) 0xFFFFFFFC, that is, remove the last two bits, You can subtract 2 from the calculation. But there is also an assumption that the start address of the hook function must be 4-byte aligned, even if the hook function is written using the thumb instruction set.
It is said that when the hook function 4 byte alignment, add R5, PC, #12这条指令的地址刚好是2字节对齐, then according to the above paragraph can be reduced by 2 R5 point is jumpt[16] instead of jumpt[18], so this hook function is required. After t
) (struct Machine_desc *, struct tag *, char * *, struct MEMinfo *); void (*map_io) (void);/* IO mapping function */void (*INIT_IRQ) (void); struct Sys_timer *timer; /* System TICK Timer */void (*init_machine) (void);};We open the Arch.h file and see that the definition of the Machine_desc struct is exactly the same as what we just said. and back to Head-common. s file, defined here for Mmap_switch: . Type __mmap_switched,%function__mmap_switched: ADR R3, __switch_data + 4
1. System calls are required from user space to kernel space2. The system call is implemented via the SWI instruction, at which point a parameter is stored in the R7 register to specify the kernel function to invoke.3. The actual functions of the general kernel State can be implemented in arbitrary. c files, but the corresponding function pointers must be added to the CALL.S (add table entries)4. Also declare the parameters in the Unistd.h. This param
directive invokes the system routine of the operating system number bit 02The way Linux 2.6.16 is used later:The 24-bit immediate number in the instruction is ignored, the service type requested by the user is determined by the value of the register R7, and the parameters are passed through the other general registers. For example:MOV R7, #12SWI 0Each system call has a unique system call function number Al
PC: [
1. Locating code crashes in the kernel or Xxx.ko
Cat/proc/kallsyms >1.txt
c0034818 T __kmalloc
...
C00082A8 T quiet_kernel/* The first is the virtual address * *
...
bf000000 T $a [CDD]
..
This can see code crashes in Xxx.ko
2. Locate the function of the crash in Xxx.ko
arm-linux-objdump-d Cdd.ko >2.txt
00000000
Compile Address +0xbf000000 = store Address
0000009c
9C:E1A0C00D mov ip,sp
A0:E92DD8F0 Push {R4,R5,R6,R7,FP,IP,
personal concepts, now described below.
Quantitative compression, for example:
Conversion of 24bit RGB888-> 16bit RGB56524IBT RGB888 R7 R6 R5 R4 R3 R2 R1 R0 G7 G6 G5 G4 G3 G2 G1 G0 B7 B6 B5 B4 B3 B2 B1 B016bit RGB656 R7 R6 R5 R4 R3 G7 G6 G5 G4 G3 G2 B7 B6 B5 B4 B3Quantization digits from 8bit to 5bit or 6bit, take the high position of the original 8bit, the quantization of compression, but the loss of pr
CORTEX-M3 has universal register R0-R15 and some special function registers. R0-r12 is the most "common purpose", the vast majority of 16-bit instructions can only use R0-R7, while the 32-bit Thumb-2 instruction has access to all the universal registers. Special function registers must be accessed through a dedicated instruction.Universal Purpose Register R0-R7R0-R7 is called a low group register. All instr
Warm tips:
1, OPPO R9 adopt and or Cato design, the slot is located on the right side of the fuselage, take out the card slot need to use the box with the Kari out, before installing SIM card.
2. The OPPO R9 is designed with a single card slot dual SIM card, two can be inserted into the Nano (mini card), which is consistent with R7 Plus, while R7 and r7s are micro SIM card +nano SIM card combinatio
"Print Call stack"(GDB) bt #0 epoll_wait () at bionic/libc/arch-arm/syscalls/epoll_wait. S:10 #1 0x401275ea in Android::looper::p ollinner ([emailprotected]=0x747fd3f0, timeoutmillis="Switch to the nth layer of the call stack"(GDB) F-one #11 0x41587ff6 in dalvik_java_lang_reflect_method_invokenative (args="Show assembly Code" (GDB) disassemble Dump of assembler code for function dalvik_java_lang_reflect_method_invokenative (U4 const*, jvalue*): 0x41587f7c "View Current Register Value"(GDB) In
, respectively.Example: ADD r0, r1, r2; r0 = r1 + r2RSB r0, r1, r2; r0 = r2-r1Logical operations by bit: AND, ORR, EOR, BICNote: bitwise and, bitwise OR, bitwise OR, and notExample: BIC r0, r1, r2; r0 = r1 and not r2Register transfer operation: MOV, MVNNote: MVN is a bitwise reverse transfer.Example: MVN r0, r2; r0 = not r2Comparison: CMP, CEN, TST, TEQNote: comparison, reverse comparison, bit test, and test are equalExample: TEQ r1, r2;Note: The sequential format of operands is the result regis
is the next eclipse comes with, but also basic is the latest (before using the Luna version, unfortunately halfway I thought it was ADT problem compiled, and replaced by Juno version, R9 also replaced R10, should not hinder), the NDK with the latest R10 .(Here I do not dare to mess to ensure that the JDK replaced 8, Android under W, L line not, I only use my own experience, I use the above version, can be equipped with the environment I want, you want to use the new NDK, you try, do not dare to
After the NAND is all formatted today, re-use the uboot in nor to burn the uboot into the NAND. It should be the same as the uboot interface in nor. The following message is prompted: #### embedsky BIOS for sky2440/tq2440 #####
Press space key to download mode!
Booting LINUX...
Copy Linux kernel from 0x00200000 to 0x30008000, size = 0x00200000... Copy Kern
El to SDRAM done, warning: This binary is not compressed Linux kernel Image
Zimage magic = 0 xffffffff
Now, booting LINUX ......
Undefined in
First download cygwin and ndk (I'm using a android-ndk-r7)
When downloading cygwin, You need to select what we want. If you do not know, we recommend that you install it all at the cost.
The current ndk version does not need to be installed, saving the installation step.
After cygwin is installed and ndk is downloaded
1. Configure the ndk environment variable in cygwin (C: \ cygwin \ home \ Administrator \. bash_profile). This is my directory.
Fi
are completed with an AT command (ultrasn0w)
We only need one command to unlock it !!
The following information comes from the Wiki maintained by the great gods (http://theiphonewiki.com/wiki/index.php)
(If you are good at English, you can browse it by yourself (you need to flip the wall). I will explain it in detail later)
4.26.08: At + xlog = 1, "dddddddddddddddddddddddddddddddd44445555pppp"
D. Fill in the data to overwrite the stack of the baseband program and overwrite the following regist
an application * is linking when the main () function is in a static library (. a) * We can be sure that main () actually gets linked in */. type _ main, stt_func; _ start:/* clear the frame pointer and the L registers. */FP = 0; L0 = 0; L1 = 0; L2 = 0; l3 = 0;/* l Oad register r1 (argc) from the stack to its final resting place */P0 = sp; R1 = [P0 ++]; /* Copy argv pointer into R2 -- which its final resting place */r2 = P0; SP + =-28; R7 = 0;/* pass
2.6.20 kernel compiled by the arm-gcc-3.4.1:(Reference http://oskfordummies.hp.infoseek.co.jp/faq.html#i5)--------------------------------------------------In header. sMoV R7, # (mach_type_omap_osk 0xf)It should beMoV R7, # (mach_type_omap_osk ~ 0xf)--------------------------------------------------To solve the problem of "no response to the kernel after decompression", which is invalid!
3. On the basis o
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.