diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md index 407d1aa..7b493e0 100644 --- a/dwt/notes/CROSS.md +++ b/dwt/notes/CROSS.md @@ -373,3 +373,18 @@ Facts for anyone tempted to "just create a window" (details in client is "one call away". * Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the realistic route for making the Terminal Manager draw something. + +## 2026-10-18 15:25 EEST — TFTP fetch into a malloc buffer works from rdebug + +For the COFF-loader agent (details: `dwt/notes/LOADER_CROSS.md` and +`dwt/notes/TCPIP.md`): + +* The firmware `tftp_open` hangs from the rdebug process (its resolver; no RRQ). + Use the socket API instead: `socket` `3F5C9A00`, `sendto` `3F5D3D70`, + `recvfrom` `3F5D7D50` (`arg5 = &socklen`, initialise to 16), `close` + `3F5E8930`, `malloc` `3F701230`. Stack args, last first. +* Verified: `dwt/tcpip/tftpc.asm` (bit `01870000`) fetched 600 B into the + malloc buffer `0x00b5bcd0`; server RRQ `'dwt/tcpip/probe.bin'`; peek/cmp + byte-identical (sha256 `9662e62b…333359`). Run it in the **rdebug process**. +* Pointers are bit addresses: advance a data cursor by `n*8`. Keep the 2048-B + receive buffer and the `from`/`fromlen`/ACK cells disjoint. diff --git a/dwt/notes/LOADER_CROSS.md b/dwt/notes/LOADER_CROSS.md index 4199277..2ba5432 100644 --- a/dwt/notes/LOADER_CROSS.md +++ b/dwt/notes/LOADER_CROSS.md @@ -128,3 +128,28 @@ out of the target sections; the loader cannot see them. offsets match it. * `dwt/notes/LOADER.md` — the full COFF layout, the position-dependence evidence and the loader algorithm. + +## 2026-10-18 15:25 EEST — TFTP fetch works from the rdebug process + +* **Exact fetch call:** the firmware's `tftp_open` is unusable (hangs in its + resolver, no RRQ). Use the minimal client in `dwt/tcpip/tftpc.asm` + (bit `01870000`, 694 B): `malloc(0x10000)` at `3F701230`, `socket(2,2,0)` at + `3F5C9A00`, `sendto(fd,buf,len,0,to,16)` at `3F5D3D70`, + `recvfrom(fd,buf,2048,0,&from,&fromlen)` at `3F5D7D50` with `*fromlen=16`, + `close(fd)` at `3F5E8930`. Stack arguments are pushed **last first**; the + sixth `recvfrom` argument is a **pointer to the socklen**. +* **Buffer/process:** run in the **rdebug process** (ordinary `jump`); no + `create_process` and no registration. A child returned `-1` from `socket()` + in the one attempt. `malloc` returns a **bit** address; advance the + destination by `n*8`, not `n`. Keep the receive buffer (2048 B) and the + `from`/`fromlen`/ACK cells disjoint — a `0x800` bit offset is only 256 bytes. +* **Verified:** 600 B fetched into the malloc buffer at `0x0095bbd0`, server + RRQ `15:23:48 ... requested 'dwt/tcpip/probe.bin'`, and `peek`/`cmp` match + byte-for-byte (sha256 `9662e62b…333359`). The payload returns 0; rdebug stays + live. +* **Hand-off:** the fetched buffer's bit address and byte length go straight + into the descriptor at `0x01882C00` (`magic 4C44/5231, buf, len, mode=1`), + then `calla 01880000h` with `A8=0` or the descriptor address. The transport + scratch is below `0x01880000` (recv `01876000`, `from` `0187A000`, `fromlen` + `0187A080`, ACK `0187A100`), so it does not collide with the loader page + `01880000`–`01883200`. diff --git a/dwt/notes/TCPIP.md b/dwt/notes/TCPIP.md new file mode 100644 index 0000000..9ac19f3 --- /dev/null +++ b/dwt/notes/TCPIP.md @@ -0,0 +1,251 @@ +# VT1200 TCP/IP and a working TFTP fetch + +Date: 2026-10-18. Firmware `vt1200_v22.bin` md5 +`b46a3e442ccb86134d2356bd70d22fd2` (**unmodified**). No driver edits, no ROM +patch. The emulator ran the documented `VT1200_SKIP_LEVEL1=1` divergence with a +private `-cfg_directory`/`-nvram_directory`, the LANCE on `taptun`, BOOTP from a +private server, and `dwt/tcpip/probe.bin` served over TFTP. + +**Result:** a payload (`dwt/tcpip/tftpc.asm`) fetched a 600-byte file from +`192.168.99.1:69` into a `malloc`'d buffer, in the **rdebug process** (ordinary +`jump`, no `create_process`), and `peek` returned it byte-for-byte: + +``` +stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5 +OK: 600 bytes at 0x0095bbd0 match dwt/tcpip/probe.bin +sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359 +``` + +Server-side RRQ (fresh server log for that run): + +``` +15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes) +``` + +The firmware's own `tftp_open` is **not usable from the rdebug process**: it +never returns and emits no RRQ (details in §3). The fetch is therefore a +minimal RFC 783 client built on the firmware's socket API — the allowed +fallback, not a mock. + +--- + +## 1. Stack architecture + +TCP/IP is an **in-process library with a kernel-lock wrapper**, not a separate +service with an IPC protocol. Every socket call is an ordinary ROM function +taking stack arguments in the firmware convention: + +``` +MOVE A14,-*SP,1 ; reserve the slot the callee restores +MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument first, upward via A14 +... +MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last +CALLA target +``` + +The wrappers take the per-process lock at `[@0x1B3900]+0x1C1` and dispatch +through the kernel entry, but from the caller's point of view they are library +calls: no registration, no service name, and no X-style attach. The arguments +are the normal BSD socket arguments; `struct sockaddr` is a 16-byte +`{u16 family; u16 port; u32 addr; u8 zero[8]}` in **network byte order** (the +firmware calls `htons(69)` itself in `tftp_open`). + +### Verified entry points + +| function | bit address | Ghidra | ABI (source order) | status | +|---|---|---|---|---| +| `socket` | `3F5C9A00` | `07EB9340` | `socket(domain, type, protocol)` -> fd | **verified live**, returns 1 | +| `bind` | `3F5CAA80` | `07EB9550` | `bind(fd, sockaddr*, len)` | from the BOOTP caller | +| `listen` | `3F5CBCD0` | `07EB979A` | `listen(fd, backlog)` | from inetd (`backlog=5`) | +| `accept` | `3F5CCB40` | `07EB9968` | `accept(fd, sockaddr*, len*)` | from inetd (`NULL,NULL`) | +| `sendto` | `3F5D3D70` | `07EBA7AE` | `sendto(fd, buf, len, flags, to, tolen)` -> n | **verified live** (28-byte RRQ) | +| `recvfrom` | `3F5D7D50` | `07EBAFAA` | `recvfrom(fd, buf, len, flags, &from, &fromlen)` -> n | **verified live** (516/92-byte DATA) | +| `read` | `3F5D8E70` | `07EBB1CE` | `read(fd, buf, len)` | the rdebug/X read wrapper named in the brief | +| `close` | `3F5E8930` | `07EBD126` | `close(fd)` | **verified live** | +| `setsockopt` | `3F5DD260` | `07EBBA4C` | `setsockopt(fd, level, name, val*, len)` | from the BOOTP/X callers | +| `select` (candidate) | `3F871CE0` | `07F0E39C` | `select(nfds, r, w, e, timeout)` | wrapper used by Xlib; not exercised | +| `malloc` | `3F701230` | `07EE0246` | `malloc(bytes)` -> **bit** pointer | **verified live** | +| `create_process` | `3F706A40` | `07EE0D48` | `create_process(entry,name,stack,1,arg)` | known from the GUI work | + +`connect` was not needed and is not in this table: the fetch uses UDP +`sendto`/`recvfrom` only. The candidates in the same wrapper block +(`3F5CF8B0`, `3F5E43F0`) were not exercised, so no ABI is claimed for them. + +`recvfrom`'s sixth argument is a **pointer to a `socklen_t`**, and the caller +must initialise it to 16 before the call. Its fifth argument is a pointer to +the source `sockaddr`. That is exactly how the firmware's own `tftp_read` +passes them (`&0x1CB8A0` / `&0x1CB920`). + +--- + +## 2. Per-process requirements + +* **rdebug process: works.** `socket`, `sendto` and `recvfrom` all return + normally from the process the `jump` handler runs in. The fd is process-local + (`socket` returned 1 in that process). +* **No network context or registration is needed.** The terminal already has + its address (BOOTP) and the stack is up; the calls are plain library calls. +* **`create_process` child:** one attempt (`dwt/tcpip/launcher.asm` + + `socktest.asm`) returned `-1` from `socket()` (`sfd=FFFFFFFF`) even though the + PCB was valid (`pcb=003FFBD0`) and the child had started (`stage=2`). The + machine then went into the boot delay loop. That is **not** a clean child + result, but it is enough to say the working context here is the rdebug + process, not a child. Do not assume the X result (`create_process` is needed) + transfers to sockets; it did not in this test. + +--- + +## 3. The firmware TFTP client (why it was not used) + +The client is `dwt_tftp.c` compiled into ROM: + +| function | bit address | Ghidra | ABI | +|---|---|---|---| +| `tftp_open` | `3F5EBC40` | `07EBD788` | `tftp_open(host, filename)` -> fd, or `-1` | +| `tftp_read` | `3F5ED230` | `07EBDA46` | `tftp_read(fd, buf, bufsize)` -> DATA payload length, `0` at EOF, `-1` error | +| `tftp_close` | `3F5EC860` | `07EBD90C` | `tftp_close(fd)` | + +`tftp_open` does, in order: `socket(2,2,0)`, `memset` a 16-byte `sockaddr`, +`sa_family=2`, resolve the host (`3F5933D0`; on `-1` it retries through +`3F5B8580`), `htons(69)` into the port, build the RRQ in its static buffer +(`0x1C85A0`) with mode `octet`, and `sendto`. It returns the fd. + +`tftp_read` receives into its own static buffer `0x1CB960` with length `0x204`, +checks opcode/block, copies `len-4` bytes to the caller's `buf`, ACKs, and sets +`@0x1CB940=1` when the block was shorter than 512. **Read until it returns 0**; +if the caller stops after a full 512-byte block, `tftp_close` sends TFTP ERROR 3 +("Disk full or allocation exceeded") — the behaviour documented in +`harness/mame/FONT_STORAGE_REPORT.md`. + +**Why it is unusable:** calling `tftp_open("192.168.99.1","…")` from the rdebug +process never returns and produces no RRQ. `socket()` alone works (proved with +`socktest.asm`: fd 1), so the hang is downstream; a direct call to the resolver +`3F5933D0` also wedged the service and the machine fell into the boot delay +loop. The exact resolver failure was not reduced further, because the socket +API is sufficient and the fallback is legitimate. **Do not call `tftp_open` +from a payload on this image.** + +--- + +## 4. The working fetch + +Payload: `dwt/tcpip/tftpc.asm`, built by `dwt/tcpip/build.sh` to +`dwt/tcpip/build/tftpc.bin` (694 bytes, linked at bit `01870000`). + +It is a minimal RFC 783 client: + +1. `buf = malloc(0x10000)`; keep the returned **bit** pointer in `a11`. +2. `fd = socket(2,2,0)`; keep it in `a9`. +3. `sendto(fd, RRQ, 28, 0, &server, 16)`, where the RRQ is + `dwt/tcpip/probe.bin` in `octet` mode and `server` is + `{AF_INET, htons(69), 192.168.99.1}`. +4. `recvfrom(fd, recv, 2048, 0, &from, &fromlen)`; accept only opcode 3 + (`00 03` on the wire, read as the 16-bit word `0x0300`). +5. Copy `len-4` payload bytes to `buf`, send ACK `00 04 ` to the + `from` address returned by `recvfrom`, advance `buf` by `(len-4)*8` **bits**. +6. Repeat while the block was full (512); a short block ends the transfer. + `close(fd)`. + +Evidence: + +``` +# server (dwt/tcpip/serve_probe.py, fresh log) +15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes) + +# MAME-side markers (probe.lua) +TCPC cstage=00000004 cfd=00000001 cbuf=00B5BCD0 ctotal=00000258 \ + clast=0000005C cblock=00000200 cdone=05A5A5A5 + +# rdebug peek + byte comparison (dwt/tcpip/verify.py) +stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5 +OK: 600 bytes at 0x0095bbd0 match dwt/tcpip/probe.bin +sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359 + +$ cmp dwt/tcpip/run/fetched.bin dwt/tcpip/probe.bin +(no output = identical) +``` + +`ctotal` counts the 512-byte block 1 plus the 88-byte block 2; `clast=0x5C` +is the 92-byte DATA packet (88 + 4-byte header); `cblock=0x0200` is the wire +word for block 2 (bytes `00 02`). + +The payload returns 0, so the same rdebug connection and later connections are +still live. No breakpoints, no ROM patch, no `create_process`. + +### The two bugs that cost the debugging cycles + +1. **Pointers are bit addresses.** After copying `n` bytes, the destination + cursor must advance by `n*8`. Adding `n` puts block 2 at `dest+64` for a + 512-byte block, which looks like a copy corruption. +2. **The receive buffer and the `from` sockaddr must not overlap.** A bit + offset of `0x800` is 256 bytes, not 2048: with the receive buffer at + `0187B000`, `from=0187B800` sat 256 bytes into the 2048-byte buffer and the + stack's `from` write corrupted the payload at offset 252. The working layout + is recv `01876000` (2048 bytes), `from` `0187A000`, `fromlen` `0187A080`, + ACK `0187A100`. + +--- + +## 5. What a loader must do to fetch a COFF at runtime + +1. Deliver a small bootstrap with rdebug `poke` + `jump` (or `create_process` if + a child is needed for the loader itself). +2. In the rdebug process: `malloc(size)` for the COFF, then `socket(2,2,0)`, + `sendto` an RRQ for the COFF name, and the `recvfrom`/ACK loop from + `tftpc.asm`. Use a receive buffer of at least 2048 bytes, separate from the + `from`/`fromlen`/ACK cells. +3. Append blocks at `dest + total*8` bits, not `dest + total`. +4. Stop on a short block; `close(fd)`. No timeout is built in — the server is + local and the payload blocks in `recvfrom`. Add `setsockopt(SO_RCVTIMEO)` or + a retry if a lossy link matters. +5. Hand the buffer to the loader resident at bit `01880000` + (`dwt/loader/build/loader.bin`, 1220 B): write the descriptor at + `01882C00` — `u16 0x4C44, u16 0x5231, u32 buf, u32 len_bytes, u32 mode=1` — + then `move a14,-*sp,1; calla 01880000h` with `A8=0` (fixed descriptor) or + the descriptor's bit address. The loader parses the COFF, copies + `.text`/`.data`, zeroes `.bss` and calls `create_process` itself. The full + contract, including the status block at `01882D00`, is in + `dwt/notes/LOADER_CROSS.md`. +6. Keep the COFF buffer alive; it is not reused by the fetch after the payload + returns. The transport's code (`01870000`), argument area (`01875000`), + receive buffer (`01876000`–`0187A000`), `from`/`fromlen`/ACK cells + (`0187A000`–`0187A120`) and markers (`0187C000`) are all below the loader + page, so they do not collide with `01880000`–`01883200`. + +The fetch call itself is only `malloc`/`socket`/`sendto`/`recvfrom`/`close`; +the firmware `tftp_open` must not be used. + +--- + +## 6. Limits and files + +* **Buffer:** the test allocates 64 KiB; the proof file is 600 bytes. The + receive buffer is 2048 bytes and the server's block size is 512, so the + largest single DATA packet is 516 bytes. A COFF over TFTP is limited only by + the malloc block and the 16-bit block counter (32 MiB at 512-byte blocks). +* **Timeouts:** none in the payload; `recvfrom` blocks until a packet arrives. + The server side has 10 retries at 60 s. A lost packet hangs the `jump`. +* **Concurrency:** the server is single-threaded. An un-ACKed transfer (the + first `udptest` left one) blocks later RRQs until it times out; restart the + server or use a per-transfer server. +* **Process:** rdebug process. A `create_process` child returned `-1` from + `socket()` in the one attempt; if the loader is a child, prove `socket()` + first. + +| path | contents | +|---|---| +| `dwt/tcpip/tftpc.asm` | the working minimal TFTP client (694 B, bit `01870000`) | +| `dwt/tcpip/build/tftpc.bin`, `.lst`, `.map` | built payload and assembler/link records | +| `dwt/tcpip/tfetch.asm` | firmware-`tftp_open` attempt (hangs; kept as the negative result) | +| `dwt/tcpip/socktest.asm`, `restest.asm`, `udptest.asm` | the isolation steps: socket, resolver, sendto | +| `dwt/tcpip/launcher.asm` | `create_process` launcher used for the child attempt | +| `dwt/tcpip/copytest.asm` | isolated byte-copy loop | +| `dwt/tcpip/serve_probe.py` | TFTP server for `probe.bin` + BOOTP (imports `harness/serve.py`) | +| `dwt/tcpip/probe.bin` | 600-byte distinctive probe file | +| `dwt/tcpip/verify.py` | rdebug peek + byte-for-byte comparison | +| `dwt/tcpip/probe.lua` | MAME-side marker/PC sampler and buffer check | +| `dwt/tcpip/run/server_final.log` | the final RRQ line | +| `dwt/tcpip/run/mame_final.log` | final `TCPC` marker line (`ctotal=0x258`) | +| `dwt/tcpip/run/final2_verify.log`, `fetched.bin` | peek comparison and the 600 fetched bytes | +| `dwt/tcpip/run/inject_tftpc.log`, `inject_res.log`, `inject_child_sock.log` | negative results: `tftp_open`, resolver, child `socket()` | +| `dwt/notes/LOADER_CROSS.md` | the loader/transport contract (loader at `01880000`, descriptor at `01882C00`) | diff --git a/dwt/tcpip/.gitignore b/dwt/tcpip/.gitignore new file mode 100644 index 0000000..be3229d --- /dev/null +++ b/dwt/tcpip/.gitignore @@ -0,0 +1,7 @@ +# SDK scratch (GSPA/GSPLNK tools and intermediate files) +work/ +__pycache__/ + +# MAME runtime state, recreated per run +run/cfg/ +run/nvram/ diff --git a/dwt/tcpip/build.sh b/dwt/tcpip/build.sh new file mode 100755 index 0000000..448001a --- /dev/null +++ b/dwt/tcpip/build.sh @@ -0,0 +1,70 @@ +#!/bin/sh +# Build a VT1200 payload with the 1987 TI TMS34010 SDK (GSPA/GSPLNK under +# DOSBox). Same flow as dwt/gui/build.sh, but all work/output stays under +# dwt/tcpip/. +# +# dwt/tcpip/build.sh SOURCE.asm [ORIGIN_BITS] +# +# Output: dwt/tcpip/build/.bin, .map, .lst +set -eu + +ROOT=$(cd "$(dirname "$0")/../.." && pwd) +DIR=$(cd "$(dirname "$0")" && pwd) +SRC=${1:?usage: build.sh SOURCE.asm [ORIGIN_BITS]} +ORIGIN=${2:-01870000} +NAME=$(basename "$SRC" .asm) +BASE=$(printf '%s' "$NAME" | tr 'a-z' 'A-Z') +WORK="$DIR/work" +OUT="$DIR/build" +IMG="$ROOT/tools/tms34010-sdk/1987-05 TMS34010 SDK/1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img" +DOSBOX_CONF="$ROOT/harness/sdk-scratch/dosbox-bench.conf" + +mkdir -p "$WORK" "$OUT" + +if [ ! -x "$WORK/GSPA.EXE" ]; then + mcopy -s -n -i "$IMG" "::/A2/*" "$WORK/" + mcopy -s -n -i "$IMG" "::/C2/*" "$WORK/" +fi + +cp "$SRC" "$WORK/$BASE.ASM" + +case "$ORIGIN" in + [0-9]*) ;; + *) ORIGIN="0$ORIGIN" ;; +esac + +printf '%s\n' \ + '-a' \ + "-o $BASE.out" \ + "-m $BASE.map" \ + "$BASE.obj" \ + 'SECTIONS' \ + '{' \ + " .text ${ORIGIN}h: {}" \ + '}' > "$WORK/$BASE.CMD" +sed -i 's/$/\r/' "$WORK/$BASE.CMD" + +rm -f "$WORK/$BASE.OBJ" "$WORK/$BASE.OUT" "$WORK/$BASE.LST" \ + "$WORK/$BASE.MAP" "$WORK/$BASE.HI" "$WORK/$BASE.LO" + +SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \ +timeout 180 dosbox -conf "$DOSBOX_CONF" -noprimaryconf -nolocalconf \ + -c "mount c $WORK" -c "c:" \ + -c "gspa $BASE $BASE.obj $BASE.lst -l" \ + -c "gsplnk $BASE.cmd" \ + -c "exit" -exit >/dev/null 2>&1 + +if [ ! -f "$WORK/$BASE.OUT" ]; then + echo "build.sh: GSPLNK produced no $BASE.OUT" >&2 + exit 1 +fi +if grep -q '\*\*\*\*\*' "$WORK/$BASE.LST" 2>/dev/null; then + echo "build.sh: assembler diagnostics:" >&2 + grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2 + exit 1 +fi + +python3 "$ROOT/harness/hello-world/cofextract.py" "$WORK/$BASE.OUT" "$OUT/$NAME.bin" +sed 's/\r$//' "$WORK/$BASE.MAP" > "$OUT/$NAME.map" +cp "$WORK/$BASE.LST" "$OUT/$NAME.lst" +echo "build.sh: $OUT/$NAME.bin ($(wc -c < "$OUT/$NAME.bin") bytes) at bit $ORIGIN" diff --git a/dwt/tcpip/build/copytest.bin b/dwt/tcpip/build/copytest.bin new file mode 100644 index 0000000..81da292 Binary files /dev/null and b/dwt/tcpip/build/copytest.bin differ diff --git a/dwt/tcpip/build/copytest.lst b/dwt/tcpip/build/copytest.lst new file mode 100644 index 0000000..199ab89 --- /dev/null +++ b/dwt/tcpip/build/copytest.lst @@ -0,0 +1,218 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; copytest.asm -- isolate the byte-copy loop used by tf + 0002 ; + 0003 ; malloc(01000h), then copy 256 bytes from SRC (values + 0004 ; dint/movb/addk/dsjs/eint loop. A peek of the destina + 0005 ; + 0006 ; 0187A800 stage (1 entered, 2 copied) + 0007 ; 0187A820 destination pointer + 0008 ; 0187A840 entry SP + 0009 ; 0187A860 entry A14 + 0010 + 0011 00000000 .text + 0012 00000000 _start: + 0013 00000000 0550 setf 16, 0, 0 + 0014 00000010 0740 setf 32, 0, 1 + 0015 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0016 00000040 078F move sp, @0187A840h, 1 + 00000050 0187A840 + 0017 00000070 078E move a14, @0187A860h, 1 + 00000080 0187A860 + 0018 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0019 000000D0 0780 move a0, @0187A800h, 1 + 000000E0 0187A800 + 0020 + 0021 00000100 A3CF move a14, -*sp, 1 + 0022 00000110 09EE movi 0187B800h, a14, L + 00000120 0187B800 + 0023 00000140 09E0 movi 01000h, a0, L + 00000150 00001000 + 0024 00000170 920E move a0, *a14+, 1 + 0025 00000180 0D5F calla 3F701230h + 00000190 3F701230 + 0026 000001B0 07AF move @0187A840h, sp, 1 + 000001C0 0187A840 + 0027 000001E0 07AE move @0187A860h, a14, 1 + 000001F0 0187A860 + 0028 00000210 0550 setf 16, 0, 0 + 0029 00000220 0740 setf 32, 0, 1 + 0030 00000230 0788 move a8, @0187A820h, 1 + 00000240 0187A820 + 0031 00000260 4D06 move a8, a6 + 0032 + 0033 00000270 0360 dint + 0034 00000280 09E5 movi SRC, a5, L + 00000290 00000400' + 0035 000002B0 09E2 movi 256, a2, L + 000002C0 00000100 + 0036 000002E0 copy_bytes: + 0037 000002E0 8EA0 movb *a5, a0 + 0038 000002F0 8C06 movb a0, *a6 + 0039 00000300 1105 addk 8, a5 + 0040 00000310 1106 addk 8, a6 + 0041 00000320 3CA2 dsjs a2, copy_bytes + 0042 00000330 0D60 eint + 0043 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0044 00000340 09E0 movi 2, a0, L + 00000350 00000002 + 0045 00000370 0780 move a0, @0187A800h, 1 + 00000380 0187A800 + 0046 000003A0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 000003B0 00FF + 0047 000003C0 09E8 movi 0, a8, L + 000003D0 00000000 + 0048 000003F0 0960 rets + 0049 + 0050 00000400 SRC: + 0051 00000400 0100 .word 00100h + 0052 00000410 0302 .word 00302h + 0053 00000420 0504 .word 00504h + 0054 00000430 0706 .word 00706h + 0055 00000440 0908 .word 00908h + 0056 00000450 0B0A .word 00B0Ah + 0057 00000460 0D0C .word 00D0Ch + 0058 00000470 0F0E .word 00F0Eh + 0059 00000480 1110 .word 01110h + 0060 00000490 1312 .word 01312h + 0061 000004A0 1514 .word 01514h + 0062 000004B0 1716 .word 01716h + 0063 000004C0 1918 .word 01918h + 0064 000004D0 1B1A .word 01B1Ah + 0065 000004E0 1D1C .word 01D1Ch + 0066 000004F0 1F1E .word 01F1Eh + 0067 00000500 2120 .word 02120h + 0068 00000510 2322 .word 02322h + 0069 00000520 2524 .word 02524h + 0070 00000530 2726 .word 02726h + 0071 00000540 2928 .word 02928h + 0072 00000550 2B2A .word 02B2Ah + 0073 00000560 2D2C .word 02D2Ch + 0074 00000570 2F2E .word 02F2Eh + 0075 00000580 3130 .word 03130h + 0076 00000590 3332 .word 03332h + 0077 000005A0 3534 .word 03534h + 0078 000005B0 3736 .word 03736h + 0079 000005C0 3938 .word 03938h + 0080 000005D0 3B3A .word 03B3Ah + 0081 000005E0 3D3C .word 03D3Ch + 0082 000005F0 3F3E .word 03F3Eh + 0083 00000600 4140 .word 04140h + 0084 00000610 4342 .word 04342h + 0085 00000620 4544 .word 04544h + 0086 00000630 4746 .word 04746h + 0087 00000640 4948 .word 04948h + 0088 00000650 4B4A .word 04B4Ah + 0089 00000660 4D4C .word 04D4Ch + 0090 00000670 4F4E .word 04F4Eh + 0091 00000680 5150 .word 05150h + 0092 00000690 5352 .word 05352h + 0093 000006A0 5554 .word 05554h + 0094 000006B0 5756 .word 05756h + 0095 000006C0 5958 .word 05958h + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 0096 000006D0 5B5A .word 05B5Ah + 0097 000006E0 5D5C .word 05D5Ch + 0098 000006F0 5F5E .word 05F5Eh + 0099 00000700 6160 .word 06160h + 0100 00000710 6362 .word 06362h + 0101 00000720 6564 .word 06564h + 0102 00000730 6766 .word 06766h + 0103 00000740 6968 .word 06968h + 0104 00000750 6B6A .word 06B6Ah + 0105 00000760 6D6C .word 06D6Ch + 0106 00000770 6F6E .word 06F6Eh + 0107 00000780 7170 .word 07170h + 0108 00000790 7372 .word 07372h + 0109 000007A0 7574 .word 07574h + 0110 000007B0 7776 .word 07776h + 0111 000007C0 7978 .word 07978h + 0112 000007D0 7B7A .word 07B7Ah + 0113 000007E0 7D7C .word 07D7Ch + 0114 000007F0 7F7E .word 07F7Eh + 0115 00000800 8180 .word 08180h + 0116 00000810 8382 .word 08382h + 0117 00000820 8584 .word 08584h + 0118 00000830 8786 .word 08786h + 0119 00000840 8988 .word 08988h + 0120 00000850 8B8A .word 08B8Ah + 0121 00000860 8D8C .word 08D8Ch + 0122 00000870 8F8E .word 08F8Eh + 0123 00000880 9190 .word 09190h + 0124 00000890 9392 .word 09392h + 0125 000008A0 9594 .word 09594h + 0126 000008B0 9796 .word 09796h + 0127 000008C0 9998 .word 09998h + 0128 000008D0 9B9A .word 09B9Ah + 0129 000008E0 9D9C .word 09D9Ch + 0130 000008F0 9F9E .word 09F9Eh + 0131 00000900 A1A0 .word 0A1A0h + 0132 00000910 A3A2 .word 0A3A2h + 0133 00000920 A5A4 .word 0A5A4h + 0134 00000930 A7A6 .word 0A7A6h + 0135 00000940 A9A8 .word 0A9A8h + 0136 00000950 ABAA .word 0ABAAh + 0137 00000960 ADAC .word 0ADACh + 0138 00000970 AFAE .word 0AFAEh + 0139 00000980 B1B0 .word 0B1B0h + 0140 00000990 B3B2 .word 0B3B2h + 0141 000009A0 B5B4 .word 0B5B4h + 0142 000009B0 B7B6 .word 0B7B6h + 0143 000009C0 B9B8 .word 0B9B8h + 0144 000009D0 BBBA .word 0BBBAh + 0145 000009E0 BDBC .word 0BDBCh + 0146 000009F0 BFBE .word 0BFBEh + 0147 00000A00 C1C0 .word 0C1C0h + 0148 00000A10 C3C2 .word 0C3C2h + 0149 00000A20 C5C4 .word 0C5C4h + 0150 00000A30 C7C6 .word 0C7C6h + 0151 00000A40 C9C8 .word 0C9C8h + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:19:40 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 0152 00000A50 CBCA .word 0CBCAh + 0153 00000A60 CDCC .word 0CDCCh + 0154 00000A70 CFCE .word 0CFCEh + 0155 00000A80 D1D0 .word 0D1D0h + 0156 00000A90 D3D2 .word 0D3D2h + 0157 00000AA0 D5D4 .word 0D5D4h + 0158 00000AB0 D7D6 .word 0D7D6h + 0159 00000AC0 D9D8 .word 0D9D8h + 0160 00000AD0 DBDA .word 0DBDAh + 0161 00000AE0 DDDC .word 0DDDCh + 0162 00000AF0 DFDE .word 0DFDEh + 0163 00000B00 E1E0 .word 0E1E0h + 0164 00000B10 E3E2 .word 0E3E2h + 0165 00000B20 E5E4 .word 0E5E4h + 0166 00000B30 E7E6 .word 0E7E6h + 0167 00000B40 E9E8 .word 0E9E8h + 0168 00000B50 EBEA .word 0EBEAh + 0169 00000B60 EDEC .word 0EDECh + 0170 00000B70 EFEE .word 0EFEEh + 0171 00000B80 F1F0 .word 0F1F0h + 0172 00000B90 F3F2 .word 0F3F2h + 0173 00000BA0 F5F4 .word 0F5F4h + 0174 00000BB0 F7F6 .word 0F7F6h + 0175 00000BC0 F9F8 .word 0F9F8h + 0176 00000BD0 FBFA .word 0FBFAh + 0177 00000BE0 FDFC .word 0FDFCh + 0178 00000BF0 FFFE .word 0FFFEh + 0179 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/copytest.map b/dwt/tcpip/build/copytest.map new file mode 100644 index 0000000..7fe89b1 --- /dev/null +++ b/dwt/tcpip/build/copytest.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:19:40 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01878000 00000C00 + 01878000 00000C00 COPYTEST.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01878000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01878000 .text +01878C00 etext 01878C00 etext + +[6 symbols] diff --git a/dwt/tcpip/build/launcher.bin b/dwt/tcpip/build/launcher.bin new file mode 100644 index 0000000..62f495f Binary files /dev/null and b/dwt/tcpip/build/launcher.bin differ diff --git a/dwt/tcpip/build/launcher.lst b/dwt/tcpip/build/launcher.lst new file mode 100644 index 0000000..9515ba2 --- /dev/null +++ b/dwt/tcpip/build/launcher.lst @@ -0,0 +1,86 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; launcher.asm -- run tfetch.bin as a first-class proce + 0002 ; + 0003 ; The rdebug `jump` runs in the "remote debug" process. + 0004 ; (dwt/notes/GUI_APPS.md section 10) showed that a serv + 0005 ; from that context is accepted but never completed; a + 0006 ; works. This launcher is the same shape as dwt/gui/xl + 0007 ; + 0008 ; create_process(entry, name, stack_size, 1, arg) + 0009 ; + 0010 ; create_process = bit 3F706A40h (Ghidra 07EE0D48) + 0011 ; + 0012 ; The child runs tfetch.bin, linked at bit 01870000h. + 0013 ; + 0014 ; Evidence cells (32-bit, bit addresses): + 0015 ; 01872500 stage (1 entered, 2 create_process return + 0016 ; 01872520 PCB returned by create_process (0 = failu + 0017 ; 01872540 entry-point argument (poked by the host, + 0018 + 0019 00000000 .text + 0020 00000000 _start: + 0021 00000000 0550 setf 16, 0, 0 + 0022 00000010 0740 setf 32, 0, 1 + 0023 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0024 00000040 078F move sp, @01872700h, 1 ; entry SP + 00000050 01872700 + 0025 00000070 078E move a14, @01872720h, 1 ; entry A14 + 00000080 01872720 + 0026 + 0027 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0028 000000D0 0780 move a0, @01872500h, 1 + 000000E0 01872500 + 0029 + 0030 00000100 A3CF move a14, -*sp, 1 + 0031 00000110 09EE movi 01872800h, a14, L ; argument area + 00000120 01872800 + 0032 00000140 09E0 movi 0, a0, L + 00000150 00000000 + 0033 00000170 920E move a0, *a14+, 1 ; arg4 = 0 + 0034 00000180 09E0 movi 1, a0, L + 00000190 00000001 + 0035 000001B0 920E move a0, *a14+, 1 ; arg3 = 1 + 0036 000001C0 09E0 movi 04000h, a0, L ; 16 KiB stack + 000001D0 00004000 + 0037 000001F0 920E move a0, *a14+, 1 ; arg2 = stack size + 0038 00000200 09E0 movi 3F30DC00h, a0, L ; ROM "0::0", any short name + 00000210 3F30DC00 + 0039 00000230 920E move a0, *a14+, 1 ; arg1 = name + 0040 00000240 07A0 move @01872540h, a0, 1 ; arg0 = entry, poked at run ti + 00000250 01872540 + 0041 00000270 920E move a0, *a14+, 1 ; (little-endian bit address) + 0042 00000280 0D5F calla 3F706A40h ; create_process + 00000290 3F706A40 + 0043 000002B0 07AF move @01872700h, sp, 1 + 000002C0 01872700 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0044 000002E0 07AE move @01872720h, a14, 1 + 000002F0 01872720 + 0045 00000310 0550 setf 16, 0, 0 + 0046 00000320 0740 setf 32, 0, 1 + 0047 + 0048 00000330 0788 move a8, @01872520h, 1 ; PCB marker + 00000340 01872520 + 0049 00000360 09E0 movi 2, a0, L + 00000370 00000002 + 0050 00000390 0780 move a0, @01872500h, 1 ; stage = 2 + 000003A0 01872500 + 0051 + 0052 000003C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 000003D0 00FF + 0053 000003E0 09E8 movi 0, a8, L + 000003F0 00000000 + 0054 00000410 0960 rets + 0055 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/launcher.map b/dwt/tcpip/build/launcher.map new file mode 100644 index 0000000..1fdd9d4 --- /dev/null +++ b/dwt/tcpip/build/launcher.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:13:38 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01872000 00000420 + 01872000 00000420 LAUNCHER.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01872000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01872000 .text +01872420 etext 01872420 etext + +[6 symbols] diff --git a/dwt/tcpip/build/restest.bin b/dwt/tcpip/build/restest.bin new file mode 100644 index 0000000..c91d188 Binary files /dev/null and b/dwt/tcpip/build/restest.bin differ diff --git a/dwt/tcpip/build/restest.lst b/dwt/tcpip/build/restest.lst new file mode 100644 index 0000000..db00266 --- /dev/null +++ b/dwt/tcpip/build/restest.lst @@ -0,0 +1,105 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; restest.asm -- socket() then the resolver tftp_open u + 0002 ; + 0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd + 0004 ; resolve = 3F5933D0h resolve("192.168.99.1") -> - + 0005 ; + 0006 ; Evidence cells (32-bit, bit addresses): + 0007 ; 01875800 stage (1 entered, 2 socket returned, 3 re + 0008 ; 01875820 socket() fd + 0009 ; 01875840 resolver return + 0010 ; 01875A00 entry SP + 0011 ; 01875A20 entry A14 + 0012 + 0013 00000000 .text + 0014 00000000 _start: + 0015 00000000 0550 setf 16, 0, 0 + 0016 00000010 0740 setf 32, 0, 1 + 0017 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0018 00000040 078F move sp, @01875A00h, 1 + 00000050 01875A00 + 0019 00000070 078E move a14, @01875A20h, 1 + 00000080 01875A20 + 0020 + 0021 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0022 000000D0 0780 move a0, @01875800h, 1 + 000000E0 01875800 + 0023 + 0024 ; socket(2,2,0) + 0025 00000100 09EE movi 01875900h, a14, L + 00000110 01875900 + 0026 00000130 09E0 movi 0, a0, L + 00000140 00000000 + 0027 00000160 920E move a0, *a14+, 1 + 0028 00000170 09E0 movi 2, a0, L + 00000180 00000002 + 0029 000001A0 920E move a0, *a14+, 1 + 0030 000001B0 09E0 movi 2, a0, L + 000001C0 00000002 + 0031 000001E0 920E move a0, *a14+, 1 + 0032 000001F0 0D5F calla 3F5C9A00h + 00000200 3F5C9A00 + 0033 00000220 07AF move @01875A00h, sp, 1 + 00000230 01875A00 + 0034 00000250 07AE move @01875A20h, a14, 1 + 00000260 01875A20 + 0035 00000280 0550 setf 16, 0, 0 + 0036 00000290 0740 setf 32, 0, 1 + 0037 000002A0 0788 move a8, @01875820h, 1 ; fd + 000002B0 01875820 + 0038 000002D0 4D09 move a8, a9 + 0039 + 0040 000002E0 09E0 movi 2, a0, L + 000002F0 00000002 + 0041 00000310 0780 move a0, @01875800h, 1 + 00000320 01875800 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0042 + 0043 ; resolve("192.168.99.1") + 0044 00000340 09EE movi 01875900h, a14, L + 00000350 01875900 + 0045 00000370 09E0 movi HOST, a0, L + 00000380 00000550' + 0046 000003A0 920E move a0, *a14+, 1 + 0047 000003B0 0D5F calla 3F5933D0h + 000003C0 3F5933D0 + 0048 000003E0 07AF move @01875A00h, sp, 1 + 000003F0 01875A00 + 0049 00000410 07AE move @01875A20h, a14, 1 + 00000420 01875A20 + 0050 00000440 0550 setf 16, 0, 0 + 0051 00000450 0740 setf 32, 0, 1 + 0052 00000460 0788 move a8, @01875840h, 1 + 00000470 01875840 + 0053 + 0054 00000490 09E0 movi 3, a0, L + 000004A0 00000003 + 0055 000004C0 0780 move a0, @01875800h, 1 + 000004D0 01875800 + 0056 000004F0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000500 00FF + 0057 00000510 09E8 movi 0, a8, L + 00000520 00000000 + 0058 00000540 0960 rets + 0059 + 0060 00000550 HOST: + 0061 00000550 3931 .word 03931h + 0062 00000560 2E32 .word 02E32h + 0063 00000570 3631 .word 03631h + 0064 00000580 2E38 .word 02E38h + 0065 00000590 3939 .word 03939h + 0066 000005A0 312E .word 0312Eh + 0067 000005B0 0000 .word 00000h + 0068 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/restest.map b/dwt/tcpip/build/restest.map new file mode 100644 index 0000000..9f2a358 --- /dev/null +++ b/dwt/tcpip/build/restest.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:12:36 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01875000 000005C0 + 01875000 000005C0 RESTEST.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01875000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01875000 .text +018755C0 etext 018755C0 etext + +[6 symbols] diff --git a/dwt/tcpip/build/socktest.bin b/dwt/tcpip/build/socktest.bin new file mode 100644 index 0000000..bde3d69 Binary files /dev/null and b/dwt/tcpip/build/socktest.bin differ diff --git a/dwt/tcpip/build/socktest.lst b/dwt/tcpip/build/socktest.lst new file mode 100644 index 0000000..054fb86 --- /dev/null +++ b/dwt/tcpip/build/socktest.lst @@ -0,0 +1,75 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; socktest.asm -- call the firmware's socket() wrapper + 0002 ; + 0003 ; Isolates the first call tftp_open makes. Run with rd + 0004 ; remote-debug process (or from a create_process child) + 0005 ; socket API is usable in that context. + 0006 ; + 0007 ; socket = bit 3F5C9A00h (Ghidra 07EB9340) + 0008 ; socket(domain, type, protocol) = socket(2, 2, 0) + 0009 ; + 0010 ; Evidence cells (32-bit, bit addresses): + 0011 ; 01874000 stage (1 entered, 2 socket returned) + 0012 ; 01874020 socket() return (fd, or a negative errno) + 0013 ; 01874200 entry SP + 0014 ; 01874220 entry A14 + 0015 + 0016 00000000 .text + 0017 00000000 _start: + 0018 00000000 0550 setf 16, 0, 0 + 0019 00000010 0740 setf 32, 0, 1 + 0020 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0021 00000040 078F move sp, @01874200h, 1 + 00000050 01874200 + 0022 00000070 078E move a14, @01874220h, 1 + 00000080 01874220 + 0023 + 0024 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0025 000000D0 0780 move a0, @01874000h, 1 + 000000E0 01874000 + 0026 + 0027 00000100 09EE movi 01873800h, a14, L + 00000110 01873800 + 0028 00000130 09E0 movi 0, a0, L + 00000140 00000000 + 0029 00000160 920E move a0, *a14+, 1 ; arg2 = protocol + 0030 00000170 09E0 movi 2, a0, L + 00000180 00000002 + 0031 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM + 0032 000001B0 09E0 movi 2, a0, L + 000001C0 00000002 + 0033 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET + 0034 000001F0 0D5F calla 3F5C9A00h ; socket + 00000200 3F5C9A00 + 0035 00000220 07AF move @01874200h, sp, 1 + 00000230 01874200 + 0036 00000250 07AE move @01874220h, a14, 1 + 00000260 01874220 + 0037 00000280 0550 setf 16, 0, 0 + 0038 00000290 0740 setf 32, 0, 1 + 0039 000002A0 0788 move a8, @01874020h, 1 + 000002B0 01874020 + 0040 + 0041 000002D0 09E0 movi 2, a0, L + 000002E0 00000002 + 0042 00000300 0780 move a0, @01874000h, 1 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 00000310 01874000 + 0043 00000330 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000340 00FF + 0044 00000350 09E8 movi 0, a8, L + 00000360 00000000 + 0045 00000380 0960 rets + 0046 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/socktest.map b/dwt/tcpip/build/socktest.map new file mode 100644 index 0000000..cdfd197 --- /dev/null +++ b/dwt/tcpip/build/socktest.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:12:14 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01873000 00000390 + 01873000 00000390 SOCKTEST.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01873000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01873000 .text +01873390 etext 01873390 etext + +[6 symbols] diff --git a/dwt/tcpip/build/tfetch.bin b/dwt/tcpip/build/tfetch.bin new file mode 100644 index 0000000..014196a Binary files /dev/null and b/dwt/tcpip/build/tfetch.bin differ diff --git a/dwt/tcpip/build/tfetch.lst b/dwt/tcpip/build/tfetch.lst new file mode 100644 index 0000000..f0a8c77 --- /dev/null +++ b/dwt/tcpip/build/tfetch.lst @@ -0,0 +1,218 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; tftp_fetch.asm -- fetch a file over TFTP into a mallo + 0002 ; firmware's own client (dwt_tftp.c in ROM). + 0003 ; + 0004 ; Linked at bit 01870000h (byte 0x30E000) and executed + 0005 ; call. The payload follows the firmware's stack-argum + 0006 ; + 0007 ; MOVE A14,-*SP,1 ; reserve the slo + 0008 ; MOVE argN,*A14+,1 ; last argument f + 0009 ; MOVE arg0,*A14+,1 ; first argument + 0010 ; CALLA target + 0011 ; + 0012 ; We point A14 at a fixed argument area and restore SP/ + 0013 ; entry values after every call, so a payload bug canno + 0014 ; stack. a9 and a11 are callee-saved by tftp_open/tftp + 0015 ; hold the fd and the current write pointer across call + 0016 ; + 0017 ; Firmware entry points (bit addresses; Ghidra = bit >> + 0018 ; malloc 3F701230h (Ghidra 07EE0246) malloc(by + 0019 ; tftp_open 3F5EBC40h (Ghidra 07EBD788) tftp_open + 0020 ; tftp_read 3F5ED230h (Ghidra 07EBDA46) tftp_read + 0021 ; tftp_close 3F5EC860h (Ghidra 07EBD90C) tftp_clos + 0022 ; + 0023 ; tftp_read returns the DATA payload length, and 0 once + 0024 ; has been consumed. tftp_close sends TFTP ERROR 3 if + 0025 ; a full 512 bytes, so the loop must read until it gets + 0026 ; + 0027 ; Evidence cells (32-bit, bit addresses; peeked over rd + 0028 ; 01871000 stage (1 malloc, 2 open, 3 reading, 4 cl + 0029 ; 01871020 fd + 0030 ; 01871040 buffer pointer (returned by malloc; a BIT + 0031 ; 01871060 total bytes fetched + 0032 ; 01871080 last tftp_read return + 0033 ; 018710A0 marker: 05A5A5A5h when the fetch complete + 0034 ; 018710C0 tftp_close return scratch + 0035 ; 01871200 entry SP + 0036 ; 01871220 entry A14 + 0037 ; + 0038 ; The fetched bytes are at [01871040] and are compared + 0039 ; The marker cells are deliberately above 01870AD0 (the + 0040 ; writing them into the code was the first, silent fail + 0041 + 0042 00000000 .text + 0043 00000000 _start: + 0044 00000000 0550 setf 16, 0, 0 + 0045 00000010 0740 setf 32, 0, 1 + 0046 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0047 00000040 078F move sp, @01871200h, 1 ; entry SP + 00000050 01871200 + 0048 00000070 078E move a14, @01871220h, 1 ; entry A14 + 00000080 01871220 + 0049 + 0050 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0051 000000D0 0780 move a0, @01871000h, 1 ; stage = 1 + 000000E0 01871000 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0052 + 0053 ; ---- buf = malloc(010000h) ------------------------- + 0054 00000100 A3CF move a14, -*sp, 1 + 0055 00000110 09EE movi 01878000h, a14, L ; argument area + 00000120 01878000 + 0056 00000140 09E0 movi 010000h, a0, L ; 65536 bytes + 00000150 00010000 + 0057 00000170 920E move a0, *a14+, 1 + 0058 00000180 0D5F calla 3F701230h ; malloc + 00000190 3F701230 + 0059 000001B0 07AF move @01871200h, sp, 1 + 000001C0 01871200 + 0060 000001E0 07AE move @01871220h, a14, 1 + 000001F0 01871220 + 0061 00000210 0550 setf 16, 0, 0 + 0062 00000220 0740 setf 32, 0, 1 + 0063 00000230 0788 move a8, @01871040h, 1 ; buffer pointer (bit address) + 00000240 01871040 + 0064 00000260 4D0B move a8, a11 + 0065 00000270 4D08 move a8, a8 + 0066 00000280 CA6A jreq fail + 0067 + 0068 00000290 09E0 movi 2, a0, L + 000002A0 00000002 + 0069 000002C0 0780 move a0, @01871000h, 1 ; stage = 2 + 000002D0 01871000 + 0070 + 0071 ; ---- fd = tftp_open("192.168.99.1", "dwt/tcpip/probe + 0072 000002F0 09EE movi 01878000h, a14, L ; argument area + 00000300 01878000 + 0073 00000320 09E0 movi FNAME, a0, L + 00000330 00000A60' + 0074 00000350 920E move a0, *a14+, 1 ; arg1 = filename + 0075 00000360 09E0 movi HOST, a0, L + 00000370 000009F0' + 0076 00000390 920E move a0, *a14+, 1 ; arg0 = host + 0077 000003A0 0D5F calla 3F5EBC40h ; tftp_open + 000003B0 3F5EBC40 + 0078 000003D0 07AF move @01871200h, sp, 1 + 000003E0 01871200 + 0079 00000400 07AE move @01871220h, a14, 1 + 00000410 01871220 + 0080 00000430 0550 setf 16, 0, 0 + 0081 00000440 0740 setf 32, 0, 1 + 0082 00000450 0788 move a8, @01871020h, 1 ; fd + 00000460 01871020 + 0083 00000480 4D09 move a8, a9 + 0084 00000490 4D08 move a8, a8 + 0085 000004A0 C448 jrlt fail + 0086 + 0087 ; ---- while ((n = tftp_read(fd, p, 010000h)) > 0) p + + 0088 000004B0 09E0 movi 3, a0, L + 000004C0 00000003 + 0089 000004E0 0780 move a0, @01871000h, 1 ; stage = 3 + 000004F0 01871000 + 0090 00000510 read_loop: + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 0091 00000510 09EE movi 01878000h, a14, L + 00000520 01878000 + 0092 00000540 09E0 movi 010000h, a0, L + 00000550 00010000 + 0093 00000570 920E move a0, *a14+, 1 ; arg2 = bufsize + 0094 00000580 936E move a11, *a14+, 1 ; arg1 = buffer + 0095 00000590 932E move a9, *a14+, 1 ; arg0 = fd + 0096 000005A0 0D5F calla 3F5ED230h ; tftp_read + 000005B0 3F5ED230 + 0097 000005D0 07AF move @01871200h, sp, 1 + 000005E0 01871200 + 0098 00000600 07AE move @01871220h, a14, 1 + 00000610 01871220 + 0099 00000630 0550 setf 16, 0, 0 + 0100 00000640 0740 setf 32, 0, 1 + 0101 00000650 0788 move a8, @01871080h, 1 ; last return + 00000660 01871080 + 0102 00000680 4D08 move a8, a8 + 0103 00000690 C609 jrle close_it + 0104 000006A0 410B add a8, a11 ; advance the write pointer + 0105 000006B0 07A1 move @01871060h, a1, 1 + 000006C0 01871060 + 0106 000006E0 4101 add a8, a1 + 0107 000006F0 0781 move a1, @01871060h, 1 ; total += n + 00000700 01871060 + 0108 00000720 C0DE jruc read_loop + 0109 + 0110 00000730 close_it: + 0111 00000730 09E0 movi 4, a0, L + 00000740 00000004 + 0112 00000760 0780 move a0, @01871000h, 1 ; stage = 4 + 00000770 01871000 + 0113 00000790 09EE movi 01878000h, a14, L + 000007A0 01878000 + 0114 000007C0 932E move a9, *a14+, 1 ; arg0 = fd + 0115 000007D0 0D5F calla 3F5EC860h ; tftp_close + 000007E0 3F5EC860 + 0116 00000800 07AF move @01871200h, sp, 1 + 00000810 01871200 + 0117 00000830 07AE move @01871220h, a14, 1 + 00000840 01871220 + 0118 00000860 0550 setf 16, 0, 0 + 0119 00000870 0740 setf 32, 0, 1 + 0120 00000880 0788 move a8, @018710C0h, 1 + 00000890 018710C0 + 0121 000008B0 09E0 movi 05A5A5A5h, a0, L + 000008C0 05A5A5A5 + 0122 000008E0 0780 move a0, @018710A0h, 1 ; DONE marker + 000008F0 018710A0 + 0123 00000910 4508 sub a8, a8 ; return 0 + 0124 00000920 C009 jruc epilogue + 0125 + 0126 00000930 fail: + 0127 00000930 09E0 movi 0FFh, a0, L + 00000940 000000FF + 0128 00000960 0780 move a0, @01871000h, 1 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:10:29 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 00000970 01871000 + 0129 00000990 09E8 movi 0FFFFFFFFh, a8, L + 000009A0 FFFFFFFF + 0130 000009C0 epilogue: + 0131 000009C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 000009D0 00FF + 0132 000009E0 0960 rets + 0133 + 0134 000009F0 HOST: + 0135 000009F0 3931 .word 03931h ; "192.168.99.1" + 0136 00000A00 2E32 .word 02E32h + 0137 00000A10 3631 .word 03631h + 0138 00000A20 2E38 .word 02E38h + 0139 00000A30 3939 .word 03939h + 0140 00000A40 312E .word 0312Eh + 0141 00000A50 0000 .word 00000h + 0142 00000A60 FNAME: + 0143 00000A60 7764 .word 07764h ; "dwt/tcpip/probe.bin" + 0144 00000A70 2F74 .word 02F74h + 0145 00000A80 6374 .word 06374h + 0146 00000A90 6970 .word 06970h + 0147 00000AA0 2F70 .word 02F70h + 0148 00000AB0 7270 .word 07270h + 0149 00000AC0 626F .word 0626Fh + 0150 00000AD0 2E65 .word 02E65h + 0151 00000AE0 6962 .word 06962h + 0152 00000AF0 006E .word 0006Eh + 0153 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/tfetch.map b/dwt/tcpip/build/tfetch.map new file mode 100644 index 0000000..2ca375d --- /dev/null +++ b/dwt/tcpip/build/tfetch.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:10:29 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01870000 00000B00 + 01870000 00000B00 TFETCH.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01870000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01870000 .text +01870B00 etext 01870B00 etext + +[6 symbols] diff --git a/dwt/tcpip/build/tftpc.bin b/dwt/tcpip/build/tftpc.bin new file mode 100644 index 0000000..15e70c4 Binary files /dev/null and b/dwt/tcpip/build/tftpc.bin differ diff --git a/dwt/tcpip/build/tftpc.lst b/dwt/tcpip/build/tftpc.lst new file mode 100644 index 0000000..68e19ae --- /dev/null +++ b/dwt/tcpip/build/tftpc.lst @@ -0,0 +1,382 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; tftpc.asm -- minimal TFTP read client built on the fi + 0002 ; + 0003 ; The firmware's own tftp_open() calls a resolver that + 0004 ; called from the rdebug process (dwt/notes/TCPIP.md), + 0005 ; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one + 0006 ; + 0007 ; socket = 3F5C9A00h socket(2,2,0) -> fd + 0008 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, t + 0009 ; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags, + 0010 ; close = 3F5E8930h close(fd) + 0011 ; malloc = 3F701230h malloc(bytes) -> bit pointer + 0012 ; + 0013 ; The transfer is 600 bytes, so DATA 1 is 512 (full) an + 0014 ; (short); the short block ends the transfer. ACKs go + 0015 ; recvfrom reports, not to a hard-coded port. + 0016 ; + 0017 ; Evidence cells (32-bit, bit addresses): + 0018 ; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4 + 0019 ; 0187C020 fd + 0020 ; 0187C040 destination buffer (malloc) + 0021 ; 0187C060 total bytes fetched + 0022 ; 0187C080 last recvfrom length + 0023 ; 0187C0A0 last DATA block word as read from the wir + 0024 ; 0187C0C0 marker 05A5A5A5h when the fetch completed + 0025 ; 0187C200 entry SP + 0026 ; 0187C220 entry A14 + 0027 ; + 0028 ; Scratch (fixed bit addresses, above this image): + 0029 ; 01875000 argument area + 0030 ; 01876000 receive buffer (2048 bytes) + 0031 ; 0187A000 recvfrom source sockaddr + 0032 ; 0187A080 recvfrom sockaddr length + 0033 ; 0187A100 ACK packet (4 bytes) + 0034 + 0035 00000000 .text + 0036 00000000 _start: + 0037 00000000 0550 setf 16, 0, 0 + 0038 00000010 0740 setf 32, 0, 1 + 0039 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0040 00000040 078F move sp, @0187C200h, 1 + 00000050 0187C200 + 0041 00000070 078E move a14, @0187C220h, 1 + 00000080 0187C220 + 0042 + 0043 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0044 000000D0 0780 move a0, @0187C000h, 1 + 000000E0 0187C000 + 0045 + 0046 ; ---- buf = malloc(010000h) ------------------------- + 0047 00000100 A3CF move a14, -*sp, 1 + 0048 00000110 09EE movi 01875000h, a14, L + 00000120 01875000 + 0049 00000140 09E0 movi 010000h, a0, L + 00000150 00010000 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0050 00000170 920E move a0, *a14+, 1 + 0051 00000180 0D5F calla 3F701230h + 00000190 3F701230 + 0052 000001B0 07AF move @0187C200h, sp, 1 + 000001C0 0187C200 + 0053 000001E0 07AE move @0187C220h, a14, 1 + 000001F0 0187C220 + 0054 00000210 0550 setf 16, 0, 0 + 0055 00000220 0740 setf 32, 0, 1 + 0056 00000230 0788 move a8, @0187C040h, 1 + 00000240 0187C040 + 0057 00000260 4D0B move a8, a11 ; dest cursor (callee-saved) + 0058 00000270 4D08 move a8, a8 + 0059 00000280 CA00 jreq fail + 00000290 010F + 0060 + 0061 000002A0 09E0 movi 2, a0, L + 000002B0 00000002 + 0062 000002D0 0780 move a0, @0187C000h, 1 + 000002E0 0187C000 + 0063 + 0064 ; ---- fd = socket(2,2,0) ---------------------------- + 0065 00000300 09EE movi 01875000h, a14, L + 00000310 01875000 + 0066 00000330 09E0 movi 0, a0, L + 00000340 00000000 + 0067 00000360 920E move a0, *a14+, 1 + 0068 00000370 09E0 movi 2, a0, L + 00000380 00000002 + 0069 000003A0 920E move a0, *a14+, 1 + 0070 000003B0 09E0 movi 2, a0, L + 000003C0 00000002 + 0071 000003E0 920E move a0, *a14+, 1 + 0072 000003F0 0D5F calla 3F5C9A00h + 00000400 3F5C9A00 + 0073 00000420 07AF move @0187C200h, sp, 1 + 00000430 0187C200 + 0074 00000450 07AE move @0187C220h, a14, 1 + 00000460 0187C220 + 0075 00000480 0550 setf 16, 0, 0 + 0076 00000490 0740 setf 32, 0, 1 + 0077 000004A0 0788 move a8, @0187C020h, 1 + 000004B0 0187C020 + 0078 000004D0 4D09 move a8, a9 ; fd (callee-saved) + 0079 000004E0 4D08 move a8, a8 + 0080 000004F0 C400 jrlt fail + 00000500 00E8 + 0081 + 0082 ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) ------------- + 0083 00000510 09EE movi 01875000h, a14, L + 00000520 01875000 + 0084 00000540 09E0 movi 16, a0, L + 00000550 00000010 + 0085 00000570 920E move a0, *a14+, 1 + 0086 00000580 09E0 movi SADDR, a0, L + 00000590 00001530' + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 0087 000005B0 920E move a0, *a14+, 1 + 0088 000005C0 09E0 movi 0, a0, L + 000005D0 00000000 + 0089 000005F0 920E move a0, *a14+, 1 + 0090 00000600 09E0 movi 28, a0, L + 00000610 0000001C + 0091 00000630 920E move a0, *a14+, 1 + 0092 00000640 09E0 movi RRQ, a0, L + 00000650 00001450' + 0093 00000670 920E move a0, *a14+, 1 + 0094 00000680 932E move a9, *a14+, 1 + 0095 00000690 0D5F calla 3F5D3D70h + 000006A0 3F5D3D70 + 0096 000006C0 07AF move @0187C200h, sp, 1 + 000006D0 0187C200 + 0097 000006F0 07AE move @0187C220h, a14, 1 + 00000700 0187C220 + 0098 00000720 0550 setf 16, 0, 0 + 0099 00000730 0740 setf 32, 0, 1 + 0100 00000740 4D08 move a8, a8 + 0101 00000750 C400 jrlt fail + 00000760 00C2 + 0102 + 0103 00000770 09E0 movi 3, a0, L + 00000780 00000003 + 0104 000007A0 0780 move a0, @0187C000h, 1 + 000007B0 0187C000 + 0105 000007D0 4400 sub a0, a0 + 0106 000007E0 0780 move a0, @0187C060h, 1 ; total = 0 + 000007F0 0187C060 + 0107 + 0108 00000810 recv_loop: + 0109 ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) --- + 0110 ; arg5 is a POINTER to the socklen (as tftp_read passe + 0111 ; value is initialised to 16 first. + 0112 00000810 09E0 movi 16, a0, L + 00000820 00000010 + 0113 00000840 0780 move a0, @0187A080h, 1 ; fromlen = 16 + 00000850 0187A080 + 0114 00000870 09EE movi 01875000h, a14, L + 00000880 01875000 + 0115 000008A0 09E0 movi 0187A080h, a0, L + 000008B0 0187A080 + 0116 000008D0 920E move a0, *a14+, 1 ; arg5 = &fromlen + 0117 000008E0 09E0 movi 0187A000h, a0, L + 000008F0 0187A000 + 0118 00000910 920E move a0, *a14+, 1 ; arg4 = &from + 0119 00000920 09E0 movi 0, a0, L + 00000930 00000000 + 0120 00000950 920E move a0, *a14+, 1 ; arg3 = flags + 0121 00000960 09E0 movi 00800h, a0, L + 00000970 00000800 + 0122 00000990 920E move a0, *a14+, 1 ; arg2 = 2048 + 0123 000009A0 09E0 movi 01876000h, a0, L + 000009B0 01876000 + 0124 000009D0 920E move a0, *a14+, 1 ; arg1 = receive buffer + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 0125 000009E0 932E move a9, *a14+, 1 ; arg0 = fd + 0126 000009F0 0D5F calla 3F5D7D50h + 00000A00 3F5D7D50 + 0127 00000A20 07AF move @0187C200h, sp, 1 + 00000A30 0187C200 + 0128 00000A50 07AE move @0187C220h, a14, 1 + 00000A60 0187C220 + 0129 00000A80 0550 setf 16, 0, 0 + 0130 00000A90 0740 setf 32, 0, 1 + 0131 + 0132 00000AA0 0788 move a8, @0187C080h, 1 ; last length + 00000AB0 0187C080 + 0133 00000AD0 4D08 move a8, a8 + 0134 00000AE0 C600 jrle fail + 00000AF0 0089 + 0135 + 0136 ; opcode: wire 00 03 -> little-endian word 0300h + 0137 00000B00 05A0 move @01876000h, a0, 0 + 00000B10 01876000 + 0138 00000B30 0B40 cmpi 0300h, a0 + 00000B40 FCFF + 0139 00000B50 CB00 jrne fail ; only DATA is accepted + 00000B60 0082 + 0140 + 0141 00000B70 05A4 move @01876010h, a4, 0 ; block number, wire order + 00000B80 01876010 + 0142 00000BA0 0784 move a4, @0187C0A0h, 1 + 00000BB0 0187C0A0 + 0143 + 0144 00000BD0 4D03 move a8, a3 + 0145 00000BE0 1483 subk 4, a3 ; payload length + 0146 + 0147 ; ---- total += payload, dest += payload ------------- + 0148 00000BF0 07A1 move @0187C060h, a1, 1 + 00000C00 0187C060 + 0149 00000C20 4061 add a3, a1 + 0150 00000C30 0781 move a1, @0187C060h, 1 ; total += payload (bytes) + 00000C40 0187C060 + 0151 00000C60 4D66 move a11, a6 ; copy destination + 0152 00000C70 4C62 move a3, a2 + 0153 00000C80 2462 sll 3, a2 ; bytes -> bits: pointers are bit addresse + 0154 00000C90 404B add a2, a11 ; dest cursor advances now (do NOT add by + 0155 + 0156 ; ---- copy payload from BUF+4 to a6, one byte at a ti + 0157 ; Interrupts are disabled for the copy so a 512-byte c + 0158 ; with respect to the firmware's ISRs. + 0159 00000CA0 0360 dint + 0160 00000CB0 09E5 movi 01876020h, a5, L + 00000CC0 01876020 + 0161 00000CE0 4C62 move a3, a2 + 0162 00000CF0 0783 move a3, @0187C0E0h, 1 ; payload length + 00000D00 0187C0E0 + 0163 00000D20 0782 move a2, @0187C140h, 1 ; copy count + 00000D30 0187C140 + 0164 00000D50 0786 move a6, @0187C120h, 1 ; write start + 00000D60 0187C120 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 5 + + 0165 00000D80 078B move a11, @0187C100h, 1 ; cursor after advance + 00000D90 0187C100 + 0166 00000DB0 0785 move a5, @0187C160h, 1 ; source + 00000DC0 0187C160 + 0167 00000DE0 CA05 jreq copy_done + 0168 00000DF0 copy_bytes: + 0169 00000DF0 8EA0 movb *a5, a0 + 0170 00000E00 8C06 movb a0, *a6 + 0171 00000E10 1105 addk 8, a5 ; one byte + 0172 00000E20 1106 addk 8, a6 + 0173 00000E30 3CA2 dsjs a2, copy_bytes + 0174 00000E40 copy_done: + 0175 00000E40 0D60 eint + 0176 + 0177 ; ---- ACK: 00 04 ---------------- + 0178 00000E50 09E0 movi 00400h, a0, L + 00000E60 00000400 + 0179 00000E80 0580 move a0, @0187A100h, 0 + 00000E90 0187A100 + 0180 00000EB0 0584 move a4, @0187A110h, 0 + 00000EC0 0187A110 + 0181 + 0182 00000EE0 09EE movi 01875000h, a14, L + 00000EF0 01875000 + 0183 00000F10 09E0 movi 16, a0, L + 00000F20 00000010 + 0184 00000F40 920E move a0, *a14+, 1 + 0185 00000F50 09E0 movi 0187A000h, a0, L + 00000F60 0187A000 + 0186 00000F80 920E move a0, *a14+, 1 + 0187 00000F90 09E0 movi 0, a0, L + 00000FA0 00000000 + 0188 00000FC0 920E move a0, *a14+, 1 + 0189 00000FD0 09E0 movi 4, a0, L + 00000FE0 00000004 + 0190 00001000 920E move a0, *a14+, 1 + 0191 00001010 09E0 movi 0187A100h, a0, L + 00001020 0187A100 + 0192 00001040 920E move a0, *a14+, 1 + 0193 00001050 932E move a9, *a14+, 1 + 0194 00001060 0D5F calla 3F5D3D70h + 00001070 3F5D3D70 + 0195 00001090 07AF move @0187C200h, sp, 1 + 000010A0 0187C200 + 0196 000010C0 07AE move @0187C220h, a14, 1 + 000010D0 0187C220 + 0197 000010F0 0550 setf 16, 0, 0 + 0198 00001100 0740 setf 32, 0, 1 + 0199 00001110 4D08 move a8, a8 + 0200 00001120 C426 jrlt fail + 0201 + 0202 ; short block ends the transfer; full block means read + 0203 00001130 07A2 move @0187C080h, a2, 1 + 00001140 0187C080 + 0204 00001160 1482 subk 4, a2 + 0205 00001170 0B42 cmpi 512, a2 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 6 + + 00001180 FDFF + 0206 00001190 C402 jrlt close_it + 0207 000011A0 C000 jruc recv_loop + 000011B0 FF65 + 0208 + 0209 000011C0 close_it: + 0210 000011C0 09E0 movi 4, a0, L + 000011D0 00000004 + 0211 000011F0 0780 move a0, @0187C000h, 1 + 00001200 0187C000 + 0212 00001220 09EE movi 01875000h, a14, L + 00001230 01875000 + 0213 00001250 932E move a9, *a14+, 1 + 0214 00001260 0D5F calla 3F5E8930h ; close(fd) + 00001270 3F5E8930 + 0215 00001290 07AF move @0187C200h, sp, 1 + 000012A0 0187C200 + 0216 000012C0 07AE move @0187C220h, a14, 1 + 000012D0 0187C220 + 0217 000012F0 0550 setf 16, 0, 0 + 0218 00001300 0740 setf 32, 0, 1 + 0219 00001310 09E0 movi 05A5A5A5h, a0, L + 00001320 05A5A5A5 + 0220 00001340 0780 move a0, @0187C0C0h, 1 + 00001350 0187C0C0 + 0221 00001370 4508 sub a8, a8 + 0222 00001380 C009 jruc epilogue + 0223 + 0224 00001390 fail: + 0225 00001390 09E0 movi 0FFh, a0, L + 000013A0 000000FF + 0226 000013C0 0780 move a0, @0187C000h, 1 + 000013D0 0187C000 + 0227 000013F0 09E8 movi 0FFFFFFFFh, a8, L + 00001400 FFFFFFFF + 0228 00001420 epilogue: + 0229 00001420 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00001430 00FF + 0230 00001440 0960 rets + 0231 + 0232 00001450 RRQ: + 0233 00001450 0100 .word 00100h ; opcode 1 (00 01) + 0234 00001460 7764 .word 07764h ; "dw" + 0235 00001470 2F74 .word 02F74h ; "t/" + 0236 00001480 6374 .word 06374h ; "tc" + 0237 00001490 6970 .word 06970h ; "pi" + 0238 000014A0 2F70 .word 02F70h ; "p/" + 0239 000014B0 7270 .word 07270h ; "pr" + 0240 000014C0 626F .word 0626Fh ; "ob" + 0241 000014D0 2E65 .word 02E65h ; "e." + 0242 000014E0 6962 .word 06962h ; "bi" + 0243 000014F0 006E .word 0006Eh ; "n\0" + 0244 00001500 636F .word 0636Fh ; "oc" + 0245 00001510 6574 .word 06574h ; "te" + 0246 00001520 0074 .word 00074h ; "t\0" + 0247 00001530 SADDR: + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 7 + + 0248 00001530 0002 .word 00002h ; sin_family = AF_INET + 0249 00001540 4500 .word 04500h ; sin_port = htons(69) + 0250 00001550 A8C0 .word 0A8C0h ; 192.168 + 0251 00001560 0163 .word 00163h ; .99.1 + 0252 00001570 0000 .word 0 + 0253 00001580 0000 .word 0 + 0254 00001590 0000 .word 0 + 0255 000015A0 0000 .word 0 + 0256 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/tftpc.map b/dwt/tcpip/build/tftpc.map new file mode 100644 index 0000000..ead148e --- /dev/null +++ b/dwt/tcpip/build/tftpc.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:23:35 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01870000 000015B0 + 01870000 000015B0 TFTPC.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01870000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01870000 .text +018715B0 etext 018715B0 etext + +[6 symbols] diff --git a/dwt/tcpip/build/udptest.bin b/dwt/tcpip/build/udptest.bin new file mode 100644 index 0000000..b9fc3a0 Binary files /dev/null and b/dwt/tcpip/build/udptest.bin differ diff --git a/dwt/tcpip/build/udptest.lst b/dwt/tcpip/build/udptest.lst new file mode 100644 index 0000000..cae4789 --- /dev/null +++ b/dwt/tcpip/build/udptest.lst @@ -0,0 +1,142 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; udptest.asm -- socket() + sendto() a real TFTP RRQ. + 0002 ; + 0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd + 0004 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to + 0005 ; + 0006 ; The RRQ is the packet the firmware itself would send + 0007 ; "dwt/tcpip/probe.bin" in octet mode. A server log li + 0008 ; proof that UDP transmit works from the calling proces + 0009 ; + 0010 ; Evidence cells (32-bit, bit addresses): + 0011 ; 01876800 stage (1 entered, 2 sendto returned) + 0012 ; 01876820 socket fd + 0013 ; 01876840 sendto return + 0014 ; 01876A00 entry SP + 0015 ; 01876A20 entry A14 + 0016 + 0017 00000000 .text + 0018 00000000 _start: + 0019 00000000 0550 setf 16, 0, 0 + 0020 00000010 0740 setf 32, 0, 1 + 0021 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0022 00000040 078F move sp, @01876A00h, 1 + 00000050 01876A00 + 0023 00000070 078E move a14, @01876A20h, 1 + 00000080 01876A20 + 0024 + 0025 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0026 000000D0 0780 move a0, @01876800h, 1 + 000000E0 01876800 + 0027 + 0028 00000100 09EE movi 01877000h, a14, L + 00000110 01877000 + 0029 00000130 09E0 movi 0, a0, L + 00000140 00000000 + 0030 00000160 920E move a0, *a14+, 1 ; arg2 = protocol + 0031 00000170 09E0 movi 2, a0, L + 00000180 00000002 + 0032 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM + 0033 000001B0 09E0 movi 2, a0, L + 000001C0 00000002 + 0034 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET + 0035 000001F0 0D5F calla 3F5C9A00h + 00000200 3F5C9A00 + 0036 00000220 07AF move @01876A00h, sp, 1 + 00000230 01876A00 + 0037 00000250 07AE move @01876A20h, a14, 1 + 00000260 01876A20 + 0038 00000280 0550 setf 16, 0, 0 + 0039 00000290 0740 setf 32, 0, 1 + 0040 000002A0 0788 move a8, @01876820h, 1 + 000002B0 01876820 + 0041 000002D0 4D09 move a8, a9 + 0042 + 0043 000002E0 09E0 movi 2, a0, L + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 000002F0 00000002 + 0044 00000310 0780 move a0, @01876800h, 1 + 00000320 01876800 + 0045 + 0046 ; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16) + 0047 00000340 09EE movi 01877000h, a14, L + 00000350 01877000 + 0048 00000370 09E0 movi 16, a0, L + 00000380 00000010 + 0049 000003A0 920E move a0, *a14+, 1 ; arg5 = 16 + 0050 000003B0 09E0 movi SADDR, a0, L + 000003C0 00000740' + 0051 000003E0 920E move a0, *a14+, 1 ; arg4 = &sockaddr + 0052 000003F0 09E0 movi 0, a0, L + 00000400 00000000 + 0053 00000420 920E move a0, *a14+, 1 ; arg3 = flags + 0054 00000430 09E0 movi 28, a0, L + 00000440 0000001C + 0055 00000460 920E move a0, *a14+, 1 ; arg2 = length + 0056 00000470 09E0 movi RRQ, a0, L + 00000480 00000660' + 0057 000004A0 920E move a0, *a14+, 1 ; arg1 = packet + 0058 000004B0 932E move a9, *a14+, 1 ; arg0 = fd + 0059 000004C0 0D5F calla 3F5D3D70h + 000004D0 3F5D3D70 + 0060 000004F0 07AF move @01876A00h, sp, 1 + 00000500 01876A00 + 0061 00000520 07AE move @01876A20h, a14, 1 + 00000530 01876A20 + 0062 00000550 0550 setf 16, 0, 0 + 0063 00000560 0740 setf 32, 0, 1 + 0064 00000570 0788 move a8, @01876840h, 1 + 00000580 01876840 + 0065 + 0066 000005A0 09E0 movi 3, a0, L + 000005B0 00000003 + 0067 000005D0 0780 move a0, @01876800h, 1 + 000005E0 01876800 + 0068 00000600 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000610 00FF + 0069 00000620 09E8 movi 0, a8, L + 00000630 00000000 + 0070 00000650 0960 rets + 0071 + 0072 00000660 RRQ: + 0073 00000660 0100 .word 00100h ; opcode 1 (00 01) + 0074 00000670 7764 .word 07764h ; "dw" + 0075 00000680 2F74 .word 02F74h ; "t/" + 0076 00000690 6374 .word 06374h ; "tc" + 0077 000006A0 6970 .word 06970h ; "pi" + 0078 000006B0 2F70 .word 02F70h ; "p/" + 0079 000006C0 7270 .word 07270h ; "pr" + 0080 000006D0 626F .word 0626Fh ; "ob" + 0081 000006E0 2E65 .word 02E65h ; "e." + 0082 000006F0 6962 .word 06962h ; "bi" + 0083 00000700 006E .word 0006Eh ; "n\0" + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 0084 00000710 636F .word 0636Fh ; "oc" + 0085 00000720 6574 .word 06574h ; "te" + 0086 00000730 0074 .word 00074h ; "t\0" + 0087 00000740 SADDR: + 0088 00000740 0002 .word 00002h ; sin_family = AF_INET + 0089 00000750 4500 .word 04500h ; sin_port = htons(69) + 0090 00000760 A8C0 .word 0A8C0h ; 192.168 + 0091 00000770 0163 .word 00163h ; .99.1 + 0092 00000780 0000 .word 0 + 0093 00000790 0000 .word 0 + 0094 000007A0 0000 .word 0 + 0095 000007B0 0000 .word 0 + 0096 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/udptest.map b/dwt/tcpip/build/udptest.map new file mode 100644 index 0000000..4a95df2 --- /dev/null +++ b/dwt/tcpip/build/udptest.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 15:14:27 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01876000 000007C0 + 01876000 000007C0 UDPTEST.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01876000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01876000 .text +018767C0 etext 018767C0 etext + +[6 symbols] diff --git a/dwt/tcpip/copytest.asm b/dwt/tcpip/copytest.asm new file mode 100644 index 0000000..fd4441f --- /dev/null +++ b/dwt/tcpip/copytest.asm @@ -0,0 +1,179 @@ +; copytest.asm -- isolate the byte-copy loop used by tftpc.asm. +; +; malloc(01000h), then copy 256 bytes from SRC (values 0..255) with the same +; dint/movb/addk/dsjs/eint loop. A peek of the destination must show 00..FF. +; +; 0187A800 stage (1 entered, 2 copied) +; 0187A820 destination pointer +; 0187A840 entry SP +; 0187A860 entry A14 + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @0187A840h, 1 + move a14, @0187A860h, 1 + movi 1, a0, L + move a0, @0187A800h, 1 + + move a14, -*sp, 1 + movi 0187B800h, a14, L + movi 01000h, a0, L + move a0, *a14+, 1 + calla 3F701230h + move @0187A840h, sp, 1 + move @0187A860h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @0187A820h, 1 + move a8, a6 + + dint + movi SRC, a5, L + movi 256, a2, L +copy_bytes: + movb *a5, a0 + movb a0, *a6 + addk 8, a5 + addk 8, a6 + dsjs a2, copy_bytes + eint + + movi 2, a0, L + move a0, @0187A800h, 1 + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + +SRC: + .word 00100h + .word 00302h + .word 00504h + .word 00706h + .word 00908h + .word 00B0Ah + .word 00D0Ch + .word 00F0Eh + .word 01110h + .word 01312h + .word 01514h + .word 01716h + .word 01918h + .word 01B1Ah + .word 01D1Ch + .word 01F1Eh + .word 02120h + .word 02322h + .word 02524h + .word 02726h + .word 02928h + .word 02B2Ah + .word 02D2Ch + .word 02F2Eh + .word 03130h + .word 03332h + .word 03534h + .word 03736h + .word 03938h + .word 03B3Ah + .word 03D3Ch + .word 03F3Eh + .word 04140h + .word 04342h + .word 04544h + .word 04746h + .word 04948h + .word 04B4Ah + .word 04D4Ch + .word 04F4Eh + .word 05150h + .word 05352h + .word 05554h + .word 05756h + .word 05958h + .word 05B5Ah + .word 05D5Ch + .word 05F5Eh + .word 06160h + .word 06362h + .word 06564h + .word 06766h + .word 06968h + .word 06B6Ah + .word 06D6Ch + .word 06F6Eh + .word 07170h + .word 07372h + .word 07574h + .word 07776h + .word 07978h + .word 07B7Ah + .word 07D7Ch + .word 07F7Eh + .word 08180h + .word 08382h + .word 08584h + .word 08786h + .word 08988h + .word 08B8Ah + .word 08D8Ch + .word 08F8Eh + .word 09190h + .word 09392h + .word 09594h + .word 09796h + .word 09998h + .word 09B9Ah + .word 09D9Ch + .word 09F9Eh + .word 0A1A0h + .word 0A3A2h + .word 0A5A4h + .word 0A7A6h + .word 0A9A8h + .word 0ABAAh + .word 0ADACh + .word 0AFAEh + .word 0B1B0h + .word 0B3B2h + .word 0B5B4h + .word 0B7B6h + .word 0B9B8h + .word 0BBBAh + .word 0BDBCh + .word 0BFBEh + .word 0C1C0h + .word 0C3C2h + .word 0C5C4h + .word 0C7C6h + .word 0C9C8h + .word 0CBCAh + .word 0CDCCh + .word 0CFCEh + .word 0D1D0h + .word 0D3D2h + .word 0D5D4h + .word 0D7D6h + .word 0D9D8h + .word 0DBDAh + .word 0DDDCh + .word 0DFDEh + .word 0E1E0h + .word 0E3E2h + .word 0E5E4h + .word 0E7E6h + .word 0E9E8h + .word 0EBEAh + .word 0EDECh + .word 0EFEEh + .word 0F1F0h + .word 0F3F2h + .word 0F5F4h + .word 0F7F6h + .word 0F9F8h + .word 0FBFAh + .word 0FDFCh + .word 0FFFEh + .end diff --git a/dwt/tcpip/launcher.asm b/dwt/tcpip/launcher.asm new file mode 100644 index 0000000..c338313 --- /dev/null +++ b/dwt/tcpip/launcher.asm @@ -0,0 +1,55 @@ +; launcher.asm -- run tfetch.bin as a first-class process. +; +; The rdebug `jump` runs in the "remote debug" process. The X experiment +; (dwt/notes/GUI_APPS.md section 10) showed that a service connection made +; from that context is accepted but never completed; a create_process child +; works. This launcher is the same shape as dwt/gui/xlaunch.asm: +; +; create_process(entry, name, stack_size, 1, arg) +; +; create_process = bit 3F706A40h (Ghidra 07EE0D48) +; +; The child runs tfetch.bin, linked at bit 01870000h. +; +; Evidence cells (32-bit, bit addresses): +; 01872500 stage (1 entered, 2 create_process returned) +; 01872520 PCB returned by create_process (0 = failure) +; 01872540 entry-point argument (poked by the host, little-endian) + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @01872700h, 1 ; entry SP + move a14, @01872720h, 1 ; entry A14 + + movi 1, a0, L + move a0, @01872500h, 1 + + move a14, -*sp, 1 + movi 01872800h, a14, L ; argument area + movi 0, a0, L + move a0, *a14+, 1 ; arg4 = 0 + movi 1, a0, L + move a0, *a14+, 1 ; arg3 = 1 + movi 04000h, a0, L ; 16 KiB stack + move a0, *a14+, 1 ; arg2 = stack size + movi 3F30DC00h, a0, L ; ROM "0::0", any short name + move a0, *a14+, 1 ; arg1 = name + move @01872540h, a0, 1 ; arg0 = entry, poked at run time + move a0, *a14+, 1 ; (little-endian bit address) + calla 3F706A40h ; create_process + move @01872700h, sp, 1 + move @01872720h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + + move a8, @01872520h, 1 ; PCB marker + movi 2, a0, L + move a0, @01872500h, 1 ; stage = 2 + + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + .end diff --git a/dwt/tcpip/probe.bin b/dwt/tcpip/probe.bin new file mode 100644 index 0000000..877808d Binary files /dev/null and b/dwt/tcpip/probe.bin differ diff --git a/dwt/tcpip/probe.lua b/dwt/tcpip/probe.lua new file mode 100644 index 0000000..a9151e3 --- /dev/null +++ b/dwt/tcpip/probe.lua @@ -0,0 +1,105 @@ +-- probe.lua -- watch the dwt/tcpip payloads from inside MAME. +-- +-- Samples marker cells and the CPU PC once per frame. This is independent of +-- the terminal's network stack, so it still reports after a payload has wedged +-- rdebug or TCP. PCs inside the payload or the socket/TFTP code are printed, +-- which is how a hang is localised. +-- +-- vt1200 ... -debug -debugger none \ +-- -autoboot_script dwt/tcpip/probe.lua -autoboot_delay 0 +-- +-- Stop with PROBE_END= (default 20000). + +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local prog = cpu.spaces['program'] + +local function hex(v) return string.format("%08X", v & 0xFFFFFFFF) end + +local M = { + -- tfetch.asm + stage = 0x01871000, fd = 0x01871020, buf = 0x01871040, + total = 0x01871060, last = 0x01871080, done = 0x018710A0, + close = 0x018710C0, sp = 0x01871200, a14 = 0x01871220, + -- launcher.asm + lstage = 0x01872500, pcb = 0x01872520, + -- socktest.asm + sstage = 0x01874000, sfd = 0x01874020, + -- tftpc.asm + cstage = 0x0187C000, cfd = 0x0187C020, cbuf = 0x0187C040, + ctotal = 0x0187C060, clast = 0x0187C080, cblock = 0x0187C0A0, + cdone = 0x0187C0C0, +} + +local END_AT = tonumber(os.getenv("PROBE_END") or "1000000") +local last = {} +local frames = 0 +local pc_lines = 0 +local checked = false + +-- Ground truth for the fetch: read the malloc'd buffer from inside MAME and +-- compare it with the file the server holds. This avoids trusting rdebug peek. +local function check_buffer(buf, total) + local f = io.open("dwt/tcpip/probe.bin", "rb") + if not f then print("PROBE: no probe.bin to compare") return end + local want = f:read("*a") + f:close() + local n = math.min(total, #want) + local bad, first = 0, -1 + for i = 0, n - 1 do + local got = prog:read_u8(buf + i * 8) + if got ~= want:byte(i + 1) then + bad = bad + 1 + if first < 0 then first = i end + end + end + print(string.format("PROBE BUFFER buf=%s total=%d file=%d bad=%d first_bad=%d", + hex(buf), total, #want, bad, first)) +end + +local function in_range(pc, lo, hi) return pc >= lo and pc < hi end + +local function sample() + frames = frames + 1 + local vals = {} + for k, a in pairs(M) do vals[k] = prog:read_u32(a) end + local pc = cpu.state['PC'].value + local changed = false + for k, v in pairs(vals) do + if last[k] ~= v then changed = true end + end + local interesting = in_range(pc, 0x01870000, 0x01874000) + or in_range(pc, 0x3F5C0000, 0x3F5F0000) + or in_range(pc, 0x3F700000, 0x3F710000) + if changed or interesting or frames % 120 == 1 then + if interesting then pc_lines = pc_lines + 1 end + if not interesting or pc_lines <= 400 then + print(string.format("PROBE f=%d pc=%s stage=%s fd=%s buf=%s total=%s last=%s done=%s close=%s sp=%s a14=%s lstage=%s pcb=%s sstage=%s sfd=%s", + frames, hex(pc), hex(vals.stage), hex(vals.fd), hex(vals.buf), + hex(vals.total), hex(vals.last), hex(vals.done), + hex(vals.close), hex(vals.sp), hex(vals.a14), + hex(vals.lstage), hex(vals.pcb), hex(vals.sstage), hex(vals.sfd))) + print(string.format("TCPC cstage=%s cfd=%s cbuf=%s ctotal=%s clast=%s cblock=%s cdone=%s", + hex(vals.cstage), hex(vals.cfd), hex(vals.cbuf), hex(vals.ctotal), + hex(vals.clast), hex(vals.cblock), hex(vals.cdone))) + end + end + if vals.cdone == 0x05A5A5A5 and not checked then + checked = true + check_buffer(vals.cbuf, vals.ctotal) + end + last = vals + if frames >= END_AT then + print("PROBE end") + machine:exit() + end +end + +if not machine.debugger then + print("PROBE ERROR: pass -debug") + machine:exit() + return +end + +emu.register_frame_done(sample, "probe") +print("PROBE armed") diff --git a/dwt/tcpip/restest.asm b/dwt/tcpip/restest.asm new file mode 100644 index 0000000..c7b5978 --- /dev/null +++ b/dwt/tcpip/restest.asm @@ -0,0 +1,68 @@ +; restest.asm -- socket() then the resolver tftp_open uses. +; +; socket = 3F5C9A00h socket(2,2,0) -> fd +; resolve = 3F5933D0h resolve("192.168.99.1") -> -1 or address +; +; Evidence cells (32-bit, bit addresses): +; 01875800 stage (1 entered, 2 socket returned, 3 resolve returned) +; 01875820 socket() fd +; 01875840 resolver return +; 01875A00 entry SP +; 01875A20 entry A14 + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @01875A00h, 1 + move a14, @01875A20h, 1 + + movi 1, a0, L + move a0, @01875800h, 1 + + ; socket(2,2,0) + movi 01875900h, a14, L + movi 0, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + calla 3F5C9A00h + move @01875A00h, sp, 1 + move @01875A20h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01875820h, 1 ; fd + move a8, a9 + + movi 2, a0, L + move a0, @01875800h, 1 + + ; resolve("192.168.99.1") + movi 01875900h, a14, L + movi HOST, a0, L + move a0, *a14+, 1 + calla 3F5933D0h + move @01875A00h, sp, 1 + move @01875A20h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01875840h, 1 + + movi 3, a0, L + move a0, @01875800h, 1 + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + +HOST: + .word 03931h + .word 02E32h + .word 03631h + .word 02E38h + .word 03939h + .word 0312Eh + .word 00000h + .end diff --git a/dwt/tcpip/run/fetched.bin b/dwt/tcpip/run/fetched.bin new file mode 100644 index 0000000..877808d Binary files /dev/null and b/dwt/tcpip/run/fetched.bin differ diff --git a/dwt/tcpip/run/final2_jump.log b/dwt/tcpip/run/final2_jump.log new file mode 100644 index 0000000..d142d36 --- /dev/null +++ b/dwt/tcpip/run/final2_jump.log @@ -0,0 +1,5 @@ +[+] challenge f8 74 7d 75 00 00 7c 61 02 63 a8 c0 f8 6c 7d 76 +[+] reply 08 66 31 7f 4f 55 f3 c9 62 d3 c9 6a 13 2e d8 3d +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +[.] jump returned 0x00000000 (0) +jump 0x01870000: returned 0x00000000 (0) payload=00 00 00 00 diff --git a/dwt/tcpip/run/final2_poke.log b/dwt/tcpip/run/final2_poke.log new file mode 100644 index 0000000..50f6186 --- /dev/null +++ b/dwt/tcpip/run/final2_poke.log @@ -0,0 +1,4 @@ +[+] challenge ff fc 7b 59 00 00 7b 51 02 63 a8 c0 ff fc 7b 5a +[+] reply a1 34 cd a5 e9 c4 80 ad 63 68 f8 78 c1 6b a2 e2 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/tcpip/build/tftpc.bin: 694 bytes at 0x01870000: ok diff --git a/dwt/tcpip/run/final2_verify.log b/dwt/tcpip/run/final2_verify.log new file mode 100644 index 0000000..a645575 --- /dev/null +++ b/dwt/tcpip/run/final2_verify.log @@ -0,0 +1,2 @@ +stage=4 fd=1 buf=0x0095bbd0 total=600 last=92 block=0x0200 done=0x05a5a5a5 +OK: 600 bytes at 0x0095bbd0 match /home/arti/code/k-space/vt1200/dwt/tcpip/probe.bin sha256=9662e62b45802984e5eef9c7410ad7482645eb5ff77805f0406d248e35333359 diff --git a/dwt/tcpip/run/inject_child_sock.log b/dwt/tcpip/run/inject_child_sock.log new file mode 100644 index 0000000..b24dc1e --- /dev/null +++ b/dwt/tcpip/run/inject_child_sock.log @@ -0,0 +1,5 @@ +[+] challenge f8 64 68 9d 00 00 67 87 02 63 a8 c0 f8 64 68 9d +[+] reply 14 dc bf 0b 6b 6c 0b 15 41 99 2a 7e b3 93 ab 36 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +[.] jump returned 0x00000000 (0) +jump 0x01872000: returned 0x00000000 (0) payload=00 00 00 00 diff --git a/dwt/tcpip/run/inject_res.log b/dwt/tcpip/run/inject_res.log new file mode 100644 index 0000000..2a511a0 --- /dev/null +++ b/dwt/tcpip/run/inject_res.log @@ -0,0 +1,4 @@ +[+] challenge f6 fc e9 16 00 00 e7 d3 02 63 a8 c0 f6 f4 e9 17 +[+] reply 53 f1 47 62 57 42 7b c4 4b 2a 56 c9 e7 30 fd f8 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +jump 0x01875000: NO RETURN within 8.0s diff --git a/dwt/tcpip/run/inject_tftpc.log b/dwt/tcpip/run/inject_tftpc.log new file mode 100644 index 0000000..92b7913 --- /dev/null +++ b/dwt/tcpip/run/inject_tftpc.log @@ -0,0 +1,5 @@ +[+] challenge ff fc 5d d5 00 00 5d c4 02 63 a8 c0 ff fc 5d d6 +[+] reply 72 61 60 45 bf bb 0d 01 f0 17 9e b1 87 a0 fd 32 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +[.] jump returned 0x00000000 (0) +jump 0x01870000: returned 0x00000000 (0) payload=00 00 00 00 diff --git a/dwt/tcpip/run/inject_udp.log b/dwt/tcpip/run/inject_udp.log new file mode 100644 index 0000000..1fe1df9 --- /dev/null +++ b/dwt/tcpip/run/inject_udp.log @@ -0,0 +1,5 @@ +[+] challenge ef 8c 60 17 00 00 5d e6 02 63 a8 c0 ef 84 60 18 +[+] reply 23 5f ff 91 64 74 93 f9 f1 f4 da 11 38 c1 1d 15 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +[.] jump returned 0x00000000 (0) +jump 0x01876000: returned 0x00000000 (0) payload=00 00 00 00 diff --git a/dwt/tcpip/run/mame_final.log b/dwt/tcpip/run/mame_final.log new file mode 100644 index 0000000..cbef728 --- /dev/null +++ b/dwt/tcpip/run/mame_final.log @@ -0,0 +1,407 @@ +Warning: -video none doesn't make much sense without -seconds_to_run +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +PROBE armed +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +PROBE f=1 pc=3F200040 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +PROBE f=3 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=4 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=5 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=6 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=7 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=8 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=9 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=10 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=11 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=12 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=13 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=14 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=15 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=16 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=17 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=18 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=19 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=20 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=21 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=22 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=23 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=24 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=25 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=26 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=27 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=28 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=29 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=30 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=31 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=32 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=33 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=34 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=35 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=36 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=37 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=38 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=39 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=40 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=41 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=42 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=43 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=44 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=45 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=46 pc=3F7056F0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=47 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=48 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=49 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=50 pc=3F7056B0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=51 pc=3F7056E0 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=52 pc=3F705700 stage=00000000 fd=00000000 buf=00000000 total=00000000 last=00000000 done=00000000 close=00000000 sp=00000000 a14=00000000 lstage=00000000 pcb=00000000 sstage=00000000 sfd=00000000 +TCPC cstage=00000000 cfd=00000000 cbuf=00000000 ctotal=00000000 clast=00000000 cblock=00000000 cdone=00000000 +PROBE f=53 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=54 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=55 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=56 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=57 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=58 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=59 pc=3F705700 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=60 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=61 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=62 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=63 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=64 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=65 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=66 pc=3F705700 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=67 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=68 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=69 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=70 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=71 pc=3F7056F0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=72 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=73 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=74 pc=3F7056B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=75 pc=3F7056E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=76 pc=3F701E60 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=77 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=78 pc=3F702C70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=79 pc=3F702070 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=80 pc=3F702530 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=81 pc=3F700E20 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=82 pc=3F7021D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=83 pc=3F7026E0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=84 pc=3F700C10 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=85 pc=3F701EB0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=86 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=87 pc=3F701100 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=88 pc=3F7020D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=89 pc=3F702590 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=90 pc=3F700E70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=91 pc=3F7021D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=92 pc=3F702730 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=93 pc=3F701D90 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=94 pc=3F701070 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=95 pc=3F702C70 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=96 pc=3F700FF0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=97 pc=3F700ED0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=98 pc=3F7010C0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=100 pc=3F701950 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=104 pc=3F701950 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=107 pc=3F701560 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=113 pc=3F703FA0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=121 pc=3FB44DA0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=131 pc=3F702810 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=241 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=361 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=432 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=433 pc=3F702110 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=472 pc=3F701930 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=477 pc=3F702C30 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=481 pc=3F350F50 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=490 pc=3F7040D0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=492 pc=3F702F00 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=493 pc=3F7012A0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=546 pc=3F702460 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=601 pc=3FB447B0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=613 pc=3F708730 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=721 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=841 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=961 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1081 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1118 pc=3F7075A0 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1123 pc=3F5D7400 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1124 pc=3F5D5500 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1127 pc=3F708C00 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1201 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1321 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1441 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1561 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1681 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1801 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1921 pc=3F579870 stage=55555555 fd=55555555 buf=55555555 total=55555555 last=55555555 done=55555555 close=55555555 sp=55555555 a14=55555555 lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1961 pc=3FB2C140 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=55555555 cfd=55555555 cbuf=55555555 ctotal=55555555 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1979 pc=3FB446C0 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000003 cfd=00000001 cbuf=0095BBD0 ctotal=00000000 clast=55555555 cblock=55555555 cdone=55555555 +PROBE f=1980 pc=3F5D7060 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE BUFFER buf=0095BBD0 total=600 file=600 bad=0 first_bad=-1 +PROBE f=2041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=2881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3601 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3721 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3841 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=3961 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4081 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4201 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4321 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4441 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4561 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4681 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4801 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=4921 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=5881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6601 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6721 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6841 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=6961 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7081 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7201 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7321 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7441 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7561 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7681 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7801 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=7921 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8041 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8161 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8281 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8401 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8521 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8641 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8761 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=8881 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=9001 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=9121 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=9241 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=9361 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 +PROBE f=9481 pc=3F579870 stage=09E0920E fd=0187A100 buf=932E920E total=3D700D5F last=07AF3F5D done=0187C200 close=C22007AE sp=0187C000 a14=500009EE lstage=55555555 pcb=55555555 sstage=55555555 sfd=55555555 +TCPC cstage=00000004 cfd=00000001 cbuf=0095BBD0 ctotal=00000258 clast=0000005C cblock=00000200 cdone=05A5A5A5 diff --git a/dwt/tcpip/run/server_final.log b/dwt/tcpip/run/server_final.log new file mode 100644 index 0000000..9d2cd5a --- /dev/null +++ b/dwt/tcpip/run/server_final.log @@ -0,0 +1,4 @@ +tftp: serving 600 bytes (probe.bin) for any name on ('192.168.99.1', 69) +bootp: L2 responder on tap-mess-1000-0: handing out 192.168.99.2, siaddr 192.168.99.1 +bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0) +15:23:48 RRQ 192.168.99.2:1025 requested 'dwt/tcpip/probe.bin' (600 bytes) diff --git a/dwt/tcpip/serve_probe.py b/dwt/tcpip/serve_probe.py new file mode 100644 index 0000000..60e7a68 --- /dev/null +++ b/dwt/tcpip/serve_probe.py @@ -0,0 +1,75 @@ +#!/usr/bin/env python3 +"""TFTP + BOOTP server for the dwt/tcpip fetch experiment. + +Serves ``dwt/tcpip/probe.bin`` for *any* requested name (the terminal's TFTP +client asks for the exact filename we put in the payload) and logs every RRQ. +``--bootp`` reuses the L2 BOOTP responder from ``harness/serve.py`` so the +terminal learns 192.168.99.2 at power-up; that file is imported, not modified. + + sudo python3 -u dwt/tcpip/serve_probe.py 192.168.99.1 --bootp + +Run this instead of ``harness/serve.py`` when the file to serve is the probe: +both want UDP 69, so only one can be up. +""" +import argparse +import os +import sys +import time + +HERE = os.path.dirname(os.path.abspath(__file__)) +ROOT = os.path.dirname(os.path.dirname(HERE)) +sys.path.insert(0, os.path.join(ROOT, "tools")) +sys.path.insert(0, os.path.join(ROOT, "harness")) + +import fontgen # noqa: E402 +import serve as hserve # noqa: E402 + +PROBE = os.path.join(HERE, "probe.bin") + + +def main(argv=None): + ap = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("host", nargs="?", default="192.168.99.1") + ap.add_argument("port", nargs="?", type=int, default=69) + ap.add_argument("--bootp", action="store_true") + ap.add_argument("--bootp-client", default="192.168.99.2") + ap.add_argument("--bootp-iface", default=None) + ap.add_argument("--file", default=PROBE) + args = ap.parse_args(argv) + + content = open(args.file, "rb").read() + # Answer any name with the probe: the payload chooses the name, and the + # log records exactly what the terminal asked for. + srv = fontgen.TFTPServer((args.host, args.port), {}, timeout=60.0, + retries=10, resolver=lambda name: content).start() + print(f"tftp: serving {len(content)} bytes ({os.path.basename(args.file)}) " + f"for any name on {srv.address}", flush=True) + + bootp = None + if args.bootp: + bootp = hserve.BootpResponder(server_ip=args.host, + client_ip=args.bootp_client, + iface=args.bootp_iface).start() + print(f"bootp: L2 responder on {bootp.iface}: handing out " + f"{bootp.client_ip}, siaddr {bootp.server_ip}", flush=True) + + start = time.time() + try: + while True: + time.sleep(0.2) + while srv.log: + ts, name, addr = srv.log.pop(0) + stamp = time.strftime("%H:%M:%S", time.localtime(ts)) + print(f"{stamp} RRQ {addr[0]}:{addr[1]} requested {name!r} " + f"({content.__len__()} bytes)", flush=True) + except KeyboardInterrupt: + pass + finally: + srv.stop() + if bootp: + bootp.stop() + + +if __name__ == "__main__": + main() diff --git a/dwt/tcpip/socktest.asm b/dwt/tcpip/socktest.asm new file mode 100644 index 0000000..c5d9dd5 --- /dev/null +++ b/dwt/tcpip/socktest.asm @@ -0,0 +1,46 @@ +; socktest.asm -- call the firmware's socket() wrapper and return. +; +; Isolates the first call tftp_open makes. Run with rdebug `jump` from the +; remote-debug process (or from a create_process child) to see whether the +; socket API is usable in that context. +; +; socket = bit 3F5C9A00h (Ghidra 07EB9340) +; socket(domain, type, protocol) = socket(2, 2, 0) +; +; Evidence cells (32-bit, bit addresses): +; 01874000 stage (1 entered, 2 socket returned) +; 01874020 socket() return (fd, or a negative errno) +; 01874200 entry SP +; 01874220 entry A14 + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @01874200h, 1 + move a14, @01874220h, 1 + + movi 1, a0, L + move a0, @01874000h, 1 + + movi 01873800h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; arg2 = protocol + movi 2, a0, L + move a0, *a14+, 1 ; arg1 = SOCK_DGRAM + movi 2, a0, L + move a0, *a14+, 1 ; arg0 = AF_INET + calla 3F5C9A00h ; socket + move @01874200h, sp, 1 + move @01874220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01874020h, 1 + + movi 2, a0, L + move a0, @01874000h, 1 + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + .end diff --git a/dwt/tcpip/tfetch.asm b/dwt/tcpip/tfetch.asm new file mode 100644 index 0000000..6f0c7ac --- /dev/null +++ b/dwt/tcpip/tfetch.asm @@ -0,0 +1,153 @@ +; tftp_fetch.asm -- fetch a file over TFTP into a malloc'd buffer using the +; firmware's own client (dwt_tftp.c in ROM). +; +; Linked at bit 01870000h (byte 0x30E000) and executed with the rdebug `jump` +; call. The payload follows the firmware's stack-argument convention: +; +; MOVE A14,-*SP,1 ; reserve the slot the callee restores +; MOVE argN,*A14+,1 ; last argument first, upward via A14 +; MOVE arg0,*A14+,1 ; first argument last +; CALLA target +; +; We point A14 at a fixed argument area and restore SP/A14 from the saved +; entry values after every call, so a payload bug cannot walk the caller's +; stack. a9 and a11 are callee-saved by tftp_open/tftp_read/tftp_close and +; hold the fd and the current write pointer across calls. +; +; Firmware entry points (bit addresses; Ghidra = bit >> 3): +; malloc 3F701230h (Ghidra 07EE0246) malloc(bytes) -> bit pointer +; tftp_open 3F5EBC40h (Ghidra 07EBD788) tftp_open(host, filename) -> fd +; tftp_read 3F5ED230h (Ghidra 07EBDA46) tftp_read(fd, buf, bufsize) -> n +; tftp_close 3F5EC860h (Ghidra 07EBD90C) tftp_close(fd) +; +; tftp_read returns the DATA payload length, and 0 once a short (final) block +; has been consumed. tftp_close sends TFTP ERROR 3 if the last block read was +; a full 512 bytes, so the loop must read until it gets 0. +; +; Evidence cells (32-bit, bit addresses; peeked over rdebug): +; 01871000 stage (1 malloc, 2 open, 3 reading, 4 closed, 0FFh failed) +; 01871020 fd +; 01871040 buffer pointer (returned by malloc; a BIT address) +; 01871060 total bytes fetched +; 01871080 last tftp_read return +; 018710A0 marker: 05A5A5A5h when the fetch completed +; 018710C0 tftp_close return scratch +; 01871200 entry SP +; 01871220 entry A14 +; +; The fetched bytes are at [01871040] and are compared with the served file. +; The marker cells are deliberately above 01870AD0 (the end of this image): +; writing them into the code was the first, silent failure of this payload. + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @01871200h, 1 ; entry SP + move a14, @01871220h, 1 ; entry A14 + + movi 1, a0, L + move a0, @01871000h, 1 ; stage = 1 + + ; ---- buf = malloc(010000h) ------------------------------------ + move a14, -*sp, 1 + movi 01878000h, a14, L ; argument area + movi 010000h, a0, L ; 65536 bytes + move a0, *a14+, 1 + calla 3F701230h ; malloc + move @01871200h, sp, 1 + move @01871220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01871040h, 1 ; buffer pointer (bit address) + move a8, a11 + move a8, a8 + jreq fail + + movi 2, a0, L + move a0, @01871000h, 1 ; stage = 2 + + ; ---- fd = tftp_open("192.168.99.1", "dwt/tcpip/probe.bin") ----- + movi 01878000h, a14, L ; argument area + movi FNAME, a0, L + move a0, *a14+, 1 ; arg1 = filename + movi HOST, a0, L + move a0, *a14+, 1 ; arg0 = host + calla 3F5EBC40h ; tftp_open + move @01871200h, sp, 1 + move @01871220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01871020h, 1 ; fd + move a8, a9 + move a8, a8 + jrlt fail + + ; ---- while ((n = tftp_read(fd, p, 010000h)) > 0) p += n -------- + movi 3, a0, L + move a0, @01871000h, 1 ; stage = 3 +read_loop: + movi 01878000h, a14, L + movi 010000h, a0, L + move a0, *a14+, 1 ; arg2 = bufsize + move a11, *a14+, 1 ; arg1 = buffer + move a9, *a14+, 1 ; arg0 = fd + calla 3F5ED230h ; tftp_read + move @01871200h, sp, 1 + move @01871220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01871080h, 1 ; last return + move a8, a8 + jrle close_it + add a8, a11 ; advance the write pointer + move @01871060h, a1, 1 + add a8, a1 + move a1, @01871060h, 1 ; total += n + jruc read_loop + +close_it: + movi 4, a0, L + move a0, @01871000h, 1 ; stage = 4 + movi 01878000h, a14, L + move a9, *a14+, 1 ; arg0 = fd + calla 3F5EC860h ; tftp_close + move @01871200h, sp, 1 + move @01871220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @018710C0h, 1 + movi 05A5A5A5h, a0, L + move a0, @018710A0h, 1 ; DONE marker + sub a8, a8 ; return 0 + jruc epilogue + +fail: + movi 0FFh, a0, L + move a0, @01871000h, 1 + movi 0FFFFFFFFh, a8, L +epilogue: + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + rets + +HOST: + .word 03931h ; "192.168.99.1" + .word 02E32h + .word 03631h + .word 02E38h + .word 03939h + .word 0312Eh + .word 00000h +FNAME: + .word 07764h ; "dwt/tcpip/probe.bin" + .word 02F74h + .word 06374h + .word 06970h + .word 02F70h + .word 07270h + .word 0626Fh + .word 02E65h + .word 06962h + .word 0006Eh + .end diff --git a/dwt/tcpip/tftpc.asm b/dwt/tcpip/tftpc.asm new file mode 100644 index 0000000..2c24763 --- /dev/null +++ b/dwt/tcpip/tftpc.asm @@ -0,0 +1,256 @@ +; tftpc.asm -- minimal TFTP read client built on the firmware's socket API. +; +; The firmware's own tftp_open() calls a resolver that does not return when +; called from the rdebug process (dwt/notes/TCPIP.md), so this payload speaks +; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one file. +; +; socket = 3F5C9A00h socket(2,2,0) -> fd +; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n +; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags, from, fromlen) -> n +; close = 3F5E8930h close(fd) +; malloc = 3F701230h malloc(bytes) -> bit pointer +; +; The transfer is 600 bytes, so DATA 1 is 512 (full) and DATA 2 is 88 +; (short); the short block ends the transfer. ACKs go to the sockaddr that +; recvfrom reports, not to a hard-coded port. +; +; Evidence cells (32-bit, bit addresses): +; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4 closed, 0FFh failed) +; 0187C020 fd +; 0187C040 destination buffer (malloc) +; 0187C060 total bytes fetched +; 0187C080 last recvfrom length +; 0187C0A0 last DATA block word as read from the wire +; 0187C0C0 marker 05A5A5A5h when the fetch completed +; 0187C200 entry SP +; 0187C220 entry A14 +; +; Scratch (fixed bit addresses, above this image): +; 01875000 argument area +; 01876000 receive buffer (2048 bytes) +; 0187A000 recvfrom source sockaddr +; 0187A080 recvfrom sockaddr length +; 0187A100 ACK packet (4 bytes) + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @0187C200h, 1 + move a14, @0187C220h, 1 + + movi 1, a0, L + move a0, @0187C000h, 1 + + ; ---- buf = malloc(010000h) ------------------------------------ + move a14, -*sp, 1 + movi 01875000h, a14, L + movi 010000h, a0, L + move a0, *a14+, 1 + calla 3F701230h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @0187C040h, 1 + move a8, a11 ; dest cursor (callee-saved) + move a8, a8 + jreq fail + + movi 2, a0, L + move a0, @0187C000h, 1 + + ; ---- fd = socket(2,2,0) -------------------------------------- + movi 01875000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + calla 3F5C9A00h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @0187C020h, 1 + move a8, a9 ; fd (callee-saved) + move a8, a8 + jrlt fail + + ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) ------------------------ + movi 01875000h, a14, L + movi 16, a0, L + move a0, *a14+, 1 + movi SADDR, a0, L + move a0, *a14+, 1 + movi 0, a0, L + move a0, *a14+, 1 + movi 28, a0, L + move a0, *a14+, 1 + movi RRQ, a0, L + move a0, *a14+, 1 + move a9, *a14+, 1 + calla 3F5D3D70h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a8 + jrlt fail + + movi 3, a0, L + move a0, @0187C000h, 1 + sub a0, a0 + move a0, @0187C060h, 1 ; total = 0 + +recv_loop: + ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) ------------- + ; arg5 is a POINTER to the socklen (as tftp_read passes it); the + ; value is initialised to 16 first. + movi 16, a0, L + move a0, @0187A080h, 1 ; fromlen = 16 + movi 01875000h, a14, L + movi 0187A080h, a0, L + move a0, *a14+, 1 ; arg5 = &fromlen + movi 0187A000h, a0, L + move a0, *a14+, 1 ; arg4 = &from + movi 0, a0, L + move a0, *a14+, 1 ; arg3 = flags + movi 00800h, a0, L + move a0, *a14+, 1 ; arg2 = 2048 + movi 01876000h, a0, L + move a0, *a14+, 1 ; arg1 = receive buffer + move a9, *a14+, 1 ; arg0 = fd + calla 3F5D7D50h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + + move a8, @0187C080h, 1 ; last length + move a8, a8 + jrle fail + + ; opcode: wire 00 03 -> little-endian word 0300h + move @01876000h, a0, 0 + cmpi 0300h, a0 + jrne fail ; only DATA is accepted + + move @01876010h, a4, 0 ; block number, wire order + move a4, @0187C0A0h, 1 + + move a8, a3 + subk 4, a3 ; payload length + + ; ---- total += payload, dest += payload ----------------------- + move @0187C060h, a1, 1 + add a3, a1 + move a1, @0187C060h, 1 ; total += payload (bytes) + move a11, a6 ; copy destination + move a3, a2 + sll 3, a2 ; bytes -> bits: pointers are bit addresses + add a2, a11 ; dest cursor advances now (do NOT add bytes) + + ; ---- copy payload from BUF+4 to a6, one byte at a time ------ + ; Interrupts are disabled for the copy so a 512-byte copy is atomic + ; with respect to the firmware's ISRs. + dint + movi 01876020h, a5, L + move a3, a2 + move a3, @0187C0E0h, 1 ; payload length + move a2, @0187C140h, 1 ; copy count + move a6, @0187C120h, 1 ; write start + move a11, @0187C100h, 1 ; cursor after advance + move a5, @0187C160h, 1 ; source + jreq copy_done +copy_bytes: + movb *a5, a0 + movb a0, *a6 + addk 8, a5 ; one byte + addk 8, a6 + dsjs a2, copy_bytes +copy_done: + eint + + ; ---- ACK: 00 04 -------------------------- + movi 00400h, a0, L + move a0, @0187A100h, 0 + move a4, @0187A110h, 0 + + movi 01875000h, a14, L + movi 16, a0, L + move a0, *a14+, 1 + movi 0187A000h, a0, L + move a0, *a14+, 1 + movi 0, a0, L + move a0, *a14+, 1 + movi 4, a0, L + move a0, *a14+, 1 + movi 0187A100h, a0, L + move a0, *a14+, 1 + move a9, *a14+, 1 + calla 3F5D3D70h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a8 + jrlt fail + + ; short block ends the transfer; full block means read again + move @0187C080h, a2, 1 + subk 4, a2 + cmpi 512, a2 + jrlt close_it + jruc recv_loop + +close_it: + movi 4, a0, L + move a0, @0187C000h, 1 + movi 01875000h, a14, L + move a9, *a14+, 1 + calla 3F5E8930h ; close(fd) + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + movi 05A5A5A5h, a0, L + move a0, @0187C0C0h, 1 + sub a8, a8 + jruc epilogue + +fail: + movi 0FFh, a0, L + move a0, @0187C000h, 1 + movi 0FFFFFFFFh, a8, L +epilogue: + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + rets + +RRQ: + .word 00100h ; opcode 1 (00 01) + .word 07764h ; "dw" + .word 02F74h ; "t/" + .word 06374h ; "tc" + .word 06970h ; "pi" + .word 02F70h ; "p/" + .word 07270h ; "pr" + .word 0626Fh ; "ob" + .word 02E65h ; "e." + .word 06962h ; "bi" + .word 0006Eh ; "n\0" + .word 0636Fh ; "oc" + .word 06574h ; "te" + .word 00074h ; "t\0" +SADDR: + .word 00002h ; sin_family = AF_INET + .word 04500h ; sin_port = htons(69) + .word 0A8C0h ; 192.168 + .word 00163h ; .99.1 + .word 0 + .word 0 + .word 0 + .word 0 + .end diff --git a/dwt/tcpip/udptest.asm b/dwt/tcpip/udptest.asm new file mode 100644 index 0000000..3164311 --- /dev/null +++ b/dwt/tcpip/udptest.asm @@ -0,0 +1,96 @@ +; udptest.asm -- socket() + sendto() a real TFTP RRQ. +; +; socket = 3F5C9A00h socket(2,2,0) -> fd +; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n +; +; The RRQ is the packet the firmware itself would send for +; "dwt/tcpip/probe.bin" in octet mode. A server log line for this packet is +; proof that UDP transmit works from the calling process; no reply is read. +; +; Evidence cells (32-bit, bit addresses): +; 01876800 stage (1 entered, 2 sendto returned) +; 01876820 socket fd +; 01876840 sendto return +; 01876A00 entry SP +; 01876A20 entry A14 + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @01876A00h, 1 + move a14, @01876A20h, 1 + + movi 1, a0, L + move a0, @01876800h, 1 + + movi 01877000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; arg2 = protocol + movi 2, a0, L + move a0, *a14+, 1 ; arg1 = SOCK_DGRAM + movi 2, a0, L + move a0, *a14+, 1 ; arg0 = AF_INET + calla 3F5C9A00h + move @01876A00h, sp, 1 + move @01876A20h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01876820h, 1 + move a8, a9 + + movi 2, a0, L + move a0, @01876800h, 1 + + ; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16) + movi 01877000h, a14, L + movi 16, a0, L + move a0, *a14+, 1 ; arg5 = 16 + movi SADDR, a0, L + move a0, *a14+, 1 ; arg4 = &sockaddr + movi 0, a0, L + move a0, *a14+, 1 ; arg3 = flags + movi 28, a0, L + move a0, *a14+, 1 ; arg2 = length + movi RRQ, a0, L + move a0, *a14+, 1 ; arg1 = packet + move a9, *a14+, 1 ; arg0 = fd + calla 3F5D3D70h + move @01876A00h, sp, 1 + move @01876A20h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01876840h, 1 + + movi 3, a0, L + move a0, @01876800h, 1 + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + +RRQ: + .word 00100h ; opcode 1 (00 01) + .word 07764h ; "dw" + .word 02F74h ; "t/" + .word 06374h ; "tc" + .word 06970h ; "pi" + .word 02F70h ; "p/" + .word 07270h ; "pr" + .word 0626Fh ; "ob" + .word 02E65h ; "e." + .word 06962h ; "bi" + .word 0006Eh ; "n\0" + .word 0636Fh ; "oc" + .word 06574h ; "te" + .word 00074h ; "t\0" +SADDR: + .word 00002h ; sin_family = AF_INET + .word 04500h ; sin_port = htons(69) + .word 0A8C0h ; 192.168 + .word 00163h ; .99.1 + .word 0 + .word 0 + .word 0 + .word 0 + .end diff --git a/dwt/tcpip/verify.py b/dwt/tcpip/verify.py new file mode 100644 index 0000000..4f4e463 --- /dev/null +++ b/dwt/tcpip/verify.py @@ -0,0 +1,88 @@ +#!/usr/bin/env python3 +"""Read the fetched TFTP image back with rdebug peek and compare it byte-for-byte. + + python3 dwt/tcpip/verify.py --host 192.168.99.2 \ + --markers 0x0187C000 --file dwt/tcpip/probe.bin + +Marker layout is the one in tftpc.asm: + +0x00 stage, +0x20 fd, +0x40 buffer, +0x60 total, + +0x80 last recvfrom length, +0xA0 last block, +0xC0 done. + +The comparison is the acceptance check: the payload is not trusted to report +its own success. +""" +from __future__ import annotations + +import argparse +import hashlib +import os +import sys + +HERE = os.path.dirname(os.path.abspath(__file__)) +DWT = os.path.dirname(HERE) +sys.path.insert(0, DWT) + +import challenge # noqa: E402 +import exploit # noqa: E402 + +_orig_answer = exploit.RDebug.answer_challenge + + +def _answer(self, challenge_bytes: bytes) -> None: + self.challenge_raw = challenge.respond(challenge_bytes) + return _orig_answer(self, challenge_bytes) + + +exploit.RDebug.answer_challenge = _answer + + +def main(argv=None): + ap = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("--host", default="192.168.99.2") + ap.add_argument("--port", type=int, default=771) + ap.add_argument("--markers", type=exploit.parse_int, default=0x0187C000) + ap.add_argument("--file", default=os.path.join(HERE, "probe.bin")) + a = ap.parse_args(argv) + + want = open(a.file, "rb").read() + rd = exploit.RDebug(a.host, a.port, 10.0, False) + rd.connect() + rd.liveness(7) + + def u32(off): + return int.from_bytes(rd.peek(a.markers + off, 4), "little") + + stage, fd, buf, total = u32(0), u32(0x20), u32(0x40), u32(0x60) + last, block, done = u32(0x80), u32(0xA0), u32(0xC0) + print(f"stage={stage} fd={fd} buf={buf:#010x} total={total} " + f"last={last} block={block:#06x} done={done:#010x}") + + if stage != 4 or done != 0x05A5A5A5: + print("FAIL: payload did not reach the completed state") + return 2 + if total != len(want): + print(f"FAIL: total {total} != file size {len(want)}") + return 2 + + got = b"" + off = 0 + while off < total: + n = min(exploit.MAX_XFER, total - off) + got += rd.peek(buf + off * 8, n) + off += n + + if got == want: + print(f"OK: {len(got)} bytes at {buf:#010x} match {a.file} " + f"sha256={hashlib.sha256(got).hexdigest()}") + return 0 + for i, (x, y) in enumerate(zip(got, want)): + if x != y: + print(f"FAIL: first mismatch at byte {i}: got {x:02x} want {y:02x}") + break + print(f"FAIL: {len(got)} bytes differ from {a.file}") + return 1 + + +if __name__ == "__main__": + raise SystemExit(main())