ESP8266 ROM XTOS

1 逆向工程

• http://dflund.se/~kongo/esp8266.bin/iram0.txt
• http://esp8266-re.foogod.com/wiki/Boot_ROM

2 探索

2.1 SYSTEM_RTC_MEM_READ

uint32 system_rtc_mem_read(int32 addr, void *buff, int32 length)
{
    int32 blocks;
     
    // validate reading a user block
    //if (addr < 64) return 0;
    if (buff == 0) return 0;
    // validate 4 byte aligned
    if (((uint32)buff & 0x3) != 0) return 0;
    // validate length is multiple of 4
    if ((length & 0x3) != 0) return 0;
     
    // check valid length from specified starting point
    if (length > (0x300 - (addr * 4))) return 0;
 
    // copy the data
    for (blocks = (length >> 2) - 1; blocks >= 0; blocks--) {
        volatile uint32 *ram = ((uint32*)buff) + blocks;
        volatile uint32 *rtc = ((uint32*)0x60001100) + addr + blocks;
        *ram = *rtc;
    }
 
    return 1;
}

2.2 SYSTEM_RTC_MEM_WRITE

uint32 system_rtc_mem_write(int32 addr, void *buff, int32 length)
{
    int32 blocks;
     
    // validate reading a user block
    if (addr < 64) return 0;
    if (buff == 0) return 0;
    // validate 4 byte aligned
    if (((uint32)buff & 0x3) != 0) return 0;
    // validate length is multiple of 4
    if ((length & 0x3) != 0) return 0;
     
    // check valid length from specified starting point
    if (length > (0x300 - (addr * 4))) return 0;
 
    // copy the data
    for (blocks = (length >> 2) - 1; blocks >= 0; blocks--) {
        volatile uint32 *ram = ((uint32*)buff) + blocks;
        volatile uint32 *rtc = ((uint32*)0x60001100) + addr + blocks;
        *rtc = *ram;
    }
 
    return 1;
}