Industries · Embedded and firmware

For firmware and control loops

ByteAsk drives gdb to the one store that corrupts a joint, and cites the STM32 reference manual by page.

ByteAsk · armctl · debug_session #1{"action":"start","program":"~/byteask/cppcon/demos/04-runtime-forensics/build/armctl","args":"6000"}

{"action":"cmd","session":1,"command":"print &g_joints[5].measured_rad"}$6 = (double *) 0x555555559280 <rtc::g_joints+256>{"action":"cmd","session":1,"command":"watch -location *(double*)0x555555559280"}Hardware watchpoint 2: -location *(double*)0x555555559280{"action":"cmd","session":1,"command":"continue"}Old value = -1.9057374359644947New value = -1.8236172821972838{"action":"cmd","session":1,"command":"print this->joint_id_"}$8 = 5{"action":"cmd","session":1,"command":"print g_joints[this->slot_].name"}$12 = "elbow\000\000"I have the concrete bad store: after reprioritization, controller `joint_id_=5` still targets `slot_=5`, and slot 5 now holds `elbow`.+            for (int i = 0; i < kNumJoints; ++i) ctl[i].bind(static_cast<std::uint32_t>(i));/usr/bin/zsh -lc './build/armctl 20000' in ~/byteask/cppcon/demos/04-runtime-forensicscompleted, all joints within soft limits

Recorded ByteAsk session on armctl, a simulated arm controller: a hardware watchpoint catches the wrong joint being written.

Standards it can cite

STM32 · CAN · Modbus

mcu_ref: STM32 · Cortex-M · Modbus · CAN

search_docsSTM32F4 RM0090 general-purpose timer encoder interface mode TI1 polarity CC1P inverted counting direction

STM32F405/415, STM32F407/417, STM32F427/437 and STM32F429/439 Advanced Arm-based 32-bit MCUs Reference Manual (RM0090, DM00031020)pp.613–614

                    Figure 168. Example of counter operation in encoder interface mode
                                forward     jitter     backward         jitter      forward
                     TI1
                     TI2
                 Counter
                                    up               down                            up
                                                                                                 MS33107V1
           Figure 169 gives an example of counter behavior when TI1FP1 polarity is inverted (same
           configuration as above except CC1P=1).
               Figure 169. Example of encoder interface mode with TI1FP1 polarity inverted
                                forward     jitter     backward         jitter      forward
                     TI1
                     TI2
                 Counter
                                    down              up                            ...

ref dm00031020:1:184:24 · captured 2026-10-26

The tools it runs for Embedded and firmware

gdb
make
cppcheck
ASan and UBSan
Valgrind
Git

Enterprise

Your code stays inside your walls

On-prem, air-gapped and bring-your-own-key deployments, with the controls your security team will ask for.

See Enterprise

Book a demo Install