SMT Solver writing code: ... and then we simply jump into the middle of this memory mapped register file and execute 48 bits as code (a compressed dummy instruction and a jump).
-
Sounds a bit like what happened when we set AFL loose on mbedOS using branch coverage of the specification to drive its heuristics. It would set the stack pointer into the middle of device space and then take an exception - very cool!
Nice! In my example the program demonstrates a problem with relative jumps that cause PC to underflow. For this processor the only thing close enough to the zero address for this to happen are memory mapped hardware registers.
