I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is connecting to the GDB service but when I attach to process it shows all zeros in memory and the PC is no were where I expect it to be. Basically seems like IDA has no control and is not hooking to it. BTW, the target is running and I rather not do a halt reset if I don't have to. I believe this is possible with JTAG.
There is no process per-say but I really would like to be able to set breakpoints and single step in some places in the code. Obviously there is some setup issue. Any ideas?
I had a lot to learn and turned out a number of things wrong.
- Start out with using OPENOCD via the terminal
- You really need to halt the target to get access to the registers in arm
- Seemed I had the JTAG speed too high
- The device under test had the WDT turned on. Now with that off, I can halt the target and see the correct registers. I could see this was happening since it would start reading the PC just fine but by the time it got to lower regs it would read all F's
- The DUT has cache and the MMU enabled so although I can halt the target, restarting always ends up with a data abort. Looking at arm11.c in ocd seems there are a bunch of stubs that aren't quite implemented for the cache to be turned on. I've tried flushing the cache before resuming but I still get a data abort. More investigation needed but if anyone has advice, let me know.
Thx for your help so far, this surely has been a learning experience.