mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
dwt/tcpip: map the socket API and fetch a file over TFTP into RAM
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
This commit is contained in:
SDD committed
1 parent
139d89a10c
commit
01923ecb69
47 files changed
+3394
No files matched your search
@@ -373,3 +373,18 @@ Facts for anyone tempted to "just create a window" (details in
|
||||
client is "one call away".
|
||||
* Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the
|
||||
realistic route for making the Terminal Manager draw something.
|
||||
|
||||
## 2026-10-18 15:25 EEST — TFTP fetch into a malloc buffer works from rdebug
|
||||
|
||||
For the COFF-loader agent (details: `dwt/notes/LOADER_CROSS.md` and
|
||||
`dwt/notes/TCPIP.md`):
|
||||
|
||||
* The firmware `tftp_open` hangs from the rdebug process (its resolver; no RRQ).
|
||||
Use the socket API instead: `socket` `3F5C9A00`, `sendto` `3F5D3D70`,
|
||||
`recvfrom` `3F5D7D50` (`arg5 = &socklen`, initialise to 16), `close`
|
||||
`3F5E8930`, `malloc` `3F701230`. Stack args, last first.
|
||||
* Verified: `dwt/tcpip/tftpc.asm` (bit `01870000`) fetched 600 B into the
|
||||
malloc buffer `0x00b5bcd0`; server RRQ `'dwt/tcpip/probe.bin'`; peek/cmp
|
||||
byte-identical (sha256 `9662e62b…333359`). Run it in the **rdebug process**.
|
||||
* Pointers are bit addresses: advance a data cursor by `n*8`. Keep the 2048-B
|
||||
receive buffer and the `from`/`fromlen`/ACK cells disjoint.
|
||||
@@ -128,3 +128,28 @@ out of the target sections; the loader cannot see them.
|
||||
offsets match it.
|
||||
* `dwt/notes/LOADER.md` — the full COFF layout, the position-dependence
|
||||
evidence and the loader algorithm.
|
||||
|
||||
## 2026-10-18 15:25 EEST — TFTP fetch works from the rdebug process
|
||||
|
||||
* **Exact fetch call:** the firmware's `tftp_open` is unusable (hangs in its
|
||||
resolver, no RRQ). Use the minimal client in `dwt/tcpip/tftpc.asm`
|
||||
(bit `01870000`, 694 B): `malloc(0x10000)` at `3F701230`, `socket(2,2,0)` at
|
||||
`3F5C9A00`, `sendto(fd,buf,len,0,to,16)` at `3F5D3D70`,
|
||||
`recvfrom(fd,buf,2048,0,&from,&fromlen)` at `3F5D7D50` with `*fromlen=16`,
|
||||
`close(fd)` at `3F5E8930`. Stack arguments are pushed **last first**; the
|
||||
sixth `recvfrom` argument is a **pointer to the socklen**.
|
||||
* **Buffer/process:** run in the **rdebug process** (ordinary `jump`); no
|
||||
`create_process` and no registration. A child returned `-1` from `socket()`
|
||||
in the one attempt. `malloc` returns a **bit** address; advance the
|
||||
destination by `n*8`, not `n`. Keep the receive buffer (2048 B) and the
|
||||
`from`/`fromlen`/ACK cells disjoint — a `0x800` bit offset is only 256 bytes.
|
||||
* **Verified:** 600 B fetched into the malloc buffer at `0x0095bbd0`, server
|
||||
RRQ `15:23:48 ... requested 'dwt/tcpip/probe.bin'`, and `peek`/`cmp` match
|
||||
byte-for-byte (sha256 `9662e62b…333359`). The payload returns 0; rdebug stays
|
||||
live.
|
||||
* **Hand-off:** the fetched buffer's bit address and byte length go straight
|
||||
into the descriptor at `0x01882C00` (`magic 4C44/5231, buf, len, mode=1`),
|
||||
then `calla 01880000h` with `A8=0` or the descriptor address. The transport
|
||||
scratch is below `0x01880000` (recv `01876000`, `from` `0187A000`, `fromlen`
|
||||
`0187A080`, ACK `0187A100`), so it does not collide with the loader page
|
||||
`01880000`–`01883200`.
|
||||
@@ -0,0 +1,251 @@
|
||||
# VT1200 TCP/IP and a working TFTP fetch
|
||||
|
||||
Date: 2026-10-18. Firmware `vt1200_v22.bin` md5
|
||||
`b46a3e442ccb86134d2356bd70d22fd2` (**unmodified**). No driver edits, no ROM
|
||||
patch. The emulator ran the documented `VT1200_SKIP_LEVEL1=1` divergence with a
|
||||
private `-cfg_directory`/`-nvram_directory`, the LANCE on `taptun`, BOOTP from a
|
||||
private server, and `dwt/tcpip/probe.bin` served over TFTP.
|
||||
|
||||
**Result:** a payload (`dwt/tcpip/tftpc.asm`) fetched a 600-byte file from
|
||||
`192.168.99.1:69` into a `malloc`'d buffer, in the **rdebug process** (ordinary
|
||||
`jump`, no `create_process`), and `peek` returned it byte-for-byte:
|
||||
|
||||
```
|
||||
stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5
|
||||
OK: 600 bytes at 0x0095bbd0 match dwt/tcpip/probe.bin
|
||||
sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359
|
||||
```
|
||||
|
||||
Server-side RRQ (fresh server log for that run):
|
||||
|
||||
```
|
||||
15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes)
|
||||
```
|
||||
|
||||
The firmware's own `tftp_open` is **not usable from the rdebug process**: it
|
||||
never returns and emits no RRQ (details in §3). The fetch is therefore a
|
||||
minimal RFC 783 client built on the firmware's socket API — the allowed
|
||||
fallback, not a mock.
|
||||
|
||||
---
|
||||
|
||||
## 1. Stack architecture
|
||||
|
||||
TCP/IP is an **in-process library with a kernel-lock wrapper**, not a separate
|
||||
service with an IPC protocol. Every socket call is an ordinary ROM function
|
||||
taking stack arguments in the firmware convention:
|
||||
|
||||
```
|
||||
MOVE A14,-*SP,1 ; reserve the slot the callee restores
|
||||
MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument first, upward via A14
|
||||
...
|
||||
MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last
|
||||
CALLA target
|
||||
```
|
||||
|
||||
The wrappers take the per-process lock at `[@0x1B3900]+0x1C1` and dispatch
|
||||
through the kernel entry, but from the caller's point of view they are library
|
||||
calls: no registration, no service name, and no X-style attach. The arguments
|
||||
are the normal BSD socket arguments; `struct sockaddr` is a 16-byte
|
||||
`{u16 family; u16 port; u32 addr; u8 zero[8]}` in **network byte order** (the
|
||||
firmware calls `htons(69)` itself in `tftp_open`).
|
||||
|
||||
### Verified entry points
|
||||
|
||||
| function | bit address | Ghidra | ABI (source order) | status |
|
||||
|---|---|---|---|---|
|
||||
| `socket` | `3F5C9A00` | `07EB9340` | `socket(domain, type, protocol)` -> fd | **verified live**, returns 1 |
|
||||
| `bind` | `3F5CAA80` | `07EB9550` | `bind(fd, sockaddr*, len)` | from the BOOTP caller |
|
||||
| `listen` | `3F5CBCD0` | `07EB979A` | `listen(fd, backlog)` | from inetd (`backlog=5`) |
|
||||
| `accept` | `3F5CCB40` | `07EB9968` | `accept(fd, sockaddr*, len*)` | from inetd (`NULL,NULL`) |
|
||||
| `sendto` | `3F5D3D70` | `07EBA7AE` | `sendto(fd, buf, len, flags, to, tolen)` -> n | **verified live** (28-byte RRQ) |
|
||||
| `recvfrom` | `3F5D7D50` | `07EBAFAA` | `recvfrom(fd, buf, len, flags, &from, &fromlen)` -> n | **verified live** (516/92-byte DATA) |
|
||||
| `read` | `3F5D8E70` | `07EBB1CE` | `read(fd, buf, len)` | the rdebug/X read wrapper named in the brief |
|
||||
| `close` | `3F5E8930` | `07EBD126` | `close(fd)` | **verified live** |
|
||||
| `setsockopt` | `3F5DD260` | `07EBBA4C` | `setsockopt(fd, level, name, val*, len)` | from the BOOTP/X callers |
|
||||
| `select` (candidate) | `3F871CE0` | `07F0E39C` | `select(nfds, r, w, e, timeout)` | wrapper used by Xlib; not exercised |
|
||||
| `malloc` | `3F701230` | `07EE0246` | `malloc(bytes)` -> **bit** pointer | **verified live** |
|
||||
| `create_process` | `3F706A40` | `07EE0D48` | `create_process(entry,name,stack,1,arg)` | known from the GUI work |
|
||||
|
||||
`connect` was not needed and is not in this table: the fetch uses UDP
|
||||
`sendto`/`recvfrom` only. The candidates in the same wrapper block
|
||||
(`3F5CF8B0`, `3F5E43F0`) were not exercised, so no ABI is claimed for them.
|
||||
|
||||
`recvfrom`'s sixth argument is a **pointer to a `socklen_t`**, and the caller
|
||||
must initialise it to 16 before the call. Its fifth argument is a pointer to
|
||||
the source `sockaddr`. That is exactly how the firmware's own `tftp_read`
|
||||
passes them (`&0x1CB8A0` / `&0x1CB920`).
|
||||
|
||||
---
|
||||
|
||||
## 2. Per-process requirements
|
||||
|
||||
* **rdebug process: works.** `socket`, `sendto` and `recvfrom` all return
|
||||
normally from the process the `jump` handler runs in. The fd is process-local
|
||||
(`socket` returned 1 in that process).
|
||||
* **No network context or registration is needed.** The terminal already has
|
||||
its address (BOOTP) and the stack is up; the calls are plain library calls.
|
||||
* **`create_process` child:** one attempt (`dwt/tcpip/launcher.asm` +
|
||||
`socktest.asm`) returned `-1` from `socket()` (`sfd=FFFFFFFF`) even though the
|
||||
PCB was valid (`pcb=003FFBD0`) and the child had started (`stage=2`). The
|
||||
machine then went into the boot delay loop. That is **not** a clean child
|
||||
result, but it is enough to say the working context here is the rdebug
|
||||
process, not a child. Do not assume the X result (`create_process` is needed)
|
||||
transfers to sockets; it did not in this test.
|
||||
|
||||
---
|
||||
|
||||
## 3. The firmware TFTP client (why it was not used)
|
||||
|
||||
The client is `dwt_tftp.c` compiled into ROM:
|
||||
|
||||
| function | bit address | Ghidra | ABI |
|
||||
|---|---|---|---|
|
||||
| `tftp_open` | `3F5EBC40` | `07EBD788` | `tftp_open(host, filename)` -> fd, or `-1` |
|
||||
| `tftp_read` | `3F5ED230` | `07EBDA46` | `tftp_read(fd, buf, bufsize)` -> DATA payload length, `0` at EOF, `-1` error |
|
||||
| `tftp_close` | `3F5EC860` | `07EBD90C` | `tftp_close(fd)` |
|
||||
|
||||
`tftp_open` does, in order: `socket(2,2,0)`, `memset` a 16-byte `sockaddr`,
|
||||
`sa_family=2`, resolve the host (`3F5933D0`; on `-1` it retries through
|
||||
`3F5B8580`), `htons(69)` into the port, build the RRQ in its static buffer
|
||||
(`0x1C85A0`) with mode `octet`, and `sendto`. It returns the fd.
|
||||
|
||||
`tftp_read` receives into its own static buffer `0x1CB960` with length `0x204`,
|
||||
checks opcode/block, copies `len-4` bytes to the caller's `buf`, ACKs, and sets
|
||||
`@0x1CB940=1` when the block was shorter than 512. **Read until it returns 0**;
|
||||
if the caller stops after a full 512-byte block, `tftp_close` sends TFTP ERROR 3
|
||||
("Disk full or allocation exceeded") — the behaviour documented in
|
||||
`harness/mame/FONT_STORAGE_REPORT.md`.
|
||||
|
||||
**Why it is unusable:** calling `tftp_open("192.168.99.1","…")` from the rdebug
|
||||
process never returns and produces no RRQ. `socket()` alone works (proved with
|
||||
`socktest.asm`: fd 1), so the hang is downstream; a direct call to the resolver
|
||||
`3F5933D0` also wedged the service and the machine fell into the boot delay
|
||||
loop. The exact resolver failure was not reduced further, because the socket
|
||||
API is sufficient and the fallback is legitimate. **Do not call `tftp_open`
|
||||
from a payload on this image.**
|
||||
|
||||
---
|
||||
|
||||
## 4. The working fetch
|
||||
|
||||
Payload: `dwt/tcpip/tftpc.asm`, built by `dwt/tcpip/build.sh` to
|
||||
`dwt/tcpip/build/tftpc.bin` (694 bytes, linked at bit `01870000`).
|
||||
|
||||
It is a minimal RFC 783 client:
|
||||
|
||||
1. `buf = malloc(0x10000)`; keep the returned **bit** pointer in `a11`.
|
||||
2. `fd = socket(2,2,0)`; keep it in `a9`.
|
||||
3. `sendto(fd, RRQ, 28, 0, &server, 16)`, where the RRQ is
|
||||
`dwt/tcpip/probe.bin` in `octet` mode and `server` is
|
||||
`{AF_INET, htons(69), 192.168.99.1}`.
|
||||
4. `recvfrom(fd, recv, 2048, 0, &from, &fromlen)`; accept only opcode 3
|
||||
(`00 03` on the wire, read as the 16-bit word `0x0300`).
|
||||
5. Copy `len-4` payload bytes to `buf`, send ACK `00 04 <block>` to the
|
||||
`from` address returned by `recvfrom`, advance `buf` by `(len-4)*8` **bits**.
|
||||
6. Repeat while the block was full (512); a short block ends the transfer.
|
||||
`close(fd)`.
|
||||
|
||||
Evidence:
|
||||
|
||||
```
|
||||
# server (dwt/tcpip/serve_probe.py, fresh log)
|
||||
15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes)
|
||||
|
||||
# MAME-side markers (probe.lua)
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=00B5BCD0 ctotal=00000258 \
|
||||
clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
|
||||
# rdebug peek + byte comparison (dwt/tcpip/verify.py)
|
||||
stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5
|
||||
OK: 600 bytes at 0x0095bbd0 match dwt/tcpip/probe.bin
|
||||
sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359
|
||||
|
||||
$ cmp dwt/tcpip/run/fetched.bin dwt/tcpip/probe.bin
|
||||
(no output = identical)
|
||||
```
|
||||
|
||||
`ctotal` counts the 512-byte block 1 plus the 88-byte block 2; `clast=0x5C`
|
||||
is the 92-byte DATA packet (88 + 4-byte header); `cblock=0x0200` is the wire
|
||||
word for block 2 (bytes `00 02`).
|
||||
|
||||
The payload returns 0, so the same rdebug connection and later connections are
|
||||
still live. No breakpoints, no ROM patch, no `create_process`.
|
||||
|
||||
### The two bugs that cost the debugging cycles
|
||||
|
||||
1. **Pointers are bit addresses.** After copying `n` bytes, the destination
|
||||
cursor must advance by `n*8`. Adding `n` puts block 2 at `dest+64` for a
|
||||
512-byte block, which looks like a copy corruption.
|
||||
2. **The receive buffer and the `from` sockaddr must not overlap.** A bit
|
||||
offset of `0x800` is 256 bytes, not 2048: with the receive buffer at
|
||||
`0187B000`, `from=0187B800` sat 256 bytes into the 2048-byte buffer and the
|
||||
stack's `from` write corrupted the payload at offset 252. The working layout
|
||||
is recv `01876000` (2048 bytes), `from` `0187A000`, `fromlen` `0187A080`,
|
||||
ACK `0187A100`.
|
||||
|
||||
---
|
||||
|
||||
## 5. What a loader must do to fetch a COFF at runtime
|
||||
|
||||
1. Deliver a small bootstrap with rdebug `poke` + `jump` (or `create_process` if
|
||||
a child is needed for the loader itself).
|
||||
2. In the rdebug process: `malloc(size)` for the COFF, then `socket(2,2,0)`,
|
||||
`sendto` an RRQ for the COFF name, and the `recvfrom`/ACK loop from
|
||||
`tftpc.asm`. Use a receive buffer of at least 2048 bytes, separate from the
|
||||
`from`/`fromlen`/ACK cells.
|
||||
3. Append blocks at `dest + total*8` bits, not `dest + total`.
|
||||
4. Stop on a short block; `close(fd)`. No timeout is built in — the server is
|
||||
local and the payload blocks in `recvfrom`. Add `setsockopt(SO_RCVTIMEO)` or
|
||||
a retry if a lossy link matters.
|
||||
5. Hand the buffer to the loader resident at bit `01880000`
|
||||
(`dwt/loader/build/loader.bin`, 1220 B): write the descriptor at
|
||||
`01882C00` — `u16 0x4C44, u16 0x5231, u32 buf, u32 len_bytes, u32 mode=1` —
|
||||
then `move a14,-*sp,1; calla 01880000h` with `A8=0` (fixed descriptor) or
|
||||
the descriptor's bit address. The loader parses the COFF, copies
|
||||
`.text`/`.data`, zeroes `.bss` and calls `create_process` itself. The full
|
||||
contract, including the status block at `01882D00`, is in
|
||||
`dwt/notes/LOADER_CROSS.md`.
|
||||
6. Keep the COFF buffer alive; it is not reused by the fetch after the payload
|
||||
returns. The transport's code (`01870000`), argument area (`01875000`),
|
||||
receive buffer (`01876000`–`0187A000`), `from`/`fromlen`/ACK cells
|
||||
(`0187A000`–`0187A120`) and markers (`0187C000`) are all below the loader
|
||||
page, so they do not collide with `01880000`–`01883200`.
|
||||
|
||||
The fetch call itself is only `malloc`/`socket`/`sendto`/`recvfrom`/`close`;
|
||||
the firmware `tftp_open` must not be used.
|
||||
|
||||
---
|
||||
|
||||
## 6. Limits and files
|
||||
|
||||
* **Buffer:** the test allocates 64 KiB; the proof file is 600 bytes. The
|
||||
receive buffer is 2048 bytes and the server's block size is 512, so the
|
||||
largest single DATA packet is 516 bytes. A COFF over TFTP is limited only by
|
||||
the malloc block and the 16-bit block counter (32 MiB at 512-byte blocks).
|
||||
* **Timeouts:** none in the payload; `recvfrom` blocks until a packet arrives.
|
||||
The server side has 10 retries at 60 s. A lost packet hangs the `jump`.
|
||||
* **Concurrency:** the server is single-threaded. An un-ACKed transfer (the
|
||||
first `udptest` left one) blocks later RRQs until it times out; restart the
|
||||
server or use a per-transfer server.
|
||||
* **Process:** rdebug process. A `create_process` child returned `-1` from
|
||||
`socket()` in the one attempt; if the loader is a child, prove `socket()`
|
||||
first.
|
||||
|
||||
| path | contents |
|
||||
|---|---|
|
||||
| `dwt/tcpip/tftpc.asm` | the working minimal TFTP client (694 B, bit `01870000`) |
|
||||
| `dwt/tcpip/build/tftpc.bin`, `.lst`, `.map` | built payload and assembler/link records |
|
||||
| `dwt/tcpip/tfetch.asm` | firmware-`tftp_open` attempt (hangs; kept as the negative result) |
|
||||
| `dwt/tcpip/socktest.asm`, `restest.asm`, `udptest.asm` | the isolation steps: socket, resolver, sendto |
|
||||
| `dwt/tcpip/launcher.asm` | `create_process` launcher used for the child attempt |
|
||||
| `dwt/tcpip/copytest.asm` | isolated byte-copy loop |
|
||||
| `dwt/tcpip/serve_probe.py` | TFTP server for `probe.bin` + BOOTP (imports `harness/serve.py`) |
|
||||
| `dwt/tcpip/probe.bin` | 600-byte distinctive probe file |
|
||||
| `dwt/tcpip/verify.py` | rdebug peek + byte-for-byte comparison |
|
||||
| `dwt/tcpip/probe.lua` | MAME-side marker/PC sampler and buffer check |
|
||||
| `dwt/tcpip/run/server_final.log` | the final RRQ line |
|
||||
| `dwt/tcpip/run/mame_final.log` | final `TCPC` marker line (`ctotal=0x258`) |
|
||||
| `dwt/tcpip/run/final2_verify.log`, `fetched.bin` | peek comparison and the 600 fetched bytes |
|
||||
| `dwt/tcpip/run/inject_tftpc.log`, `inject_res.log`, `inject_child_sock.log` | negative results: `tftp_open`, resolver, child `socket()` |
|
||||
| `dwt/notes/LOADER_CROSS.md` | the loader/transport contract (loader at `01880000`, descriptor at `01882C00`) |
|
||||
@@ -0,0 +1,7 @@
|
||||
# SDK scratch (GSPA/GSPLNK tools and intermediate files)
|
||||
work/
|
||||
__pycache__/
|
||||
|
||||
# MAME runtime state, recreated per run
|
||||
run/cfg/
|
||||
run/nvram/
|
||||
Executable
+70
@@ -0,0 +1,70 @@
|
||||
#!/bin/sh
|
||||
# Build a VT1200 payload with the 1987 TI TMS34010 SDK (GSPA/GSPLNK under
|
||||
# DOSBox). Same flow as dwt/gui/build.sh, but all work/output stays under
|
||||
# dwt/tcpip/.
|
||||
#
|
||||
# dwt/tcpip/build.sh SOURCE.asm [ORIGIN_BITS]
|
||||
#
|
||||
# Output: dwt/tcpip/build/<name>.bin, .map, .lst
|
||||
set -eu
|
||||
|
||||
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
|
||||
DIR=$(cd "$(dirname "$0")" && pwd)
|
||||
SRC=${1:?usage: build.sh SOURCE.asm [ORIGIN_BITS]}
|
||||
ORIGIN=${2:-01870000}
|
||||
NAME=$(basename "$SRC" .asm)
|
||||
BASE=$(printf '%s' "$NAME" | tr 'a-z' 'A-Z')
|
||||
WORK="$DIR/work"
|
||||
OUT="$DIR/build"
|
||||
IMG="$ROOT/tools/tms34010-sdk/1987-05 TMS34010 SDK/1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img"
|
||||
DOSBOX_CONF="$ROOT/harness/sdk-scratch/dosbox-bench.conf"
|
||||
|
||||
mkdir -p "$WORK" "$OUT"
|
||||
|
||||
if [ ! -x "$WORK/GSPA.EXE" ]; then
|
||||
mcopy -s -n -i "$IMG" "::/A2/*" "$WORK/"
|
||||
mcopy -s -n -i "$IMG" "::/C2/*" "$WORK/"
|
||||
fi
|
||||
|
||||
cp "$SRC" "$WORK/$BASE.ASM"
|
||||
|
||||
case "$ORIGIN" in
|
||||
[0-9]*) ;;
|
||||
*) ORIGIN="0$ORIGIN" ;;
|
||||
esac
|
||||
|
||||
printf '%s\n' \
|
||||
'-a' \
|
||||
"-o $BASE.out" \
|
||||
"-m $BASE.map" \
|
||||
"$BASE.obj" \
|
||||
'SECTIONS' \
|
||||
'{' \
|
||||
" .text ${ORIGIN}h: {}" \
|
||||
'}' > "$WORK/$BASE.CMD"
|
||||
sed -i 's/$/\r/' "$WORK/$BASE.CMD"
|
||||
|
||||
rm -f "$WORK/$BASE.OBJ" "$WORK/$BASE.OUT" "$WORK/$BASE.LST" \
|
||||
"$WORK/$BASE.MAP" "$WORK/$BASE.HI" "$WORK/$BASE.LO"
|
||||
|
||||
SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
|
||||
timeout 180 dosbox -conf "$DOSBOX_CONF" -noprimaryconf -nolocalconf \
|
||||
-c "mount c $WORK" -c "c:" \
|
||||
-c "gspa $BASE $BASE.obj $BASE.lst -l" \
|
||||
-c "gsplnk $BASE.cmd" \
|
||||
-c "exit" -exit >/dev/null 2>&1
|
||||
|
||||
if [ ! -f "$WORK/$BASE.OUT" ]; then
|
||||
echo "build.sh: GSPLNK produced no $BASE.OUT" >&2
|
||||
exit 1
|
||||
fi
|
||||
if grep -q '\*\*\*\*\*' "$WORK/$BASE.LST" 2>/dev/null; then
|
||||
echo "build.sh: assembler diagnostics:" >&2
|
||||
grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
python3 "$ROOT/harness/hello-world/cofextract.py" "$WORK/$BASE.OUT" "$OUT/$NAME.bin"
|
||||
sed 's/\r$//' "$WORK/$BASE.MAP" > "$OUT/$NAME.map"
|
||||
cp "$WORK/$BASE.LST" "$OUT/$NAME.lst"
|
||||
echo "build.sh: $OUT/$NAME.bin ($(wc -c < "$OUT/$NAME.bin") bytes) at bit $ORIGIN"
|
||||
Binary file not shown.
@@ -0,0 +1,218 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; copytest.asm -- isolate the byte-copy loop used by tf
|
||||
0002 ;
|
||||
0003 ; malloc(01000h), then copy 256 bytes from SRC (values
|
||||
0004 ; dint/movb/addk/dsjs/eint loop. A peek of the destina
|
||||
0005 ;
|
||||
0006 ; 0187A800 stage (1 entered, 2 copied)
|
||||
0007 ; 0187A820 destination pointer
|
||||
0008 ; 0187A840 entry SP
|
||||
0009 ; 0187A860 entry A14
|
||||
0010
|
||||
0011 00000000 .text
|
||||
0012 00000000 _start:
|
||||
0013 00000000 0550 setf 16, 0, 0
|
||||
0014 00000010 0740 setf 32, 0, 1
|
||||
0015 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0016 00000040 078F move sp, @0187A840h, 1
|
||||
00000050 0187A840
|
||||
0017 00000070 078E move a14, @0187A860h, 1
|
||||
00000080 0187A860
|
||||
0018 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0019 000000D0 0780 move a0, @0187A800h, 1
|
||||
000000E0 0187A800
|
||||
0020
|
||||
0021 00000100 A3CF move a14, -*sp, 1
|
||||
0022 00000110 09EE movi 0187B800h, a14, L
|
||||
00000120 0187B800
|
||||
0023 00000140 09E0 movi 01000h, a0, L
|
||||
00000150 00001000
|
||||
0024 00000170 920E move a0, *a14+, 1
|
||||
0025 00000180 0D5F calla 3F701230h
|
||||
00000190 3F701230
|
||||
0026 000001B0 07AF move @0187A840h, sp, 1
|
||||
000001C0 0187A840
|
||||
0027 000001E0 07AE move @0187A860h, a14, 1
|
||||
000001F0 0187A860
|
||||
0028 00000210 0550 setf 16, 0, 0
|
||||
0029 00000220 0740 setf 32, 0, 1
|
||||
0030 00000230 0788 move a8, @0187A820h, 1
|
||||
00000240 0187A820
|
||||
0031 00000260 4D06 move a8, a6
|
||||
0032
|
||||
0033 00000270 0360 dint
|
||||
0034 00000280 09E5 movi SRC, a5, L
|
||||
00000290 00000400'
|
||||
0035 000002B0 09E2 movi 256, a2, L
|
||||
000002C0 00000100
|
||||
0036 000002E0 copy_bytes:
|
||||
0037 000002E0 8EA0 movb *a5, a0
|
||||
0038 000002F0 8C06 movb a0, *a6
|
||||
0039 00000300 1105 addk 8, a5
|
||||
0040 00000310 1106 addk 8, a6
|
||||
0041 00000320 3CA2 dsjs a2, copy_bytes
|
||||
0042 00000330 0D60 eint
|
||||
0043
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
0044 00000340 09E0 movi 2, a0, L
|
||||
00000350 00000002
|
||||
0045 00000370 0780 move a0, @0187A800h, 1
|
||||
00000380 0187A800
|
||||
0046 000003A0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
000003B0 00FF
|
||||
0047 000003C0 09E8 movi 0, a8, L
|
||||
000003D0 00000000
|
||||
0048 000003F0 0960 rets
|
||||
0049
|
||||
0050 00000400 SRC:
|
||||
0051 00000400 0100 .word 00100h
|
||||
0052 00000410 0302 .word 00302h
|
||||
0053 00000420 0504 .word 00504h
|
||||
0054 00000430 0706 .word 00706h
|
||||
0055 00000440 0908 .word 00908h
|
||||
0056 00000450 0B0A .word 00B0Ah
|
||||
0057 00000460 0D0C .word 00D0Ch
|
||||
0058 00000470 0F0E .word 00F0Eh
|
||||
0059 00000480 1110 .word 01110h
|
||||
0060 00000490 1312 .word 01312h
|
||||
0061 000004A0 1514 .word 01514h
|
||||
0062 000004B0 1716 .word 01716h
|
||||
0063 000004C0 1918 .word 01918h
|
||||
0064 000004D0 1B1A .word 01B1Ah
|
||||
0065 000004E0 1D1C .word 01D1Ch
|
||||
0066 000004F0 1F1E .word 01F1Eh
|
||||
0067 00000500 2120 .word 02120h
|
||||
0068 00000510 2322 .word 02322h
|
||||
0069 00000520 2524 .word 02524h
|
||||
0070 00000530 2726 .word 02726h
|
||||
0071 00000540 2928 .word 02928h
|
||||
0072 00000550 2B2A .word 02B2Ah
|
||||
0073 00000560 2D2C .word 02D2Ch
|
||||
0074 00000570 2F2E .word 02F2Eh
|
||||
0075 00000580 3130 .word 03130h
|
||||
0076 00000590 3332 .word 03332h
|
||||
0077 000005A0 3534 .word 03534h
|
||||
0078 000005B0 3736 .word 03736h
|
||||
0079 000005C0 3938 .word 03938h
|
||||
0080 000005D0 3B3A .word 03B3Ah
|
||||
0081 000005E0 3D3C .word 03D3Ch
|
||||
0082 000005F0 3F3E .word 03F3Eh
|
||||
0083 00000600 4140 .word 04140h
|
||||
0084 00000610 4342 .word 04342h
|
||||
0085 00000620 4544 .word 04544h
|
||||
0086 00000630 4746 .word 04746h
|
||||
0087 00000640 4948 .word 04948h
|
||||
0088 00000650 4B4A .word 04B4Ah
|
||||
0089 00000660 4D4C .word 04D4Ch
|
||||
0090 00000670 4F4E .word 04F4Eh
|
||||
0091 00000680 5150 .word 05150h
|
||||
0092 00000690 5352 .word 05352h
|
||||
0093 000006A0 5554 .word 05554h
|
||||
0094 000006B0 5756 .word 05756h
|
||||
0095 000006C0 5958 .word 05958h
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 3
|
||||
|
||||
0096 000006D0 5B5A .word 05B5Ah
|
||||
0097 000006E0 5D5C .word 05D5Ch
|
||||
0098 000006F0 5F5E .word 05F5Eh
|
||||
0099 00000700 6160 .word 06160h
|
||||
0100 00000710 6362 .word 06362h
|
||||
0101 00000720 6564 .word 06564h
|
||||
0102 00000730 6766 .word 06766h
|
||||
0103 00000740 6968 .word 06968h
|
||||
0104 00000750 6B6A .word 06B6Ah
|
||||
0105 00000760 6D6C .word 06D6Ch
|
||||
0106 00000770 6F6E .word 06F6Eh
|
||||
0107 00000780 7170 .word 07170h
|
||||
0108 00000790 7372 .word 07372h
|
||||
0109 000007A0 7574 .word 07574h
|
||||
0110 000007B0 7776 .word 07776h
|
||||
0111 000007C0 7978 .word 07978h
|
||||
0112 000007D0 7B7A .word 07B7Ah
|
||||
0113 000007E0 7D7C .word 07D7Ch
|
||||
0114 000007F0 7F7E .word 07F7Eh
|
||||
0115 00000800 8180 .word 08180h
|
||||
0116 00000810 8382 .word 08382h
|
||||
0117 00000820 8584 .word 08584h
|
||||
0118 00000830 8786 .word 08786h
|
||||
0119 00000840 8988 .word 08988h
|
||||
0120 00000850 8B8A .word 08B8Ah
|
||||
0121 00000860 8D8C .word 08D8Ch
|
||||
0122 00000870 8F8E .word 08F8Eh
|
||||
0123 00000880 9190 .word 09190h
|
||||
0124 00000890 9392 .word 09392h
|
||||
0125 000008A0 9594 .word 09594h
|
||||
0126 000008B0 9796 .word 09796h
|
||||
0127 000008C0 9998 .word 09998h
|
||||
0128 000008D0 9B9A .word 09B9Ah
|
||||
0129 000008E0 9D9C .word 09D9Ch
|
||||
0130 000008F0 9F9E .word 09F9Eh
|
||||
0131 00000900 A1A0 .word 0A1A0h
|
||||
0132 00000910 A3A2 .word 0A3A2h
|
||||
0133 00000920 A5A4 .word 0A5A4h
|
||||
0134 00000930 A7A6 .word 0A7A6h
|
||||
0135 00000940 A9A8 .word 0A9A8h
|
||||
0136 00000950 ABAA .word 0ABAAh
|
||||
0137 00000960 ADAC .word 0ADACh
|
||||
0138 00000970 AFAE .word 0AFAEh
|
||||
0139 00000980 B1B0 .word 0B1B0h
|
||||
0140 00000990 B3B2 .word 0B3B2h
|
||||
0141 000009A0 B5B4 .word 0B5B4h
|
||||
0142 000009B0 B7B6 .word 0B7B6h
|
||||
0143 000009C0 B9B8 .word 0B9B8h
|
||||
0144 000009D0 BBBA .word 0BBBAh
|
||||
0145 000009E0 BDBC .word 0BDBCh
|
||||
0146 000009F0 BFBE .word 0BFBEh
|
||||
0147 00000A00 C1C0 .word 0C1C0h
|
||||
0148 00000A10 C3C2 .word 0C3C2h
|
||||
0149 00000A20 C5C4 .word 0C5C4h
|
||||
0150 00000A30 C7C6 .word 0C7C6h
|
||||
0151 00000A40 C9C8 .word 0C9C8h
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 4
|
||||
|
||||
0152 00000A50 CBCA .word 0CBCAh
|
||||
0153 00000A60 CDCC .word 0CDCCh
|
||||
0154 00000A70 CFCE .word 0CFCEh
|
||||
0155 00000A80 D1D0 .word 0D1D0h
|
||||
0156 00000A90 D3D2 .word 0D3D2h
|
||||
0157 00000AA0 D5D4 .word 0D5D4h
|
||||
0158 00000AB0 D7D6 .word 0D7D6h
|
||||
0159 00000AC0 D9D8 .word 0D9D8h
|
||||
0160 00000AD0 DBDA .word 0DBDAh
|
||||
0161 00000AE0 DDDC .word 0DDDCh
|
||||
0162 00000AF0 DFDE .word 0DFDEh
|
||||
0163 00000B00 E1E0 .word 0E1E0h
|
||||
0164 00000B10 E3E2 .word 0E3E2h
|
||||
0165 00000B20 E5E4 .word 0E5E4h
|
||||
0166 00000B30 E7E6 .word 0E7E6h
|
||||
0167 00000B40 E9E8 .word 0E9E8h
|
||||
0168 00000B50 EBEA .word 0EBEAh
|
||||
0169 00000B60 EDEC .word 0EDECh
|
||||
0170 00000B70 EFEE .word 0EFEEh
|
||||
0171 00000B80 F1F0 .word 0F1F0h
|
||||
0172 00000B90 F3F2 .word 0F3F2h
|
||||
0173 00000BA0 F5F4 .word 0F5F4h
|
||||
0174 00000BB0 F7F6 .word 0F7F6h
|
||||
0175 00000BC0 F9F8 .word 0F9F8h
|
||||
0176 00000BD0 FBFA .word 0FBFAh
|
||||
0177 00000BE0 FDFC .word 0FDFCh
|
||||
0178 00000BF0 FFFE .word 0FFFEh
|
||||
0179 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:19:40 2026
|
||||
|
||||
OUTPUT FILE NAME: <COPYTEST.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01878000 00000C00
|
||||
01878000 00000C00 COPYTEST.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01878000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01878000 .text
|
||||
01878C00 etext 01878C00 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,86 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; launcher.asm -- run tfetch.bin as a first-class proce
|
||||
0002 ;
|
||||
0003 ; The rdebug `jump` runs in the "remote debug" process.
|
||||
0004 ; (dwt/notes/GUI_APPS.md section 10) showed that a serv
|
||||
0005 ; from that context is accepted but never completed; a
|
||||
0006 ; works. This launcher is the same shape as dwt/gui/xl
|
||||
0007 ;
|
||||
0008 ; create_process(entry, name, stack_size, 1, arg)
|
||||
0009 ;
|
||||
0010 ; create_process = bit 3F706A40h (Ghidra 07EE0D48)
|
||||
0011 ;
|
||||
0012 ; The child runs tfetch.bin, linked at bit 01870000h.
|
||||
0013 ;
|
||||
0014 ; Evidence cells (32-bit, bit addresses):
|
||||
0015 ; 01872500 stage (1 entered, 2 create_process return
|
||||
0016 ; 01872520 PCB returned by create_process (0 = failu
|
||||
0017 ; 01872540 entry-point argument (poked by the host,
|
||||
0018
|
||||
0019 00000000 .text
|
||||
0020 00000000 _start:
|
||||
0021 00000000 0550 setf 16, 0, 0
|
||||
0022 00000010 0740 setf 32, 0, 1
|
||||
0023 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0024 00000040 078F move sp, @01872700h, 1 ; entry SP
|
||||
00000050 01872700
|
||||
0025 00000070 078E move a14, @01872720h, 1 ; entry A14
|
||||
00000080 01872720
|
||||
0026
|
||||
0027 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0028 000000D0 0780 move a0, @01872500h, 1
|
||||
000000E0 01872500
|
||||
0029
|
||||
0030 00000100 A3CF move a14, -*sp, 1
|
||||
0031 00000110 09EE movi 01872800h, a14, L ; argument area
|
||||
00000120 01872800
|
||||
0032 00000140 09E0 movi 0, a0, L
|
||||
00000150 00000000
|
||||
0033 00000170 920E move a0, *a14+, 1 ; arg4 = 0
|
||||
0034 00000180 09E0 movi 1, a0, L
|
||||
00000190 00000001
|
||||
0035 000001B0 920E move a0, *a14+, 1 ; arg3 = 1
|
||||
0036 000001C0 09E0 movi 04000h, a0, L ; 16 KiB stack
|
||||
000001D0 00004000
|
||||
0037 000001F0 920E move a0, *a14+, 1 ; arg2 = stack size
|
||||
0038 00000200 09E0 movi 3F30DC00h, a0, L ; ROM "0::0", any short name
|
||||
00000210 3F30DC00
|
||||
0039 00000230 920E move a0, *a14+, 1 ; arg1 = name
|
||||
0040 00000240 07A0 move @01872540h, a0, 1 ; arg0 = entry, poked at run ti
|
||||
00000250 01872540
|
||||
0041 00000270 920E move a0, *a14+, 1 ; (little-endian bit address)
|
||||
0042 00000280 0D5F calla 3F706A40h ; create_process
|
||||
00000290 3F706A40
|
||||
0043 000002B0 07AF move @01872700h, sp, 1
|
||||
000002C0 01872700
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
0044 000002E0 07AE move @01872720h, a14, 1
|
||||
000002F0 01872720
|
||||
0045 00000310 0550 setf 16, 0, 0
|
||||
0046 00000320 0740 setf 32, 0, 1
|
||||
0047
|
||||
0048 00000330 0788 move a8, @01872520h, 1 ; PCB marker
|
||||
00000340 01872520
|
||||
0049 00000360 09E0 movi 2, a0, L
|
||||
00000370 00000002
|
||||
0050 00000390 0780 move a0, @01872500h, 1 ; stage = 2
|
||||
000003A0 01872500
|
||||
0051
|
||||
0052 000003C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
000003D0 00FF
|
||||
0053 000003E0 09E8 movi 0, a8, L
|
||||
000003F0 00000000
|
||||
0054 00000410 0960 rets
|
||||
0055 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:13:38 2026
|
||||
|
||||
OUTPUT FILE NAME: <LAUNCHER.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01872000 00000420
|
||||
01872000 00000420 LAUNCHER.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01872000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01872000 .text
|
||||
01872420 etext 01872420 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,105 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; restest.asm -- socket() then the resolver tftp_open u
|
||||
0002 ;
|
||||
0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
0004 ; resolve = 3F5933D0h resolve("192.168.99.1") -> -
|
||||
0005 ;
|
||||
0006 ; Evidence cells (32-bit, bit addresses):
|
||||
0007 ; 01875800 stage (1 entered, 2 socket returned, 3 re
|
||||
0008 ; 01875820 socket() fd
|
||||
0009 ; 01875840 resolver return
|
||||
0010 ; 01875A00 entry SP
|
||||
0011 ; 01875A20 entry A14
|
||||
0012
|
||||
0013 00000000 .text
|
||||
0014 00000000 _start:
|
||||
0015 00000000 0550 setf 16, 0, 0
|
||||
0016 00000010 0740 setf 32, 0, 1
|
||||
0017 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0018 00000040 078F move sp, @01875A00h, 1
|
||||
00000050 01875A00
|
||||
0019 00000070 078E move a14, @01875A20h, 1
|
||||
00000080 01875A20
|
||||
0020
|
||||
0021 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0022 000000D0 0780 move a0, @01875800h, 1
|
||||
000000E0 01875800
|
||||
0023
|
||||
0024 ; socket(2,2,0)
|
||||
0025 00000100 09EE movi 01875900h, a14, L
|
||||
00000110 01875900
|
||||
0026 00000130 09E0 movi 0, a0, L
|
||||
00000140 00000000
|
||||
0027 00000160 920E move a0, *a14+, 1
|
||||
0028 00000170 09E0 movi 2, a0, L
|
||||
00000180 00000002
|
||||
0029 000001A0 920E move a0, *a14+, 1
|
||||
0030 000001B0 09E0 movi 2, a0, L
|
||||
000001C0 00000002
|
||||
0031 000001E0 920E move a0, *a14+, 1
|
||||
0032 000001F0 0D5F calla 3F5C9A00h
|
||||
00000200 3F5C9A00
|
||||
0033 00000220 07AF move @01875A00h, sp, 1
|
||||
00000230 01875A00
|
||||
0034 00000250 07AE move @01875A20h, a14, 1
|
||||
00000260 01875A20
|
||||
0035 00000280 0550 setf 16, 0, 0
|
||||
0036 00000290 0740 setf 32, 0, 1
|
||||
0037 000002A0 0788 move a8, @01875820h, 1 ; fd
|
||||
000002B0 01875820
|
||||
0038 000002D0 4D09 move a8, a9
|
||||
0039
|
||||
0040 000002E0 09E0 movi 2, a0, L
|
||||
000002F0 00000002
|
||||
0041 00000310 0780 move a0, @01875800h, 1
|
||||
00000320 01875800
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
0042
|
||||
0043 ; resolve("192.168.99.1")
|
||||
0044 00000340 09EE movi 01875900h, a14, L
|
||||
00000350 01875900
|
||||
0045 00000370 09E0 movi HOST, a0, L
|
||||
00000380 00000550'
|
||||
0046 000003A0 920E move a0, *a14+, 1
|
||||
0047 000003B0 0D5F calla 3F5933D0h
|
||||
000003C0 3F5933D0
|
||||
0048 000003E0 07AF move @01875A00h, sp, 1
|
||||
000003F0 01875A00
|
||||
0049 00000410 07AE move @01875A20h, a14, 1
|
||||
00000420 01875A20
|
||||
0050 00000440 0550 setf 16, 0, 0
|
||||
0051 00000450 0740 setf 32, 0, 1
|
||||
0052 00000460 0788 move a8, @01875840h, 1
|
||||
00000470 01875840
|
||||
0053
|
||||
0054 00000490 09E0 movi 3, a0, L
|
||||
000004A0 00000003
|
||||
0055 000004C0 0780 move a0, @01875800h, 1
|
||||
000004D0 01875800
|
||||
0056 000004F0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000500 00FF
|
||||
0057 00000510 09E8 movi 0, a8, L
|
||||
00000520 00000000
|
||||
0058 00000540 0960 rets
|
||||
0059
|
||||
0060 00000550 HOST:
|
||||
0061 00000550 3931 .word 03931h
|
||||
0062 00000560 2E32 .word 02E32h
|
||||
0063 00000570 3631 .word 03631h
|
||||
0064 00000580 2E38 .word 02E38h
|
||||
0065 00000590 3939 .word 03939h
|
||||
0066 000005A0 312E .word 0312Eh
|
||||
0067 000005B0 0000 .word 00000h
|
||||
0068 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:12:36 2026
|
||||
|
||||
OUTPUT FILE NAME: <RESTEST.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01875000 000005C0
|
||||
01875000 000005C0 RESTEST.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01875000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01875000 .text
|
||||
018755C0 etext 018755C0 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,75 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; socktest.asm -- call the firmware's socket() wrapper
|
||||
0002 ;
|
||||
0003 ; Isolates the first call tftp_open makes. Run with rd
|
||||
0004 ; remote-debug process (or from a create_process child)
|
||||
0005 ; socket API is usable in that context.
|
||||
0006 ;
|
||||
0007 ; socket = bit 3F5C9A00h (Ghidra 07EB9340)
|
||||
0008 ; socket(domain, type, protocol) = socket(2, 2, 0)
|
||||
0009 ;
|
||||
0010 ; Evidence cells (32-bit, bit addresses):
|
||||
0011 ; 01874000 stage (1 entered, 2 socket returned)
|
||||
0012 ; 01874020 socket() return (fd, or a negative errno)
|
||||
0013 ; 01874200 entry SP
|
||||
0014 ; 01874220 entry A14
|
||||
0015
|
||||
0016 00000000 .text
|
||||
0017 00000000 _start:
|
||||
0018 00000000 0550 setf 16, 0, 0
|
||||
0019 00000010 0740 setf 32, 0, 1
|
||||
0020 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0021 00000040 078F move sp, @01874200h, 1
|
||||
00000050 01874200
|
||||
0022 00000070 078E move a14, @01874220h, 1
|
||||
00000080 01874220
|
||||
0023
|
||||
0024 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0025 000000D0 0780 move a0, @01874000h, 1
|
||||
000000E0 01874000
|
||||
0026
|
||||
0027 00000100 09EE movi 01873800h, a14, L
|
||||
00000110 01873800
|
||||
0028 00000130 09E0 movi 0, a0, L
|
||||
00000140 00000000
|
||||
0029 00000160 920E move a0, *a14+, 1 ; arg2 = protocol
|
||||
0030 00000170 09E0 movi 2, a0, L
|
||||
00000180 00000002
|
||||
0031 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
||||
0032 000001B0 09E0 movi 2, a0, L
|
||||
000001C0 00000002
|
||||
0033 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET
|
||||
0034 000001F0 0D5F calla 3F5C9A00h ; socket
|
||||
00000200 3F5C9A00
|
||||
0035 00000220 07AF move @01874200h, sp, 1
|
||||
00000230 01874200
|
||||
0036 00000250 07AE move @01874220h, a14, 1
|
||||
00000260 01874220
|
||||
0037 00000280 0550 setf 16, 0, 0
|
||||
0038 00000290 0740 setf 32, 0, 1
|
||||
0039 000002A0 0788 move a8, @01874020h, 1
|
||||
000002B0 01874020
|
||||
0040
|
||||
0041 000002D0 09E0 movi 2, a0, L
|
||||
000002E0 00000002
|
||||
0042 00000300 0780 move a0, @01874000h, 1
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
00000310 01874000
|
||||
0043 00000330 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000340 00FF
|
||||
0044 00000350 09E8 movi 0, a8, L
|
||||
00000360 00000000
|
||||
0045 00000380 0960 rets
|
||||
0046 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:12:14 2026
|
||||
|
||||
OUTPUT FILE NAME: <SOCKTEST.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01873000 00000390
|
||||
01873000 00000390 SOCKTEST.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01873000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01873000 .text
|
||||
01873390 etext 01873390 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,218 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; tftp_fetch.asm -- fetch a file over TFTP into a mallo
|
||||
0002 ; firmware's own client (dwt_tftp.c in ROM).
|
||||
0003 ;
|
||||
0004 ; Linked at bit 01870000h (byte 0x30E000) and executed
|
||||
0005 ; call. The payload follows the firmware's stack-argum
|
||||
0006 ;
|
||||
0007 ; MOVE A14,-*SP,1 ; reserve the slo
|
||||
0008 ; MOVE argN,*A14+,1 ; last argument f
|
||||
0009 ; MOVE arg0,*A14+,1 ; first argument
|
||||
0010 ; CALLA target
|
||||
0011 ;
|
||||
0012 ; We point A14 at a fixed argument area and restore SP/
|
||||
0013 ; entry values after every call, so a payload bug canno
|
||||
0014 ; stack. a9 and a11 are callee-saved by tftp_open/tftp
|
||||
0015 ; hold the fd and the current write pointer across call
|
||||
0016 ;
|
||||
0017 ; Firmware entry points (bit addresses; Ghidra = bit >>
|
||||
0018 ; malloc 3F701230h (Ghidra 07EE0246) malloc(by
|
||||
0019 ; tftp_open 3F5EBC40h (Ghidra 07EBD788) tftp_open
|
||||
0020 ; tftp_read 3F5ED230h (Ghidra 07EBDA46) tftp_read
|
||||
0021 ; tftp_close 3F5EC860h (Ghidra 07EBD90C) tftp_clos
|
||||
0022 ;
|
||||
0023 ; tftp_read returns the DATA payload length, and 0 once
|
||||
0024 ; has been consumed. tftp_close sends TFTP ERROR 3 if
|
||||
0025 ; a full 512 bytes, so the loop must read until it gets
|
||||
0026 ;
|
||||
0027 ; Evidence cells (32-bit, bit addresses; peeked over rd
|
||||
0028 ; 01871000 stage (1 malloc, 2 open, 3 reading, 4 cl
|
||||
0029 ; 01871020 fd
|
||||
0030 ; 01871040 buffer pointer (returned by malloc; a BIT
|
||||
0031 ; 01871060 total bytes fetched
|
||||
0032 ; 01871080 last tftp_read return
|
||||
0033 ; 018710A0 marker: 05A5A5A5h when the fetch complete
|
||||
0034 ; 018710C0 tftp_close return scratch
|
||||
0035 ; 01871200 entry SP
|
||||
0036 ; 01871220 entry A14
|
||||
0037 ;
|
||||
0038 ; The fetched bytes are at [01871040] and are compared
|
||||
0039 ; The marker cells are deliberately above 01870AD0 (the
|
||||
0040 ; writing them into the code was the first, silent fail
|
||||
0041
|
||||
0042 00000000 .text
|
||||
0043 00000000 _start:
|
||||
0044 00000000 0550 setf 16, 0, 0
|
||||
0045 00000010 0740 setf 32, 0, 1
|
||||
0046 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0047 00000040 078F move sp, @01871200h, 1 ; entry SP
|
||||
00000050 01871200
|
||||
0048 00000070 078E move a14, @01871220h, 1 ; entry A14
|
||||
00000080 01871220
|
||||
0049
|
||||
0050 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0051 000000D0 0780 move a0, @01871000h, 1 ; stage = 1
|
||||
000000E0 01871000
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
0052
|
||||
0053 ; ---- buf = malloc(010000h) -------------------------
|
||||
0054 00000100 A3CF move a14, -*sp, 1
|
||||
0055 00000110 09EE movi 01878000h, a14, L ; argument area
|
||||
00000120 01878000
|
||||
0056 00000140 09E0 movi 010000h, a0, L ; 65536 bytes
|
||||
00000150 00010000
|
||||
0057 00000170 920E move a0, *a14+, 1
|
||||
0058 00000180 0D5F calla 3F701230h ; malloc
|
||||
00000190 3F701230
|
||||
0059 000001B0 07AF move @01871200h, sp, 1
|
||||
000001C0 01871200
|
||||
0060 000001E0 07AE move @01871220h, a14, 1
|
||||
000001F0 01871220
|
||||
0061 00000210 0550 setf 16, 0, 0
|
||||
0062 00000220 0740 setf 32, 0, 1
|
||||
0063 00000230 0788 move a8, @01871040h, 1 ; buffer pointer (bit address)
|
||||
00000240 01871040
|
||||
0064 00000260 4D0B move a8, a11
|
||||
0065 00000270 4D08 move a8, a8
|
||||
0066 00000280 CA6A jreq fail
|
||||
0067
|
||||
0068 00000290 09E0 movi 2, a0, L
|
||||
000002A0 00000002
|
||||
0069 000002C0 0780 move a0, @01871000h, 1 ; stage = 2
|
||||
000002D0 01871000
|
||||
0070
|
||||
0071 ; ---- fd = tftp_open("192.168.99.1", "dwt/tcpip/probe
|
||||
0072 000002F0 09EE movi 01878000h, a14, L ; argument area
|
||||
00000300 01878000
|
||||
0073 00000320 09E0 movi FNAME, a0, L
|
||||
00000330 00000A60'
|
||||
0074 00000350 920E move a0, *a14+, 1 ; arg1 = filename
|
||||
0075 00000360 09E0 movi HOST, a0, L
|
||||
00000370 000009F0'
|
||||
0076 00000390 920E move a0, *a14+, 1 ; arg0 = host
|
||||
0077 000003A0 0D5F calla 3F5EBC40h ; tftp_open
|
||||
000003B0 3F5EBC40
|
||||
0078 000003D0 07AF move @01871200h, sp, 1
|
||||
000003E0 01871200
|
||||
0079 00000400 07AE move @01871220h, a14, 1
|
||||
00000410 01871220
|
||||
0080 00000430 0550 setf 16, 0, 0
|
||||
0081 00000440 0740 setf 32, 0, 1
|
||||
0082 00000450 0788 move a8, @01871020h, 1 ; fd
|
||||
00000460 01871020
|
||||
0083 00000480 4D09 move a8, a9
|
||||
0084 00000490 4D08 move a8, a8
|
||||
0085 000004A0 C448 jrlt fail
|
||||
0086
|
||||
0087 ; ---- while ((n = tftp_read(fd, p, 010000h)) > 0) p +
|
||||
0088 000004B0 09E0 movi 3, a0, L
|
||||
000004C0 00000003
|
||||
0089 000004E0 0780 move a0, @01871000h, 1 ; stage = 3
|
||||
000004F0 01871000
|
||||
0090 00000510 read_loop:
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 3
|
||||
|
||||
0091 00000510 09EE movi 01878000h, a14, L
|
||||
00000520 01878000
|
||||
0092 00000540 09E0 movi 010000h, a0, L
|
||||
00000550 00010000
|
||||
0093 00000570 920E move a0, *a14+, 1 ; arg2 = bufsize
|
||||
0094 00000580 936E move a11, *a14+, 1 ; arg1 = buffer
|
||||
0095 00000590 932E move a9, *a14+, 1 ; arg0 = fd
|
||||
0096 000005A0 0D5F calla 3F5ED230h ; tftp_read
|
||||
000005B0 3F5ED230
|
||||
0097 000005D0 07AF move @01871200h, sp, 1
|
||||
000005E0 01871200
|
||||
0098 00000600 07AE move @01871220h, a14, 1
|
||||
00000610 01871220
|
||||
0099 00000630 0550 setf 16, 0, 0
|
||||
0100 00000640 0740 setf 32, 0, 1
|
||||
0101 00000650 0788 move a8, @01871080h, 1 ; last return
|
||||
00000660 01871080
|
||||
0102 00000680 4D08 move a8, a8
|
||||
0103 00000690 C609 jrle close_it
|
||||
0104 000006A0 410B add a8, a11 ; advance the write pointer
|
||||
0105 000006B0 07A1 move @01871060h, a1, 1
|
||||
000006C0 01871060
|
||||
0106 000006E0 4101 add a8, a1
|
||||
0107 000006F0 0781 move a1, @01871060h, 1 ; total += n
|
||||
00000700 01871060
|
||||
0108 00000720 C0DE jruc read_loop
|
||||
0109
|
||||
0110 00000730 close_it:
|
||||
0111 00000730 09E0 movi 4, a0, L
|
||||
00000740 00000004
|
||||
0112 00000760 0780 move a0, @01871000h, 1 ; stage = 4
|
||||
00000770 01871000
|
||||
0113 00000790 09EE movi 01878000h, a14, L
|
||||
000007A0 01878000
|
||||
0114 000007C0 932E move a9, *a14+, 1 ; arg0 = fd
|
||||
0115 000007D0 0D5F calla 3F5EC860h ; tftp_close
|
||||
000007E0 3F5EC860
|
||||
0116 00000800 07AF move @01871200h, sp, 1
|
||||
00000810 01871200
|
||||
0117 00000830 07AE move @01871220h, a14, 1
|
||||
00000840 01871220
|
||||
0118 00000860 0550 setf 16, 0, 0
|
||||
0119 00000870 0740 setf 32, 0, 1
|
||||
0120 00000880 0788 move a8, @018710C0h, 1
|
||||
00000890 018710C0
|
||||
0121 000008B0 09E0 movi 05A5A5A5h, a0, L
|
||||
000008C0 05A5A5A5
|
||||
0122 000008E0 0780 move a0, @018710A0h, 1 ; DONE marker
|
||||
000008F0 018710A0
|
||||
0123 00000910 4508 sub a8, a8 ; return 0
|
||||
0124 00000920 C009 jruc epilogue
|
||||
0125
|
||||
0126 00000930 fail:
|
||||
0127 00000930 09E0 movi 0FFh, a0, L
|
||||
00000940 000000FF
|
||||
0128 00000960 0780 move a0, @01871000h, 1
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 4
|
||||
|
||||
00000970 01871000
|
||||
0129 00000990 09E8 movi 0FFFFFFFFh, a8, L
|
||||
000009A0 FFFFFFFF
|
||||
0130 000009C0 epilogue:
|
||||
0131 000009C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
000009D0 00FF
|
||||
0132 000009E0 0960 rets
|
||||
0133
|
||||
0134 000009F0 HOST:
|
||||
0135 000009F0 3931 .word 03931h ; "192.168.99.1"
|
||||
0136 00000A00 2E32 .word 02E32h
|
||||
0137 00000A10 3631 .word 03631h
|
||||
0138 00000A20 2E38 .word 02E38h
|
||||
0139 00000A30 3939 .word 03939h
|
||||
0140 00000A40 312E .word 0312Eh
|
||||
0141 00000A50 0000 .word 00000h
|
||||
0142 00000A60 FNAME:
|
||||
0143 00000A60 7764 .word 07764h ; "dwt/tcpip/probe.bin"
|
||||
0144 00000A70 2F74 .word 02F74h
|
||||
0145 00000A80 6374 .word 06374h
|
||||
0146 00000A90 6970 .word 06970h
|
||||
0147 00000AA0 2F70 .word 02F70h
|
||||
0148 00000AB0 7270 .word 07270h
|
||||
0149 00000AC0 626F .word 0626Fh
|
||||
0150 00000AD0 2E65 .word 02E65h
|
||||
0151 00000AE0 6962 .word 06962h
|
||||
0152 00000AF0 006E .word 0006Eh
|
||||
0153 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:10:29 2026
|
||||
|
||||
OUTPUT FILE NAME: <TFETCH.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01870000 00000B00
|
||||
01870000 00000B00 TFETCH.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01870000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01870000 .text
|
||||
01870B00 etext 01870B00 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,382 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; tftpc.asm -- minimal TFTP read client built on the fi
|
||||
0002 ;
|
||||
0003 ; The firmware's own tftp_open() calls a resolver that
|
||||
0004 ; called from the rdebug process (dwt/notes/TCPIP.md),
|
||||
0005 ; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one
|
||||
0006 ;
|
||||
0007 ; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
0008 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, t
|
||||
0009 ; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags,
|
||||
0010 ; close = 3F5E8930h close(fd)
|
||||
0011 ; malloc = 3F701230h malloc(bytes) -> bit pointer
|
||||
0012 ;
|
||||
0013 ; The transfer is 600 bytes, so DATA 1 is 512 (full) an
|
||||
0014 ; (short); the short block ends the transfer. ACKs go
|
||||
0015 ; recvfrom reports, not to a hard-coded port.
|
||||
0016 ;
|
||||
0017 ; Evidence cells (32-bit, bit addresses):
|
||||
0018 ; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4
|
||||
0019 ; 0187C020 fd
|
||||
0020 ; 0187C040 destination buffer (malloc)
|
||||
0021 ; 0187C060 total bytes fetched
|
||||
0022 ; 0187C080 last recvfrom length
|
||||
0023 ; 0187C0A0 last DATA block word as read from the wir
|
||||
0024 ; 0187C0C0 marker 05A5A5A5h when the fetch completed
|
||||
0025 ; 0187C200 entry SP
|
||||
0026 ; 0187C220 entry A14
|
||||
0027 ;
|
||||
0028 ; Scratch (fixed bit addresses, above this image):
|
||||
0029 ; 01875000 argument area
|
||||
0030 ; 01876000 receive buffer (2048 bytes)
|
||||
0031 ; 0187A000 recvfrom source sockaddr
|
||||
0032 ; 0187A080 recvfrom sockaddr length
|
||||
0033 ; 0187A100 ACK packet (4 bytes)
|
||||
0034
|
||||
0035 00000000 .text
|
||||
0036 00000000 _start:
|
||||
0037 00000000 0550 setf 16, 0, 0
|
||||
0038 00000010 0740 setf 32, 0, 1
|
||||
0039 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0040 00000040 078F move sp, @0187C200h, 1
|
||||
00000050 0187C200
|
||||
0041 00000070 078E move a14, @0187C220h, 1
|
||||
00000080 0187C220
|
||||
0042
|
||||
0043 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0044 000000D0 0780 move a0, @0187C000h, 1
|
||||
000000E0 0187C000
|
||||
0045
|
||||
0046 ; ---- buf = malloc(010000h) -------------------------
|
||||
0047 00000100 A3CF move a14, -*sp, 1
|
||||
0048 00000110 09EE movi 01875000h, a14, L
|
||||
00000120 01875000
|
||||
0049 00000140 09E0 movi 010000h, a0, L
|
||||
00000150 00010000
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
0050 00000170 920E move a0, *a14+, 1
|
||||
0051 00000180 0D5F calla 3F701230h
|
||||
00000190 3F701230
|
||||
0052 000001B0 07AF move @0187C200h, sp, 1
|
||||
000001C0 0187C200
|
||||
0053 000001E0 07AE move @0187C220h, a14, 1
|
||||
000001F0 0187C220
|
||||
0054 00000210 0550 setf 16, 0, 0
|
||||
0055 00000220 0740 setf 32, 0, 1
|
||||
0056 00000230 0788 move a8, @0187C040h, 1
|
||||
00000240 0187C040
|
||||
0057 00000260 4D0B move a8, a11 ; dest cursor (callee-saved)
|
||||
0058 00000270 4D08 move a8, a8
|
||||
0059 00000280 CA00 jreq fail
|
||||
00000290 010F
|
||||
0060
|
||||
0061 000002A0 09E0 movi 2, a0, L
|
||||
000002B0 00000002
|
||||
0062 000002D0 0780 move a0, @0187C000h, 1
|
||||
000002E0 0187C000
|
||||
0063
|
||||
0064 ; ---- fd = socket(2,2,0) ----------------------------
|
||||
0065 00000300 09EE movi 01875000h, a14, L
|
||||
00000310 01875000
|
||||
0066 00000330 09E0 movi 0, a0, L
|
||||
00000340 00000000
|
||||
0067 00000360 920E move a0, *a14+, 1
|
||||
0068 00000370 09E0 movi 2, a0, L
|
||||
00000380 00000002
|
||||
0069 000003A0 920E move a0, *a14+, 1
|
||||
0070 000003B0 09E0 movi 2, a0, L
|
||||
000003C0 00000002
|
||||
0071 000003E0 920E move a0, *a14+, 1
|
||||
0072 000003F0 0D5F calla 3F5C9A00h
|
||||
00000400 3F5C9A00
|
||||
0073 00000420 07AF move @0187C200h, sp, 1
|
||||
00000430 0187C200
|
||||
0074 00000450 07AE move @0187C220h, a14, 1
|
||||
00000460 0187C220
|
||||
0075 00000480 0550 setf 16, 0, 0
|
||||
0076 00000490 0740 setf 32, 0, 1
|
||||
0077 000004A0 0788 move a8, @0187C020h, 1
|
||||
000004B0 0187C020
|
||||
0078 000004D0 4D09 move a8, a9 ; fd (callee-saved)
|
||||
0079 000004E0 4D08 move a8, a8
|
||||
0080 000004F0 C400 jrlt fail
|
||||
00000500 00E8
|
||||
0081
|
||||
0082 ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) -------------
|
||||
0083 00000510 09EE movi 01875000h, a14, L
|
||||
00000520 01875000
|
||||
0084 00000540 09E0 movi 16, a0, L
|
||||
00000550 00000010
|
||||
0085 00000570 920E move a0, *a14+, 1
|
||||
0086 00000580 09E0 movi SADDR, a0, L
|
||||
00000590 00001530'
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 3
|
||||
|
||||
0087 000005B0 920E move a0, *a14+, 1
|
||||
0088 000005C0 09E0 movi 0, a0, L
|
||||
000005D0 00000000
|
||||
0089 000005F0 920E move a0, *a14+, 1
|
||||
0090 00000600 09E0 movi 28, a0, L
|
||||
00000610 0000001C
|
||||
0091 00000630 920E move a0, *a14+, 1
|
||||
0092 00000640 09E0 movi RRQ, a0, L
|
||||
00000650 00001450'
|
||||
0093 00000670 920E move a0, *a14+, 1
|
||||
0094 00000680 932E move a9, *a14+, 1
|
||||
0095 00000690 0D5F calla 3F5D3D70h
|
||||
000006A0 3F5D3D70
|
||||
0096 000006C0 07AF move @0187C200h, sp, 1
|
||||
000006D0 0187C200
|
||||
0097 000006F0 07AE move @0187C220h, a14, 1
|
||||
00000700 0187C220
|
||||
0098 00000720 0550 setf 16, 0, 0
|
||||
0099 00000730 0740 setf 32, 0, 1
|
||||
0100 00000740 4D08 move a8, a8
|
||||
0101 00000750 C400 jrlt fail
|
||||
00000760 00C2
|
||||
0102
|
||||
0103 00000770 09E0 movi 3, a0, L
|
||||
00000780 00000003
|
||||
0104 000007A0 0780 move a0, @0187C000h, 1
|
||||
000007B0 0187C000
|
||||
0105 000007D0 4400 sub a0, a0
|
||||
0106 000007E0 0780 move a0, @0187C060h, 1 ; total = 0
|
||||
000007F0 0187C060
|
||||
0107
|
||||
0108 00000810 recv_loop:
|
||||
0109 ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) ---
|
||||
0110 ; arg5 is a POINTER to the socklen (as tftp_read passe
|
||||
0111 ; value is initialised to 16 first.
|
||||
0112 00000810 09E0 movi 16, a0, L
|
||||
00000820 00000010
|
||||
0113 00000840 0780 move a0, @0187A080h, 1 ; fromlen = 16
|
||||
00000850 0187A080
|
||||
0114 00000870 09EE movi 01875000h, a14, L
|
||||
00000880 01875000
|
||||
0115 000008A0 09E0 movi 0187A080h, a0, L
|
||||
000008B0 0187A080
|
||||
0116 000008D0 920E move a0, *a14+, 1 ; arg5 = &fromlen
|
||||
0117 000008E0 09E0 movi 0187A000h, a0, L
|
||||
000008F0 0187A000
|
||||
0118 00000910 920E move a0, *a14+, 1 ; arg4 = &from
|
||||
0119 00000920 09E0 movi 0, a0, L
|
||||
00000930 00000000
|
||||
0120 00000950 920E move a0, *a14+, 1 ; arg3 = flags
|
||||
0121 00000960 09E0 movi 00800h, a0, L
|
||||
00000970 00000800
|
||||
0122 00000990 920E move a0, *a14+, 1 ; arg2 = 2048
|
||||
0123 000009A0 09E0 movi 01876000h, a0, L
|
||||
000009B0 01876000
|
||||
0124 000009D0 920E move a0, *a14+, 1 ; arg1 = receive buffer
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 4
|
||||
|
||||
0125 000009E0 932E move a9, *a14+, 1 ; arg0 = fd
|
||||
0126 000009F0 0D5F calla 3F5D7D50h
|
||||
00000A00 3F5D7D50
|
||||
0127 00000A20 07AF move @0187C200h, sp, 1
|
||||
00000A30 0187C200
|
||||
0128 00000A50 07AE move @0187C220h, a14, 1
|
||||
00000A60 0187C220
|
||||
0129 00000A80 0550 setf 16, 0, 0
|
||||
0130 00000A90 0740 setf 32, 0, 1
|
||||
0131
|
||||
0132 00000AA0 0788 move a8, @0187C080h, 1 ; last length
|
||||
00000AB0 0187C080
|
||||
0133 00000AD0 4D08 move a8, a8
|
||||
0134 00000AE0 C600 jrle fail
|
||||
00000AF0 0089
|
||||
0135
|
||||
0136 ; opcode: wire 00 03 -> little-endian word 0300h
|
||||
0137 00000B00 05A0 move @01876000h, a0, 0
|
||||
00000B10 01876000
|
||||
0138 00000B30 0B40 cmpi 0300h, a0
|
||||
00000B40 FCFF
|
||||
0139 00000B50 CB00 jrne fail ; only DATA is accepted
|
||||
00000B60 0082
|
||||
0140
|
||||
0141 00000B70 05A4 move @01876010h, a4, 0 ; block number, wire order
|
||||
00000B80 01876010
|
||||
0142 00000BA0 0784 move a4, @0187C0A0h, 1
|
||||
00000BB0 0187C0A0
|
||||
0143
|
||||
0144 00000BD0 4D03 move a8, a3
|
||||
0145 00000BE0 1483 subk 4, a3 ; payload length
|
||||
0146
|
||||
0147 ; ---- total += payload, dest += payload -------------
|
||||
0148 00000BF0 07A1 move @0187C060h, a1, 1
|
||||
00000C00 0187C060
|
||||
0149 00000C20 4061 add a3, a1
|
||||
0150 00000C30 0781 move a1, @0187C060h, 1 ; total += payload (bytes)
|
||||
00000C40 0187C060
|
||||
0151 00000C60 4D66 move a11, a6 ; copy destination
|
||||
0152 00000C70 4C62 move a3, a2
|
||||
0153 00000C80 2462 sll 3, a2 ; bytes -> bits: pointers are bit addresse
|
||||
0154 00000C90 404B add a2, a11 ; dest cursor advances now (do NOT add by
|
||||
0155
|
||||
0156 ; ---- copy payload from BUF+4 to a6, one byte at a ti
|
||||
0157 ; Interrupts are disabled for the copy so a 512-byte c
|
||||
0158 ; with respect to the firmware's ISRs.
|
||||
0159 00000CA0 0360 dint
|
||||
0160 00000CB0 09E5 movi 01876020h, a5, L
|
||||
00000CC0 01876020
|
||||
0161 00000CE0 4C62 move a3, a2
|
||||
0162 00000CF0 0783 move a3, @0187C0E0h, 1 ; payload length
|
||||
00000D00 0187C0E0
|
||||
0163 00000D20 0782 move a2, @0187C140h, 1 ; copy count
|
||||
00000D30 0187C140
|
||||
0164 00000D50 0786 move a6, @0187C120h, 1 ; write start
|
||||
00000D60 0187C120
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 5
|
||||
|
||||
0165 00000D80 078B move a11, @0187C100h, 1 ; cursor after advance
|
||||
00000D90 0187C100
|
||||
0166 00000DB0 0785 move a5, @0187C160h, 1 ; source
|
||||
00000DC0 0187C160
|
||||
0167 00000DE0 CA05 jreq copy_done
|
||||
0168 00000DF0 copy_bytes:
|
||||
0169 00000DF0 8EA0 movb *a5, a0
|
||||
0170 00000E00 8C06 movb a0, *a6
|
||||
0171 00000E10 1105 addk 8, a5 ; one byte
|
||||
0172 00000E20 1106 addk 8, a6
|
||||
0173 00000E30 3CA2 dsjs a2, copy_bytes
|
||||
0174 00000E40 copy_done:
|
||||
0175 00000E40 0D60 eint
|
||||
0176
|
||||
0177 ; ---- ACK: 00 04 <block as received> ----------------
|
||||
0178 00000E50 09E0 movi 00400h, a0, L
|
||||
00000E60 00000400
|
||||
0179 00000E80 0580 move a0, @0187A100h, 0
|
||||
00000E90 0187A100
|
||||
0180 00000EB0 0584 move a4, @0187A110h, 0
|
||||
00000EC0 0187A110
|
||||
0181
|
||||
0182 00000EE0 09EE movi 01875000h, a14, L
|
||||
00000EF0 01875000
|
||||
0183 00000F10 09E0 movi 16, a0, L
|
||||
00000F20 00000010
|
||||
0184 00000F40 920E move a0, *a14+, 1
|
||||
0185 00000F50 09E0 movi 0187A000h, a0, L
|
||||
00000F60 0187A000
|
||||
0186 00000F80 920E move a0, *a14+, 1
|
||||
0187 00000F90 09E0 movi 0, a0, L
|
||||
00000FA0 00000000
|
||||
0188 00000FC0 920E move a0, *a14+, 1
|
||||
0189 00000FD0 09E0 movi 4, a0, L
|
||||
00000FE0 00000004
|
||||
0190 00001000 920E move a0, *a14+, 1
|
||||
0191 00001010 09E0 movi 0187A100h, a0, L
|
||||
00001020 0187A100
|
||||
0192 00001040 920E move a0, *a14+, 1
|
||||
0193 00001050 932E move a9, *a14+, 1
|
||||
0194 00001060 0D5F calla 3F5D3D70h
|
||||
00001070 3F5D3D70
|
||||
0195 00001090 07AF move @0187C200h, sp, 1
|
||||
000010A0 0187C200
|
||||
0196 000010C0 07AE move @0187C220h, a14, 1
|
||||
000010D0 0187C220
|
||||
0197 000010F0 0550 setf 16, 0, 0
|
||||
0198 00001100 0740 setf 32, 0, 1
|
||||
0199 00001110 4D08 move a8, a8
|
||||
0200 00001120 C426 jrlt fail
|
||||
0201
|
||||
0202 ; short block ends the transfer; full block means read
|
||||
0203 00001130 07A2 move @0187C080h, a2, 1
|
||||
00001140 0187C080
|
||||
0204 00001160 1482 subk 4, a2
|
||||
0205 00001170 0B42 cmpi 512, a2
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 6
|
||||
|
||||
00001180 FDFF
|
||||
0206 00001190 C402 jrlt close_it
|
||||
0207 000011A0 C000 jruc recv_loop
|
||||
000011B0 FF65
|
||||
0208
|
||||
0209 000011C0 close_it:
|
||||
0210 000011C0 09E0 movi 4, a0, L
|
||||
000011D0 00000004
|
||||
0211 000011F0 0780 move a0, @0187C000h, 1
|
||||
00001200 0187C000
|
||||
0212 00001220 09EE movi 01875000h, a14, L
|
||||
00001230 01875000
|
||||
0213 00001250 932E move a9, *a14+, 1
|
||||
0214 00001260 0D5F calla 3F5E8930h ; close(fd)
|
||||
00001270 3F5E8930
|
||||
0215 00001290 07AF move @0187C200h, sp, 1
|
||||
000012A0 0187C200
|
||||
0216 000012C0 07AE move @0187C220h, a14, 1
|
||||
000012D0 0187C220
|
||||
0217 000012F0 0550 setf 16, 0, 0
|
||||
0218 00001300 0740 setf 32, 0, 1
|
||||
0219 00001310 09E0 movi 05A5A5A5h, a0, L
|
||||
00001320 05A5A5A5
|
||||
0220 00001340 0780 move a0, @0187C0C0h, 1
|
||||
00001350 0187C0C0
|
||||
0221 00001370 4508 sub a8, a8
|
||||
0222 00001380 C009 jruc epilogue
|
||||
0223
|
||||
0224 00001390 fail:
|
||||
0225 00001390 09E0 movi 0FFh, a0, L
|
||||
000013A0 000000FF
|
||||
0226 000013C0 0780 move a0, @0187C000h, 1
|
||||
000013D0 0187C000
|
||||
0227 000013F0 09E8 movi 0FFFFFFFFh, a8, L
|
||||
00001400 FFFFFFFF
|
||||
0228 00001420 epilogue:
|
||||
0229 00001420 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00001430 00FF
|
||||
0230 00001440 0960 rets
|
||||
0231
|
||||
0232 00001450 RRQ:
|
||||
0233 00001450 0100 .word 00100h ; opcode 1 (00 01)
|
||||
0234 00001460 7764 .word 07764h ; "dw"
|
||||
0235 00001470 2F74 .word 02F74h ; "t/"
|
||||
0236 00001480 6374 .word 06374h ; "tc"
|
||||
0237 00001490 6970 .word 06970h ; "pi"
|
||||
0238 000014A0 2F70 .word 02F70h ; "p/"
|
||||
0239 000014B0 7270 .word 07270h ; "pr"
|
||||
0240 000014C0 626F .word 0626Fh ; "ob"
|
||||
0241 000014D0 2E65 .word 02E65h ; "e."
|
||||
0242 000014E0 6962 .word 06962h ; "bi"
|
||||
0243 000014F0 006E .word 0006Eh ; "n\0"
|
||||
0244 00001500 636F .word 0636Fh ; "oc"
|
||||
0245 00001510 6574 .word 06574h ; "te"
|
||||
0246 00001520 0074 .word 00074h ; "t\0"
|
||||
0247 00001530 SADDR:
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 7
|
||||
|
||||
0248 00001530 0002 .word 00002h ; sin_family = AF_INET
|
||||
0249 00001540 4500 .word 04500h ; sin_port = htons(69)
|
||||
0250 00001550 A8C0 .word 0A8C0h ; 192.168
|
||||
0251 00001560 0163 .word 00163h ; .99.1
|
||||
0252 00001570 0000 .word 0
|
||||
0253 00001580 0000 .word 0
|
||||
0254 00001590 0000 .word 0
|
||||
0255 000015A0 0000 .word 0
|
||||
0256 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:23:35 2026
|
||||
|
||||
OUTPUT FILE NAME: <TFTPC.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01870000 000015B0
|
||||
01870000 000015B0 TFTPC.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01870000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01870000 .text
|
||||
018715B0 etext 018715B0 etext
|
||||
|
||||
[6 symbols]
|
||||
Binary file not shown.
@@ -0,0 +1,142 @@
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 1
|
||||
|
||||
0001 ; udptest.asm -- socket() + sendto() a real TFTP RRQ.
|
||||
0002 ;
|
||||
0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
0004 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to
|
||||
0005 ;
|
||||
0006 ; The RRQ is the packet the firmware itself would send
|
||||
0007 ; "dwt/tcpip/probe.bin" in octet mode. A server log li
|
||||
0008 ; proof that UDP transmit works from the calling proces
|
||||
0009 ;
|
||||
0010 ; Evidence cells (32-bit, bit addresses):
|
||||
0011 ; 01876800 stage (1 entered, 2 sendto returned)
|
||||
0012 ; 01876820 socket fd
|
||||
0013 ; 01876840 sendto return
|
||||
0014 ; 01876A00 entry SP
|
||||
0015 ; 01876A20 entry A14
|
||||
0016
|
||||
0017 00000000 .text
|
||||
0018 00000000 _start:
|
||||
0019 00000000 0550 setf 16, 0, 0
|
||||
0020 00000010 0740 setf 32, 0, 1
|
||||
0021 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000030 FF00
|
||||
0022 00000040 078F move sp, @01876A00h, 1
|
||||
00000050 01876A00
|
||||
0023 00000070 078E move a14, @01876A20h, 1
|
||||
00000080 01876A20
|
||||
0024
|
||||
0025 000000A0 09E0 movi 1, a0, L
|
||||
000000B0 00000001
|
||||
0026 000000D0 0780 move a0, @01876800h, 1
|
||||
000000E0 01876800
|
||||
0027
|
||||
0028 00000100 09EE movi 01877000h, a14, L
|
||||
00000110 01877000
|
||||
0029 00000130 09E0 movi 0, a0, L
|
||||
00000140 00000000
|
||||
0030 00000160 920E move a0, *a14+, 1 ; arg2 = protocol
|
||||
0031 00000170 09E0 movi 2, a0, L
|
||||
00000180 00000002
|
||||
0032 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
||||
0033 000001B0 09E0 movi 2, a0, L
|
||||
000001C0 00000002
|
||||
0034 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET
|
||||
0035 000001F0 0D5F calla 3F5C9A00h
|
||||
00000200 3F5C9A00
|
||||
0036 00000220 07AF move @01876A00h, sp, 1
|
||||
00000230 01876A00
|
||||
0037 00000250 07AE move @01876A20h, a14, 1
|
||||
00000260 01876A20
|
||||
0038 00000280 0550 setf 16, 0, 0
|
||||
0039 00000290 0740 setf 32, 0, 1
|
||||
0040 000002A0 0788 move a8, @01876820h, 1
|
||||
000002B0 01876820
|
||||
0041 000002D0 4D09 move a8, a9
|
||||
0042
|
||||
0043 000002E0 09E0 movi 2, a0, L
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 2
|
||||
|
||||
000002F0 00000002
|
||||
0044 00000310 0780 move a0, @01876800h, 1
|
||||
00000320 01876800
|
||||
0045
|
||||
0046 ; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16)
|
||||
0047 00000340 09EE movi 01877000h, a14, L
|
||||
00000350 01877000
|
||||
0048 00000370 09E0 movi 16, a0, L
|
||||
00000380 00000010
|
||||
0049 000003A0 920E move a0, *a14+, 1 ; arg5 = 16
|
||||
0050 000003B0 09E0 movi SADDR, a0, L
|
||||
000003C0 00000740'
|
||||
0051 000003E0 920E move a0, *a14+, 1 ; arg4 = &sockaddr
|
||||
0052 000003F0 09E0 movi 0, a0, L
|
||||
00000400 00000000
|
||||
0053 00000420 920E move a0, *a14+, 1 ; arg3 = flags
|
||||
0054 00000430 09E0 movi 28, a0, L
|
||||
00000440 0000001C
|
||||
0055 00000460 920E move a0, *a14+, 1 ; arg2 = length
|
||||
0056 00000470 09E0 movi RRQ, a0, L
|
||||
00000480 00000660'
|
||||
0057 000004A0 920E move a0, *a14+, 1 ; arg1 = packet
|
||||
0058 000004B0 932E move a9, *a14+, 1 ; arg0 = fd
|
||||
0059 000004C0 0D5F calla 3F5D3D70h
|
||||
000004D0 3F5D3D70
|
||||
0060 000004F0 07AF move @01876A00h, sp, 1
|
||||
00000500 01876A00
|
||||
0061 00000520 07AE move @01876A20h, a14, 1
|
||||
00000530 01876A20
|
||||
0062 00000550 0550 setf 16, 0, 0
|
||||
0063 00000560 0740 setf 32, 0, 1
|
||||
0064 00000570 0788 move a8, @01876840h, 1
|
||||
00000580 01876840
|
||||
0065
|
||||
0066 000005A0 09E0 movi 3, a0, L
|
||||
000005B0 00000003
|
||||
0067 000005D0 0780 move a0, @01876800h, 1
|
||||
000005E0 01876800
|
||||
0068 00000600 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
00000610 00FF
|
||||
0069 00000620 09E8 movi 0, a8, L
|
||||
00000630 00000000
|
||||
0070 00000650 0960 rets
|
||||
0071
|
||||
0072 00000660 RRQ:
|
||||
0073 00000660 0100 .word 00100h ; opcode 1 (00 01)
|
||||
0074 00000670 7764 .word 07764h ; "dw"
|
||||
0075 00000680 2F74 .word 02F74h ; "t/"
|
||||
0076 00000690 6374 .word 06374h ; "tc"
|
||||
0077 000006A0 6970 .word 06970h ; "pi"
|
||||
0078 000006B0 2F70 .word 02F70h ; "p/"
|
||||
0079 000006C0 7270 .word 07270h ; "pr"
|
||||
0080 000006D0 626F .word 0626Fh ; "ob"
|
||||
0081 000006E0 2E65 .word 02E65h ; "e."
|
||||
0082 000006F0 6962 .word 06962h ; "bi"
|
||||
0083 00000700 006E .word 0006Eh ; "n\0"
|
||||
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
||||
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
||||
|
||||
PAGE 3
|
||||
|
||||
0084 00000710 636F .word 0636Fh ; "oc"
|
||||
0085 00000720 6574 .word 06574h ; "te"
|
||||
0086 00000730 0074 .word 00074h ; "t\0"
|
||||
0087 00000740 SADDR:
|
||||
0088 00000740 0002 .word 00002h ; sin_family = AF_INET
|
||||
0089 00000750 4500 .word 04500h ; sin_port = htons(69)
|
||||
0090 00000760 A8C0 .word 0A8C0h ; 192.168
|
||||
0091 00000770 0163 .word 00163h ; .99.1
|
||||
0092 00000780 0000 .word 0
|
||||
0093 00000790 0000 .word 0
|
||||
0094 000007A0 0000 .word 0
|
||||
0095 000007B0 0000 .word 0
|
||||
0096 .end
|
||||
|
||||
No Errors, No Warnings
|
||||
@@ -0,0 +1,34 @@
|
||||
*****************************************************
|
||||
GSP COFF Linker, Version 2.00, 87.300
|
||||
*****************************************************
|
||||
Sun Oct 18 15:14:27 2026
|
||||
|
||||
OUTPUT FILE NAME: <UDPTEST.out>
|
||||
ENTRY POINT SYMBOL: 0
|
||||
|
||||
|
||||
SECTION ALLOCATION MAP
|
||||
|
||||
output attributes/
|
||||
section page origin length input sections
|
||||
-------- ---- ---------- ---------- ----------------
|
||||
.data 0 00000000 00000000
|
||||
|
||||
.bss 0 00000000 00000000 UNINITIALIZED
|
||||
|
||||
.text 0 01876000 000007C0
|
||||
01876000 000007C0 UDPTEST.obj (.text)
|
||||
|
||||
|
||||
GLOBAL SYMBOLS
|
||||
|
||||
address name address name
|
||||
-------- ---- -------- ----
|
||||
00000000 .bss 00000000 edata
|
||||
00000000 .data 00000000 .bss
|
||||
01876000 .text 00000000 end
|
||||
00000000 edata 00000000 .data
|
||||
00000000 end 01876000 .text
|
||||
018767C0 etext 018767C0 etext
|
||||
|
||||
[6 symbols]
|
||||
@@ -0,0 +1,179 @@
|
||||
; copytest.asm -- isolate the byte-copy loop used by tftpc.asm.
|
||||
;
|
||||
; malloc(01000h), then copy 256 bytes from SRC (values 0..255) with the same
|
||||
; dint/movb/addk/dsjs/eint loop. A peek of the destination must show 00..FF.
|
||||
;
|
||||
; 0187A800 stage (1 entered, 2 copied)
|
||||
; 0187A820 destination pointer
|
||||
; 0187A840 entry SP
|
||||
; 0187A860 entry A14
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @0187A840h, 1
|
||||
move a14, @0187A860h, 1
|
||||
movi 1, a0, L
|
||||
move a0, @0187A800h, 1
|
||||
|
||||
move a14, -*sp, 1
|
||||
movi 0187B800h, a14, L
|
||||
movi 01000h, a0, L
|
||||
move a0, *a14+, 1
|
||||
calla 3F701230h
|
||||
move @0187A840h, sp, 1
|
||||
move @0187A860h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @0187A820h, 1
|
||||
move a8, a6
|
||||
|
||||
dint
|
||||
movi SRC, a5, L
|
||||
movi 256, a2, L
|
||||
copy_bytes:
|
||||
movb *a5, a0
|
||||
movb a0, *a6
|
||||
addk 8, a5
|
||||
addk 8, a6
|
||||
dsjs a2, copy_bytes
|
||||
eint
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @0187A800h, 1
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
movi 0, a8, L
|
||||
rets
|
||||
|
||||
SRC:
|
||||
.word 00100h
|
||||
.word 00302h
|
||||
.word 00504h
|
||||
.word 00706h
|
||||
.word 00908h
|
||||
.word 00B0Ah
|
||||
.word 00D0Ch
|
||||
.word 00F0Eh
|
||||
.word 01110h
|
||||
.word 01312h
|
||||
.word 01514h
|
||||
.word 01716h
|
||||
.word 01918h
|
||||
.word 01B1Ah
|
||||
.word 01D1Ch
|
||||
.word 01F1Eh
|
||||
.word 02120h
|
||||
.word 02322h
|
||||
.word 02524h
|
||||
.word 02726h
|
||||
.word 02928h
|
||||
.word 02B2Ah
|
||||
.word 02D2Ch
|
||||
.word 02F2Eh
|
||||
.word 03130h
|
||||
.word 03332h
|
||||
.word 03534h
|
||||
.word 03736h
|
||||
.word 03938h
|
||||
.word 03B3Ah
|
||||
.word 03D3Ch
|
||||
.word 03F3Eh
|
||||
.word 04140h
|
||||
.word 04342h
|
||||
.word 04544h
|
||||
.word 04746h
|
||||
.word 04948h
|
||||
.word 04B4Ah
|
||||
.word 04D4Ch
|
||||
.word 04F4Eh
|
||||
.word 05150h
|
||||
.word 05352h
|
||||
.word 05554h
|
||||
.word 05756h
|
||||
.word 05958h
|
||||
.word 05B5Ah
|
||||
.word 05D5Ch
|
||||
.word 05F5Eh
|
||||
.word 06160h
|
||||
.word 06362h
|
||||
.word 06564h
|
||||
.word 06766h
|
||||
.word 06968h
|
||||
.word 06B6Ah
|
||||
.word 06D6Ch
|
||||
.word 06F6Eh
|
||||
.word 07170h
|
||||
.word 07372h
|
||||
.word 07574h
|
||||
.word 07776h
|
||||
.word 07978h
|
||||
.word 07B7Ah
|
||||
.word 07D7Ch
|
||||
.word 07F7Eh
|
||||
.word 08180h
|
||||
.word 08382h
|
||||
.word 08584h
|
||||
.word 08786h
|
||||
.word 08988h
|
||||
.word 08B8Ah
|
||||
.word 08D8Ch
|
||||
.word 08F8Eh
|
||||
.word 09190h
|
||||
.word 09392h
|
||||
.word 09594h
|
||||
.word 09796h
|
||||
.word 09998h
|
||||
.word 09B9Ah
|
||||
.word 09D9Ch
|
||||
.word 09F9Eh
|
||||
.word 0A1A0h
|
||||
.word 0A3A2h
|
||||
.word 0A5A4h
|
||||
.word 0A7A6h
|
||||
.word 0A9A8h
|
||||
.word 0ABAAh
|
||||
.word 0ADACh
|
||||
.word 0AFAEh
|
||||
.word 0B1B0h
|
||||
.word 0B3B2h
|
||||
.word 0B5B4h
|
||||
.word 0B7B6h
|
||||
.word 0B9B8h
|
||||
.word 0BBBAh
|
||||
.word 0BDBCh
|
||||
.word 0BFBEh
|
||||
.word 0C1C0h
|
||||
.word 0C3C2h
|
||||
.word 0C5C4h
|
||||
.word 0C7C6h
|
||||
.word 0C9C8h
|
||||
.word 0CBCAh
|
||||
.word 0CDCCh
|
||||
.word 0CFCEh
|
||||
.word 0D1D0h
|
||||
.word 0D3D2h
|
||||
.word 0D5D4h
|
||||
.word 0D7D6h
|
||||
.word 0D9D8h
|
||||
.word 0DBDAh
|
||||
.word 0DDDCh
|
||||
.word 0DFDEh
|
||||
.word 0E1E0h
|
||||
.word 0E3E2h
|
||||
.word 0E5E4h
|
||||
.word 0E7E6h
|
||||
.word 0E9E8h
|
||||
.word 0EBEAh
|
||||
.word 0EDECh
|
||||
.word 0EFEEh
|
||||
.word 0F1F0h
|
||||
.word 0F3F2h
|
||||
.word 0F5F4h
|
||||
.word 0F7F6h
|
||||
.word 0F9F8h
|
||||
.word 0FBFAh
|
||||
.word 0FDFCh
|
||||
.word 0FFFEh
|
||||
.end
|
||||
@@ -0,0 +1,55 @@
|
||||
; launcher.asm -- run tfetch.bin as a first-class process.
|
||||
;
|
||||
; The rdebug `jump` runs in the "remote debug" process. The X experiment
|
||||
; (dwt/notes/GUI_APPS.md section 10) showed that a service connection made
|
||||
; from that context is accepted but never completed; a create_process child
|
||||
; works. This launcher is the same shape as dwt/gui/xlaunch.asm:
|
||||
;
|
||||
; create_process(entry, name, stack_size, 1, arg)
|
||||
;
|
||||
; create_process = bit 3F706A40h (Ghidra 07EE0D48)
|
||||
;
|
||||
; The child runs tfetch.bin, linked at bit 01870000h.
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses):
|
||||
; 01872500 stage (1 entered, 2 create_process returned)
|
||||
; 01872520 PCB returned by create_process (0 = failure)
|
||||
; 01872540 entry-point argument (poked by the host, little-endian)
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @01872700h, 1 ; entry SP
|
||||
move a14, @01872720h, 1 ; entry A14
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @01872500h, 1
|
||||
|
||||
move a14, -*sp, 1
|
||||
movi 01872800h, a14, L ; argument area
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1 ; arg4 = 0
|
||||
movi 1, a0, L
|
||||
move a0, *a14+, 1 ; arg3 = 1
|
||||
movi 04000h, a0, L ; 16 KiB stack
|
||||
move a0, *a14+, 1 ; arg2 = stack size
|
||||
movi 3F30DC00h, a0, L ; ROM "0::0", any short name
|
||||
move a0, *a14+, 1 ; arg1 = name
|
||||
move @01872540h, a0, 1 ; arg0 = entry, poked at run time
|
||||
move a0, *a14+, 1 ; (little-endian bit address)
|
||||
calla 3F706A40h ; create_process
|
||||
move @01872700h, sp, 1
|
||||
move @01872720h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
|
||||
move a8, @01872520h, 1 ; PCB marker
|
||||
movi 2, a0, L
|
||||
move a0, @01872500h, 1 ; stage = 2
|
||||
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
movi 0, a8, L
|
||||
rets
|
||||
.end
|
||||
Binary file not shown.
@@ -0,0 +1,105 @@
|
||||
-- probe.lua -- watch the dwt/tcpip payloads from inside MAME.
|
||||
--
|
||||
-- Samples marker cells and the CPU PC once per frame. This is independent of
|
||||
-- the terminal's network stack, so it still reports after a payload has wedged
|
||||
-- rdebug or TCP. PCs inside the payload or the socket/TFTP code are printed,
|
||||
-- which is how a hang is localised.
|
||||
--
|
||||
-- <mame> vt1200 ... -debug -debugger none \
|
||||
-- -autoboot_script dwt/tcpip/probe.lua -autoboot_delay 0
|
||||
--
|
||||
-- Stop with PROBE_END=<frame> (default 20000).
|
||||
|
||||
local machine = manager.machine
|
||||
local cpu = machine.devices[':maincpu']
|
||||
local prog = cpu.spaces['program']
|
||||
|
||||
local function hex(v) return string.format("%08X", v & 0xFFFFFFFF) end
|
||||
|
||||
local M = {
|
||||
-- tfetch.asm
|
||||
stage = 0x01871000, fd = 0x01871020, buf = 0x01871040,
|
||||
total = 0x01871060, last = 0x01871080, done = 0x018710A0,
|
||||
close = 0x018710C0, sp = 0x01871200, a14 = 0x01871220,
|
||||
-- launcher.asm
|
||||
lstage = 0x01872500, pcb = 0x01872520,
|
||||
-- socktest.asm
|
||||
sstage = 0x01874000, sfd = 0x01874020,
|
||||
-- tftpc.asm
|
||||
cstage = 0x0187C000, cfd = 0x0187C020, cbuf = 0x0187C040,
|
||||
ctotal = 0x0187C060, clast = 0x0187C080, cblock = 0x0187C0A0,
|
||||
cdone = 0x0187C0C0,
|
||||
}
|
||||
|
||||
local END_AT = tonumber(os.getenv("PROBE_END") or "1000000")
|
||||
local last = {}
|
||||
local frames = 0
|
||||
local pc_lines = 0
|
||||
local checked = false
|
||||
|
||||
-- Ground truth for the fetch: read the malloc'd buffer from inside MAME and
|
||||
-- compare it with the file the server holds. This avoids trusting rdebug peek.
|
||||
local function check_buffer(buf, total)
|
||||
local f = io.open("dwt/tcpip/probe.bin", "rb")
|
||||
if not f then print("PROBE: no probe.bin to compare") return end
|
||||
local want = f:read("*a")
|
||||
f:close()
|
||||
local n = math.min(total, #want)
|
||||
local bad, first = 0, -1
|
||||
for i = 0, n - 1 do
|
||||
local got = prog:read_u8(buf + i * 8)
|
||||
if got ~= want:byte(i + 1) then
|
||||
bad = bad + 1
|
||||
if first < 0 then first = i end
|
||||
end
|
||||
end
|
||||
print(string.format("PROBE BUFFER buf=%s total=%d file=%d bad=%d first_bad=%d",
|
||||
hex(buf), total, #want, bad, first))
|
||||
end
|
||||
|
||||
local function in_range(pc, lo, hi) return pc >= lo and pc < hi end
|
||||
|
||||
local function sample()
|
||||
frames = frames + 1
|
||||
local vals = {}
|
||||
for k, a in pairs(M) do vals[k] = prog:read_u32(a) end
|
||||
local pc = cpu.state['PC'].value
|
||||
local changed = false
|
||||
for k, v in pairs(vals) do
|
||||
if last[k] ~= v then changed = true end
|
||||
end
|
||||
local interesting = in_range(pc, 0x01870000, 0x01874000)
|
||||
or in_range(pc, 0x3F5C0000, 0x3F5F0000)
|
||||
or in_range(pc, 0x3F700000, 0x3F710000)
|
||||
if changed or interesting or frames % 120 == 1 then
|
||||
if interesting then pc_lines = pc_lines + 1 end
|
||||
if not interesting or pc_lines <= 400 then
|
||||
print(string.format("PROBE f=%d pc=%s stage=%s fd=%s buf=%s total=%s last=%s done=%s close=%s sp=%s a14=%s lstage=%s pcb=%s sstage=%s sfd=%s",
|
||||
frames, hex(pc), hex(vals.stage), hex(vals.fd), hex(vals.buf),
|
||||
hex(vals.total), hex(vals.last), hex(vals.done),
|
||||
hex(vals.close), hex(vals.sp), hex(vals.a14),
|
||||
hex(vals.lstage), hex(vals.pcb), hex(vals.sstage), hex(vals.sfd)))
|
||||
print(string.format("TCPC cstage=%s cfd=%s cbuf=%s ctotal=%s clast=%s cblock=%s cdone=%s",
|
||||
hex(vals.cstage), hex(vals.cfd), hex(vals.cbuf), hex(vals.ctotal),
|
||||
hex(vals.clast), hex(vals.cblock), hex(vals.cdone)))
|
||||
end
|
||||
end
|
||||
if vals.cdone == 0x05A5A5A5 and not checked then
|
||||
checked = true
|
||||
check_buffer(vals.cbuf, vals.ctotal)
|
||||
end
|
||||
last = vals
|
||||
if frames >= END_AT then
|
||||
print("PROBE end")
|
||||
machine:exit()
|
||||
end
|
||||
end
|
||||
|
||||
if not machine.debugger then
|
||||
print("PROBE ERROR: pass -debug")
|
||||
machine:exit()
|
||||
return
|
||||
end
|
||||
|
||||
emu.register_frame_done(sample, "probe")
|
||||
print("PROBE armed")
|
||||
@@ -0,0 +1,68 @@
|
||||
; restest.asm -- socket() then the resolver tftp_open uses.
|
||||
;
|
||||
; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
; resolve = 3F5933D0h resolve("192.168.99.1") -> -1 or address
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses):
|
||||
; 01875800 stage (1 entered, 2 socket returned, 3 resolve returned)
|
||||
; 01875820 socket() fd
|
||||
; 01875840 resolver return
|
||||
; 01875A00 entry SP
|
||||
; 01875A20 entry A14
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @01875A00h, 1
|
||||
move a14, @01875A20h, 1
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @01875800h, 1
|
||||
|
||||
; socket(2,2,0)
|
||||
movi 01875900h, a14, L
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1
|
||||
calla 3F5C9A00h
|
||||
move @01875A00h, sp, 1
|
||||
move @01875A20h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01875820h, 1 ; fd
|
||||
move a8, a9
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @01875800h, 1
|
||||
|
||||
; resolve("192.168.99.1")
|
||||
movi 01875900h, a14, L
|
||||
movi HOST, a0, L
|
||||
move a0, *a14+, 1
|
||||
calla 3F5933D0h
|
||||
move @01875A00h, sp, 1
|
||||
move @01875A20h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01875840h, 1
|
||||
|
||||
movi 3, a0, L
|
||||
move a0, @01875800h, 1
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
movi 0, a8, L
|
||||
rets
|
||||
|
||||
HOST:
|
||||
.word 03931h
|
||||
.word 02E32h
|
||||
.word 03631h
|
||||
.word 02E38h
|
||||
.word 03939h
|
||||
.word 0312Eh
|
||||
.word 00000h
|
||||
.end
|
||||
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
[+] challenge f8 74 7d 75 00 00 7c 61 02 63 a8 c0 f8 6c 7d 76
|
||||
[+] reply 08 66 31 7f 4f 55 f3 c9 62 d3 c9 6a 13 2e d8 3d
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
[.] jump returned 0x00000000 (0)
|
||||
jump 0x01870000: returned 0x00000000 (0) payload=00 00 00 00
|
||||
@@ -0,0 +1,4 @@
|
||||
[+] challenge ff fc 7b 59 00 00 7b 51 02 63 a8 c0 ff fc 7b 5a
|
||||
[+] reply a1 34 cd a5 e9 c4 80 ad 63 68 f8 78 c1 6b a2 e2
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
poke-file dwt/tcpip/build/tftpc.bin: 694 bytes at 0x01870000: ok
|
||||
@@ -0,0 +1,2 @@
|
||||
stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5
|
||||
OK: 600 bytes at 0x0095bbd0 match /home/arti/code/k-space/vt1200/dwt/tcpip/probe.bin sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359
|
||||
@@ -0,0 +1,5 @@
|
||||
[+] challenge f8 64 68 9d 00 00 67 87 02 63 a8 c0 f8 64 68 9d
|
||||
[+] reply 14 dc bf 0b 6b 6c 0b 15 41 99 2a 7e b3 93 ab 36
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
[.] jump returned 0x00000000 (0)
|
||||
jump 0x01872000: returned 0x00000000 (0) payload=00 00 00 00
|
||||
@@ -0,0 +1,4 @@
|
||||
[+] challenge f6 fc e9 16 00 00 e7 d3 02 63 a8 c0 f6 f4 e9 17
|
||||
[+] reply 53 f1 47 62 57 42 7b c4 4b 2a 56 c9 e7 30 fd f8
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
jump 0x01875000: NO RETURN within 8.0s
|
||||
@@ -0,0 +1,5 @@
|
||||
[+] challenge ff fc 5d d5 00 00 5d c4 02 63 a8 c0 ff fc 5d d6
|
||||
[+] reply 72 61 60 45 bf bb 0d 01 f0 17 9e b1 87 a0 fd 32
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
[.] jump returned 0x00000000 (0)
|
||||
jump 0x01870000: returned 0x00000000 (0) payload=00 00 00 00
|
||||
@@ -0,0 +1,5 @@
|
||||
[+] challenge ef 8c 60 17 00 00 5d e6 02 63 a8 c0 ef 84 60 18
|
||||
[+] reply 23 5f ff 91 64 74 93 f9 f1 f4 da 11 38 c1 1d 15
|
||||
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
||||
[.] jump returned 0x00000000 (0)
|
||||
jump 0x01876000: returned 0x00000000 (0) payload=00 00 00 00
|
||||
@@ -0,0 +1,407 @@
|
||||
Warning: -video none doesn't make much sense without -seconds_to_run
|
||||
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
|
||||
PROBE armed
|
||||
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
|
||||
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
|
||||
PROBE f=1 pc=3F200040 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901
|
||||
vt1200: scanline#1 line=0 enabled=1
|
||||
vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1
|
||||
vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901
|
||||
vt1200: scanline#2 line=0 enabled=1
|
||||
vt1200: scanline#3 line=1 enabled=1
|
||||
vt1200: scanline#4 line=2 enabled=1
|
||||
PROBE f=3 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=4 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=5 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=6 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=7 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=8 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=9 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=10 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=11 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=12 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=13 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=14 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=15 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=16 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=17 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=18 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=19 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=20 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=21 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=22 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=23 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=24 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=25 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=26 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=27 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=28 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=29 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=30 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=31 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=32 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=33 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=34 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=35 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=36 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=37 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=38 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=39 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=40 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=41 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=42 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=43 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=44 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=45 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=46 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=47 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=48 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=49 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=50 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=51 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=52 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000
|
||||
TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000
|
||||
PROBE f=53 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=54 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=55 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=56 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=57 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=58 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=59 pc=3F705700 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=60 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=61 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=62 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=63 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=64 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=65 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=66 pc=3F705700 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=67 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=68 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=69 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=70 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=71 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=72 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=73 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=74 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=75 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=76 pc=3F701E60 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=77 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=78 pc=3F702C70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=79 pc=3F702070 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=80 pc=3F702530 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=81 pc=3F700E20 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=82 pc=3F7021D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=83 pc=3F7026E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=84 pc=3F700C10 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=85 pc=3F701EB0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=86 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=87 pc=3F701100 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=88 pc=3F7020D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=89 pc=3F702590 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=90 pc=3F700E70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=91 pc=3F7021D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=92 pc=3F702730 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=93 pc=3F701D90 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=94 pc=3F701070 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=95 pc=3F702C70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=96 pc=3F700FF0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=97 pc=3F700ED0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=98 pc=3F7010C0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=100 pc=3F701950 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=104 pc=3F701950 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=107 pc=3F701560 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=113 pc=3F703FA0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=121 pc=3FB44DA0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=131 pc=3F702810 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=241 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=361 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=432 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=433 pc=3F702110 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=472 pc=3F701930 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=477 pc=3F702C30 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=481 pc=3F350F50 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=490 pc=3F7040D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=492 pc=3F702F00 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=493 pc=3F7012A0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=546 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=601 pc=3FB447B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=613 pc=3F708730 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=721 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=841 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=961 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1081 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1118 pc=3F7075A0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1123 pc=3F5D7400 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1124 pc=3F5D5500 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1127 pc=3F708C00 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1201 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1321 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1441 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1561 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1681 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1801 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1921 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1961 pc=3FB2C140 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1979 pc=3FB446C0 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000003 cfd=00000001 cbuf=0095BBD0 ctotal=00000000 clast=55555555 cblock=55555555 cdone=55555555
|
||||
PROBE f=1980 pc=3F5D7060 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE BUFFER buf=0095BBD0 total=600 file=600 bad=0 first_bad=-1
|
||||
PROBE f=2041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=2881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3601 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3721 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3841 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=3961 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4081 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4201 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4321 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4441 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4561 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4681 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4801 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=4921 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=5881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6601 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6721 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6841 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=6961 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7081 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7201 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7321 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7441 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7561 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7681 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7801 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=7921 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=8881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=9001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=9121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=9241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=9361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
PROBE f=9481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555
|
||||
TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5
|
||||
@@ -0,0 +1,4 @@
|
||||
tftp: serving 600 bytes (probe.bin) for any name on ('192.168.99.1', 69)
|
||||
bootp: L2 responder on tap-mess-1000-0: handing out 192.168.99.2, siaddr 192.168.99.1
|
||||
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
|
||||
15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes)
|
||||
@@ -0,0 +1,75 @@
|
||||
#!/usr/bin/env python3
|
||||
"""TFTP + BOOTP server for the dwt/tcpip fetch experiment.
|
||||
|
||||
Serves ``dwt/tcpip/probe.bin`` for *any* requested name (the terminal's TFTP
|
||||
client asks for the exact filename we put in the payload) and logs every RRQ.
|
||||
``--bootp`` reuses the L2 BOOTP responder from ``harness/serve.py`` so the
|
||||
terminal learns 192.168.99.2 at power-up; that file is imported, not modified.
|
||||
|
||||
sudo python3 -u dwt/tcpip/serve_probe.py 192.168.99.1 --bootp
|
||||
|
||||
Run this instead of ``harness/serve.py`` when the file to serve is the probe:
|
||||
both want UDP 69, so only one can be up.
|
||||
"""
|
||||
import argparse
|
||||
import os
|
||||
import sys
|
||||
import time
|
||||
|
||||
HERE = os.path.dirname(os.path.abspath(__file__))
|
||||
ROOT = os.path.dirname(os.path.dirname(HERE))
|
||||
sys.path.insert(0, os.path.join(ROOT, "tools"))
|
||||
sys.path.insert(0, os.path.join(ROOT, "harness"))
|
||||
|
||||
import fontgen # noqa: E402
|
||||
import serve as hserve # noqa: E402
|
||||
|
||||
PROBE = os.path.join(HERE, "probe.bin")
|
||||
|
||||
|
||||
def main(argv=None):
|
||||
ap = argparse.ArgumentParser(description=__doc__,
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter)
|
||||
ap.add_argument("host", nargs="?", default="192.168.99.1")
|
||||
ap.add_argument("port", nargs="?", type=int, default=69)
|
||||
ap.add_argument("--bootp", action="store_true")
|
||||
ap.add_argument("--bootp-client", default="192.168.99.2")
|
||||
ap.add_argument("--bootp-iface", default=None)
|
||||
ap.add_argument("--file", default=PROBE)
|
||||
args = ap.parse_args(argv)
|
||||
|
||||
content = open(args.file, "rb").read()
|
||||
# Answer any name with the probe: the payload chooses the name, and the
|
||||
# log records exactly what the terminal asked for.
|
||||
srv = fontgen.TFTPServer((args.host, args.port), {}, timeout=60.0,
|
||||
retries=10, resolver=lambda name: content).start()
|
||||
print(f"tftp: serving {len(content)} bytes ({os.path.basename(args.file)}) "
|
||||
f"for any name on {srv.address}", flush=True)
|
||||
|
||||
bootp = None
|
||||
if args.bootp:
|
||||
bootp = hserve.BootpResponder(server_ip=args.host,
|
||||
client_ip=args.bootp_client,
|
||||
iface=args.bootp_iface).start()
|
||||
print(f"bootp: L2 responder on {bootp.iface}: handing out "
|
||||
f"{bootp.client_ip}, siaddr {bootp.server_ip}", flush=True)
|
||||
|
||||
start = time.time()
|
||||
try:
|
||||
while True:
|
||||
time.sleep(0.2)
|
||||
while srv.log:
|
||||
ts, name, addr = srv.log.pop(0)
|
||||
stamp = time.strftime("%H:%M:%S", time.localtime(ts))
|
||||
print(f"{stamp} RRQ {addr[0]}:{addr[1]} requested {name!r} "
|
||||
f"({content.__len__()} bytes)", flush=True)
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
finally:
|
||||
srv.stop()
|
||||
if bootp:
|
||||
bootp.stop()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,46 @@
|
||||
; socktest.asm -- call the firmware's socket() wrapper and return.
|
||||
;
|
||||
; Isolates the first call tftp_open makes. Run with rdebug `jump` from the
|
||||
; remote-debug process (or from a create_process child) to see whether the
|
||||
; socket API is usable in that context.
|
||||
;
|
||||
; socket = bit 3F5C9A00h (Ghidra 07EB9340)
|
||||
; socket(domain, type, protocol) = socket(2, 2, 0)
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses):
|
||||
; 01874000 stage (1 entered, 2 socket returned)
|
||||
; 01874020 socket() return (fd, or a negative errno)
|
||||
; 01874200 entry SP
|
||||
; 01874220 entry A14
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @01874200h, 1
|
||||
move a14, @01874220h, 1
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @01874000h, 1
|
||||
|
||||
movi 01873800h, a14, L
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1 ; arg2 = protocol
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1 ; arg0 = AF_INET
|
||||
calla 3F5C9A00h ; socket
|
||||
move @01874200h, sp, 1
|
||||
move @01874220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01874020h, 1
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @01874000h, 1
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
movi 0, a8, L
|
||||
rets
|
||||
.end
|
||||
@@ -0,0 +1,153 @@
|
||||
; tftp_fetch.asm -- fetch a file over TFTP into a malloc'd buffer using the
|
||||
; firmware's own client (dwt_tftp.c in ROM).
|
||||
;
|
||||
; Linked at bit 01870000h (byte 0x30E000) and executed with the rdebug `jump`
|
||||
; call. The payload follows the firmware's stack-argument convention:
|
||||
;
|
||||
; MOVE A14,-*SP,1 ; reserve the slot the callee restores
|
||||
; MOVE argN,*A14+,1 ; last argument first, upward via A14
|
||||
; MOVE arg0,*A14+,1 ; first argument last
|
||||
; CALLA target
|
||||
;
|
||||
; We point A14 at a fixed argument area and restore SP/A14 from the saved
|
||||
; entry values after every call, so a payload bug cannot walk the caller's
|
||||
; stack. a9 and a11 are callee-saved by tftp_open/tftp_read/tftp_close and
|
||||
; hold the fd and the current write pointer across calls.
|
||||
;
|
||||
; Firmware entry points (bit addresses; Ghidra = bit >> 3):
|
||||
; malloc 3F701230h (Ghidra 07EE0246) malloc(bytes) -> bit pointer
|
||||
; tftp_open 3F5EBC40h (Ghidra 07EBD788) tftp_open(host, filename) -> fd
|
||||
; tftp_read 3F5ED230h (Ghidra 07EBDA46) tftp_read(fd, buf, bufsize) -> n
|
||||
; tftp_close 3F5EC860h (Ghidra 07EBD90C) tftp_close(fd)
|
||||
;
|
||||
; tftp_read returns the DATA payload length, and 0 once a short (final) block
|
||||
; has been consumed. tftp_close sends TFTP ERROR 3 if the last block read was
|
||||
; a full 512 bytes, so the loop must read until it gets 0.
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses; peeked over rdebug):
|
||||
; 01871000 stage (1 malloc, 2 open, 3 reading, 4 closed, 0FFh failed)
|
||||
; 01871020 fd
|
||||
; 01871040 buffer pointer (returned by malloc; a BIT address)
|
||||
; 01871060 total bytes fetched
|
||||
; 01871080 last tftp_read return
|
||||
; 018710A0 marker: 05A5A5A5h when the fetch completed
|
||||
; 018710C0 tftp_close return scratch
|
||||
; 01871200 entry SP
|
||||
; 01871220 entry A14
|
||||
;
|
||||
; The fetched bytes are at [01871040] and are compared with the served file.
|
||||
; The marker cells are deliberately above 01870AD0 (the end of this image):
|
||||
; writing them into the code was the first, silent failure of this payload.
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @01871200h, 1 ; entry SP
|
||||
move a14, @01871220h, 1 ; entry A14
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @01871000h, 1 ; stage = 1
|
||||
|
||||
; ---- buf = malloc(010000h) ------------------------------------
|
||||
move a14, -*sp, 1
|
||||
movi 01878000h, a14, L ; argument area
|
||||
movi 010000h, a0, L ; 65536 bytes
|
||||
move a0, *a14+, 1
|
||||
calla 3F701230h ; malloc
|
||||
move @01871200h, sp, 1
|
||||
move @01871220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01871040h, 1 ; buffer pointer (bit address)
|
||||
move a8, a11
|
||||
move a8, a8
|
||||
jreq fail
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @01871000h, 1 ; stage = 2
|
||||
|
||||
; ---- fd = tftp_open("192.168.99.1", "dwt/tcpip/probe.bin") -----
|
||||
movi 01878000h, a14, L ; argument area
|
||||
movi FNAME, a0, L
|
||||
move a0, *a14+, 1 ; arg1 = filename
|
||||
movi HOST, a0, L
|
||||
move a0, *a14+, 1 ; arg0 = host
|
||||
calla 3F5EBC40h ; tftp_open
|
||||
move @01871200h, sp, 1
|
||||
move @01871220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01871020h, 1 ; fd
|
||||
move a8, a9
|
||||
move a8, a8
|
||||
jrlt fail
|
||||
|
||||
; ---- while ((n = tftp_read(fd, p, 010000h)) > 0) p += n --------
|
||||
movi 3, a0, L
|
||||
move a0, @01871000h, 1 ; stage = 3
|
||||
read_loop:
|
||||
movi 01878000h, a14, L
|
||||
movi 010000h, a0, L
|
||||
move a0, *a14+, 1 ; arg2 = bufsize
|
||||
move a11, *a14+, 1 ; arg1 = buffer
|
||||
move a9, *a14+, 1 ; arg0 = fd
|
||||
calla 3F5ED230h ; tftp_read
|
||||
move @01871200h, sp, 1
|
||||
move @01871220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01871080h, 1 ; last return
|
||||
move a8, a8
|
||||
jrle close_it
|
||||
add a8, a11 ; advance the write pointer
|
||||
move @01871060h, a1, 1
|
||||
add a8, a1
|
||||
move a1, @01871060h, 1 ; total += n
|
||||
jruc read_loop
|
||||
|
||||
close_it:
|
||||
movi 4, a0, L
|
||||
move a0, @01871000h, 1 ; stage = 4
|
||||
movi 01878000h, a14, L
|
||||
move a9, *a14+, 1 ; arg0 = fd
|
||||
calla 3F5EC860h ; tftp_close
|
||||
move @01871200h, sp, 1
|
||||
move @01871220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @018710C0h, 1
|
||||
movi 05A5A5A5h, a0, L
|
||||
move a0, @018710A0h, 1 ; DONE marker
|
||||
sub a8, a8 ; return 0
|
||||
jruc epilogue
|
||||
|
||||
fail:
|
||||
movi 0FFh, a0, L
|
||||
move a0, @01871000h, 1
|
||||
movi 0FFFFFFFFh, a8, L
|
||||
epilogue:
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
rets
|
||||
|
||||
HOST:
|
||||
.word 03931h ; "192.168.99.1"
|
||||
.word 02E32h
|
||||
.word 03631h
|
||||
.word 02E38h
|
||||
.word 03939h
|
||||
.word 0312Eh
|
||||
.word 00000h
|
||||
FNAME:
|
||||
.word 07764h ; "dwt/tcpip/probe.bin"
|
||||
.word 02F74h
|
||||
.word 06374h
|
||||
.word 06970h
|
||||
.word 02F70h
|
||||
.word 07270h
|
||||
.word 0626Fh
|
||||
.word 02E65h
|
||||
.word 06962h
|
||||
.word 0006Eh
|
||||
.end
|
||||
@@ -0,0 +1,256 @@
|
||||
; tftpc.asm -- minimal TFTP read client built on the firmware's socket API.
|
||||
;
|
||||
; The firmware's own tftp_open() calls a resolver that does not return when
|
||||
; called from the rdebug process (dwt/notes/TCPIP.md), so this payload speaks
|
||||
; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one file.
|
||||
;
|
||||
; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n
|
||||
; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags, from, fromlen) -> n
|
||||
; close = 3F5E8930h close(fd)
|
||||
; malloc = 3F701230h malloc(bytes) -> bit pointer
|
||||
;
|
||||
; The transfer is 600 bytes, so DATA 1 is 512 (full) and DATA 2 is 88
|
||||
; (short); the short block ends the transfer. ACKs go to the sockaddr that
|
||||
; recvfrom reports, not to a hard-coded port.
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses):
|
||||
; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4 closed, 0FFh failed)
|
||||
; 0187C020 fd
|
||||
; 0187C040 destination buffer (malloc)
|
||||
; 0187C060 total bytes fetched
|
||||
; 0187C080 last recvfrom length
|
||||
; 0187C0A0 last DATA block word as read from the wire
|
||||
; 0187C0C0 marker 05A5A5A5h when the fetch completed
|
||||
; 0187C200 entry SP
|
||||
; 0187C220 entry A14
|
||||
;
|
||||
; Scratch (fixed bit addresses, above this image):
|
||||
; 01875000 argument area
|
||||
; 01876000 receive buffer (2048 bytes)
|
||||
; 0187A000 recvfrom source sockaddr
|
||||
; 0187A080 recvfrom sockaddr length
|
||||
; 0187A100 ACK packet (4 bytes)
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @0187C200h, 1
|
||||
move a14, @0187C220h, 1
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @0187C000h, 1
|
||||
|
||||
; ---- buf = malloc(010000h) ------------------------------------
|
||||
move a14, -*sp, 1
|
||||
movi 01875000h, a14, L
|
||||
movi 010000h, a0, L
|
||||
move a0, *a14+, 1
|
||||
calla 3F701230h
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @0187C040h, 1
|
||||
move a8, a11 ; dest cursor (callee-saved)
|
||||
move a8, a8
|
||||
jreq fail
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @0187C000h, 1
|
||||
|
||||
; ---- fd = socket(2,2,0) --------------------------------------
|
||||
movi 01875000h, a14, L
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1
|
||||
calla 3F5C9A00h
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @0187C020h, 1
|
||||
move a8, a9 ; fd (callee-saved)
|
||||
move a8, a8
|
||||
jrlt fail
|
||||
|
||||
; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) ------------------------
|
||||
movi 01875000h, a14, L
|
||||
movi 16, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi SADDR, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 28, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi RRQ, a0, L
|
||||
move a0, *a14+, 1
|
||||
move a9, *a14+, 1
|
||||
calla 3F5D3D70h
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, a8
|
||||
jrlt fail
|
||||
|
||||
movi 3, a0, L
|
||||
move a0, @0187C000h, 1
|
||||
sub a0, a0
|
||||
move a0, @0187C060h, 1 ; total = 0
|
||||
|
||||
recv_loop:
|
||||
; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) -------------
|
||||
; arg5 is a POINTER to the socklen (as tftp_read passes it); the
|
||||
; value is initialised to 16 first.
|
||||
movi 16, a0, L
|
||||
move a0, @0187A080h, 1 ; fromlen = 16
|
||||
movi 01875000h, a14, L
|
||||
movi 0187A080h, a0, L
|
||||
move a0, *a14+, 1 ; arg5 = &fromlen
|
||||
movi 0187A000h, a0, L
|
||||
move a0, *a14+, 1 ; arg4 = &from
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1 ; arg3 = flags
|
||||
movi 00800h, a0, L
|
||||
move a0, *a14+, 1 ; arg2 = 2048
|
||||
movi 01876000h, a0, L
|
||||
move a0, *a14+, 1 ; arg1 = receive buffer
|
||||
move a9, *a14+, 1 ; arg0 = fd
|
||||
calla 3F5D7D50h
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
|
||||
move a8, @0187C080h, 1 ; last length
|
||||
move a8, a8
|
||||
jrle fail
|
||||
|
||||
; opcode: wire 00 03 -> little-endian word 0300h
|
||||
move @01876000h, a0, 0
|
||||
cmpi 0300h, a0
|
||||
jrne fail ; only DATA is accepted
|
||||
|
||||
move @01876010h, a4, 0 ; block number, wire order
|
||||
move a4, @0187C0A0h, 1
|
||||
|
||||
move a8, a3
|
||||
subk 4, a3 ; payload length
|
||||
|
||||
; ---- total += payload, dest += payload -----------------------
|
||||
move @0187C060h, a1, 1
|
||||
add a3, a1
|
||||
move a1, @0187C060h, 1 ; total += payload (bytes)
|
||||
move a11, a6 ; copy destination
|
||||
move a3, a2
|
||||
sll 3, a2 ; bytes -> bits: pointers are bit addresses
|
||||
add a2, a11 ; dest cursor advances now (do NOT add bytes)
|
||||
|
||||
; ---- copy payload from BUF+4 to a6, one byte at a time ------
|
||||
; Interrupts are disabled for the copy so a 512-byte copy is atomic
|
||||
; with respect to the firmware's ISRs.
|
||||
dint
|
||||
movi 01876020h, a5, L
|
||||
move a3, a2
|
||||
move a3, @0187C0E0h, 1 ; payload length
|
||||
move a2, @0187C140h, 1 ; copy count
|
||||
move a6, @0187C120h, 1 ; write start
|
||||
move a11, @0187C100h, 1 ; cursor after advance
|
||||
move a5, @0187C160h, 1 ; source
|
||||
jreq copy_done
|
||||
copy_bytes:
|
||||
movb *a5, a0
|
||||
movb a0, *a6
|
||||
addk 8, a5 ; one byte
|
||||
addk 8, a6
|
||||
dsjs a2, copy_bytes
|
||||
copy_done:
|
||||
eint
|
||||
|
||||
; ---- ACK: 00 04 <block as received> --------------------------
|
||||
movi 00400h, a0, L
|
||||
move a0, @0187A100h, 0
|
||||
move a4, @0187A110h, 0
|
||||
|
||||
movi 01875000h, a14, L
|
||||
movi 16, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 0187A000h, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 4, a0, L
|
||||
move a0, *a14+, 1
|
||||
movi 0187A100h, a0, L
|
||||
move a0, *a14+, 1
|
||||
move a9, *a14+, 1
|
||||
calla 3F5D3D70h
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, a8
|
||||
jrlt fail
|
||||
|
||||
; short block ends the transfer; full block means read again
|
||||
move @0187C080h, a2, 1
|
||||
subk 4, a2
|
||||
cmpi 512, a2
|
||||
jrlt close_it
|
||||
jruc recv_loop
|
||||
|
||||
close_it:
|
||||
movi 4, a0, L
|
||||
move a0, @0187C000h, 1
|
||||
movi 01875000h, a14, L
|
||||
move a9, *a14+, 1
|
||||
calla 3F5E8930h ; close(fd)
|
||||
move @0187C200h, sp, 1
|
||||
move @0187C220h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
movi 05A5A5A5h, a0, L
|
||||
move a0, @0187C0C0h, 1
|
||||
sub a8, a8
|
||||
jruc epilogue
|
||||
|
||||
fail:
|
||||
movi 0FFh, a0, L
|
||||
move a0, @0187C000h, 1
|
||||
movi 0FFFFFFFFh, a8, L
|
||||
epilogue:
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
rets
|
||||
|
||||
RRQ:
|
||||
.word 00100h ; opcode 1 (00 01)
|
||||
.word 07764h ; "dw"
|
||||
.word 02F74h ; "t/"
|
||||
.word 06374h ; "tc"
|
||||
.word 06970h ; "pi"
|
||||
.word 02F70h ; "p/"
|
||||
.word 07270h ; "pr"
|
||||
.word 0626Fh ; "ob"
|
||||
.word 02E65h ; "e."
|
||||
.word 06962h ; "bi"
|
||||
.word 0006Eh ; "n\0"
|
||||
.word 0636Fh ; "oc"
|
||||
.word 06574h ; "te"
|
||||
.word 00074h ; "t\0"
|
||||
SADDR:
|
||||
.word 00002h ; sin_family = AF_INET
|
||||
.word 04500h ; sin_port = htons(69)
|
||||
.word 0A8C0h ; 192.168
|
||||
.word 00163h ; .99.1
|
||||
.word 0
|
||||
.word 0
|
||||
.word 0
|
||||
.word 0
|
||||
.end
|
||||
@@ -0,0 +1,96 @@
|
||||
; udptest.asm -- socket() + sendto() a real TFTP RRQ.
|
||||
;
|
||||
; socket = 3F5C9A00h socket(2,2,0) -> fd
|
||||
; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n
|
||||
;
|
||||
; The RRQ is the packet the firmware itself would send for
|
||||
; "dwt/tcpip/probe.bin" in octet mode. A server log line for this packet is
|
||||
; proof that UDP transmit works from the calling process; no reply is read.
|
||||
;
|
||||
; Evidence cells (32-bit, bit addresses):
|
||||
; 01876800 stage (1 entered, 2 sendto returned)
|
||||
; 01876820 socket fd
|
||||
; 01876840 sendto return
|
||||
; 01876A00 entry SP
|
||||
; 01876A20 entry A14
|
||||
|
||||
.text
|
||||
_start:
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
move sp, @01876A00h, 1
|
||||
move a14, @01876A20h, 1
|
||||
|
||||
movi 1, a0, L
|
||||
move a0, @01876800h, 1
|
||||
|
||||
movi 01877000h, a14, L
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1 ; arg2 = protocol
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
||||
movi 2, a0, L
|
||||
move a0, *a14+, 1 ; arg0 = AF_INET
|
||||
calla 3F5C9A00h
|
||||
move @01876A00h, sp, 1
|
||||
move @01876A20h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01876820h, 1
|
||||
move a8, a9
|
||||
|
||||
movi 2, a0, L
|
||||
move a0, @01876800h, 1
|
||||
|
||||
; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16)
|
||||
movi 01877000h, a14, L
|
||||
movi 16, a0, L
|
||||
move a0, *a14+, 1 ; arg5 = 16
|
||||
movi SADDR, a0, L
|
||||
move a0, *a14+, 1 ; arg4 = &sockaddr
|
||||
movi 0, a0, L
|
||||
move a0, *a14+, 1 ; arg3 = flags
|
||||
movi 28, a0, L
|
||||
move a0, *a14+, 1 ; arg2 = length
|
||||
movi RRQ, a0, L
|
||||
move a0, *a14+, 1 ; arg1 = packet
|
||||
move a9, *a14+, 1 ; arg0 = fd
|
||||
calla 3F5D3D70h
|
||||
move @01876A00h, sp, 1
|
||||
move @01876A20h, a14, 1
|
||||
setf 16, 0, 0
|
||||
setf 32, 0, 1
|
||||
move a8, @01876840h, 1
|
||||
|
||||
movi 3, a0, L
|
||||
move a0, @01876800h, 1
|
||||
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
||||
movi 0, a8, L
|
||||
rets
|
||||
|
||||
RRQ:
|
||||
.word 00100h ; opcode 1 (00 01)
|
||||
.word 07764h ; "dw"
|
||||
.word 02F74h ; "t/"
|
||||
.word 06374h ; "tc"
|
||||
.word 06970h ; "pi"
|
||||
.word 02F70h ; "p/"
|
||||
.word 07270h ; "pr"
|
||||
.word 0626Fh ; "ob"
|
||||
.word 02E65h ; "e."
|
||||
.word 06962h ; "bi"
|
||||
.word 0006Eh ; "n\0"
|
||||
.word 0636Fh ; "oc"
|
||||
.word 06574h ; "te"
|
||||
.word 00074h ; "t\0"
|
||||
SADDR:
|
||||
.word 00002h ; sin_family = AF_INET
|
||||
.word 04500h ; sin_port = htons(69)
|
||||
.word 0A8C0h ; 192.168
|
||||
.word 00163h ; .99.1
|
||||
.word 0
|
||||
.word 0
|
||||
.word 0
|
||||
.word 0
|
||||
.end
|
||||
@@ -0,0 +1,88 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Read the fetched TFTP image back with rdebug peek and compare it byte-for-byte.
|
||||
|
||||
python3 dwt/tcpip/verify.py --host 192.168.99.2 \
|
||||
--markers 0x0187C000 --file dwt/tcpip/probe.bin
|
||||
|
||||
Marker layout is the one in tftpc.asm:
|
||||
+0x00 stage, +0x20 fd, +0x40 buffer, +0x60 total,
|
||||
+0x80 last recvfrom length, +0xA0 last block, +0xC0 done.
|
||||
|
||||
The comparison is the acceptance check: the payload is not trusted to report
|
||||
its own success.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
import os
|
||||
import sys
|
||||
|
||||
HERE = os.path.dirname(os.path.abspath(__file__))
|
||||
DWT = os.path.dirname(HERE)
|
||||
sys.path.insert(0, DWT)
|
||||
|
||||
import challenge # noqa: E402
|
||||
import exploit # noqa: E402
|
||||
|
||||
_orig_answer = exploit.RDebug.answer_challenge
|
||||
|
||||
|
||||
def _answer(self, challenge_bytes: bytes) -> None:
|
||||
self.challenge_raw = challenge.respond(challenge_bytes)
|
||||
return _orig_answer(self, challenge_bytes)
|
||||
|
||||
|
||||
exploit.RDebug.answer_challenge = _answer
|
||||
|
||||
|
||||
def main(argv=None):
|
||||
ap = argparse.ArgumentParser(description=__doc__,
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter)
|
||||
ap.add_argument("--host", default="192.168.99.2")
|
||||
ap.add_argument("--port", type=int, default=771)
|
||||
ap.add_argument("--markers", type=exploit.parse_int, default=0x0187C000)
|
||||
ap.add_argument("--file", default=os.path.join(HERE, "probe.bin"))
|
||||
a = ap.parse_args(argv)
|
||||
|
||||
want = open(a.file, "rb").read()
|
||||
rd = exploit.RDebug(a.host, a.port, 10.0, False)
|
||||
rd.connect()
|
||||
rd.liveness(7)
|
||||
|
||||
def u32(off):
|
||||
return int.from_bytes(rd.peek(a.markers + off, 4), "little")
|
||||
|
||||
stage, fd, buf, total = u32(0), u32(0x20), u32(0x40), u32(0x60)
|
||||
last, block, done = u32(0x80), u32(0xA0), u32(0xC0)
|
||||
print(f"stage={stage} fd={fd} buf={buf:#010x} total={total} "
|
||||
f"last={last} block={block:#06x} done={done:#010x}")
|
||||
|
||||
if stage != 4 or done != 0x05A5A5A5:
|
||||
print("FAIL: payload did not reach the completed state")
|
||||
return 2
|
||||
if total != len(want):
|
||||
print(f"FAIL: total {total} != file size {len(want)}")
|
||||
return 2
|
||||
|
||||
got = b""
|
||||
off = 0
|
||||
while off < total:
|
||||
n = min(exploit.MAX_XFER, total - off)
|
||||
got += rd.peek(buf + off * 8, n)
|
||||
off += n
|
||||
|
||||
if got == want:
|
||||
print(f"OK: {len(got)} bytes at {buf:#010x} match {a.file} "
|
||||
f"sha256={hashlib.sha256(got).hexdigest()}")
|
||||
return 0
|
||||
for i, (x, y) in enumerate(zip(got, want)):
|
||||
if x != y:
|
||||
print(f"FAIL: first mismatch at byte {i}: got {x:02x} want {y:02x}")
|
||||
break
|
||||
print(f"FAIL: {len(got)} bytes differ from {a.file}")
|
||||
return 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Reference in new issue
Block a user