Page 4 of 4

Re: Next step after telnet access?

Posted: Sat Aug 17, 2013 12:47 pm
by patois
breakpoints seem to not be handled correctly. I tried debugging with the armlinux_server binary that is shipped with IDA. It works better than gdb for me but still, breakpoints aren't handled correctly (and so isn't single stepping). I.e. the debugging client is not being notified about a breakpoint event. I think the same goes for gdb. One situation I absolutely do not understand is the following:

1. set a breakpoint on a particular TCP packet processing function
2. send data to TCP port
3. observe that nothing happens (altho breakpoint should have been triggered or at least tv should have processed the packet)
4. remove breakpoint
5. only then(!) TCP packet processing function is executed

Further anti-debugging code somewhere? integrity check?

edit: I have not customized memjack to patch functions other than adbg_CheckSystem() since I do not know what the other patches are for.

Re: Next step after telnet access?

Posted: Sat Aug 17, 2013 1:35 pm
by juusso
Try this gdbserver

Re: Next step after telnet access?

Posted: Sat Aug 17, 2013 1:55 pm
by patois
thanks. appears to work better but my tv still reboots, due to a watchdog i guess? I've been told in a PM that additional libraries need patching.

Re: Next step after telnet access?

Posted: Sun Aug 18, 2013 5:43 pm
by patois
remote debugging still doesn't work but I'm one step closer to getting it to work. Theres a binary, 'micom', on my ESXX6100 which has "undocumented" commands, such as "watchdog_off" which lets you turn off the watchdog. This allows exeDSP to be debugged without the TV rebooting. Breakpoints however are still kind of an issue...

Re: Next step after telnet access?

Posted: Tue Aug 27, 2013 6:07 am
by juusso
any success?

Re: Next step after telnet access?

Posted: Sat Aug 31, 2013 12:13 pm
by patois
well, debugging somehow works. i think it's sufficient for now but it's still a tedious process because lots of reboots are involved, requiring me to manually run the telnet enabler, memjack, gdbserver, micom, putty and whatnot after each reboot. at some point i got fed up so i suspended my little project until i think i will be able to handle all the frustration a bit better :)

Re: Next step after telnet access?

Posted: Sat Aug 31, 2013 12:40 pm
by bugficks
haha, sounds too familiar. hence i ve skipped debugging and just use log files. still involves a lot of reboots though :)

Re: Next step after telnet access?

Posted: Sat Aug 31, 2013 1:27 pm
by patois
yeah, probably i should finally give this library injection tool of yours a try :)