I managed to get some more info in case of a boot failure (fatal exception 29) aka zombie mode.
For the impatient:
That means the code in memory is not as expected!
Details:
cal_dex 0.2a, dump 0.2a
Fatal Exception: 001d (29), sp 3ffffad0
SDK Version: 0.9.5
Fingerprint: 1/xh=4023fb8c,t=0000-7da4,d=8000-8b48,b=ca70-5350,ro=8b50-ca70
epc1: 402228c8 exccause: 0000001d excvaddr: 00000044 depc: 00000000
ps : 00000030 sar : 00000019 unk1 : 80899bc3
a0 : 4021f72f a1 : 3ffffbd0 a2 : 60000600 a3 : 00000001
a4 : 00000002 a5 : 3ffecf94 a6 : 03910267 a7 : 01910267
a8 : 00000010 a9 : 01910267 a10: 00000004 a11: 00000000
a12: 60000600 a13: 00000001 a14: 60000e00 a15: 3ffecdd8
Stack (3ffffbb0)
3ffffb90 40100860 3ffffbd0 f854dadd e13d1b52 3ffffbd0 3ffffbd0 00000004 9cc74050
3ffffbb0 000000d0 00000043 3ffffbd0 00000018 3fff54f0 4021fab9 3ffecf8a 9c02b254
3ffffbd0 00100000 0019c06a 4021f794 00000000 4021fb4b 60000e78 402199f9 0000007d
3ffffbf0 00000000 0000000e 4021009f 3ffeca96 3ffeca96 00000000 00000000 00000000
3ffffc10 00000000 3fff5450 40210473 3ffeca9c 402104ba 3fff5460 40210495 3fff5460
3ffffc30 00000000 400042db 73bcc810 2cef3292 40004b31 0007c000 00000002 40100340
3ffffc50 0007c000 00000002 d6d3c977 bf981f0b ffffffff ffffffff ffff0001 00000004
3ffffc70 6b6e7570 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3ffffc90 00030503 21000001 63696572 33317368 72616d36 0000216b 00000000 00000000
3ffffcb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3ffffcd0 00000000 00000000 a6251cf8 a65db399 e38fc234 f9cd095d 4b8c072d d3520bcc
3ffffcf0 b5074eb3 77daaea2 ffffff01 ffffffff ffffffff ffffffff ffff00ff ffffffff
3ffffd10 00000011 542d4941 4b4e4948 395f5245 38393844 00000035 00000000 00000000
3ffffd30 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3ffffd50 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3ffffd70 00000000 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
3ffffb90 40100860
3ffffbc4 4021fab9
3ffffbd8 4021f794
3ffffbe0 4021fb4b
3ffffbe8 402199f9
3ffffbf8 4021009f
3ffffc18 40210473
3ffffc20 402104ba
3ffffc28 40210495
3ffffc34 400042db
3ffffc40 40004b31
3ffffc4c 40100340
3fffffd4 4010000c
3fffffd8 40001878
3fffffe0 40001100
3ffffff0 4000044c
epc1:
40222888 520020c0 5580d026 20557010 520020c0 020cd066 00ffe446 66021226 18512f22
402228a8 010522ff 632162ec 0020c0b6 304a2232 a3cc1430 420020c0 40404a22 40404a22
402228c8 40404a22 40404a22 40404a22 40404a22 40404a22 40404a22 0020c0b6 0c446682
402228e8 0020c007 51516672 20c0c234 40665200 c0e8d441 23220020 102240f2 220020c0
The most interesting part is the dump of the epc1 block.
epc1 is the programm counter (pc) where the exception occurred. (Note that the integer values are little endian,
so some mental byte swapping needed when looking at the code.
The content of the address 402228c8 is 40404a22.
But it should be (as dumped on startup)
402228c8 20c0270c 4a226200 62106670 f00d0345 31e65b81 5761e1b8 0020c0b6 0c446682
For code
402228c8: 270c movi.n a7, 2
402228ca: 0020c0 memw
402228cd: 4a2262 l32i a6, a2, 0x128
That means the code in memory is not as expected!
Cal