Hands-On: First Debug Session

// Lab 01: Connect to target and load symbols
// Step 1: Establish JTAG connection
SYStem.RESet
SYStem.CPU TC397
SYStem.JtagClock 10MHz
SYStem.Option WATCHDOG OFF
SYStem.Up
IF INTERFACE.CABLE()!="LA-7780"
    PRINT %ERROR "Wrong probe; connect LA-7780"
ELSE
    PRINT "Connected: " CPUIS()

// Step 2: Load ELF with debug symbols
Data.LOAD.Elf lab_debug/debug_lab.elf /RELPATH
PRINT "Symbols loaded: " Symbol.COUNT() " symbols"

// Step 3: Reset target to defined start state
SYStem.Reset
Register.Set PC __start     // set PC to reset vector

// Verify: check a known variable address
PRINT "g_testArray @ " Var.ADDRESS(g_testArray)
PRINT "Expected: within 0x70000000-0x70FFFFFF (LMU RAM)"

// Step 4: Run to main() before exercises
Go main
WAIT !STATE.RUN() 5s        // wait up to 5s for halt at main
PRINT "Halted at: " Format.ADDRESS(Register(PC))

// Exercise 1: null pointer dereference — locate the fault
// Expected: program crashes inside ProcessCanFrame() with HardFault

// 1. Set catchpoint for HardFault exception (vector 3)
Break.Set VECTOR:3 /Program    // halt when HardFault handler is entered

// 2. Run the program
Go
WAIT !STATE.RUN() 10s

// 3. At HardFault: read fault status registers
PRINT "HFSR: " Data.Long(SFR:SCB.HFSR)     // HardFault Status Register
PRINT "CFSR: " Data.Long(SFR:SCB.CFSR)     // Configurable Fault Status Register
PRINT "BFAR: " Data.Long(SFR:SCB.BFAR)     // Bus Fault Address Register (faulting address)
// CFSR bit 15 (BFARVALID): 1 = BFAR contains valid fault address

// 4. Check LR to reconstruct which exception handler we're in
PRINT "LR=" Register(LR)    // should be 0xFFFFFFF9 or 0xFFFFFFFD

// 5. Get PC at time of fault (in hw-pushed stack frame)
// Hardware pushes PC at SP+24
LOCAL &fault_pc
&fault_pc=Data.Long(Register(SP)+24.)
PRINT "Faulting PC: " Format.ADDRESS(&fault_pc)
// Convert to source: list source at faulting address
List &fault_pc

// Expected finding: ptr = GetCanFramePtr() returned NULL; code derefs without null check
// Fix: add null check before dereferencing GetCanFramePtr() return value

// Exercise 2: stack buffer overflow corrupts return address
// Symptom: function returns to wrong address -> HardFault or random behaviour

// 1. Enable stack guard watchpoint at bottom of task stack
// Stack grows down; guard zone at lowest addresses
LOCAL &stack_base
&stack_base=Var.ADDRESS(task_stack_buf)
Break.Set &stack_base /Write /Hardware      // fires if stack grows below guard

// 2. Run the program; trigger the overflow condition
Go
WAIT !STATE.RUN() 10s

// 3. At watchpoint hit: inspect the situation
PRINT "Watchpoint hit at PC=" Register(PC)
PRINT "Data written to: " Register(DWT_COMP0)   // address that triggered watchpoint

// 4. View the corrupted stack
Data.dump &stack_base--(&stack_base+0x100) /Long

// 5. Backtrace: where are we?
Frame.view /Caller

// 6. Find the over-writing function
// Look at Frame 0: the function writing below stack = the source of overflow
// Check Frame.LOCAL 0 for large local arrays or memcpy calls

// Expected finding: char local_buf[64]; memcpy(local_buf, src, src_len);
// src_len comes from untrusted CAN RX, not bounds-checked
// Fix: validate src_len <= sizeof(local_buf) before memcpy