The gdb_init_real_mode from mhugo

Wrong context after break

I have physical machine with 8088 cpu (non PC compatible in any other way).
The machine is running unknown 32 years old code, yet partly disassembled, placed in ROM.
I have ported gdb-stub to it and placed it to an empty space in ROM.
I have modified the interrupt vectors INT 1 and INT 3 to jump to the gdb-stub and at specific place in the original code placed INT 3 instruction, which I can hit by sending specific character to serial port.

When i connect gdb initialized by your .gdbinit with
target remote /dev/ttyUSB0
appended to the end, the gdb "successfully" reads the registers and memory as in your qemu case.
The quotes around the word successfully are because I'm not sure yet if it's really correct.

I know that the program is using constant values of the CS, DS and SS registers CS = 0xf800 DS = 0xff00 SS = 0xff00.

After the breakpoint is hit i see:

Program received signal SIGTRAP, Trace/breakpoint trap.
---------------------------[ STACK ]---
FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 
FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 
---------------------------[ DS:SI ]---
FF000044: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
FF000054: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
FF000064: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
FF000074: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
---------------------------[ ES:DI ]---
00001CE1: 00 00 21 00 1F 1F 1D 00 00 00 00 00 17 00 15 00  ..!.............
00001CF1: 13 30 30 00 0F 30 30 00 0B 00 09 08 07 06 05 04  .00..00.........
00001D01: 03 02 01 00 FF FE FD FC FB FA F9 F8 F7 F6 F5 F4  ................
00001D11: F3 F2 F1 F0 EF EE ED EC EB EA E9 E8 E7 E6 E5 E4  ................
----------------------------[ CPU ]----
AX: 0018 BX: 0E5B CX: 0003 DX: 0000
SI: 0044 DI: 1CE1 SP: 17DC BP: 17F0
CS: F800 DS: FF00 ES: 0000 SS: FF00

IP: 0F5A EIP:00000F5A
CS:IP: F800:0F5A (0xF8F5A)
SS:SP: FF00:17DC (0x007DC)
SS:BP: FF00:17F0 (0x007F0)
OF <0>  DF <0>  IF <1>  TF <0>  SF <0>  ZF <1>  AF <0>  PF <1>  CF <0>
ID <0>  VIP <0> VIF <0> AC <0>  VM <0>  RF <0>  NT <1>  IOPL <3>
---------------------------[ CODE ]----
   0xf8f5a:     stos   BYTE PTR es:[di],al
   0xf8f5b:     test   ax,0xa7a8
   0xf8f5e:     cmps   BYTE PTR ds:[si],BYTE PTR es:[di]
   0xf8f5f:     movs   WORD PTR es:[di],WORD PTR ds:[si]
   0xf8f60:     movs   BYTE PTR es:[di],BYTE PTR ds:[si]
   0xf8f61:     mov    ds:0xa1a2,ax
   0xf8f64:     mov    al,ds:0x9e9f
   0xf8f67:     popf   
   0xf8f68:     pushf  
   0xf8f69:     fwait
0x00000f5a in ?? ()
real-mode-gdb$

The addresses are OK but that disassembly at the end is incorrect, the code where the breakpoint is can be examined by this:
(subtracting the data segment instead)

real-mode-gdb$ x/10i 0x9f59
   0x9f59:      int3   
   0x9f5a:      nop
   0x9f5b:      nop
   0x9f5c:      nop
   0x9f5d:      nop
   0x9f5e:      jmp    0x9e26
   0x9f61:      mov    al,ds:0x1c2e
   0x9f64:      cbw    
   0x9f65:      cmp    ax,0xffff
   0x9f68:      jne    0x9f95
real-mode-gdb$

And that is corresponding to the disassembly from ghidra:

                             **************************************************************
                             * CANCEL and SUBSTITUTE handler - here was c6 06 ee 1c 00... *
                             **************************************************************
                             CANCEL_and_SUBSTITUTE_handler                   XREF[1]:     SPECIAL_CHARACTER_HANDLER:f000:8
       f000:8f59 cc              INT        3
       f000:8f5a 90              NOP
       f000:8f5b 90              NOP
       f000:8f5c 90              NOP
       f000:8f5d 90              NOP
       f000:8f5e e9 c5 fe        JMP        LAB_f000_8e26
                             **************************************************************
                             * Backspace handler                                          *
                             **************************************************************
                             backspace_handler                               XREF[1]:     SPECIAL_CHARACTER_HANDLER:f000:8
       f000:8f61 a0 2e 1c        MOV        AL,[DAT_0000_1c2e]                               = D6h
       f000:8f64 98              CBW
       f000:8f65 3d ff ff        CMP        AX,0xffff
       f000:8f68 75 2b           JNZ        LAB_f000_8f95

Maybe i have some problem in the gdb-stub left, or something in your script can't deal with the fact CS and DS aren't pointing to the same memory segments.

Please, can you look what should be wrong with it?

I can provide the memory dump which can be launched in qemu, but because qemu emulates different machine, it is only somewhat useful, or the gdb <-> gdb remote stub communication if you want.

Thank you

mhugo / gdb_init_real_mode Goto Github PK

gdb_init_real_mode's People

Stargazers

Watchers

Forkers

gdb_init_real_mode's Issues

Wrong context after break

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent