avatarone / avatar-samples Goto Github PK

#    bkpt_clear_bss = ava.get_emulator().set_breakpoint(0x010000b4)
#    ava.get_emulator().cont()
#    bkpt_clear_bss.wait()
#    print("==================== Arrived at clear_bss ===========================")
    bkpt_main_loop = ava.get_emulator().set_breakpoint(0x0100af34)
    ava.get_emulator().cont()
    bkpt_main_loop.wait()
    print("Arrived at main loop, demo is over")

vagrant@vagrant-ubuntu-precise-64:~/projects/avatar-samples$ netcat -vlu 2000
<listening>

vagrant@vagrant-ubuntu-precise-64:~/projects/avatar-samples/qemu_uboot$ ./start_full_forwarding_demo.sh -vvv
This script is optimized for the path layout of the Avatar vagrant machine.
avatar is supposed to be located in ~/projects/avatar-python, S2E is supposed
to be in ~/projects/s2e-build, and gdb in ~/projects/gdb-build.
No output directory specified, output files are written to /tmp/tmppl0glr
WARNING:avatar.emulators.s2e.configuration:Unknown plugin 'MemoryInterceptor' in configuration - including raw config
WARNING:avatar.emulators.s2e.configuration:Unknown plugin 'ExecutionTracer' in configuration - including raw config
WARNING:avatar.emulators.s2e.configuration:Unknown plugin 'InstructionTracer' in configuration - including raw config
oss: Could not initialize DAC
oss: Failed to open `/dev/dsp'
oss: Reason: No such file or directory
oss: Could not initialize DAC
oss: Failed to open `/dev/dsp'
oss: Reason: No such file or directory
audio: Failed to create voice `lm4549.out'
VNC server running on `127.0.0.1:5900'
INFO:GDB-MI:Creating GDB instance: "/home/vagrant/projects/gdb-build/gdb/gdb" "-q" "-nowindows" "-nx" "-i" "mi" "--data-directory=/home/vagrant/projects/gdb-build/gdb/data-directory"
DEBUG:avatar.bintools.gdb.gdb_debugger:Connecting to remote gdb: tcp:localhost:1234
DEBUG:root:[TX] 1-target-select remote tcp:localhost:1234
DEBUG:root:[RX] =thread-group-added,id="i1"
Received async message: '=thread-group-added,id=i1'
DEBUG:root:[RX] (gdb)
DEBUG:root:[RX] =thread-group-started,id="i1",pid="42000"
Received async message: '=thread-group-started,pid=42000,id=i1'
DEBUG:root:[RX] =thread-created,id="1",group-id="i1"
Received async message: '=thread-created,id=1,group-id=i1'
DEBUG:root:[RX] *stopped,frame={addr="0x01000000",func="??",args=[]},thread-id="1",stopped-threads="all"
Received async message: '*stopped,stopped-threads=all,frame={'args': [], 'addr': '0x01000000', 'func': '??'},thread-id=1'
DEBUG:root:[RX] 1^connected
DEBUG:root:[RX] (gdb)
INFO:avatar.emulators.s2e.s2e_emulator:Executing S2E process: '/home/vagrant/projects/s2e-build/qemu-release/arm-s2e-softmmu/qemu-system-arm' '-s2e-config-file' '/tmp/tmppl0glr/s2e_conf.lua' '-M' 'configura'
INFO:avatar.emulators.s2e.s2e_emulator:Starting S2E process: '/home/vagrant/projects/s2e-build/qemu-release/arm-s2e-softmmu/qemu-system-arm' '-s2e-config-file' '/tmp/tmppl0glr/s2e_conf.lua' '-M' 'configurab'
S2E: output directory = "/tmp/tmppl0glr/s2e-out-0"
WARNING: Linking two modules of different data layouts!
Can not get configuration value 'pluginsConfig['MemoryInterceptor'].verbose':
    value of type nil can not be converted to boolean
Can not get configuration value 'pluginsConfig['RemoteMemory'].writeBack':
    value of type nil can not be converted to boolean
INFO:GDB-MI:Creating GDB instance: "/home/vagrant/projects/gdb-build/gdb/gdb" "-q" "-nowindows" "-nx" "-i" "mi" "--data-directory=/home/vagrant/projects/gdb-build/gdb/data-directory"
DEBUG:avatar.remote_memory_interface:Connecting to S2E RemoteMemory plugin at localhost:3333
Configurable: Adding processor arm926
INFO:avatar.remote_memory_interface:Connection to RemoteMemory plugin established
DEBUG:avatar.emulators.s2e.s2e_emulator:Trying to connect to emulator.
DEBUG:avatar.bintools.gdb.gdb_debugger:Connecting to remote gdb: tcp:127.0.0.1:55553
DEBUG:root:[TX] 1-target-select remote tcp:127.0.0.1:55553
Adding CPU (addr = 0x7f04b9c49210, size = 0x1dbc8)
Configurable: Adding memory region interrupts (size: 0x1000) at address 0x0
Configurable: Adding memory region text_data_bss (size: 0x19000) at address 0x1000000
Configurable: Copying 0x15144 byte of data from file /tmp/tmppl0glr/u-boot.bin to address 0x1000000
Configurable: Ready to start at 0x1000000.
VNC server running on `127.0.0.1:5901'
DEBUG:root:[RX] =thread-group-added,id="i1"
Received async message: '=thread-group-added,id=i1'
DEBUG:root:[RX] (gdb)
DEBUG:root:[RX] =thread-group-started,id="i1",pid="42000"
Received async message: '=thread-group-started,pid=42000,id=i1'
DEBUG:root:[RX] =thread-created,id="1",group-id="i1"
Received async message: '=thread-created,id=1,group-id=i1'
DEBUG:root:[RX] *stopped,frame={addr="0x01000000",func="??",args=[]},thread-id="1",stopped-threads="all"
Received async message: '*stopped,stopped-threads=all,frame={'args': [], 'addr': '0x01000000', 'func': '??'},thread-id=1'
DEBUG:root:[RX] 1^connected
DEBUG:root:[RX] (gdb)
INFO:avatar.emulators.s2e.s2e_emulator:Successfully connected to emulator.
DEBUG:root:[TX] 2-break-insert *0x100af34
DEBUG:root:[RX] 2^done,bkpt={number="1",type="breakpoint",disp="keep",enabled="y",addr="0x0100af34",thread-groups=["i1"],times="0",original-location="*0x100af34"}
DEBUG:root:[RX] (gdb)
DEBUG:root:[TX] 3-exec-continue
DEBUG:root:[RX] 3^running
DEBUG:root:[RX] *running,thread-id="all"
Received async message: '*running,thread-id=all'
DEBUG:root:[RX] (gdb)
DEBUG:avatar.system:Processing event: '{'source': 'emulator', 'properties': {}, 'channel': 'gdb', 'tags': ['EVENT_RUNNING']}'
DEBUG:avatar.remote_memory_interface:buf: '{ \t"cmd" : "write", \t"params" : { \t\t"value" : "0x0", \t\t"address" : "0xfddf70", \t\t"size" : "0x4" \t}, \t"cpu_state" : { \t\t"r0" : "0x10180a8", \t\t"r1" : "'
DEBUG:root:[TX] 2-gdb-set *((long *) 0xfddf70)=0x0
DEBUG:avatar.system:Processing event: '{'source': 'emulator', 'properties': {'cpu_state': {'r4': '0x0', 'r5': '0x0', 'r6': '0x0', 'r7': '0x0', 'r0': '0x10180a8', 'r1': '0x10180a4', 'r2': '0x0', 'r3': '0x0','
DEBUG:root:[RX] =memory-changed,thread-group="i1",addr="0x00fddf70",len="0x4"
Received async message: '=memory-changed,len=0x4,addr=0x00fddf70,thread-group=i1'
DEBUG:root:[RX] 2^done
DEBUG:root:[RX] (gdb)
DEBUG:avatar.remote_memory_interface:buf: '\n{ \t"cmd" : "write", \t"params" : { \t\t"value" : "0x0", \t\t"address" : "0xfddf74", \t\t"size" : "0x4" \t}, \t"cpu_state" : { \t\t"r0" : "0x10180a8", \t\t"r1" :'
DEBUG:root:[TX] 3-gdb-set *((long *) 0xfddf74)=0x0
DEBUG:avatar.system:Processing event: '{'source': 'emulator', 'properties': {'cpu_state': {'r4': '0x0', 'r5': '0x0', 'r6': '0x0', 'r7': '0x0', 'r0': '0x10180a8', 'r1': '0x10180a4', 'r2': '0x0', 'r3': '0x0','
DEBUG:root:[RX] =memory-changed,thread-group="i1",addr="0x00fddf74",len="0x4"
Received async message: '=memory-changed,len=0x4,addr=0x00fddf74,thread-group=i1'
<snip>

EBUG:root:[RX] 3956^done
DEBUG:root:[RX] (gdb)
DEBUG:avatar.remote_memory_interface:buf: '\n{ \t"cmd" : "write", \t"params" : { \t\t"value" : "0x0", \t\t"address" : "0xfde794", \t\t"size" : "0x4" \t}, \t"cpu_state" : { \t\t"r0" : "0xfde000", \t\t"r1" : "0x0", \t\t"r2" : "0x22000", \t\t"r3" : "0x21868", \t\t"r4" : "0xfde794", \t\t"r5" : "0x10145f8", \t\t"r6" : "0x0", \t\t"r7" : "0x0", \t\t"r8" : "0xfddfe0", \t\t"r9" : "0x0", \t\t"r10" : "0x0", \t\t"r11" : "0x0", \t\t"r12" : "0x0", \t\t"r13" : "0xfddf68", \t\t"r14" : "0x1000534", \t\t"pc" : "0x100bbc0", \t\t"cpsr" : "0x200001d3" \t} }'
DEBUG:root:[TX] 3957-gdb-set *((long *) 0xfde794)=0x0
DEBUG:avatar.system:Processing event: '{'source': 'emulator', 'properties': {'cpu_state': {'r4': '0xfde794', 'r5': '0x10145f8', 'r6': '0x0', 'r7': '0x0', 'r0': '0xfde000', 'r1': '0x0', 'r2': '0x22000', 'r3': '0x21868', 'r14': '0x1000534', 'r11': '0x0', 'r8': '0xfddfe0', 'r9': '0x0', 'pc': '0x100bbc0', 'r12': '0x0', 'r10': '0x0', 'cpsr': '0x200001d3', 'r13': '0xfddf68'}, 'size': 4, 'value': 0, 'address': 16639892}, 'tags': ['EVENT_REQUEST_WRITE_MEMORY_VALUE']}'
DEBUG:root:[RX] =memory-changed,thread-group="i1",addr="0x00fde794",len="0x4"
Received async message: '=memory-changed,len=0x4,addr=0x00fde794,thread-group=i1'
DEBUG:root:[RX] 3957^done
DEBUG:root:[RX] (gdb)

vagrant@vagrant-ubuntu-precise-64:~/projects/avatar-samples/qemu_uboot$ ~/projects/s2e-build/qemu-release/arm-softmmu/qemu-system-arm -M versatilepb -m 20M -serial "udp:127.0.0.1:2000" -kernel u-boot
oss: Could not initialize DAC
oss: Failed to open `/dev/dsp'
oss: Reason: No such file or directory
oss: Could not initialize DAC
oss: Failed to open `/dev/dsp'
oss: Reason: No such file or directory
audio: Failed to create voice `lm4549.out'
VNC server running on `127.0.0.1:5900'

sudo cp ${UBOOT_DIR}/MLO ${UBOOT_DIR}/u-boot.img ${UBOOT_DIR}/u-boot.bin ${tmp_dir}