Skip to content

Commit

Permalink
Merge pull request #77 from amboar/dev/cmd-autodata
Browse files Browse the repository at this point in the history
cmd: Exploit autodata for registration and enumeration

Signed-off-by: Andrew Jeffery <[email protected]>
  • Loading branch information
amboar authored Jan 1, 2025
2 parents b2238b3 + 71a5968 commit 40bb728
Show file tree
Hide file tree
Showing 18 changed files with 218 additions and 126 deletions.
42 changes: 16 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -113,34 +113,24 @@ apt install build-essential flex swig bison meson device-tree-compiler libyaml-d

```
$ ./build/src/culvert -h
culvert: v0.4.0-10-gb30b8364b75a
culvert: v0.4.0-196-g34001fbe828a
Usage:
culvert probe [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert ilpc read ADDRESS
culvert ilpc write ADDRESS VALUE
culvert p2a vga read ADDRESS
culvert p2a vga write ADDRESS VALUE
culvert debug read ADDRESS INTERFACE [IP PORT USERNAME PASSWORD]
culvert debug write ADDRESS VALUE INTERFACE [IP PORT USERNAME PASSWORD]
culvert devmem read ADDRESS
culvert devmem write ADDRESS VALUE
culvert console HOST_UART BMC_UART BAUD USER PASSWORD
culvert read firmware [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert read ram [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert write firmware [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert replace ram MATCH REPLACE
culvert reset TYPE WDT [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert jtag TARGET [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert sfc fmc read ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert sfc fmc erase ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert sfc fmc write ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert otp read conf [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert otp read strap [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert otp write strap BIT VALUE [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert otp write conf WORD BIT [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert trace ADDRESS WIDTH MODE [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert coprocessor run ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert console HOST_UART BMC_UART BAUD USER PASSWORD
culvert coprocessor <run ADDRESS LENGTH|stop> [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert debug <read ADDRESS|write ADDRESS VALUE> INTERFACE [IP PORT USERNAME PASSWORD]
culvert devmem <read ADDRESS|write ADDRESS VALUE>
culvert ilpc <read ADDRESS|write ADDRESS VALUE
culvert jtag [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert otp <read <conf|strap>|write <conf WORD BIT|strap BIT VALUE>> [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert p2a vga <read ADDRESS|write ADDRESS VALUE>
culvert probe [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert read <firmware|ram ADDRESS LENGTH> [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert replace ram MATCH REPLACE
culvert reset TYPE WDT [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert sfc fmc <erase|read|write> ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert trace ADDRESS WIDTH MODE [INTERFACE [IP PORT USERNAME PASSWORD]]
culvert write <firmware|ram ADDRESS LENGTH> [INTERFACE [IP PORT USERNAME PASSWORD]]
```

```
Expand Down
27 changes: 27 additions & 0 deletions src/cmd.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
/* SPDX-License-Identifier: Apache-2.0 */
/* Copyright (C) 2024 Andrew Jeffery */

#ifndef CULVERT_CMD_H
#define CULVERT_CMD_H

#include "ccan/autodata/autodata.h"
#include <string.h>

struct cmd {
const char *name;
const char *help;
int (*fn)(const char *, int, char *[]);
};

AUTODATA_TYPE(cmds, struct cmd);
#define REGISTER_CMD(cmd) AUTODATA_SYM(cmds, cmd);

static inline int cmd_cmp(const void *a, const void *b)
{
const struct cmd * const *acmd = a;
const struct cmd * const *bcmd = b;

return strcmp((*acmd)->name, (*bcmd)->name);
}

#endif
9 changes: 8 additions & 1 deletion src/cmd/console.c
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand All @@ -16,7 +17,7 @@
#include <string.h>
#include <unistd.h>

int cmd_console(const char *name __unused, int argc, char *argv[])
static int do_console(const char *name __unused, int argc, char *argv[])
{
struct suart _suart, *suart = &_suart;
struct host _host, *host = &_host;
Expand Down Expand Up @@ -179,3 +180,9 @@ int cmd_console(const char *name __unused, int argc, char *argv[])
return rc;
}

static const struct cmd console_cmd = {
"console",
"HOST_UART BMC_UART BAUD USER PASSWORD",
do_console
};
REGISTER_CMD(console_cmd);
10 changes: 9 additions & 1 deletion src/cmd/coprocessor.c
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
// Copyright (C) 2024 Code Construct

#include "bits.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand Down Expand Up @@ -274,7 +275,7 @@ static int cmd_coprocessor_stop(const char *name __unused, int argc, char *argv[
return rc;
}

int cmd_coprocessor(const char *name __unused, int argc, char *argv[])
static int do_coprocessor(const char *name __unused, int argc, char *argv[])
{
const char *arg_subcmd;

Expand All @@ -295,3 +296,10 @@ int cmd_coprocessor(const char *name __unused, int argc, char *argv[])

return EXIT_FAILURE;
}

static const struct cmd coprocessor_cmd = {
"coprocessor",
"<run ADDRESS LENGTH|stop> [INTERFACE [IP PORT USERNAME PASSWORD]]",
do_coprocessor
};
REGISTER_CMD(coprocessor_cmd);
10 changes: 9 additions & 1 deletion src/cmd/debug.c
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@
#include "ahb.h"
#include "ast.h"
#include "bridge/debug.h"
#include "cmd.h"
#include "log.h"

int cmd_debug(const char *name, int argc, char *argv[])
static int do_debug(const char *name, int argc, char *argv[])
{
struct debug _debug, *debug = &_debug;
struct ahb *ahb;
Expand Down Expand Up @@ -73,3 +74,10 @@ int cmd_debug(const char *name, int argc, char *argv[])

return rc;
}

static const struct cmd debug_cmd = {
"debug",
"<read ADDRESS|write ADDRESS VALUE> INTERFACE [IP PORT USERNAME PASSWORD]",
do_debug
};
REGISTER_CMD(debug_cmd);
9 changes: 8 additions & 1 deletion src/cmd/devmem.c
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@
#include "ahb.h"
#include "ast.h"
#include "bridge/devmem.h"
#include "cmd.h"
#include "priv.h"

int cmd_devmem(const char *name, int argc, char *argv[])
static int do_devmem(const char *name, int argc, char *argv[])
{
struct devmem _devmem, *devmem = &_devmem;
struct ahb *ahb;
Expand Down Expand Up @@ -46,3 +47,9 @@ int cmd_devmem(const char *name, int argc, char *argv[])
return 0;
}

static const struct cmd devmem_cmd = {
"devmem",
"<read ADDRESS|write ADDRESS VALUE>",
do_devmem,
};
REGISTER_CMD(devmem_cmd);
10 changes: 9 additions & 1 deletion src/cmd/ilpc.c
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@
#include "ahb.h"
#include "ast.h"
#include "bridge/ilpc.h"
#include "cmd.h"
#include "priv.h"

int cmd_ilpc(const char *name, int argc, char *argv[])
static int do_ilpc(const char *name, int argc, char *argv[])
{
struct ilpcb _ilpcb, *ilpcb = &_ilpcb;
struct ahb *ahb;
Expand Down Expand Up @@ -44,3 +45,10 @@ int cmd_ilpc(const char *name, int argc, char *argv[])

return 0;
}

static const struct cmd ilpc_cmd = {
"ilpc",
"<read ADDRESS|write ADDRESS VALUE",
do_ilpc,
};
REGISTER_CMD(ilpc_cmd);
10 changes: 9 additions & 1 deletion src/cmd/jtag.c
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand Down Expand Up @@ -147,7 +148,7 @@ static int run_openocd_bitbang_server(struct jtag *jtag, uint16_t port)
}
}

int cmd_jtag(const char *name, int argc, char *argv[])
static int do_jtag(const char *name, int argc, char *argv[])
{
struct host _host, *host = &_host;
struct soc _soc, *soc = &_soc;
Expand Down Expand Up @@ -260,3 +261,10 @@ int cmd_jtag(const char *name, int argc, char *argv[])
done:
exit(rc);
}

static const struct cmd jtag_cmd = {
"jtag",
"[INTERFACE [IP PORT USERNAME PASSWORD]]",
do_jtag,
};
REGISTER_CMD(jtag_cmd);
10 changes: 9 additions & 1 deletion src/cmd/otp.c
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
// Copyright (C) 2018,2021 IBM Corp.
#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand All @@ -13,7 +14,7 @@
#include <stdlib.h>
#include <string.h>

int cmd_otp(const char *name __unused, int argc, char *argv[])
static int do_otp(const char *name __unused, int argc, char *argv[])
{
enum otp_region reg = otp_region_conf;
struct host _host, *host = &_host;
Expand Down Expand Up @@ -104,3 +105,10 @@ int cmd_otp(const char *name __unused, int argc, char *argv[])

return rc;
}

static const struct cmd otp_cmd = {
"otp",
"<read <conf|strap>|write <conf WORD BIT|strap BIT VALUE>> [INTERFACE [IP PORT USERNAME PASSWORD]]",
do_otp,
};
REGISTER_CMD(otp_cmd);
10 changes: 9 additions & 1 deletion src/cmd/p2a.c
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,11 @@
#include "ahb.h"
#include "ast.h"
#include "bridge/p2a.h"
#include "cmd.h"
#include "log.h"
#include "priv.h"

int cmd_p2a(const char *name, int argc, char *argv[])
static int do_p2a(const char *name, int argc, char *argv[])
{
struct p2ab _p2ab, *p2ab = &_p2ab;
struct ahb *ahb;
Expand Down Expand Up @@ -55,3 +56,10 @@ int cmd_p2a(const char *name, int argc, char *argv[])

return 0;
}

static const struct cmd p2a_cmd = {
"p2a",
"vga <read ADDRESS|write ADDRESS VALUE>",
do_p2a,
};
REGISTER_CMD(p2a_cmd);
11 changes: 9 additions & 2 deletions src/cmd/probe.c
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
// SPDX-License-Identifier: Apache-2.0
// Copyright (C) 2018,2021 IBM Corp.

#include "cmd.h"
#include "compiler.h"

#include "host.h"
#include "log.h"
#include "soc.h"
Expand All @@ -24,7 +24,7 @@ cmd_probe_help(const char *name, int argc __unused, char *argv[] __unused)
printf(probe_help, name, name, name, name);
}

int cmd_probe(const char *name, int argc, char *argv[])
static int do_probe(const char *name, int argc, char *argv[])
{
enum bridge_mode required = bm_permissive;
struct host _host, *host = &_host;
Expand Down Expand Up @@ -123,3 +123,10 @@ int cmd_probe(const char *name, int argc, char *argv[])
done:
exit(rc);
}

static const struct cmd probe_cmd = {
"probe",
"[INTERFACE [IP PORT USERNAME PASSWORD]]",
do_probe,
};
REGISTER_CMD(probe_cmd);
10 changes: 9 additions & 1 deletion src/cmd/read.c
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "flash.h"
#include "host.h"
Expand Down Expand Up @@ -194,7 +195,7 @@ static int cmd_read_ram(int argc, char *argv[])
return rc;
}

int cmd_read(const char *name __unused, int argc, char *argv[])
static int do_read(const char *name __unused, int argc, char *argv[])
{
int rc;

Expand All @@ -214,3 +215,10 @@ int cmd_read(const char *name __unused, int argc, char *argv[])

return rc < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}

static const struct cmd read_cmd = {
"read",
"<firmware|ram ADDRESS LENGTH> [INTERFACE [IP PORT USERNAME PASSWORD]]",
do_read,
};
REGISTER_CMD(read_cmd);
10 changes: 9 additions & 1 deletion src/cmd/replace.c
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand All @@ -18,7 +19,7 @@

#define DUMP_RAM_WIN (8 << 20)

int cmd_replace(const char *name __unused, int argc, char *argv[])
static int do_replace(const char *name __unused, int argc, char *argv[])
{
struct host _host, *host = &_host;
struct soc _soc, *soc = &_soc;
Expand Down Expand Up @@ -128,3 +129,10 @@ int cmd_replace(const char *name __unused, int argc, char *argv[])

return rc;
}

static const struct cmd replace_cmd = {
"replace",
"ram MATCH REPLACE",
do_replace,
};
REGISTER_CMD(replace_cmd);
10 changes: 9 additions & 1 deletion src/cmd/reset.c
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
// Copyright (C) 2018,2021 IBM Corp.
#include "ahb.h"
#include "ast.h"
#include "cmd.h"
#include "compiler.h"
#include "host.h"
#include "log.h"
Expand All @@ -16,7 +17,7 @@
#include <string.h>
#include <unistd.h>

int cmd_reset(const char *name __unused, int argc, char *argv[])
static int do_reset(const char *name __unused, int argc, char *argv[])
{
struct host _host, *host = &_host;
struct soc _soc, *soc = &_soc;
Expand Down Expand Up @@ -99,3 +100,10 @@ int cmd_reset(const char *name __unused, int argc, char *argv[])

return rc;
}

static const struct cmd reset_cmd = {
"reset",
"TYPE WDT [INTERFACE [IP PORT USERNAME PASSWORD]]",
do_reset,
};
REGISTER_CMD(reset_cmd);
Loading

0 comments on commit 40bb728

Please sign in to comment.