{"id":1721,"date":"2022-09-10T10:24:29","date_gmt":"2022-09-10T08:24:29","guid":{"rendered":"http:\/\/www.mhrooz.xyz\/?p=1721"},"modified":"2023-01-31T00:26:30","modified_gmt":"2023-01-30T23:26:30","slug":"ansi_c_xue_xi_bi_ji","status":"publish","type":"post","link":"https:\/\/blog.mhrooz.xyz\/index.php\/2022\/09\/10\/ansi_c_xue_xi_bi_ji\/","title":{"rendered":"XMC4500\u5b66\u4e60\u7b14\u8bb0"},"content":{"rendered":"\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"1-workflow-of-embedded-programs\">1. Embedded Programs<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-11.58.29.png\" alt=\"\" class=\"wp-image-2209\" width=\"626\" height=\"304\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-11.58.29.png 900w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-11.58.29-300x146.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-11.58.29-768x373.png 768w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><figcaption class=\"wp-element-caption\"><strong>\u2020 arm-none-eabi-(gcc | objcopy | objdump)<\/strong><\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">(1) What &#8220;Embedded Programs&#8221; Mean<\/h3>\n\n\n\n<p>Embedded programs are \u201cbare metal\u201d programs, i.e. without an underlying operating system (OS). You have full control over the hardware of embedded systems. You also have full responsibility, no convenient functions are available.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Retrace Build Steps<\/h3>\n\n\n\n<ul>\n<li>Cross Compiler<\/li>\n<\/ul>\n\n\n\n<p><code>arm-non-eabi-gcc<\/code> compiles header files, libraries and main.c and generate <code>*.o<\/code> files. <code>-I<\/code> options are for specifying directories to search for header files to be included. Here the device header XMC4500.h are the header files for the GPIO driver.<\/p>\n\n\n\n<p><code>*.o<\/code> files are compiled but unlinked versions of source files, not human-readable.<\/p>\n\n\n\n<ul>\n<li>Cross Linker<\/li>\n<\/ul>\n\n\n\n<p><code>arm-non-eabi-gcc<\/code> links all <code>*.o<\/code> files into <code>main.elf<\/code> file. <code>-T<\/code> option gives the linker description file <code>*.ld<\/code>. <\/p>\n\n\n\n<p><code>*.elf<\/code> files (<strong>executable<\/strong> and <strong>linkable<\/strong> format) are compiled and linked programs, ready to execute on the architecture they are built for. <\/p>\n\n\n\n<p>That means, <code>ELF<\/code> format is used in two ways: The <strong>linker<\/strong> reads it as an input that can be linked with other objects. The <strong>loader<\/strong> interprets it as an executable program. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Important ELF sections<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-26-21.15.43.png\" alt=\"\" class=\"wp-image-2482\" width=\"595\" height=\"195\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-26-21.15.43.png 868w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-26-21.15.43-300x99.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-26-21.15.43-768x252.png 768w\" sizes=\"(max-width: 595px) 100vw, 595px\" \/><\/figure><\/div><\/blockquote>\n\n\n\n<ul>\n<li>objcopy<\/li>\n<\/ul>\n\n\n\n<p><code>arm-non-eabi-objcopy<\/code> creates <code>*.hex<\/code> files, which is pure machine code together with information about instruction addresses, technically human-readable.<\/p>\n\n\n\n<ul>\n<li>objdump<\/li>\n<\/ul>\n\n\n\n<p><code>arm-non-eabi-objdump<\/code> creates <code>*.lst<\/code> files, which is a human-readable copy of parts of the <code>*.elf<\/code> file. What to put here is assigned by options of <code>objdump<\/code>, but usually it is:<\/p>\n\n\n\n<p>&#8211; Section headers (where .data, .bss, etc. are located and how large they are)<\/p>\n\n\n\n<p>&#8211; Disassembly of the .text section interleaved with the C instructions it was<br>compiled from. (.text\u90e8\u5206\u7684\u53cd\u6c47\u7f16\u4ee5\u53ca\u5bf9\u5e94\u7684\u7684C\u6307\u4ee4)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(3) Difference from Computer Programs<\/h3>\n\n\n\n<ul>\n<li>Cross-compiler instead of compiler<\/li>\n\n\n\n<li><strong>Device<\/strong> header and device linker file needed<\/li>\n\n\n\n<li>Often additional <strong>libraries<\/strong> and drivers necessary<\/li>\n\n\n\n<li>Programming onto uC as another final step<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. XMC4500 Board<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Functional Blocks<\/h3>\n\n\n\n<p>CPU, memory, clock and reset, timers\/counters, communications, analogs, GPIOs<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"698\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-15.26.03-1024x698.png\" alt=\"\" class=\"wp-image-2391\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-15.26.03-1024x698.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-15.26.03-300x205.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-15.26.03-768x524.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-15.26.03.png 1396w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">(2) Peripherals<\/h3>\n\n\n\n<ul>\n<li>CCU4<\/li>\n<\/ul>\n\n\n\n<p>provides several counters for PWM generation, counting external events<\/p>\n\n\n\n<ul>\n<li>ADC <\/li>\n<\/ul>\n\n\n\n<p>Measures analog signals<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(3) Accessing Peripherals<\/h3>\n\n\n\n<p><strong>Memory-mapped<\/strong>: I\/O devices are accessed through memory addresses, just like normal memory, the processor can access them by reading or writing to those memory addresses. It is generally more flexible and easier to use, as it allows the processor to access I\/O devices using the same instructions and addressing modes as it uses for normal memory. BUT the memory bus has to connect to each and every peripheral, whereas a longer bus reduces the maximal clock frequency, especially when going off-chip.<\/p>\n\n\n\n<p>Port-mapped: I\/O devices are accessed through dedicated I\/O ports, each I\/O device is assigned a unique port address, and the processor can access the device by reading or writing to that port address via special instructions <code>IN<\/code>, <code>OUT<\/code> instead of <code>LD<\/code>, <code>ST<\/code>. It is generally faster and more efficient than memory mapped I\/O, as it requires fewer bus transactions and can be implemented using a simpler addressing scheme. BUT specialized instructions and addressing modes are needed for different devices, which leads to additional complexity.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-22.28.54-1024x478.png\" alt=\"\" class=\"wp-image-2395\" width=\"635\" height=\"296\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-22.28.54-1024x478.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-22.28.54-300x140.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-22.28.54-768x358.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-22.28.54.png 1260w\" sizes=\"(max-width: 635px) 100vw, 635px\" \/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Cortex M4<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Functional Blocks<\/h3>\n\n\n\n<p>The Cortex-M4 has a three-stage pipeline (Fetch, Decode, Execute) with the following functional blocks.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-1024x315.png\" alt=\"\" class=\"wp-image-2392\" width=\"639\" height=\"196\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-1024x315.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-300x92.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-768x236.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-1536x472.png 1536w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36-1568x482.png 1568w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.09.36.png 1686w\" sizes=\"(max-width: 639px) 100vw, 639px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">(2) Registers<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">1. Registers for Function Arguments<\/h4>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.11.27-1024x227.png\" alt=\"\" class=\"wp-image-2394\" width=\"575\" height=\"127\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.11.27-1024x227.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.11.27-300x67.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.11.27-768x170.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-16.11.27.png 1424w\" sizes=\"(max-width: 575px) 100vw, 575px\" \/><figcaption class=\"wp-element-caption\"><strong>R1:R0<\/strong> for the return value<\/figcaption><\/figure><\/div>\n\n\n<h4 class=\"wp-block-heading\">2. Caller\/Callee-saved Registers<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Registers are special memory locations in the processor that are used to store data temporarily while a program is running.<\/p>\n\n\n\n<p>Caller-saved registers (<strong>R0 &#8211; R3, R12<\/strong>) are registers that are expected to be preserved by a called function. This means that the calling function (the &#8220;caller&#8221;) is responsible for saving the values of these registers before making the function call, and restoring them after the function returns.<\/p>\n\n\n\n<p>Callee-saved registers (<strong>R4 &#8211; R11<\/strong>), on the other hand, are registers that are expected to be preserved by the called function, and are guaranteed to retain their values after the function returns. This means that the called function (the &#8220;callee&#8221;) is responsible for saving the values of these registers before modifying them, and restoring them before returning control to the calling function. To do this, the callee must either leave them unchanged or push them on the stack in the beginning and pop them back before return.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">3. Special Registers<\/h4>\n\n\n\n<p>Register R13 &#8211; R15 are not classified as caller- or callee-saved. <\/p>\n\n\n\n<p>R13 (Stack Pointer): The <code>SP<\/code> determines the border between allocated and unallocated memory on the stack. If a function requires stack space, it allocates it by decreasing the <code>SP<\/code>.<\/p>\n\n\n\n<p>R14 (Link Register): The <code>LR<\/code> can be seen as a kind of hidden argument register that tells a callee the return address.<\/p>\n\n\n\n<p>R15 (Program Counter)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4. PSR (Program status registers)<\/h4>\n\n\n\n<p>ApplicationPSR: N, Z, C, V (flags)<\/p>\n\n\n\n<p>ExecutionPSR: IT (if-then instruction status bits), T (thumb state, always 1 for Cortex-M)<\/p>\n\n\n\n<p>InterruptPSR: EN (exception number)<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Assembler<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"1-instructions\">(1) Instructions<\/h3>\n\n\n\n<ul>\n<li>Data Processing<\/li>\n<\/ul>\n\n\n\n<p><code>ADD r3, r4, r5; <\/code><\/p>\n\n\n\n<p>Add the contents of <code>r4<\/code> and <code>r5<\/code> and store the result in <code>r3<\/code>.<\/p>\n\n\n\n<p><code>ADC r0, r1, r2; <\/code><\/p>\n\n\n\n<p>Add the contents of<code> r1<\/code> and <code>r2<\/code> and store the result in <code>r0<\/code>, taking into account the carry flag.<\/p>\n\n\n\n<p><code>SUB r3, r4, r5;<\/code><\/p>\n\n\n\n<p>Subtract the contents of <code>r5<\/code> from <code>r4<\/code> and store the result in <code>r3<\/code>.<\/p>\n\n\n\n<p><code>NEG r12, r13;<\/code><\/p>\n\n\n\n<p>Negate the contents of <code>r13<\/code> and store the result in <code>r12<\/code>.<\/p>\n\n\n\n<ul>\n<li>Data Move<\/li>\n<\/ul>\n\n\n\n<p><code>MOV r0, #0; <\/code><\/p>\n\n\n\n<p>Move the value <code>0<\/code> into register <code>r0<\/code>. The <code>#<\/code> symbol indicates that the value is an immediate value, rather than a register or memory location.<\/p>\n\n\n\n<p><code>LDR r1, [r2]; <\/code><\/p>\n\n\n\n<p>Load the value at the memory location pointed to by <code>r2<\/code> into<code> r1<\/code>. The <code>[]<\/code> symbol indicates that the operand is a <strong>memory location<\/strong>, rather than a register or immediate value.<\/p>\n\n\n\n<p><code>STR r6, [r7, #4];<\/code> <\/p>\n\n\n\n<p>Store the contents of <code>r6<\/code> at the memory location pointed to by <code>r7 + 4<\/code>.<\/p>\n\n\n\n<ul>\n<li>Control Flow<\/li>\n<\/ul>\n\n\n\n<p><code>B foo; <\/code><\/p>\n\n\n\n<p>Jump to the label <code>foo<\/code>. This instruction adds a delta to the current PC.<\/p>\n\n\n\n<p><code>BX r0; <\/code><\/p>\n\n\n\n<p>Jump to the address stored in <code>r0<\/code> and change the execution mode. This branch writes a new address value in the PC<\/p>\n\n\n\n<p><code>BL foo; <\/code>(<strong>function call<\/strong>)<\/p>\n\n\n\n<p>Call the function <code>foo<\/code> and store the return address in the link register. Before branch execution PC is copied into the link register (LR).<\/p>\n\n\n\n<p><code>pop {r4,r5,r7,pc};<\/code> (<strong>function return<\/strong>)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2-risc-vs-cisc\">(2) RISC vs CISC<\/h3>\n\n\n\n<p>RISC: \u9664\u4e86load\/store\uff0c\u6ca1\u6709\u5176\u4ed6\u8bbf\u95ee\u5185\u5b58\u7684\u6307\u4ee4\u3002\u6307\u4ee4\u56fa\u5b9a\u957f\u5ea6\uff0c\u6307\u4ee4\u5f88\u591a\uff0c\u4f46CPU\u5f88\u7b80\u5355\uff0c\u65f6\u949f\u9891\u7387\u5f88\u9ad8\u3002By reducing the number of addressing modes, RISC computer achieves less complexity and higher clock frequencies<\/p>\n\n\n\n<p>Distinct <code>load<\/code> and <code>store<\/code> instructions, lacking memory addressing modes for data processing instructions (e.g. ADD), and fixed length instructions all indicate RISC.<\/p>\n\n\n\n<p>CISC: load\/store\u88ab\u96c6\u6210\u5230\u5404\u79cd\u6307\u4ee4\u4e2d\u3002\u6307\u4ee4\u957f\u5ea6\u53ef\u53d8\uff0c\u6307\u4ee4\u5f88\u5c11\u4f46CPU\u66f4\u590d\u6742\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(3) Thumb Mode<\/h3>\n\n\n\n<ul>\n<li>Thumb or ARM Mode<\/li>\n<\/ul>\n\n\n\n<p>Use the LSB of <code>PC<\/code> for detection. An even address is seen as an ARM code, and an odd address as Thumb.<\/p>\n\n\n\n<ul>\n<li>Operands<\/li>\n<\/ul>\n\n\n\n<p><code>result<\/code> counts as an operand of the opcode, thus Cortex-M opcodes have three operands <code>result, operand1, operand2<\/code><\/p>\n\n\n\n<ul>\n<li>Suffix &#8220;S&#8221;<\/li>\n<\/ul>\n\n\n\n<p>Suffix &#8220;S&#8221; tells the CPU to update the <strong>conditional execution flags<\/strong> depending on the result of this operation, i.e. ADDS is ADD with S suffix, only ADDS updates APSR flags.<\/p>\n\n\n\n<ul>\n<li>32-bit Literal<\/li>\n<\/ul>\n\n\n\n<p>As instructions are only 32-bit long and a few bits are needed to encode the opcode, the 32-bit literal cannot be placed as an immediate in the instruction. Use <code>MOV<\/code> for the lower 16 bits and <code>MOVT<\/code> for the upper 16 bits.<\/p>\n\n\n\n<p>Alternatively, we can use the so-called <strong>literal pool<\/strong> with<code> LDR r0,=0x12345678<\/code>. The literal is placed into the text section right after the current function and is loaded from there using the <code>PC<\/code> with an offset automatically calculated by the assembler.<\/p>\n\n\n\n<ul>\n<li>Function call<\/li>\n<\/ul>\n\n\n\n<p>Function calls\/ Jumps are done using <code>B<\/code> or <code>BX<\/code>. Note that the <code>LR<\/code> needs to be updated to the address of the next instruction after the function call. <code>BL<\/code> or <code>BLX<\/code> do that automatically.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"3-gnu-debugger\">5. GNU Debugger<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2-comparisons-of-debug-methods\">(1) Comparisons of Debug Methods<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.47.png\" alt=\"\" class=\"wp-image-2232\" width=\"819\" height=\"361\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.47.png 890w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.47-300x132.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.47-768x339.png 768w\" sizes=\"(max-width: 819px) 100vw, 819px\" \/><\/figure><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.55.png\" alt=\"\" class=\"wp-image-2233\" width=\"806\" height=\"519\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.55.png 882w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.55-300x193.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/11\/\u622a\u5c4f2022-11-26-19.30.55-768x494.png 768w\" sizes=\"(max-width: 806px) 100vw, 806px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">(2) GDB Overview<\/h3>\n\n\n\n<p>GDB can be directly attached to any PC program. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.28.50.png\" alt=\"\" class=\"wp-image-2397\" width=\"534\" height=\"193\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.28.50.png 964w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.28.50-300x109.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.28.50-768x278.png 768w\" sizes=\"(max-width: 534px) 100vw, 534px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"1-cheatsheet\">(3) <a rel=\"noreferrer noopener\" href=\"https:\/\/users.ece.utexas.edu\/~adnan\/gdb-refcard.pdf\" data-type=\"URL\" data-id=\"https:\/\/users.ece.utexas.edu\/~adnan\/gdb-refcard.pdf\" target=\"_blank\">Cheatsheet<\/a><\/h3>\n\n\n\n<ul>\n<li>\u5230\u8fbe\u51fd\u6570foo()\u65f6\u505c\u6b62\u6267\u884c &#8211; break foo<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6267\u884c\u5355\u884c\u6e90\u4ee3\u7801\/\u6c47\u7f16\u4ee3\u7801 &#8211; step (<code>s<\/code>) \/ stepi (<code>si<\/code>)<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u5f53\u53d8\u91cfBytes\u88ab\u6539\u53d8\u65f6\u505c\u6b62\u6267\u884c &#8211; watch Bytes<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6682\u65f6\u7ee7\u7eed\u6267\u884c &#8211; continue (<code>c<\/code>)<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u5220\u96642\u53f7\u65ad\u70b9 &#8211; delete 2<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6539\u53d8\u5e03\u5c40\uff0c\u540c\u65f6\u663e\u793a\u6e90\u4ee3\u7801\u548c\u6c47\u7f16\u7a0b\u5e8f &#8211; layout split<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6539\u53d8\u5149\u6807\u7126\u70b9\u4ee5\u626b\u63cf\u547d\u4ee4\u5386\u53f2\u800c\u4e0d\u662f\u6eda\u52a8\u6e90\u7801 &#8211; <code>focus cmd<\/code><\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6253\u5370\u53d8\u91cf\u8ba1\u6570\u5668\/\u5bc4\u5b58\u5668r3\u7684\u503c &#8211; print counter \/ print $r3<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u8bbe\u7f6e\u53d8\u91cf\u8ba1\u6570\u5668\u4e3a7 &#8211; set counter = 7<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6253\u5370\u5730\u5740\u4e3a0x08000000\u768432\u4f4d\u7684\u5341\u516d\u8fdb\u5236\u503c &#8211; x \/1wx 0x80000000<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u6bcf\u6b21\u6267\u884c\u505c\u6b62\u65f6\u663e\u793aBytes\u503c &#8211; display Bytes<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>\u663e\u793a\u5f53\u524d\u51fd\u6570\u7684\u5c40\u90e8\u53d8\u91cf &#8211; info locals<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"4-memory-organization-vulnerabilities\">6. Memory Organization Vulnerabilities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"1-sections-in-a-regular-os-based-system\">(1) Sections in a regular OS-based system<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.09.17.png\" alt=\"\" class=\"wp-image-2238\" width=\"218\" height=\"317\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.09.17.png 344w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.09.17-206x300.png 206w\" sizes=\"(max-width: 218px) 100vw, 218px\" \/><\/figure><\/div>\n\n\n<ul>\n<li>BSS: uninitialized global data <code>uint_t bla;<\/code><\/li>\n\n\n\n<li>data: initialized global data <code>uint32_t bla2 = 0xFEFE;<\/code><\/li>\n\n\n\n<li>heap: dynamically allocated data <code>long *foo = calloc(a, sizeof(long));<\/code><\/li>\n\n\n\n<li>stack: local variables<code> uint8_t bla3 = 5;<\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2-sections-of-a-xmc4500-program-using-lst-files\">(2) Section Locations<\/h3>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Virtual Memory Address &amp; Load Memory Address<\/p>\n\n\n\n<p>The virtual memory address (<strong>VMA<\/strong>) is used by the processor to access a particular location in virtual memory, i.e. to access the data in virtual memory, regardless of whether it is currently stored in RAM or on disk. In a virtual memory system, each program file is assigned a virtual address space, which is a range of memory addresses that are used for the program to access the data. Virtual memory addresses are used in a similar way to physical memory addresses, with the main difference being that the operating system is responsible for mapping virtual addresses to physical addresses when the program or data is accessed.<\/p>\n\n\n\n<p>The load memory address (<strong>LMA<\/strong>) is a location in the physical main memory where a particular piece of code or data is loaded. This address is typically specified in the program or data file that the operating system or other software uses to load the program or data into the appropriate location in memory.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">1. SRAM<\/h4>\n\n\n\n<p><img decoding=\"async\" loading=\"lazy\" width=\"480\" height=\"320\" class=\"wp-image-2398\" style=\"width: 280px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.42.35.png\" alt=\"\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.42.35.png 480w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.42.35-300x200.png 300w\" sizes=\"(max-width: 480px) 100vw, 480px\" \/>     <img decoding=\"async\" loading=\"lazy\" width=\"469\" height=\"338\" class=\"wp-image-2403\" style=\"width: 270px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-10.23.17.png\" alt=\"\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-10.23.17.png 469w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-10.23.17-300x216.png 300w\" sizes=\"(max-width: 469px) 100vw, 469px\" \/><\/p>\n\n\n\n<p>SRAM is volatile, which means that it requires a constant power supply to retain its stored data. The data stored in SRAM will be lost if the power supply is interrupted.<\/p>\n\n\n\n<p>For the data section, the VMA is in SRAM, because the program needs to be able to modify the data.<\/p>\n\n\n\n<ul>\n<li>maximum size of stack<\/li>\n<\/ul>\n\n\n\n<p>The main stack currently occupies <code>0x10000000<\/code> through <code>0x10000800<\/code>, so 2 KiB, which is the maximum size during runtime. It can be made larger in the linker description file, then the maximum is the size of PSRAM, 64 KiB.<\/p>\n\n\n\n<ul>\n<li>maximum size of heap<\/li>\n<\/ul>\n\n\n\n<p>However, the actual size limit of the heap is defined in the linker description file. Of course, the limit defined there must be small enough such that the heap and all the other sections, e.g. <code>data<\/code> and <code>bss<\/code>, all together fit into DSRAM1. Note that this size limit cannot be used entirely for heap storage, because each chunk consumes an additional <code>4B<\/code> for its header.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. FLASH<\/h4>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.45.58.png\" alt=\"\" class=\"wp-image-2399\" width=\"276\" height=\"269\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.45.58.png 483w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-22-23.45.58-300x292.png 300w\" sizes=\"(max-width: 276px) 100vw, 276px\" \/><\/figure><\/div>\n\n\n<p>Flash memory is non-volatile and based on electrically-erasable programmable read-only memory (EEPROM) technology. Non-volatile memory retains its stored data even when the power supply is interrupted<\/p>\n\n\n\n<p>For the data section, the LMA is in FLASH, because the initialization values need to be in some non-volatile memory. Startup code in the boot routine copies initialization values from FLASH to SRAM and clears BSS<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2-address-space\">(3) Address space<\/h3>\n\n\n\n<p>Address space for stack, data and BSS can be read out from *.lst file. Location of the heap cannot be read from it but has to be tried using a debugger and some <code>calloc<\/code> calls.<\/p>\n\n\n\n<p>Stack cannot crash into heap, but may run out of memory. Because On many platforms the heap and stack are allocated in different pages and never will meet.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"3-stack-frame\">(4) Stack Frame<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.49.16.png\" alt=\"\" class=\"wp-image-2241\" width=\"354\" height=\"325\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.49.16.png 654w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-10.49.16-300x276.png 300w\" sizes=\"(max-width: 354px) 100vw, 354px\" \/><figcaption class=\"wp-element-caption\">a typical stack frame created by GCC<\/figcaption><\/figure><\/div>\n\n\n<p>\u5982\u679c\u53c2\u6570\u5728\u5806\u6808\u4e2d\u4f20\u9012\uff0c\u4f8b\u5982\uff0c\u5982\u679c\u51fd\u6570\u6709\u56db\u4e2a\u4ee5\u4e0a\u7684\u53c2\u6570\uff0c\u5b83\u4eec\u662fcaller\u2019s stack frame\u7684\u4e00\u90e8\u5206\uff0c\u800c\u4e0d\u662fcallee\u2019s stack frame\u3002\u56e0\u6b64\uff0c\u5728\u4e0a\u56fe\u4e2d\uff0c\u51fd\u6570\u53c2\u6570\u88ab\u7b80\u8981\u6807\u8bb0\u4e3a &#8220;previous frame &#8220;\u7684\u4e00\u90e8\u5206\u3002<\/p>\n\n\n\n<p>\u9664\u6b64\u4e4b\u5916\uff0c\u7f16\u8bd1\u5668\u53ef\u80fd\u4f1a\u628a\u4e00\u4e2a\u53c2\u6570\u7684\u526f\u672c\u653e\u5165\u4e3a<mark style=\"background-color:#7bdcb5\" class=\"has-inline-color\">local variable<\/mark>\u4fdd\u7559\u7684\u533a\u57df\u3002\u4f8b\u5982\uff0c\u5982\u679c\u7b2c\u4e00\u4e2a\u53c2\u6570\uff0c\u5373\u5728R0\u4e2d\u4f20\u9012\u7684\u53c2\u6570\uff0c\u5728\u51fd\u6570\u7684\u672b\u5c3e\u662f\u9700\u8981\u7684\uff0c\u4f46\u53e6\u4e00\u4e2a\u5e26\u6709\u5176\u4ed6\u53c2\u6570\u7684\u51fd\u6570\u5fc5\u987b\u5728\u4e4b\u524d\u88ab\u8c03\u7528\u3002\u90a3\u4e48\u5bc4\u5b58\u5668R0-R3\u5fc5\u987b\u88ab\u91ca\u653e\uff0c\u56e0\u4e3a\u5176\u4ed6\u51fd\u6570\u53ef\u80fd\u4f1a\u7834\u574f\u5b83\u4eec\uff0c\u6240\u4ee5\u7f16\u8bd1\u5668\u5fc5\u987b\u5c06\u6211\u4eec\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u4fdd\u5b58\u5728(\u53ef\u80fd\u662f)\u5806\u6808\u4e2d\u3002<\/p>\n\n\n\n<p>\u5982\u679c\u4e00\u4e2a\u8f83\u957f\u7684string\u88ab\u653e\u8fdblocal variable\u533a\u57df\uff0clocal variable\u533a\u57df\u4e0a\u7684<mark style=\"background-color:#7bdcb5\" class=\"has-inline-color\">return address<\/mark>\u53ef\u80fd\u4f1a\u88ab\u8986\u76d6\uff0c\u8fd9\u53ef\u80fd\u4f7f\u7a0b\u5e8f\u6d41\u7a0b\u6539\u53d8\uff0c\u56e0\u4e3a\u5728\u5f53\u524d\u51fd\u6570\u8fd4\u56de\u65f6\uff0creturn address\u7684\u503c\u5c06\u88ab\u653e\u5165\u7a0b\u5e8f\u8ba1\u6570\u5668\u4e2d\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"4-buffer-overflow-attack\">(5) Buffer Overflow Attack<\/h3>\n\n\n\n<p>\u53c2\u89c1\u53c2\u8003\u624b\u518c\u7b2c2.3.3\u8282\u7b2c2-22\u9875\u5173\u4e8e\u9ed8\u8ba4\u7684\u8bbf\u95ee\u6743\u9650\u3002\u4ee3\u7801\u3001SRAM\u548c\u5916\u90e8RAM\u533a\u57df\u9ed8\u8ba4\u90fd\u662f\u53ef\u6267\u884c\u7684\u3002\u5806\u6808\u5728PSRAM\u4e2d\uff0c\u4f4d\u4e8eCortex-M4\u7684\u4ee3\u7801\u5b58\u50a8\u5668\u533a\u57df\uff0c\u8303\u56f4\u662f0x00000000\u52300x1FFFFFFF\u3002\u6240\u4ee5\u5806\u6808\u9ed8\u8ba4\u662f\u53ef\u6267\u884c\u7684\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.06.27.png\" alt=\"\" class=\"wp-image-2245\" width=\"613\" height=\"297\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.06.27.png 984w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.06.27-300x146.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.06.27-768x373.png 768w\" sizes=\"(max-width: 613px) 100vw, 613px\" \/><\/figure><\/div>\n\n\n<ul>\n<li>\u7528info frames\u786e\u5b9a\u7f13\u51b2\u533a\u548c\u8fd4\u56de\u5730\u5740\u7684\u4f4d\u7f6e\u4ee5\u53caexploit\u8981\u591a\u957f\u624d\u80fd\u8986\u76d6return address\uff1a<\/li>\n<\/ul>\n\n\n\n<p>\u5982\u56fe\uff0cbuffer\u5728<code>&amp;buf = 0x100007c0<\/code>\u5904\u3002\u8fd4\u56de\u5730\u5740\u88abGDB\u79f0\u4e3a<code>lr<\/code>\uff0c\u5b83\u7684\u4f4d\u7f6e\u662f<code>0x100007e4<\/code>\u3002\u4e24\u8005\u4e4b\u95f4\u670936 Bytes\uff0c\u6240\u4ee5\u6211\u4eec\u7684exploit\u9700\u898140 Bytes\u957f\u6765\u8986\u76d6\u8fd4\u56de\u5730\u5740\u3002<\/p>\n\n\n\n<ul>\n<li>\u8bbe\u8ba1\u4e00\u4e2aexploit\uff1a<\/li>\n<\/ul>\n\n\n\n<p>\u7531\u4e8e\u7ed9\u5b9a\u7684\u4ee3\u7801\u53ea\u670920B\u957f\uff0c\u6211\u4eec\u9700\u8981\u589e\u52a016B\u7684padding\uff0c\u7136\u540e\u662f\u65b0\u7684\u8fd4\u56de\u5730\u5740\uff0c\u6307\u5411exploit\u4ee3\u7801\u3002exploit\u4ee3\u7801\u4f4d\u4e8ebuf\u7684\u5f00\u5934\uff0c\u5373<code>0x100007c0<\/code>\u5904\u3002\u5728Thumb\u6a21\u5f0f\u4e0b\uff0c\u65b0\u7684\u8fd4\u56de\u5730\u5740\u662f<code>0x100007c0+1=0x100007c1<\/code>\u3002<\/p>\n\n\n\n<p>\u4e00\u4e2a\u53ef\u80fd\u7684exploit\u662f\uff08\u6bcf\u4e2a\u5b57\u8282\u7531\u4e24\u4e2aHEX\u6570\u8868\u793a\uff09<\/p>\n\n\n\n<p><code><mark style=\"background-color:#fcb900\" class=\"has-inline-color\">FD 46 48 F2 01 12 C4 F6 02 02 80 21 D1 73 C9 09 D1 70 FE E7<\/mark><\/code> <mark style=\"background-color:#abb8c3\" class=\"has-inline-color has-black-color\"><code>FF FF FF FF FF <mark style=\"background-color:#abb8c3\" class=\"has-inline-color has-black-color\"><code>FF FF FF FF FF FF FF FF<\/code><\/mark> FF FF FF<\/code><\/mark> <mark style=\"background-color:#f78da7\" class=\"has-inline-color\"><code>C1 07 00 10<\/code><\/mark><\/p>\n\n\n\n<p>\u6211\u4eec\u4e5f\u53ef\u4ee5\u9884\u7559\u586b\u5145\u7269\uff0c\u5c06\u8fd4\u56de\u5730\u5740\u6539\u4e3a0x100007d1\u3002\u90a3\u4e48\uff0c\u8fd9\u4e2aexploit\u5c06\u662f\uff1a<br><code><mark style=\"background-color:#abb8c3\" class=\"has-inline-color\">ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<\/mark> <mark style=\"background-color:#fcb900\" class=\"has-inline-color\">fd 46 48 f2 01 12 c4 f6 02 02 80 21 d1 73 c9 09 d1 70 fe e7<\/mark> <mark style=\"background-color:#f78da7\" class=\"has-inline-color has-black-color\">d1 07 00 10<\/mark><\/code><\/p>\n\n\n\n<p><mark style=\"background-color:#fcb900\" class=\"has-inline-color\">  <\/mark> &#8211; exploit instruction<\/p>\n\n\n\n<p><mark style=\"background-color:#abb8c3\" class=\"has-inline-color\">  <\/mark> &#8211; padding<\/p>\n\n\n\n<p><mark style=\"background-color:#f78da7\" class=\"has-inline-color\">  <\/mark> &#8211; new return address<\/p>\n\n\n\n<ul>\n<li>Little Endian\uff1a<\/li>\n<\/ul>\n\n\n\n<p>\u5728\u53d1\u9001\u8fd9\u4e2a\u6587\u4ef6\u5230\u7535\u8def\u677f\u4e4b\u524d\uff0c\u9700\u8981\u5c06\u5176\u8f6c\u6362\u4e3a\u4e8c\u8fdb\u5236\u8868\u793a<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.22.45.png\" alt=\"\" class=\"wp-image-2249\" width=\"587\" height=\"182\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.22.45.png 1010w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.22.45-300x93.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-01-11.22.45-768x239.png 768w\" sizes=\"(max-width: 587px) 100vw, 587px\" \/><\/figure><\/div>\n\n\n<p>\u4ece<code>0x100007c0<\/code>\u5230<code>0x100007c4<\/code>\u5904\u5b58\u50a8\u7684\u5b57\u8282\u662f\uff1a<code><mark style=\"background-color:#fcb900\" class=\"has-inline-color\">FD 46 48 F2<\/mark><\/code>\uff0c\u8f6c\u6362\u621032\u4f4d\u4e8c\u8fdb\u5236\u503c\u662f<code><mark style=\"background-color:#fcb900\" class=\"has-inline-color\">0xF24846FD<\/mark><\/code>\u3002<\/p>\n\n\n\n<p>\u4ee5<code>0x100007c0<\/code>\u5230<code>0x100007c4<\/code>\u5904\u4e3a\u4f8b\uff0c\u5728Little Endian\u65f6\uff0cMSByte\u8981\u7528*<code>((uint_8 *)&amp;a+3)<\/code>\u83b7\u5f97\uff0c\u800c\u5728Big Endian\u65f6\uff0c\u7528*<code>((uint_8 *)&amp;a)<\/code>\u83b7\u5f97\u3002<\/p>\n\n\n\n<ul>\n<li>Drawbacks of strcpy()\uff1a<\/li>\n<\/ul>\n\n\n\n<p>\u5982\u679c\u6211\u4eec\u770b\u4e00\u4e0b\u4e0a\u9762\u7684\u6f0f\u6d1e\uff0c\u5b83\u4eec\u90fd\u5728\u65b0\u7684\u8fd4\u56de\u5730\u5740\u4e2d\u5305\u542b\u4e00\u4e2a00\u5b57\u7b26\u3002\u8fd9\u5c06\u5bfc\u81f4strcpy()\u5728\u8fd9\u4e00\u70b9\u4e0a\u7ec8\u6b62\uff0c\u5e76\u4e14\u4e0d\u5199\u6700\u540e\u4e00\u4e2a\u5b57\u8282\uff0c\u8ba9\u65b0\u7684\u8fd4\u56de\u5730\u5740\u6307\u5411<code>0x<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">08<\/mark>0007c1<\/code>\uff0c\u8fd9\u4e0d\u662f\u6211\u4eec\u7684exploit\u6240\u5728\u7684\u4f4d\u7f6e\u3002\u6240\u4ee5\u5728\u8fd9\u4e2a\u7279\u5b9a\u7684\u4f8b\u5b50\u4e2d\uff0c\u7528strcpy()\u5728\u5806\u6808\u4e0a\u6267\u884cbuffer overflow attack\u662f\u4e0d\u53ef\u80fd\u7684\u3002<\/p>\n\n\n\n<ul>\n<li>Find Buffer Overflow Vulnerability<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54-1024x670.png\" alt=\"\" class=\"wp-image-2539\" width=\"647\" height=\"423\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54-1024x670.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54-300x196.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54-768x503.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54-1536x1005.png 1536w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.02.54.png 1542w\" sizes=\"(max-width: 647px) 100vw, 647px\" \/><\/figure><\/div>\n\n\n<p>The string <code>givenPW<\/code> is allocated with length 21, but then in line 8, up to <code>0x21=33 <\/code>characters are allowed to be written.<\/p>\n\n\n\n<p>Pro tip: Use a macro or a const variable with a name to hold the size and always use this variable instead of the plain number a.k.a. magic number. That not only avoids such vulnerabilities but also makes your code much more comprehensible.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Exceptions and Interrupts<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Use Cases<\/h3>\n\n\n\n<ul>\n<li>Reaction to events outside of the CPU, e.g. ADC conversion finished<\/li>\n<\/ul>\n\n\n\n<p>Reaction to outside events is also possible via polling.<\/p>\n\n\n\n<ul>\n<li>Multi-Tasking with termination of hung-up tasks<\/li>\n<\/ul>\n\n\n\n<p>Multi-Tasking may work without interrupts if all tasks periodically call a context-switching function, but this is highly impractical. In real scenarios, and also if it comes to terminating hung-up tasks, multi-tasking cannot be realized without interrupts. Usually, the SysTickTimer is used to switch context and hand over the CPU to the next task in the queue.<\/p>\n\n\n\n<ul>\n<li>Power Saving<\/li>\n<\/ul>\n\n\n\n<p>Power saving requires IRQs (interrupt requests) to wake up the CPU after sleep. So this cannot work without interrupts (reset is often considered just a special case of interrupt or exception).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Interrupts vs. Polling<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"414\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.25.12-1024x414.png\" alt=\"\" class=\"wp-image-2418\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.25.12-1024x414.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.25.12-300x121.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.25.12-768x311.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.25.12.png 1201w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>1. According to the problem, a context switch happens once per second. The CPU load for the context switch is <img decoding=\"async\" loading=\"lazy\" width=\"414\" height=\"64\" class=\"wp-image-2419\" style=\"width: 300px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.29.53.png\" alt=\"\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.29.53.png 414w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.29.53-300x46.png 300w\" sizes=\"(max-width: 414px) 100vw, 414px\" \/>. It is obvious that 30 \u00b5s + 5 \u00b5s &lt; 50 \u00b5s.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>No flags have to be polled in case of interrupts, but we have to save the current CPU context on the stack and restore it after the ISR (interrupt service routine) finishes. Such a context switch only happens if the IRQ is pending, i.e. after the outside event occurred.<\/p>\n<\/blockquote>\n\n\n\n<p>2. The flag needs to be polled with at least <img decoding=\"async\" loading=\"lazy\" width=\"189\" height=\"42\" class=\"wp-image-2421\" style=\"width: 140px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.51.56.png\" alt=\"\">  The CPU load for the polling is <img decoding=\"async\" loading=\"lazy\" width=\"85\" height=\"48\" class=\"wp-image-2424\" style=\"width: 60px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.55.27.png\" alt=\"\"> <img decoding=\"async\" loading=\"lazy\" width=\"399\" height=\"73\" class=\"wp-image-2423\" style=\"width: 280px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.55.32.png\" alt=\"\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.55.32.png 399w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.55.32-300x55.png 300w\" sizes=\"(max-width: 399px) 100vw, 399px\" \/>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"961\" height=\"286\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.46.50.png\" alt=\"\" class=\"wp-image-2420\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.46.50.png 961w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.46.50-300x89.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.46.50-768x229.png 768w\" sizes=\"(max-width: 961px) 100vw, 961px\" \/><\/figure><\/div>\n\n\n<blockquote class=\"wp-block-quote\">\n<p>We must have finished the subroutine within 50 \u00b5s after the event. Considering that processing the subroutine takes 30 \u00b5s, the subroutine has to start not more than 20 \u00b5s after the event. As the poll itself takes 2 \u00b5s, the start of a poll must thus be not more than 18 \u00b5s after the last poll started.<\/p>\n\n\n\n<p>Since the flag is not guaranteed to be set within 2 \u00b5s after the event happens, we have to assume that a poll is not guaranteed to be successful when the event happens. <\/p>\n<\/blockquote>\n\n\n\n<p>3. The CPU load for the subroutine is <img decoding=\"async\" loading=\"lazy\" width=\"302\" height=\"76\" class=\"wp-image-2427\" style=\"width: 210px;\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.59.04.png\" alt=\"\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.59.04.png 302w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/09\/\u622a\u5c4f2022-12-23-16.59.04-300x75.png 300w\" sizes=\"(max-width: 302px) 100vw, 302px\" \/>.<\/p>\n\n\n\n<p>Therefore, the polling-based implementation has an overall CPU load of<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.59.32.png\" alt=\"\" class=\"wp-image-2425\" width=\"410\" height=\"30\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.59.32.png 517w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-16.59.32-300x22.png 300w\" sizes=\"(max-width: 410px) 100vw, 410px\" \/><\/figure><\/div>\n\n\n<p>And the polling-based implementation has an overall CPU load of<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.00.06.png\" alt=\"\" class=\"wp-image-2426\" width=\"318\" height=\"31\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.00.06.png 416w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.00.06-300x30.png 300w\" sizes=\"(max-width: 318px) 100vw, 318px\" \/><\/figure><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"382\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.02.28-1024x382.png\" alt=\"\" class=\"wp-image-2430\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.02.28-1024x382.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.02.28-300x112.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.02.28-768x286.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.02.28.png 1272w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>1. Due to the interrupt latency (5 \u00b5s) and context switching (4 \u00b5s), interrupts cannot be used.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"991\" height=\"323\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.11.33.png\" alt=\"\" class=\"wp-image-2431\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.11.33.png 991w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.11.33-300x98.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.11.33-768x250.png 768w\" sizes=\"(max-width: 991px) 100vw, 991px\" \/><\/figure><\/div>\n\n\n<p>2. Since we poll the GPIO line, what decides is whether the system can poll fast enough (frequency). Polling can achieve the requirements. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"994\" height=\"316\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.13.21.png\" alt=\"\" class=\"wp-image-2432\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.13.21.png 994w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.13.21-300x95.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.13.21-768x244.png 768w\" sizes=\"(max-width: 994px) 100vw, 994px\" \/><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Although in this case, the polling loop requires 100% CPU load, it does so only for a very short period of time after the SW initiates a mode change. Thus the average CPU load is not much affected by the polling loop.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">(3) ISR (interrupt service routine)<\/h3>\n\n\n\n<ul>\n<li>Transparency<\/li>\n<\/ul>\n\n\n\n<p>In general, an ISR should be transparent to other codes, which means that it should not <strong>interfere with the normal operation<\/strong> of the system. I.e. except for the variables intended to be changed by the ISR, everything \u2013 including all registers and special registers such as APSR \u2013 must be restored to their original value.<\/p>\n\n\n\n<ul>\n<li>Context saving<\/li>\n<\/ul>\n\n\n\n<p>The registers that are saved automatically upon an IRQ for the XMC4500 include <code>PC, PSR, R0, R1, R2, R3, R12, LR<\/code>.<\/p>\n\n\n\n<ul>\n<li>Number of arguments<\/li>\n<\/ul>\n\n\n\n<p>None, because there is no caller that could set the arguments to some meaningful value. But this is not true for exceptions in general.<\/p>\n\n\n\n<ul>\n<li>Access of IRQ<\/li>\n<\/ul>\n\n\n\n<p>For performance optimization, the compiler might keep a local copy of a <strong>variable<\/strong> in a <strong>register<\/strong> for repeated access. If ISR updates the original variable in <strong>SRAM<\/strong>, the software will continue to use the old value. If it is a wait loop that postpones code execution until, e.g. a certain number of bytes are received by the UART, the system will hang forever.<\/p>\n\n\n\n<p>The keyword <code>volatile<\/code> can be given to a variable to avoid this issue. The use of the &#8220;<code>volatile<\/code>&#8221; keyword tells the compiler that it should not optimize access to the variable, as the value of the variable may change unexpectedly.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Memory Protection Unit<\/h2>\n\n\n\n<p>MPU defines regions in memory and specifies attributes for them:<br>r&#8211; r&#8211;: read-only in privileged mode<br>rw- rw-: read&amp;write, never execute<br>rw- r&#8211;: read always, but write only in privileged mode<br>r-x r-x: read&amp;execute, never write<br><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Access to Memory Sections<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"880\" height=\"130\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.42.10.png\" alt=\"\" class=\"wp-image-2435\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.42.10.png 880w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.42.10-300x44.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-23-17.42.10-768x113.png 768w\" sizes=\"(max-width: 880px) 100vw, 880px\" \/><figcaption class=\"wp-element-caption\">Peripherals are located at addresses <code>0x40000000<\/code> up to <code>0x5FFFFFFF<\/code>.<\/figcaption><\/figure><\/div>\n\n\n<blockquote class=\"wp-block-quote\">\n<p>The <strong>text (code)<\/strong> section is a region of memory that is used to store the executable instructions of a program. For these instructions to be executed, the text section must be marked as executable.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">(2) MPU Configuration<\/h4>\n\n\n\n<ul>\n<li>XMC4500<\/li>\n<\/ul>\n\n\n\n<p>Up to 8 regions, each is of size between <code>32B<\/code> and <code>4GB<\/code> distinguished by priority, i.e. only one region per priority level.<\/p>\n\n\n\n<p>Background region for privileged level with the lowest priority.<\/p>\n\n\n\n<ul>\n<li>Define <code>MPUconfig_t<\/code><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-30-23.02.18.png\" alt=\"\" class=\"wp-image-2531\" width=\"366\" height=\"151\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-30-23.02.18.png 569w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-30-23.02.18-300x124.png 300w\" sizes=\"(max-width: 366px) 100vw, 366px\" \/><\/figure><\/div>\n\n\n<p><code>enum MPUeasyPermissions { MPUeasy_None_None = 0, MPUeasy_RW_None = 1, MPUeasy_RW_R = 2, MPUeasy_RW_RW = 3, MPUeasy_R_None = 5, MPUeasy_R_R = 6};<br><br># define MPUeasyXN (0x1&lt;&lt;4)<br># define MPUeasyENABLEREGION (0x1&lt;&lt;7)<br>typedef struct {<br>   void * baseAddress;<br>   int permissions;<br>   uint8_t size;<br>   uint8_t priority;<br>} MPUconfig_t;<\/code><\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p><code>uint8_t size<\/code> is as power of 2, so e.g. <code>10=1KiB<\/code> , <code>20=1MiB<\/code>.<\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>&#8220;<strong>#define<\/strong>&#8221; directive is used to define a macro. A macro is a fragment of code that is replaced with a different fragment of code when the program is compiled. Macros can be used to simplify complex code, to improve readability, or to provide a convenient way to reuse code.<\/p>\n<\/blockquote>\n\n\n\n<ul>\n<li>Define regions<\/li>\n<\/ul>\n\n\n\n<p>The proper MPU configuration for the sections mentioned in the previous question looks like that:<\/p>\n\n\n\n<p><code>MPUconfig_t FLASH = {.baseAddress =( void *) 0x08000000, .size =<mark style=\"background-color:rgba(0, 0, 0, 0);color:#fc0404\" class=\"has-inline-color\">27<\/mark>, .priority =0, .permissions = MPUeasyENABLEREGION | MPUeasy_R_R };<\/code><br><code>\/\/ 10000000 | 1010 = 10001010<\/code><br><code><br>MPUconfig_t PSRAM = {.baseAddress =( void *) 0x10000000, .size =16, .priority =1, .permissions = MPUeasyENABLEREGION | MPUeasy_RW_RW | MPUeasyXN };<\/code><br><code>\/\/ 10000000 | 11 | 10000 = 10010011<\/code><br><code><br>MPUconfig_t DSRAM1 = {.baseAddress =( void *) 0x20000000, .size =16, .priority =2, .permissions = MPUeasyENABLEREGION | MPUeasy_RW_RW | MPUeasyXN };<\/code><br><code>\/\/ 10000000 | 11 | <code>10000 = 10010011<\/code><\/code><br><br><code>MPUconfig_t Pheriperals = {.baseAddress =( void *) 0x40000000, .size =29, .priority =3, .permissions = MPUeasyENABLEREGION | MPUeasy_RW_RW | MPUeasyXN };<\/code><br><code>\/\/ 10000000 | 11 | <code>10000 = 10010011<\/code><\/code><\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>The size for the FLASH region is 27 and not 20 as one would expect for <code>1 MiB<\/code>, because the cached access to the FLASH runs via addresses <code>0x0C000000<\/code> up to <code>0x0C0FFFFF<\/code> and we want to capture both cached and uncached access to the FLASH. <\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>The &#8220;|&#8221; operator is a bitwise OR operator. the &#8220;.&#8221; operator is used to access the members of a structure. It is used to both <strong>create<\/strong> and <strong>initialize<\/strong> a variable of a structure type.<\/p>\n<\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Although the regions for PSRAM, DSRAM1, and peripherals share the same access permissions, we have to define separate regions for them for two reasons: <\/p>\n\n\n\n<p>First, a single region ranging from <code>0x10000000<\/code> to <code>0x5FFFFFFF<\/code> would have size <code>2<sup>30.3219<\/sup>B<\/code> which is not an <strong>integer power<\/strong> of 2. <\/p>\n\n\n\n<p>A common region for PSRAM and DSRAM1 with size <code>2<sup>29<\/sup>B<\/code> would have a feasible size, but is not possible for the second reason, namely that<strong> region base addresses<\/strong> have to be aligned to the <strong>size of the region<\/strong>. A region of size <code>2<sup>29<\/sup>B<\/code> would need to start at an address that has its <code>29<\/code> lowermost bits equal to zero (<code>&gt;=0x20000000<\/code>), which is not the case for 0x10000000.<\/p>\n<\/blockquote>\n\n\n\n<ul>\n<li>Calling <code>configMPU()<\/code><\/li>\n<\/ul>\n\n\n\n<p>After defining the appropriate regions as <code>MPUconfig_t<\/code>, we have to program them into the MPU by calling <code>configMPU()<\/code> on each one. Then we can enable the MPU and drop our privileges. If the program continues to run, we have set up the MPU correctly. <\/p>\n\n\n\n<p>The functions to check the current privilege level and drop privileges are provided by another set of small helper functions in <code>privilege.c<\/code>. <\/p>\n\n\n\n<p>Note that the Private Peripheral Bus (PPB) is always accessible in privileged mode <strong>even if <\/strong>there is no region defined for it and with a <strong>disabled<\/strong> background region.<\/p>\n\n\n\n<ul>\n<li>Example<\/li>\n<\/ul>\n\n\n\n<p>Now a credential store is added to the system in the uppermost <code>1KiB<\/code> of DSRAM1, which should be only readable by the task. We change the configuration like:<\/p>\n\n\n\n<p><code>MPUconfig_t Secret = {.baseAddress =( void *) <mark style=\"background-color:rgba(0, 0, 0, 0);color:#f80505\" class=\"has-inline-color\">SECRETSTORE<\/mark>, .size =10, .priority =<mark style=\"background-color:rgba(0, 0, 0, 0);color:#f40606\" class=\"has-inline-color\">4<\/mark>, .permissions = MPUeasyENABLEREGION | MPUeasy_RW_R | MPUeasyXN };<\/code><br><code>\/\/ 10000000 | 11 | 10000 = 10010011<\/code><br><code><br>MPUconfig_t DSRAM1 = {.baseAddress =( void *) 0x20000000, .size =16, .priority =2, .permissions = MPUeasyENABLEREGION | MPUeasy_RW_RW | MPUeasyXN };<\/code><br><code>\/\/ 10000000 | 10 | <code>10000 = 10010010<\/code><\/code><\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>You do not have to <strong>exclude<\/strong> the uppermost <code>1 KiB<\/code> for the secret store from the DSRAM1 region, because the higher priority of the Secret region will override the permissions of this part of the DSRAM1 region. The priority for Secret can be any priority (<code>0-7<\/code>) that is yet unused (<code>4-7<\/code>) and larger than the priority of the DSRAM1 region (<code>&gt;2<\/code>).<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Manual Canary<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Secure below function using canaries<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.14.40-1024x379.png\" alt=\"\" class=\"wp-image-2532\" width=\"626\" height=\"231\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.14.40-1024x379.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.14.40-300x111.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.14.40-768x284.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.14.40.png 1410w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><\/figure><\/div>\n\n\n<ul>\n<li>Using <code>struct<\/code><\/li>\n<\/ul>\n\n\n\n<p>We use a <code>struct<\/code> to prohibit the compiler from reordering the local variables during alignment:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.17.55-1024x707.png\" alt=\"\" class=\"wp-image-2533\" width=\"678\" height=\"468\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.17.55-1024x707.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.17.55-300x207.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.17.55-768x530.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.17.55.png 1300w\" sizes=\"(max-width: 678px) 100vw, 678px\" \/><\/figure><\/div>\n\n\n<p>This is a hypothetic example. In practice, you would not add the canary yourself in a real program but use the <code>-fstack-protector<\/code> option of your compiler and then the compiler decides if it spends the extra effort to protect exactly the array boundaries of only the control flow information, i.e.the return address.<\/p>\n\n\n\n<ul>\n<li>Using Buffer<\/li>\n<\/ul>\n\n\n\n<p>Another smart solution is to increase the size of the buffer and make the canary part of the buffer itself. Then no struct is required to prohibit reordering, but it gets somewhat complicated to access the canary.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"572\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.22.24-1024x572.png\" alt=\"\" class=\"wp-image-2534\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.22.24-1024x572.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.22.24-300x168.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.22.24-768x429.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-00.22.24.png 1255w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Properties of Canaries<\/h3>\n\n\n\n<p>If the value of the canary can be guessed or tried out by an attacker, she can overwrite the canary with its original value, such that it is not changed. This would render an attack unnoticeable and must thus be made infeasible. The value should therefore fulfill the following properties:<\/p>\n\n\n\n<ol>\n<li>Unpredictable and not readable for the attacker in any way<\/li>\n\n\n\n<li>Large enough to avoid trying out all possible values (brute-force)<\/li>\n\n\n\n<li>Ideally, change upon each program invocation (a change upon each function call would make the program terribly slow)<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Other Software Attacks<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Heap Based Buffer Overflow<\/h3>\n\n\n\n<ul>\n<li>Example<\/li>\n<\/ul>\n\n\n\n<p><code>#include &lt;stdio.h&gt; <br>#include &lt;stdlib.h&gt; <br>#include &lt;string.h&gt; <br>int main(int argc, char *argv[]) { <br>char *buf; <br><br>\/\/ Allocate memory on the heap <br>buf = malloc(10); <br>if (buf == NULL) { <br>perror(\"malloc failed\"); <br>return 1; } <br><br>\/\/ Read input from the user <br>printf(\"Enter a string: \"); <br>fgets(buf, 20, stdin); <br><br>\/\/ Print the input back to the user <br>printf(\"You entered: %s\\n\", buf); <br><br>\/\/ Free the allocated memory free(buf); <br>return 0; }<\/code><\/p>\n\n\n\n<p>The &#8220;<code>fgets()<\/code>&#8221; function is called with a buffer size of 20, which is larger than the size of the allocated buffer (10). This means that the program writes more data to the buffer than it is intended to hold, which can cause a buffer overflow. In this example, the <strong>size of the buffer<\/strong> should be passed as the second argument to &#8220;<code>fgets()<\/code>&#8221; rather than hardcoded as a <strong>constant<\/strong>.<\/p>\n\n\n\n<p>This attack can overwrite the backward and forward pointer.<\/p>\n\n\n\n<ul>\n<li>Use-after-free Bug<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.22.30.png\" alt=\"\" class=\"wp-image-2651\" width=\"453\" height=\"266\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.22.30.png 942w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.22.30-300x176.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.22.30-768x452.png 768w\" sizes=\"(max-width: 453px) 100vw, 453px\" \/><\/figure><\/div>\n\n\n<p>Consequence: The memory locations might already be allocated for a different purpose. Reading from them may cause the function to perform unexpected and possibly exploitable actions. Writing to it clobbers data of the other function that the memory locations are now allocated to and may cause this code to malfunction.<\/p>\n\n\n\n<ul>\n<li>Double-free Bug<\/li>\n<\/ul>\n\n\n\n<p>Countermeasure: The easiest way to do this is to always set the pointer to NULL when it is freed, just like malloc and calloc return a NULL pointer when the allocation failed. According to the C standard, freeing a NULL pointer does no harm.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Format String Attacks<\/h3>\n\n\n\n<ul>\n<li>Read password<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.30.36-1024x417.png\" alt=\"\" class=\"wp-image-2540\" width=\"622\" height=\"253\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.30.36-1024x417.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.30.36-300x122.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.30.36-768x313.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.30.36.png 1186w\" sizes=\"(max-width: 622px) 100vw, 622px\" \/><\/figure><\/div>\n\n\n<p>In line 7, an attacker-controlled string is used as a format string to printf. An attacker may thus add conversions to this string to read<strong> <\/strong><code>correctPW<\/code> from memory.<\/p>\n\n\n\n<p>We know that <code>r0<\/code> to <code>r3 <\/code>contains the first four arguments of a function, and the return value is placed in <code>r0<\/code>. Tracing back the code, the last time <code>r1<\/code> is used, is to pass <code>correctPW<\/code> to <code>strcmp()<\/code>, so <code>correctPW<\/code> is still in <code>r1<\/code> when<code> printf()<\/code> is called.<\/p>\n\n\n\n<p>Since the &#8220;<code>printf()<\/code>&#8221; function in C takes a format string as its first argument(<code>r0<\/code>) and a variable number of additional arguments(<code>r1, r2, r3, stack ...<\/code>) that are used to fill in placeholders in the format string. It is thus sufficient for an attacker to provide <code>%s<\/code> as the <code>givenPW<\/code>, because <code>printf()<\/code> will interpret the conversion and print the string pointed to by <code>r1<\/code>(second argument), which is the <code>correctPW<\/code>.<\/p>\n\n\n\n<ul>\n<li>Read location of stack<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"378\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.51.19-1024x378.png\" alt=\"\" class=\"wp-image-2541\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.51.19-1024x378.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.51.19-300x111.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.51.19-768x283.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-09.51.19.png 1481w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>In line 8 a user-controlled string is used as format string. The &#8220;<code>sprintf()<\/code>&#8221; function takes a string buffer as its first argument and a format string as its second argument, and a variable number of additional arguments that are used to <strong>fill in placeholders<\/strong> in the format string.<\/p>\n\n\n\n<p>A sufficient number of <code>%x<\/code> or <code>%p<\/code> will print out the value of <code>r2, r3, and contents in stack<\/code> including the <em>previous stack frame pointer<\/em> (under the return address) into the <code>debugString<\/code>, which will eventually be displayed on the screen.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(3) Integer Underflows<\/h3>\n\n\n\n<ul>\n<li><code>for(uint8_t i = 42; i &gt;= 0; --i);<\/code><\/li>\n<\/ul>\n\n\n\n<p>The programmer intended to loop 43 times by decrementing the variable <code>uint8_t i<\/code> from 42 to 0. The loop should stop as soon as <code>i <\/code>becomes negative. The actual behavior of the implementation is an endless loop due to the declaration of the variable<code> i<\/code> as <code>uint8_t<\/code>, i.e. as an unsigned 8 bit variable of range 0 to 255. If <code>i=0<\/code> is decremented by one, the result will be 255. This issue is called <strong>integer underflow<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(4) SQL Injection<\/h3>\n\n\n\n<p>Code Injection requires that data is treated as code so that it can contain variables.<\/p>\n\n\n\n<p><code>userpass=sqlInt.execute(\"SELECT\u2423password\u2423FROM\u2423users\u2423WHERE\u2423username \u2423=\u2423\u2019\" + userName + \" \u2019;\");<\/code><\/p>\n\n\n\n<p>The variable <code>userName<\/code> is taken directly from the input of the login form. The SQL statement retrieves the password corresponding to the entered username and checks it against the array <code>userpass<\/code>. <\/p>\n\n\n\n<p>The statements after the <code>WHERE<\/code> keyword filter what is retrieved from the database. So we need to disable the filter or make it always true: <\/p>\n\n\n\n<p><code>userpass = \" SELECT \u2423 password \u2423 FROM \u2423 users \u2423 WHERE \u2423 username \u2423=\u2423<strong> \u2019<\/strong><mark style=\"background-color:rgba(0, 0, 0, 0);color:#ed0303\" class=\"has-inline-color\">\u2019\u2423OR\u2423<\/mark><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-secondary-color\">\u20191\u2019=\u20191<\/mark><strong>\u2019<\/strong>;\"<\/code><\/p>\n\n\n\n<p>The <code>\u20191\u2019=\u20191\u2019 <\/code>statement is always true.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(5) Cross Site Scripting(XSS)<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"446\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.21.33-1024x446.png\" alt=\"\" class=\"wp-image-2649\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.21.33-1024x446.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.21.33-300x131.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.21.33-768x334.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-17.21.33.png 1356w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>XSS requires that server stores user data and displays it on its webpages to others e.g. comment fields in online shop, forum entries, etc. and server does not check data for statements <strong>interpreted by a browser<\/strong>.<\/p>\n\n\n\n<p>Popular not-so-harmful example: Alert box using javascript:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"53\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-10.21.34-1024x53.png\" alt=\"\" class=\"wp-image-2542\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-10.21.34-1024x53.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-10.21.34-300x15.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-10.21.34-768x40.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2022\/12\/\u622a\u5c4f2022-12-31-10.21.34.png 1278w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>Javascript can also do other things, like stealing a session cookie and sending it to the attacker, which then can impersonate the victim.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>When is there a risk of code injection? <\/p>\n\n\n\n<p>Whenever code and data is only weakly separated, e.g. in von Neumann architectures or scripting languages.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">11. Security and Cryptography<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Security Objectives (CIA)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Objectives<\/td><td>Measure<\/td><\/tr><tr><td><strong>Confidentiality<\/strong><\/td><td>Access Control \/ Encryption<\/td><\/tr><tr><td><strong>Integrity<\/strong><\/td><td>Write Protection \/ Crypto Signature<\/td><\/tr><tr><td><strong>Availiability<\/strong><\/td><td>Redundancy<\/td><\/tr><tr><td>Accountability<\/td><td>Logging<\/td><\/tr><tr><td>Authenticity<\/td><td>Password \/ Crypto Signature<\/td><\/tr><tr><td>Privacy<\/td><td>Data Minimization \/ Pseudonyms<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Crypto Algorithm Overview<\/h3>\n\n\n\n<ul>\n<li>Symmetric Cryptography<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Block Ciphers<\/td><td>Description<\/td><td>Block Size \/ bit<\/td><td>Key Size \/ bit<\/td><\/tr><tr><td>DES<\/td><td>proven weak<\/td><td>64 <\/td><td>56<\/td><\/tr><tr><td>IDEA<\/td><td>international <br>data encryption<br>algorithm<\/td><td>64<\/td><td>128<\/td><\/tr><tr><td>AES<\/td><td>advanced <br>encryption <br>algorithm<\/td><td>128<\/td><td>128 \/ 192 \/ 256<\/td><\/tr><tr><td>SPECK<\/td><td>linear cipher, <br>light weight<\/td><td>32 &#8211; 128<\/td><td>64 &#8211; 256<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Stream Cipher<\/td><td>Key Size \/ bit<\/td><\/tr><tr><td>RC4(weak)<\/td><td>8 &#8211; 2048<\/td><\/tr><tr><td>Salsa20<\/td><td>256<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ul>\n<li>Asymmetric Cryptography<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Cryptography<\/td><td>Key Size<\/td><\/tr><tr><td>RSA<\/td><td>1024(weak), 4096<\/td><\/tr><tr><td>DSA(digital signature)<\/td><td>1024<\/td><\/tr><tr><td>ECDSA<\/td><td>160<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ul>\n<li>Cryptographic Hash Functions<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Hash Functions<\/td><td>Output Size \/ bit<\/td><\/tr><tr><td>MD5(weak)<\/td><td>128<\/td><\/tr><tr><td>SHA-1(weak)<\/td><td>160<\/td><\/tr><tr><td>SHA-2<\/td><td>224 &#8211; 512<\/td><\/tr><tr><td>SHA-3<\/td><td>224 &#8211; 512<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">(3) Confusion &amp; Diffusion<\/h3>\n\n\n\n<ul>\n<li>Confusion of mapping<\/li>\n<\/ul>\n\n\n\n<p>The relation between plaintext and ciphertext shall be highly complex, known pairs of plaintext and ciphertext shall not allow recovering the key.<\/p>\n\n\n\n<ul>\n<li>Diffusion of entropy<\/li>\n<\/ul>\n\n\n\n<p><strong>Every<\/strong> bit of <strong>input<\/strong> to the cryptographic algorithm shall affect <strong>all<\/strong> bits of the <strong>output<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(4) Attacks<\/h3>\n\n\n\n<ul>\n<li>Block Cipher<\/li>\n<\/ul>\n\n\n\n<p>Instead of trying brute-force which is infeasible, one can build up a look-up table and perform a search-and-replace attack.<\/p>\n\n\n\n<ul>\n<li>Ideal Stream Cipher<\/li>\n<\/ul>\n\n\n\n<p>A brute-force attack is not possible. Because all keys are equally probable and a certain ciphertext could equally probably represent any plaintext.<\/p>\n\n\n\n<ul>\n<li>One-time Pad<\/li>\n<\/ul>\n\n\n\n<p>The problem with OTP is that it requires a secure method for generating and distributing the keys, as well as securely storing them. The key must be kept secret and be as long as the plaintext. This is a difficult task to accomplish in practice, especially for large amounts of data or for long-term storage.<\/p>\n\n\n\n<p>Another issue with OTP is that it is not very efficient, as the same amount of data must be encrypted as the plaintext, which can lead to large key sizes and slow encryption and decryption times.<\/p>\n\n\n\n<ul>\n<li>Asymmetric Cryptography<\/li>\n<\/ul>\n\n\n\n<p>An IoT node communicates with multiple webservers via TLS, a hybrid cryptography protocol. If the IoT node wants to communicate, it first exchanges public keys with the respective server, then establishes a signed and encrypted channel with them.<\/p>\n\n\n\n<p>If an attacker redirects the entire traffic to his servers, the IoT won&#8217;t know and still accepts the attacker&#8217;s public key. To avoid such attacks, the IoT node could have a list of public keys for the trusted servers.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>To avoid such attacks, real-world asymmetric cryptography never uses raw public keys, but <strong>certificates<\/strong>, which are basically just signed public keys for a certain URL, email address, etc. Whether to trust the public key can then be decided depending on who signed it.<br>The webbrowser has a built-in list of so called <strong>certificate authorities (CAs)<\/strong>, whose business model is to sign public keys for money. If you now browse a website that uses TLS, your browser will check if the certificate returned by the server contains a signature of <strong>one of these trusted CAs<\/strong> (often via a couple of intermediate certifications) and only if so accept the public key. <\/p>\n\n\n\n<p>In this problem&#8217;s scenario, the public key returned by the attacker\u2019s server will not be accompanied by a signature of one of these CAs and thus the browser will display a warning that the public key could not be authenticated and it is likely that you are currently under attack.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">12. Side Channel Attacks<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Types<\/h3>\n\n\n\n<p>There is physical quantity related to the operation of a cryptosystem but not <strong>intended<\/strong> to carry information.<\/p>\n\n\n\n<ul>\n<li>Time<\/li>\n\n\n\n<li>Power<\/li>\n\n\n\n<li>Electromagnetic emanations<\/li>\n\n\n\n<li>Acoustic emanations<\/li>\n\n\n\n<li>Temperature<\/li>\n\n\n\n<li>Light<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">(2) Timing of Password Check<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.10.43-1024x228.png\" alt=\"\" class=\"wp-image-2664\" width=\"580\" height=\"129\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.10.43-1024x228.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.10.43-300x67.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.10.43-768x171.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.10.43.png 1438w\" sizes=\"(max-width: 580px) 100vw, 580px\" \/><\/figure><\/div>\n\n\n<p><code>strcmp<\/code> terminates upon the first character that differs. So by observing how long it takes to check the password, one can determine how many characters \u2013 at the beginning of the string \u2013 are correct.<\/p>\n\n\n\n<p>The cryptographic library <code>sodium<\/code> provides a more secure function for comparing data: <code>sodium_memcmp<\/code><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"432\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-1024x432.png\" alt=\"\" class=\"wp-image-2665\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-1024x432.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-300x127.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-768x324.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-1536x648.png 1536w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05-1568x662.png 1568w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.11.05.png 1966w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">(3) Power Trace of Square-Multiply Algorithm<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"767\" src=\"http:\/\/iizz.ddns.net:9595\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.13.41-1024x767.png\" alt=\"\" class=\"wp-image-2666\" srcset=\"https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.13.41-1024x767.png 1024w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.13.41-300x225.png 300w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.13.41-768x575.png 768w, https:\/\/blog.mhrooz.xyz\/wp-content\/uploads\/2023\/01\/\u622a\u5c4f2023-01-27-18.13.41.png 1520w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<h2 class=\"wp-block-heading\">13. Embedded Communication<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">(1) Embedded Communication Standards<\/h3>\n\n\n\n<ul>\n<li>CAN<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>RS-232<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>I2C(Inter-Integrated Circuit)<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>SPI(Serial Peripheral Interface)<\/li>\n<\/ul>\n\n\n\n<p>It is a full-duplex communication protocol, which means that data can be transmitted and received simultaneously on separate lines. It is used for communication between integrated circuits.<\/p>\n\n\n\n<ul>\n<li>Ethernet<\/li>\n<\/ul>\n\n\n\n<p>\u4e00\u79cd\u5e7f\u6cdb\u4f7f\u7528\u7684\u5c40\u57df\u7f51\uff08LAN\uff09\u534f\u8bae\uff0c\u652f\u630110 Mbps\u81f3100 Gbps\u7684\u6570\u636e\u4f20\u8f93\u901f\u7387\u3002It is a standard for connecting computers and other devices in a LAN and is also used in wide area network (WAN) connections. Ethernet is based on the use of a shared medium, typically a wired cable, to transmit data between devices.<\/p>\n\n\n\n<ul>\n<li>UART(Universal Asynchronous Receiver Transmitter)<\/li>\n<\/ul>\n\n\n\n<p>It allows devices to transmit and receive data serially (i.e., one bit at a time) over a single communication line or channel. UARTs are commonly used in embedded systems, such as microcontrollers, to communicate with other devices, such as sensors, memory, and other peripherals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">(2) USB (Universal Serial Bus) <\/h3>\n\n\n\n<p>It is a standard for connecting devices to a computer or other host. It is a serial bus that provides a standard interface for connecting a wide variety of peripherals, such as keyboard, mouse, cameras, printers, and external hard drives.<\/p>\n\n\n\n<ul>\n<li>USB connection sequence<\/li>\n<\/ul>\n\n\n\n<ol>\n<li>Attach: The host detects the connection and sends a reset signal to the device.<\/li>\n\n\n\n<li>Read Device Descriptor: The host queries the device for its identity and configuration information. The device responds with its device descriptor, which contains information such as its vendor ID, product ID, and supported USB version.<\/li>\n\n\n\n<li>Assign Address: The host assigns a unique address to the device and the device uses that address for all subsequent communications with the host.<\/li>\n\n\n\n<li>Configuration: The host selects a configuration for the device and sends a configuration request. The device responds by setting its configuration and sending a configuration descriptor, which contains information such as the device&#8217;s power requirements and the number of interfaces.<\/li>\n\n\n\n<li>Read Interface Descriptor: The host selects an interface and sets up the endpoints. The device responds by setting up the interface and endpoints and sending an endpoint descriptor, which contains information such as the endpoint&#8217;s maximum packet size and transfer type.<\/li>\n\n\n\n<li>Load Driver: A USB driver is a software component that allows a computer&#8217;s operating system to communicate with a USB device. Drivers act as a translator between the operating system and the device, allowing the operating system to recognize and control the device.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>1. Embedded Programs (1) What &#8220;Embedded Programs&#038;<a class=\"more-link\" href=\"https:\/\/blog.mhrooz.xyz\/index.php\/2022\/09\/10\/ansi_c_xue_xi_bi_ji\/\">\u7ee7\u7eed\u9605\u8bfb<span class=\"screen-reader-text\">&#8220;XMC4500\u5b66\u4e60\u7b14\u8bb0&#8221;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[49],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/posts\/1721"}],"collection":[{"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=1721"}],"version-history":[{"count":71,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/posts\/1721\/revisions"}],"predecessor-version":[{"id":2755,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/posts\/1721\/revisions\/2755"}],"wp:attachment":[{"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=1721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=1721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mhrooz.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=1721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}