Sounds a bit like what happened when we set AFL loose on mbedOS using branch coverage of the specification to drive its heuristics. It would set the stack pointer into the middle of device space and then take an exception - very cool!
SMT Solver writing code: ... and then we simply jump into the middle of this memory mapped register file and execute 48 bits as code (a compressed dummy instruction and a jump).
-
-
-
Nice! In my example the program demonstrates a problem with relative jumps that cause PC to underflow. For this processor the only thing close enough to the zero address for this to happen are memory mapped hardware registers.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.