# -*- GDB-Script -*-
# "file" should place before "target"
# file build/sample.elf
# file /run/shm/d/workspace/STM32F103C8_TEST_8M/SW4STM32/STM32F103C8_TEST_8M/Debug/STM32F103C8_TEST_8M.elf
# set debug arm # only for gdb-multiarch
file build/read_program_in_flash.elf
target remote localhost:3333
# target extended-remote /dev/ttyACM0
# monitor swdp_scan
# attach 1
load
# gdb settings ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
alias -a di = disas
# alias -a dis = disas
# alias -a disa = disas
alias -a tb = tbreak
# gdb settings vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
################################################################################
# gef settings ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# with capstone and keystone setup
gef config context.layout "regs stack code args source threads trace extra memory"
# gef config context.layout "regs stack -code -args source threads trace extra memory"
# gef config context.layout "regs stack -code -args source trace extra memory"
# gef config context.layout "stack -code -args source trace extra memory"
# gef config context.layout "regs source memory"
gef config context.nb_lines_code 8
gef config context.redirect "/dev/pts/0"
layout split
tui disable
# gef settings vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
################################################################################
# debug ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set $pc = *0x20000004
set $sp = 0x20005000
# trace enable bit in DEMCR register
# TPIU module -> DEMCR& = 1 << TRCENA
# DEMCR MON_STEP
# DEMCR MON_EN
# PM0056 Programming manual
# describe registers
# CPS, CPUID
# watch CPU SCB registers
# CPUID ICSR VTOR AIRCR SCR CCR SHPR1 SHPR2 SHPR3 CSFR
memory watch 0xe000ed00 10 dword
# stack
memory watch 0x20004FC0 64 byte
# DWT_CTRL and DWT_CYCCNT described ARM® v7-M Architecture Reference Manual
# DWT_CTRL bit CYCCNTENA (bit 1) is set, CYCCNT works
# DWT_CTRL bit CPIEVTENA (bit 17) is set, DWT_CPICNT works
# DWT_CTRL DWT_CYCCNT DWT_CPICNT DWT_SLEEPCNT DWT_LSUCNT DWT_FOLDCNT
memory watch 0xE0001000 3 dword
# set *0xE0001000=(*0xE0001000) & 0x1
# set *0xE0001000=(*0xE0001000) & (0x20000)
set *0xE0001000 = 0x20001
# reset DWT_CYCCNT value
set *0xE0001004 = (long int)0x0
set *0xE0001008 = (long int)0x0
# Debug registers
# DFSR 0xE000ED30
# DHCSR 0xE000EDF0
# DCRSR 0xE000EDF4
# DCRDR 0xE000EDF8
# DEMCR 0xE000EDFC bit 24, TRCENA, Trace Enable
# C1.5 Debug event behavior
# C1.6 Debug register support in the SCS
# ARMv7-M Architecture Reference Manual(ARMv7-M_ARM).pdf
# DHCSR DCRSR DCRDR DEMCR
# DHCSR: bit2 C_STEP, bit1 C_HALT
memory watch 0xE000EDF0 4 dword
# clear memory aroud stack
set *0x20004fb0=(long int)0x0
set *0x20004fb4=(long int)0x0
set *0x20004fb8=(long int)0x0
set *0x20004fbc=(long int)0x0
set *0x20004fc0=(long int)0x0
set *0x20004fc4=(long int)0x0
set *0x20004fc8=(long int)0x0
set *0x20004fcc=(long int)0x0
set *0x20004fd0=(long int)0x0
set *0x20004fd4=(long int)0x0
set *0x20004fd8=(long int)0x0
set *0x20004fdc=(long int)0x0
set *0x20004fe0=(long int)0x0
set *0x20004fe4=(long int)0x0
set *0x20004fe8=(long int)0x0
set *0x20004fec=(long int)0x0
set *0x20004ff0=(long int)0x0
set *0x20004ff4=(long int)0x0
set *0x20004ff8=(long int)0x0
set *0x20004ffc=(long int)0x0
# set *0xE000EDF0=
# set PC counter in ETM/ TPIU
# break point 1
# command 1
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print $pc
# bt
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# end
# # break point 2
# command 2
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print $pc
# btp
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# print "^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
# end
# b *((main) +14)
# b *0x80003160
# after command MSP
# b *(reset+30)
# command
# set $sp=0x20004FFC
# end
# **********************************************************
# 0x080012e0 <+64>: bl 0x8002370
# tb *0x8002370
b *(entry+64)
# 0x080012e4 <+68>: bl 0x8002350
# tb *0x8002350
b *(entry+68)
# # "bl gpio_init\n\t"
# 0x080012e8 <+72>: bl 0x8001cf0
# tb *0x8001cf0
b *(entry+72)
# **********************************************************
# "bl gpio_init\n\t"
# 0x0800f462
# 0xe0042000 DBGMCU_IDCODE, in RM0008 chapter 31.6.1
# awatch *(int*)0xE000ED04
# awatch *0xE000ED04 SCB_ICSR
# awatch -l *(uint32_t *)0xe0042000
# b *(main+48)
# b *0x080013e4
# c
# command
# disassemble 'foo.c'::bar
# end
# entry -> main
# halt
# hit breakpoint main
# loop here
# msr CONTROL, r1
# reset
# set $pc 0x8003268
# set $pc to reset()
# set $sp=0x20004FFC
# tb main
# tbreak *(entry+88)
# tbreak *0x8002168
# trace-run *0x0800fc30
# trace-run *0x080122e0
# trace-run *0x08013110
# trace-run *0x8013110
# trace-run 0x0800fc84
# trace-run 0x8005574
# watch *(int*)0xE000ED04
# watch -l *0xE000ED04
# debug vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv