
         }
     ]
 }

source/bootrom_emulator/amlogic_rom_db.py

@@ -4,16 +4,22 @@ TEST_CONTEXT_BUFFER = TEST_OFFSET + 0x9000
 
 amlogic_rom_db = {
     "S905X3" : {
+        "name" : "S905X3",
+        "path" : "bin/BootROM_s905x3.bin",
         "ENTRY_POINT" : 0xffff0000,
         "STACK_ADDRESS" : 0xfffe3800,
         "FASTBOOT_CMD_HANDLER" : 0xffff9758,
-        "fastboot_response" : 0xffff8c04,
+        "fastboot_tx_write": 0xffff8c04,
+        "fastboot_response" : 0xffff8c78,
         "usb_ep_queue" : 0xffff8998
     },
     "S922" : {
+        "name" : "S922",
+        "path" : "bin/S922X_bootrom.bin",
         "ENTRY_POINT" : 0xffff0000,
         "STACK_ADDRESS" : 0xfffe3800,
         "FASTBOOT_CMD_HANDLER" : 0xffff815c,
+        "fastboot_tx_write": 0xffff76cc,
         "fastboot_response" : 0xffff7740,
         "usb_ep_queue" : 0xffff7474
     },

source/bootrom_emulator/emulator.py

@@ -12,7 +12,7 @@ from amlogic_rom_db import *
 ENTRY_POINT = 0xffff0000
 STACK_ADDRESS = 0xfffe3800
     
-FASTBOOT_CMD_HANDLER = 0xffff9758
+# FASTBOOT_CMD_HANDLER = 0xffff9758
 TEST_OFFSET = 0xfffa0000 + 0x8000
 TEST_REQ_BUFFER = TEST_OFFSET + 0x800
 TEST_CONTEXT_BUFFER = TEST_OFFSET + 0x9000
@@ -26,15 +26,16 @@ class Amlogic_Emulator(ARM64UC_Emulator):
             Amlogic bootrom emulator.
         '''
         super().__init__(True)
+        self.device_offsets = amlogic_rom_db[device]
+        self.file = self.device_offsets['path']
         
         self.logger = setup_logger("GSCEmulator")
         self.logger.setLevel(logging.DEBUG)
         self.debug = debug
 
-        self.bootrom = open(file, 'rb').read()
+        self.bootrom = open(self.file, 'rb').read()
         self.uc = Uc(UC_ARCH_ARM64, UC_MODE_LITTLE_ENDIAN)
         self.sc = ShellcodeCrafterARM64(None, None)
-        self.device_offsets = amlogic_rom_db[device]
         self.setup_memory()
         self.setup_registers()
         self.setup_hooks()
@@ -57,7 +58,7 @@ class Amlogic_Emulator(ARM64UC_Emulator):
         return bytes(self.uc.mem_read(address, size))
     
     def apply_patches(self):
-        self.write(self.device_offsets['fastboot_response'], self.sc.ret_ins)
+        self.write(self.device_offsets['fastboot_tx_write'], self.sc.ret_ins)
         self.write(self.device_offsets['usb_ep_queue'], self.sc.ret_ins)
 
     def setup_memory(self):
@@ -242,6 +243,7 @@ class Amlogic_Emulator(ARM64UC_Emulator):
         '''
         if self.enable_trace:
             self.pc_trace.append(hex(self.pc))
+        return
         # Reset expects value in DRAM
         if self.pc == 0xffff00b0:
             self.write_ptr(0xff800228, uc.reg_read(UC_ARM64_REG_X1))
@@ -330,9 +332,9 @@ class Amlogic_Emulator(ARM64UC_Emulator):
                 hexdump(em.read(em.X0, em.X1))
             # em.uc.emu_stop()
             return True
-        self.uc.hook_add(UC_HOOK_CODE, _hook_fastboot_tx_write, self, self.device_offsets['fastboot_response'], self.device_offsets['fastboot_response'] + 1)
+        self.uc.hook_add(UC_HOOK_CODE, _hook_fastboot_tx_write, self, self.device_offsets['fastboot_tx_write'], self.device_offsets['fastboot_tx_write'] + 1)
         
-        self.pc = FASTBOOT_CMD_HANDLER
+        self.pc = self.device_offsets['FASTBOOT_CMD_HANDLER']
         self.sp = STACK_ADDRESS
         
         # Run 

source/bootrom_emulator/fuzzer.py

@@ -5,7 +5,7 @@ import argparse
 ENTRY_POINT = 0xffff0000
 STACK_ADDRESS = 0xfffe3800
     
-FASTBOOT_CMD_HANDLER = 0xffff9758
+# FASTBOOT_CMD_HANDLER = 0xffff9758
 TEST_OFFSET = 0xfffa0000 + 0x8000
 TEST_REQ_BUFFER = TEST_OFFSET + 0x800
 TEST_CONTEXT_BUFFER = TEST_OFFSET + 0x9000
@@ -17,7 +17,7 @@ debug_functions = [
 ]
   
 def test_fb_cmd(cmd=b'getvar:version', device="S905X3"):
-    emulator = Amlogic_Emulator(device=device)
+    emulator = Amlogic_Emulator(device=device, debug=True)
     emulator.debug = True
     emulator.place_fastboot_command(cmd)
     res = emulator.run_fastboot_cmd()
@@ -45,13 +45,19 @@ def afl_fuzzer():
     
 if __name__ == "__main__":
     args = argparse.ArgumentParser("Amlogic BootROM Fuzzer")
-    # test_fb_cmd(device="S905X3")
-    test_fb_cmd(device="S922")
-    # afl_fuzzer()
-    # exit(0)
+    args.add_argument("--device", "-d", help="Device to test", default="S905X3")
+    args.add_argument("--test", "-t", help="Test fastboot command", default=False, action="store_true")
     args.add_argument("--input", "-i", help="Input file for crash", default=None)
-    arg = args.parse_args()
-    if arg.input:
-        test_fb_cmd(open(arg.input, 'rb').read())
+    
+    args = args.parse_args()
+    
+    if args.test:
+        test_fb_cmd(device=args.device)
+        exit(0)
+        
+    if args.input:
+        # Run a single comand
+        test_fb_cmd(open(args.input, 'rb').read())
     else:
+        # Run AFL
         afl_fuzzer()