.. _regmon:

Regmon
======

Video One
---------

https://youtu.be/elPlRpeSg2U

Someone hands you a microcontroller running unknown firmware and asks: *what is it actually doing?* No source code. No disassembler. No pausing the chip. Just a black box on a bench and a pair of debug wires.

This episode walks through a real capture — and the first trap it hits is one that would fool a lot of tools. Regmon, the free register monitor from the FossilCrew stack, reads the chip's clock-enable registers and finds essentially nothing switched on. No GPIO, no timer, no UART, no DMA. Any naive analysis would call that chip idle and move on.

But the chip isn't idle. It isn't even close to idle.

Regmon asks a second question the others don't: not *which peripherals have clocks* — but *is the CPU core actually fetching instructions?* It answers by sampling the program counter over a couple of seconds, and the values come back telling a completely different story. The core is bouncing between two adjacent addresses in a tight, deterministic loop — a pattern that could mean a busy-wait spinlock, or something far more interesting.

That ambiguity is the whole point of reverse engineering, and this episode shows how you reason through it: two candidate explanations, what each one implies, why an interrupt can be ruled out, and how the honest next step is handing the exact code addresses to a disassembler to find out which story is true.

You'll come away with a genuinely useful technique: watch the silicon's behaviour through its side effects, not its declared configuration. The clocks can lie. The program counter doesn't.

Covered in this episode:

- Why "no peripheral clocks" does NOT mean "idle CPU"
- Reading the chip's identity over the debug wire — knowing your silicon first
- Sampling the program counter live to catch a running core in the act
- A tight two-instruction loop: busy-wait or Forth interpreter? Reasoning through the evidence
- Ruling out interrupts by the pattern, not the guess
- The division of labour in real RE: dynamic monitoring hands the disassembler the breadcrumb addresses

Regmon is part of the FossilCrew stack — open-source, Linux desktop, STM32-focused, and it reads the silicon, not the source, so it works with firmware written in C, Forth, Rust, or anything else. It watches a running chip with zero impact on real-time performance — the target never knows it's being observed.

If you've ever been handed a locked black box and wished you could see inside without breaking it, this one's for you.

Don't trust the clocks. Peek at the program counter. It'll tell you the truth.

.. image:: pics/regmon/regmon-v2-analyse-prog.png