diff --git a/dwt/evidence/real-unit-xtext-2.png b/dwt/evidence/real-unit-xtext-2.png new file mode 100644 index 0000000..a147b80 Binary files /dev/null and b/dwt/evidence/real-unit-xtext-2.png differ diff --git a/dwt/evidence/real-unit-xtext-tftp.png b/dwt/evidence/real-unit-xtext-tftp.png new file mode 100644 index 0000000..936656c Binary files /dev/null and b/dwt/evidence/real-unit-xtext-tftp.png differ diff --git a/dwt/evidence/real-unit-xtext-tftp2.png b/dwt/evidence/real-unit-xtext-tftp2.png new file mode 100644 index 0000000..8c3aa1e Binary files /dev/null and b/dwt/evidence/real-unit-xtext-tftp2.png differ diff --git a/dwt/evidence/real-unit-xtext.png b/dwt/evidence/real-unit-xtext.png new file mode 100644 index 0000000..fce1171 Binary files /dev/null and b/dwt/evidence/real-unit-xtext.png differ diff --git a/dwt/gui/build/xtext.bin b/dwt/gui/build/xtext.bin new file mode 100644 index 0000000..2780c0c Binary files /dev/null and b/dwt/gui/build/xtext.bin differ diff --git a/dwt/gui/build/xtext.lst b/dwt/gui/build/xtext.lst new file mode 100644 index 0000000..7b2d55c --- /dev/null +++ b/dwt/gui/build/xtext.lst @@ -0,0 +1,879 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; xtext.asm -- open a window on the live DWT X server a + 0002 ; + 0003 ; Run as a first-class process created by the COFF load + 0004 ; in the rdebug dispatcher's context: a connect made fr + 0005 ; accepted at the service layer but the server never re + 0006 ; XOpenDisplay returns an unusable Display. A fresh pr + 0007 ; + 0008 ; This is xhello.asm plus the text path: + 0009 ; XLoadFont(d,"fixed") 3FD4AE80 + 0010 ; XCreateGC(d,win,mask,&values) 3F997000 + 0011 ; XSetForeground(d,gc,1) 3FD99A60 + 0012 ; XMapWindow(d,win) 3FD645B0 + 0013 ; XSync(d,0) / XDrawString(...) loop 3FD9F6B0 / 3 + 0014 ; + 0015 ; The GC is created with a zero value-mask, so the serv + 0016 ; screen's default GC (which carries the server's defau + 0017 ; draw is repeated with an XSync between iterations so + 0018 ; WM has framed/reparented/mapped the window; a single + 0019 ; when the window is reparented. + 0020 ; + 0021 ; Calling convention (the one the firmware itself uses; + 0022 ; 07F57044 and the TM at 07E5D2B4): + 0023 ; + 0024 ; MOVE A14,-*SP,1 ; reserve the slot the ca + 0025 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument + 0026 ; ... + 0027 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen + 0028 ; CALLA target + 0029 ; + 0030 ; The callee's `rets 2` pops the return address and the + 0031 ; restored by the call itself; A14 is restored from tha + 0032 ; entry SP/A14 in RAM and restore them after each call: + 0033 ; Xlib data structures use the same free heap, and a cl + 0034 ; turns the next call into a wild push. That exact pat + 0035 ; version of this payload at XCreateGC. + 0036 ; + 0037 ; Xlib clobbers the CPU's SETF field state, so the ABI' + 0038 ; re-established after every call. The Display pointer + 0039 ; are kept in callee-saved registers (a11/a10/a12). + 0040 ; + 0041 ; Markers live in 224 bytes of zero padding at the end + 0042 ; NOT in the free heap: the first version's cells at 01 + 0043 ; by the OS heap (the string "Exiting\n" landed on them + 0044 ; + 0045 ; 01842000 stage (1 start, 2 display, 3 window, 4 fo + 0046 ; 7 map, 8 synced/drawn, 9 flushed, + 0047 ; 01842020 display pointer + 0048 ; 01842040 font id returned by XLoadFont + 0049 ; 01842060 window id + 0050 ; 01842080 GC id returned by XCreateGC + 0051 ; 018420A0 XSetForeground return + 0052 ; 018420C0 XMapWindow return + 0053 ; 018420E0 last XSync return + 0054 ; 01842100 first XDrawString return + 0055 ; 01842120 second XDrawString return + 0056 ; 01842140 final XSync return + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0057 ; 01841760 strlen("0::0") -- must be 4 + 0058 ; + 0059 ; Scratch: 01894000 argument area + 0060 + 0061 00000000 .text + 0062 00000000 _start: + 0063 00000000 0550 setf 16, 0, 0 + 0064 00000010 0740 setf 32, 0, 1 + 0065 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0066 + 0067 00000040 09E0 movi 1, a0, L + 00000050 00000001 + 0068 00000070 0780 move a0, @01842000h, 1 ; stage = 1 + 00000080 01842000 + 0069 + 0070 ; ---- convention check: strlen("0::0") == 4 --------- + 0071 000000A0 A3CF move a14, -*sp, 1 + 0072 000000B0 09EE movi 01894000h, a14, L + 000000C0 01894000 + 0073 000000E0 09E0 movi 3FACE948h, a0, L ; ROM "0::0" + 000000F0 3FACE948 + 0074 00000110 920E move a0, *a14+, 1 ; arg0 + 0075 00000120 0D5F calla 3FB458D0h ; strlen + 00000130 3FB458D0 + 0076 00000150 0550 setf 16, 0, 0 + 0077 00000160 0740 setf 32, 0, 1 + 0078 00000170 0788 move a8, @01842160h, 1 ; MARK strlen + 00000180 01842160 + 0079 000001A0 09E0 movi 4, a0, L + 000001B0 00000004 + 0080 000001D0 4808 cmp a0, a8 + 0081 000001E0 CB00 jrne failed + 000001F0 0126 + 0082 + 0083 00000200 09E0 movi 2, a0, L + 00000210 00000002 + 0084 00000230 0780 move a0, @01842000h, 1 ; stage = 2 + 00000240 01842000 + 0085 + 0086 ; ---- display = XOpenDisplay("0::0") ---------------- + 0087 00000260 A3CF move a14, -*sp, 1 + 0088 00000270 09EE movi 01894000h, a14, L + 00000280 01894000 + 0089 000002A0 09E0 movi 3FACE948h, a0, L + 000002B0 3FACE948 + 0090 000002D0 920E move a0, *a14+, 1 ; arg0 = name + 0091 000002E0 0D5F calla 3F9C2570h ; XOpenDisplay + 000002F0 3F9C2570 + 0092 00000310 0550 setf 16, 0, 0 + 0093 00000320 0740 setf 32, 0, 1 + 0094 00000330 4D0B move a8, a11 ; Display * (callee-saved) + 0095 00000340 078B move a11, @01842020h, 1 ; MARK display + 00000350 01842020 + 0096 00000370 4D6B move a11, a11 + 0097 00000380 CA00 jreq failed + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 00000390 010C + 0098 + 0099 ; ---- root = *(*(display+0x480)+0x40) --------------- + 0100 000003A0 B76A move *a11(0480h), a10, 1 + 000003B0 0480 + 0101 000003C0 B74A move *a10(040h), a10, 1 + 000003D0 0040 + 0102 + 0103 000003E0 09E0 movi 3, a0, L + 000003F0 00000003 + 0104 00000410 0780 move a0, @01842000h, 1 ; stage = 3 + 00000420 01842000 + 0105 + 0106 ; ---- window = XCreateSimpleWindow(d,root,100,100,400 + 0107 00000440 A3CF move a14, -*sp, 1 + 0108 00000450 09EE movi 01894000h, a14, L + 00000460 01894000 + 0109 00000480 09E0 movi 0, a0, L + 00000490 00000000 + 0110 000004B0 920E move a0, *a14+, 1 ; background = 0 (black) + 0111 000004C0 09E0 movi 1, a0, L + 000004D0 00000001 + 0112 000004F0 920E move a0, *a14+, 1 ; border = 1 (white) + 0113 00000500 09E0 movi 2, a0, L + 00000510 00000002 + 0114 00000530 920E move a0, *a14+, 1 ; border width + 0115 00000540 09E0 movi 200, a0, L + 00000550 000000C8 + 0116 00000570 920E move a0, *a14+, 1 ; height + 0117 00000580 09E0 movi 400, a0, L + 00000590 00000190 + 0118 000005B0 920E move a0, *a14+, 1 ; width + 0119 000005C0 09E0 movi 100, a0, L + 000005D0 00000064 + 0120 000005F0 920E move a0, *a14+, 1 ; y + 0121 00000600 920E move a0, *a14+, 1 ; x + 0122 00000610 934E move a10, *a14+, 1 ; parent = root + 0123 00000620 936E move a11, *a14+, 1 ; display + 0124 00000630 0D5F calla 3FD41B90h ; XCreateSimpleWindow + 00000640 3FD41B90 + 0125 00000660 0550 setf 16, 0, 0 + 0126 00000670 0740 setf 32, 0, 1 + 0127 00000680 4D0A move a8, a10 ; window id + 0128 00000690 078A move a10, @01842060h, 1 ; MARK window + 000006A0 01842060 + 0129 000006C0 4D4A move a10, a10 + 0130 000006D0 CA00 jreq failed + 000006E0 00D7 + 0131 + 0132 000006F0 09E0 movi 4, a0, L + 00000700 00000004 + 0133 00000720 0780 move a0, @01842000h, 1 ; stage = 4 + 00000730 01842000 + 0134 + 0135 ; ---- font = XLoadFont(display, "fixed") ------------ + 0136 00000750 A3CF move a14, -*sp, 1 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 0137 00000760 09EE movi 01894000h, a14, L + 00000770 01894000 + 0138 00000790 09E0 movi FONTNAME, a0, L + 000007A0 000015E0' + 0139 000007C0 920E move a0, *a14+, 1 ; arg1 = name + 0140 000007D0 936E move a11, *a14+, 1 ; arg0 = display + 0141 000007E0 0D5F calla 3FD4AE80h ; XLoadFont + 000007F0 3FD4AE80 + 0142 00000810 0550 setf 16, 0, 0 + 0143 00000820 0740 setf 32, 0, 1 + 0144 00000830 4D09 move a8, a9 ; Font (callee-saved) + 0145 00000840 0789 move a9, @01842040h, 1 ; MARK font + 00000850 01842040 + 0146 00000870 4D29 move a9, a9 + 0147 00000880 CA00 jreq failed + 00000890 00BC + 0148 + 0149 000008A0 09E0 movi 5, a0, L + 000008B0 00000005 + 0150 000008D0 0780 move a0, @01842000h, 1 ; stage = 5 + 000008E0 01842000 + 0151 + 0152 ; ---- gc = XCreateGC(d, window, 0, NULL) ------------ + 0153 ; mask 0 -> server default GC values (no value-list to + 0154 00000900 A3CF move a14, -*sp, 1 + 0155 00000910 09EE movi 01894000h, a14, L + 00000920 01894000 + 0156 00000940 09E0 movi 0, a0, L + 00000950 00000000 + 0157 00000970 920E move a0, *a14+, 1 ; arg3 = values + 0158 00000980 920E move a0, *a14+, 1 ; arg2 = mask 0 + 0159 00000990 934E move a10, *a14+, 1 ; arg1 = drawable + 0160 000009A0 936E move a11, *a14+, 1 ; arg0 = display + 0161 000009B0 0D5F calla 3F997000h ; XCreateGC + 000009C0 3F997000 + 0162 000009E0 0550 setf 16, 0, 0 + 0163 000009F0 0740 setf 32, 0, 1 + 0164 00000A00 4D0C move a8, a12 ; GC (callee-saved) + 0165 00000A10 078C move a12, @01842080h, 1 ; MARK gc + 00000A20 01842080 + 0166 00000A40 4D8C move a12, a12 + 0167 00000A50 CA00 jreq failed + 00000A60 009F + 0168 + 0169 ; ---- XSetForeground(display, gc, 1) ---------------- + 0170 00000A70 A3CF move a14, -*sp, 1 + 0171 00000A80 09EE movi 01894000h, a14, L + 00000A90 01894000 + 0172 00000AB0 09E0 movi 1, a0, L + 00000AC0 00000001 + 0173 00000AE0 920E move a0, *a14+, 1 ; arg2 = pixel 1 (white) + 0174 00000AF0 938E move a12, *a14+, 1 ; arg1 = gc + 0175 00000B00 936E move a11, *a14+, 1 ; arg0 = display + 0176 00000B10 0D5F calla 3FD99A60h ; XSetForeground + 00000B20 3FD99A60 + 0177 00000B40 0550 setf 16, 0, 0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 5 + + 0178 00000B50 0740 setf 32, 0, 1 + 0179 00000B60 0788 move a8, @018420A0h, 1 ; MARK setfg + 00000B70 018420A0 + 0180 00000B90 09E0 movi 6, a0, L + 00000BA0 00000006 + 0181 00000BC0 0780 move a0, @01842000h, 1 ; stage = 6 + 00000BD0 01842000 + 0182 + 0183 ; ---- XMapWindow(display, window) ------------------- + 0184 00000BF0 A3CF move a14, -*sp, 1 + 0185 00000C00 09EE movi 01894000h, a14, L + 00000C10 01894000 + 0186 00000C30 934E move a10, *a14+, 1 ; window + 0187 00000C40 936E move a11, *a14+, 1 ; display + 0188 00000C50 0D5F calla 3FD645B0h ; XMapWindow + 00000C60 3FD645B0 + 0189 00000C80 0550 setf 16, 0, 0 + 0190 00000C90 0740 setf 32, 0, 1 + 0191 00000CA0 0788 move a8, @018420C0h, 1 ; MARK map + 00000CB0 018420C0 + 0192 00000CD0 09E0 movi 7, a0, L + 00000CE0 00000007 + 0193 00000D00 0780 move a0, @01842000h, 1 ; stage = 7 + 00000D10 01842000 + 0194 + 0195 ; ---- sync + draw, repeated: the WM needs time to fra + 0196 00000D30 09E9 movi 4, a9, L + 00000D40 00000004 + 0197 00000D60 draw_loop: + 0198 00000D60 A3CF move a14, -*sp, 1 + 0199 00000D70 09EE movi 01894000h, a14, L + 00000D80 01894000 + 0200 00000DA0 09E0 movi 0, a0, L + 00000DB0 00000000 + 0201 00000DD0 920E move a0, *a14+, 1 ; discard = 0 + 0202 00000DE0 936E move a11, *a14+, 1 ; display + 0203 00000DF0 0D5F calla 3FD9F6B0h ; XSync (flush + round trip) + 00000E00 3FD9F6B0 + 0204 00000E20 0550 setf 16, 0, 0 + 0205 00000E30 0740 setf 32, 0, 1 + 0206 00000E40 0788 move a8, @018420E0h, 1 ; MARK last sync + 00000E50 018420E0 + 0207 + 0208 ; ---- XDrawString(display, window, gc, 20, 80, msg1, + 0209 00000E70 A3CF move a14, -*sp, 1 + 0210 00000E80 09EE movi 01894000h, a14, L + 00000E90 01894000 + 0211 00000EB0 09E0 movi 12, a0, L + 00000EC0 0000000C + 0212 00000EE0 920E move a0, *a14+, 1 ; arg6 = length + 0213 00000EF0 09E0 movi MSG1, a0, L + 00000F00 00001520' + 0214 00000F20 920E move a0, *a14+, 1 ; arg5 = string + 0215 00000F30 09E0 movi 80, a0, L + 00000F40 00000050 + 0216 00000F60 920E move a0, *a14+, 1 ; arg4 = y + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 6 + + 0217 00000F70 09E0 movi 20, a0, L + 00000F80 00000014 + 0218 00000FA0 920E move a0, *a14+, 1 ; arg3 = x + 0219 00000FB0 938E move a12, *a14+, 1 ; arg2 = gc + 0220 00000FC0 934E move a10, *a14+, 1 ; arg1 = window + 0221 00000FD0 936E move a11, *a14+, 1 ; arg0 = display + 0222 00000FE0 0D5F calla 3FDA0000h ; XDrawString + 00000FF0 3FDA0000 + 0223 00001010 0550 setf 16, 0, 0 + 0224 00001020 0740 setf 32, 0, 1 + 0225 00001030 0788 move a8, @01842100h, 1 ; MARK draw1 + 00001040 01842100 + 0226 + 0227 ; ---- XDrawString(display, window, gc, 20, 120, msg2, + 0228 00001060 A3CF move a14, -*sp, 1 + 0229 00001070 09EE movi 01894000h, a14, L + 00001080 01894000 + 0230 000010A0 09E0 movi 10, a0, L + 000010B0 0000000A + 0231 000010D0 920E move a0, *a14+, 1 ; arg6 = length + 0232 000010E0 09E0 movi MSG2, a0, L + 000010F0 00001588' + 0233 00001110 920E move a0, *a14+, 1 ; arg5 = string + 0234 00001120 09E0 movi 120, a0, L + 00001130 00000078 + 0235 00001150 920E move a0, *a14+, 1 ; arg4 = y + 0236 00001160 09E0 movi 20, a0, L + 00001170 00000014 + 0237 00001190 920E move a0, *a14+, 1 ; arg3 = x + 0238 000011A0 938E move a12, *a14+, 1 ; arg2 = gc + 0239 000011B0 934E move a10, *a14+, 1 ; arg1 = window + 0240 000011C0 936E move a11, *a14+, 1 ; arg0 = display + 0241 000011D0 0D5F calla 3FDA0000h ; XDrawString + 000011E0 3FDA0000 + 0242 00001200 0550 setf 16, 0, 0 + 0243 00001210 0740 setf 32, 0, 1 + 0244 00001220 0788 move a8, @01842120h, 1 ; MARK draw2 + 00001230 01842120 + 0245 + 0246 ; DSJS has a short range; trampoline to the long backw + 0247 00001250 3829 dsjs a9, draw_next + 0248 00001260 C001 jruc draw_done + 0249 00001270 draw_next: + 0250 00001270 C0AE jruc draw_loop + 0251 00001280 draw_done: + 0252 + 0253 00001280 09E0 movi 8, a0, L + 00001290 00000008 + 0254 000012B0 0780 move a0, @01842000h, 1 ; stage = 8 + 000012C0 01842000 + 0255 + 0256 ; ---- final XSync flushes the last PolyText8 -------- + 0257 000012E0 A3CF move a14, -*sp, 1 + 0258 000012F0 09EE movi 01894000h, a14, L + 00001300 01894000 + 0259 00001320 09E0 movi 0, a0, L + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 7 + + 00001330 00000000 + 0260 00001350 920E move a0, *a14+, 1 ; discard = 0 + 0261 00001360 936E move a11, *a14+, 1 ; display + 0262 00001370 0D5F calla 3FD9F6B0h ; XSync + 00001380 3FD9F6B0 + 0263 000013A0 0550 setf 16, 0, 0 + 0264 000013B0 0740 setf 32, 0, 1 + 0265 000013C0 0788 move a8, @01842140h, 1 ; MARK final sync + 000013D0 01842140 + 0266 + 0267 000013F0 09E0 movi 9, a0, L + 00001400 00000009 + 0268 00001420 0780 move a0, @01842000h, 1 ; stage = 9 (text drawn and flu + 00001430 01842000 + 0269 00001450 C006 jruc done + 0270 + 0271 00001460 failed: + 0272 00001460 09E0 movi 0FFh, a0, L + 00001470 000000FF + 0273 00001490 0780 move a0, @01842000h, 1 + 000014A0 01842000 + 0274 + 0275 000014C0 done: + 0276 000014C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 000014D0 00FF + 0277 000014E0 09E8 movi 0, a8, L + 000014F0 00000000 + 0278 00001510 0960 rets + 0279 + 0280 00001520 48 MSG1: .byte "HELLO VT1200", 0 + 00001528 45 + 00001530 4C + 00001538 4C + 00001540 4F + 00001548 20 + 00001550 56 + 00001558 54 + 00001560 31 + 00001568 32 + 00001570 30 + 00001578 30 + 00001580 00 + 0281 00001588 74 MSG2: .byte "text works", 0 + 00001590 65 + 00001598 78 + 000015A0 74 + 000015A8 20 + 000015B0 77 + 000015B8 6F + 000015C0 72 + 000015C8 6B + 000015D0 73 + 000015D8 00 + 0282 000015E0 2D FONTNAME: .byte "-DEC-Terminal-Medium-R-Normal--14-140- + 000015E8 44 + 000015F0 45 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 8 + + 000015F8 43 + 00001600 2D + 00001608 54 + 00001610 65 + 00001618 72 + 00001620 6D + 00001628 69 + 00001630 6E + 00001638 61 + 00001640 6C + 00001648 2D + 00001650 4D + 00001658 65 + 00001660 64 + 00001668 69 + 00001670 75 + 00001678 6D + 00001680 2D + 00001688 52 + 00001690 2D + 00001698 4E + 000016A0 6F + 000016A8 72 + 000016B0 6D + 000016B8 61 + 000016C0 6C + 000016C8 2D + 000016D0 2D + 000016D8 31 + 000016E0 34 + 000016E8 2D + 000016F0 31 + 000016F8 34 + 00001700 30 + 00001708 2D + 00001710 37 + 00001718 35 + 00001720 2D + 00001728 37 + 00001730 35 + 00001738 2D + 00001740 43 + 00001748 2D + 00001750 38 + 00001758 2D + 00001760 49 + 00001768 53 + 00001770 4F + 00001778 38 + 00001780 38 + 00001788 35 + 00001790 39 + 00001798 2D + 000017A0 31 + 000017A8 00 + 0283 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 9 + + 0284 ; 224 bytes of padding: marker cells 01842000h..018421 + 0285 000017B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000017B8 00 + 000017C0 00 + 000017C8 00 + 000017D0 00 + 000017D8 00 + 000017E0 00 + 000017E8 00 + 000017F0 00 + 000017F8 00 + 00001800 00 + 00001808 00 + 00001810 00 + 00001818 00 + 00001820 00 + 00001828 00 + 0286 00001830 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001838 00 + 00001840 00 + 00001848 00 + 00001850 00 + 00001858 00 + 00001860 00 + 00001868 00 + 00001870 00 + 00001878 00 + 00001880 00 + 00001888 00 + 00001890 00 + 00001898 00 + 000018A0 00 + 000018A8 00 + 0287 000018B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000018B8 00 + 000018C0 00 + 000018C8 00 + 000018D0 00 + 000018D8 00 + 000018E0 00 + 000018E8 00 + 000018F0 00 + 000018F8 00 + 00001900 00 + 00001908 00 + 00001910 00 + 00001918 00 + 00001920 00 + 00001928 00 + 0288 00001930 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001938 00 + 00001940 00 + 00001948 00 + 00001950 00 + 00001958 00 + 00001960 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 10 + + 00001968 00 + 00001970 00 + 00001978 00 + 00001980 00 + 00001988 00 + 00001990 00 + 00001998 00 + 000019A0 00 + 000019A8 00 + 0289 000019B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000019B8 00 + 000019C0 00 + 000019C8 00 + 000019D0 00 + 000019D8 00 + 000019E0 00 + 000019E8 00 + 000019F0 00 + 000019F8 00 + 00001A00 00 + 00001A08 00 + 00001A10 00 + 00001A18 00 + 00001A20 00 + 00001A28 00 + 0290 00001A30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001A38 00 + 00001A40 00 + 00001A48 00 + 00001A50 00 + 00001A58 00 + 00001A60 00 + 00001A68 00 + 00001A70 00 + 00001A78 00 + 00001A80 00 + 00001A88 00 + 00001A90 00 + 00001A98 00 + 00001AA0 00 + 00001AA8 00 + 0291 00001AB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001AB8 00 + 00001AC0 00 + 00001AC8 00 + 00001AD0 00 + 00001AD8 00 + 00001AE0 00 + 00001AE8 00 + 00001AF0 00 + 00001AF8 00 + 00001B00 00 + 00001B08 00 + 00001B10 00 + 00001B18 00 + 00001B20 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 11 + + 00001B28 00 + 0292 00001B30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001B38 00 + 00001B40 00 + 00001B48 00 + 00001B50 00 + 00001B58 00 + 00001B60 00 + 00001B68 00 + 00001B70 00 + 00001B78 00 + 00001B80 00 + 00001B88 00 + 00001B90 00 + 00001B98 00 + 00001BA0 00 + 00001BA8 00 + 0293 00001BB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001BB8 00 + 00001BC0 00 + 00001BC8 00 + 00001BD0 00 + 00001BD8 00 + 00001BE0 00 + 00001BE8 00 + 00001BF0 00 + 00001BF8 00 + 00001C00 00 + 00001C08 00 + 00001C10 00 + 00001C18 00 + 00001C20 00 + 00001C28 00 + 0294 00001C30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001C38 00 + 00001C40 00 + 00001C48 00 + 00001C50 00 + 00001C58 00 + 00001C60 00 + 00001C68 00 + 00001C70 00 + 00001C78 00 + 00001C80 00 + 00001C88 00 + 00001C90 00 + 00001C98 00 + 00001CA0 00 + 00001CA8 00 + 0295 00001CB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001CB8 00 + 00001CC0 00 + 00001CC8 00 + 00001CD0 00 + 00001CD8 00 + 00001CE0 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 12 + + 00001CE8 00 + 00001CF0 00 + 00001CF8 00 + 00001D00 00 + 00001D08 00 + 00001D10 00 + 00001D18 00 + 00001D20 00 + 00001D28 00 + 0296 00001D30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001D38 00 + 00001D40 00 + 00001D48 00 + 00001D50 00 + 00001D58 00 + 00001D60 00 + 00001D68 00 + 00001D70 00 + 00001D78 00 + 00001D80 00 + 00001D88 00 + 00001D90 00 + 00001D98 00 + 00001DA0 00 + 00001DA8 00 + 0297 00001DB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001DB8 00 + 00001DC0 00 + 00001DC8 00 + 00001DD0 00 + 00001DD8 00 + 00001DE0 00 + 00001DE8 00 + 00001DF0 00 + 00001DF8 00 + 00001E00 00 + 00001E08 00 + 00001E10 00 + 00001E18 00 + 00001E20 00 + 00001E28 00 + 0298 00001E30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001E38 00 + 00001E40 00 + 00001E48 00 + 00001E50 00 + 00001E58 00 + 00001E60 00 + 00001E68 00 + 00001E70 00 + 00001E78 00 + 00001E80 00 + 00001E88 00 + 00001E90 00 + 00001E98 00 + 00001EA0 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 13 + + 00001EA8 00 + 0299 00001EB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001EB8 00 + 00001EC0 00 + 00001EC8 00 + 00001ED0 00 + 00001ED8 00 + 00001EE0 00 + 00001EE8 00 + 00001EF0 00 + 00001EF8 00 + 00001F00 00 + 00001F08 00 + 00001F10 00 + 00001F18 00 + 00001F20 00 + 00001F28 00 + 0300 00001F30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001F38 00 + 00001F40 00 + 00001F48 00 + 00001F50 00 + 00001F58 00 + 00001F60 00 + 00001F68 00 + 00001F70 00 + 00001F78 00 + 00001F80 00 + 00001F88 00 + 00001F90 00 + 00001F98 00 + 00001FA0 00 + 00001FA8 00 + 0301 00001FB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001FB8 00 + 00001FC0 00 + 00001FC8 00 + 00001FD0 00 + 00001FD8 00 + 00001FE0 00 + 00001FE8 00 + 00001FF0 00 + 00001FF8 00 + 00002000 00 + 00002008 00 + 00002010 00 + 00002018 00 + 00002020 00 + 00002028 00 + 0302 00002030 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002038 00 + 00002040 00 + 00002048 00 + 00002050 00 + 00002058 00 + 00002060 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 14 + + 00002068 00 + 00002070 00 + 00002078 00 + 00002080 00 + 00002088 00 + 00002090 00 + 00002098 00 + 000020A0 00 + 000020A8 00 + 0303 000020B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000020B8 00 + 000020C0 00 + 000020C8 00 + 000020D0 00 + 000020D8 00 + 000020E0 00 + 000020E8 00 + 000020F0 00 + 000020F8 00 + 00002100 00 + 00002108 00 + 00002110 00 + 00002118 00 + 00002120 00 + 00002128 00 + 0304 00002130 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002138 00 + 00002140 00 + 00002148 00 + 00002150 00 + 00002158 00 + 00002160 00 + 00002168 00 + 00002170 00 + 00002178 00 + 00002180 00 + 00002188 00 + 00002190 00 + 00002198 00 + 000021A0 00 + 000021A8 00 + 0305 000021B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000021B8 00 + 000021C0 00 + 000021C8 00 + 000021D0 00 + 000021D8 00 + 000021E0 00 + 000021E8 00 + 000021F0 00 + 000021F8 00 + 00002200 00 + 00002208 00 + 00002210 00 + 00002218 00 + 00002220 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:19 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 15 + + 00002228 00 + 0306 00002230 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002238 00 + 00002240 00 + 00002248 00 + 00002250 00 + 00002258 00 + 00002260 00 + 00002268 00 + 00002270 00 + 00002278 00 + 00002280 00 + 00002288 00 + 00002290 00 + 00002298 00 + 000022A0 00 + 000022A8 00 + 0307 .end + + No Errors, No Warnings diff --git a/dwt/gui/build/xtext.map b/dwt/gui/build/xtext.map new file mode 100644 index 0000000..37a0f27 --- /dev/null +++ b/dwt/gui/build/xtext.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 17:23:19 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000022B0 + 01840000 000022B0 XTEXT.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018422B0 etext 018422B0 etext + +[6 symbols] diff --git a/dwt/gui/xtext.asm b/dwt/gui/xtext.asm new file mode 100644 index 0000000..bbaa2ae --- /dev/null +++ b/dwt/gui/xtext.asm @@ -0,0 +1,307 @@ +; xtext.asm -- open a window on the live DWT X server and draw text in it. +; +; Run as a first-class process created by the COFF loader (create_process), NOT +; in the rdebug dispatcher's context: a connect made from the rdebug process is +; accepted at the service layer but the server never reads the X11 setup, so +; XOpenDisplay returns an unusable Display. A fresh process works. +; +; This is xhello.asm plus the text path: +; XLoadFont(d,"fixed") 3FD4AE80 +; XCreateGC(d,win,mask,&values) 3F997000 +; XSetForeground(d,gc,1) 3FD99A60 +; XMapWindow(d,win) 3FD645B0 +; XSync(d,0) / XDrawString(...) loop 3FD9F6B0 / 3FDA0000 +; +; The GC is created with a zero value-mask, so the server fills it from the +; screen's default GC (which carries the server's default font, "fixed"). The +; draw is repeated with an XSync between iterations so that it lands after the +; WM has framed/reparented/mapped the window; a single early draw can be lost +; when the window is reparented. +; +; Calling convention (the one the firmware itself uses; see the WM at +; 07F57044 and the TM at 07E5D2B4): +; +; MOVE A14,-*SP,1 ; reserve the slot the callee restores A14 from +; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument first, upward via A14 +; ... +; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last +; CALLA target +; +; The callee's `rets 2` pops the return address and the reserved slot, so SP is +; restored by the call itself; A14 is restored from that slot. Do NOT keep the +; entry SP/A14 in RAM and restore them after each call: the app's own stack and +; Xlib data structures use the same free heap, and a clobbered saved-SP cell +; turns the next call into a wild push. That exact pattern crashed the first +; version of this payload at XCreateGC. +; +; Xlib clobbers the CPU's SETF field state, so the ABI's 32-bit field 1 is +; re-established after every call. The Display pointer and the window/GC ids +; are kept in callee-saved registers (a11/a10/a12). +; +; Markers live in 224 bytes of zero padding at the end of .text (01842000h), +; NOT in the free heap: the first version's cells at 01895000h were overwritten +; by the OS heap (the string "Exiting\n" landed on them). +; +; 01842000 stage (1 start, 2 display, 3 window, 4 font, 5 GC, 6 setfg, +; 7 map, 8 synced/drawn, 9 flushed, 0FFh failed) +; 01842020 display pointer +; 01842040 font id returned by XLoadFont +; 01842060 window id +; 01842080 GC id returned by XCreateGC +; 018420A0 XSetForeground return +; 018420C0 XMapWindow return +; 018420E0 last XSync return +; 01842100 first XDrawString return +; 01842120 second XDrawString return +; 01842140 final XSync return +; 01841760 strlen("0::0") -- must be 4 +; +; Scratch: 01894000 argument area + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + + movi 1, a0, L + move a0, @01842000h, 1 ; stage = 1 + + ; ---- convention check: strlen("0::0") == 4 -------------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 3FACE948h, a0, L ; ROM "0::0" + move a0, *a14+, 1 ; arg0 + calla 3FB458D0h ; strlen + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01842160h, 1 ; MARK strlen + movi 4, a0, L + cmp a0, a8 + jrne failed + + movi 2, a0, L + move a0, @01842000h, 1 ; stage = 2 + + ; ---- display = XOpenDisplay("0::0") --------------------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 3FACE948h, a0, L + move a0, *a14+, 1 ; arg0 = name + calla 3F9C2570h ; XOpenDisplay + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a11 ; Display * (callee-saved) + move a11, @01842020h, 1 ; MARK display + move a11, a11 + jreq failed + + ; ---- root = *(*(display+0x480)+0x40) -------------------------- + move *a11(0480h), a10, 1 + move *a10(040h), a10, 1 + + movi 3, a0, L + move a0, @01842000h, 1 ; stage = 3 + + ; ---- window = XCreateSimpleWindow(d,root,100,100,400,200,2,1,0) -- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; background = 0 (black) + movi 1, a0, L + move a0, *a14+, 1 ; border = 1 (white) + movi 2, a0, L + move a0, *a14+, 1 ; border width + movi 200, a0, L + move a0, *a14+, 1 ; height + movi 400, a0, L + move a0, *a14+, 1 ; width + movi 100, a0, L + move a0, *a14+, 1 ; y + move a0, *a14+, 1 ; x + move a10, *a14+, 1 ; parent = root + move a11, *a14+, 1 ; display + calla 3FD41B90h ; XCreateSimpleWindow + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a10 ; window id + move a10, @01842060h, 1 ; MARK window + move a10, a10 + jreq failed + + movi 4, a0, L + move a0, @01842000h, 1 ; stage = 4 + + ; ---- font = XLoadFont(display, "fixed") ----------------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi FONTNAME, a0, L + move a0, *a14+, 1 ; arg1 = name + move a11, *a14+, 1 ; arg0 = display + calla 3FD4AE80h ; XLoadFont + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a9 ; Font (callee-saved) + move a9, @01842040h, 1 ; MARK font + move a9, a9 + jreq failed + + movi 5, a0, L + move a0, @01842000h, 1 ; stage = 5 + + ; ---- gc = XCreateGC(d, window, 0, NULL) ---------------------- + ; mask 0 -> server default GC values (no value-list to misparse). + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; arg3 = values + move a0, *a14+, 1 ; arg2 = mask 0 + move a10, *a14+, 1 ; arg1 = drawable + move a11, *a14+, 1 ; arg0 = display + calla 3F997000h ; XCreateGC + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a12 ; GC (callee-saved) + move a12, @01842080h, 1 ; MARK gc + move a12, a12 + jreq failed + + ; ---- XSetForeground(display, gc, 1) -------------------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 1, a0, L + move a0, *a14+, 1 ; arg2 = pixel 1 (white) + move a12, *a14+, 1 ; arg1 = gc + move a11, *a14+, 1 ; arg0 = display + calla 3FD99A60h ; XSetForeground + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @018420A0h, 1 ; MARK setfg + movi 6, a0, L + move a0, @01842000h, 1 ; stage = 6 + + ; ---- XMapWindow(display, window) ----------------------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + move a10, *a14+, 1 ; window + move a11, *a14+, 1 ; display + calla 3FD645B0h ; XMapWindow + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @018420C0h, 1 ; MARK map + movi 7, a0, L + move a0, @01842000h, 1 ; stage = 7 + + ; ---- sync + draw, repeated: the WM needs time to frame/map ----- + movi 4, a9, L +draw_loop: + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; discard = 0 + move a11, *a14+, 1 ; display + calla 3FD9F6B0h ; XSync (flush + round trip) + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @018420E0h, 1 ; MARK last sync + + ; ---- XDrawString(display, window, gc, 20, 80, msg1, 12) ------ + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 12, a0, L + move a0, *a14+, 1 ; arg6 = length + movi MSG1, a0, L + move a0, *a14+, 1 ; arg5 = string + movi 80, a0, L + move a0, *a14+, 1 ; arg4 = y + movi 20, a0, L + move a0, *a14+, 1 ; arg3 = x + move a12, *a14+, 1 ; arg2 = gc + move a10, *a14+, 1 ; arg1 = window + move a11, *a14+, 1 ; arg0 = display + calla 3FDA0000h ; XDrawString + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01842100h, 1 ; MARK draw1 + + ; ---- XDrawString(display, window, gc, 20, 120, msg2, 10) ---- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 10, a0, L + move a0, *a14+, 1 ; arg6 = length + movi MSG2, a0, L + move a0, *a14+, 1 ; arg5 = string + movi 120, a0, L + move a0, *a14+, 1 ; arg4 = y + movi 20, a0, L + move a0, *a14+, 1 ; arg3 = x + move a12, *a14+, 1 ; arg2 = gc + move a10, *a14+, 1 ; arg1 = window + move a11, *a14+, 1 ; arg0 = display + calla 3FDA0000h ; XDrawString + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01842120h, 1 ; MARK draw2 + + ; DSJS has a short range; trampoline to the long backward jump. + dsjs a9, draw_next + jruc draw_done +draw_next: + jruc draw_loop +draw_done: + + movi 8, a0, L + move a0, @01842000h, 1 ; stage = 8 + + ; ---- final XSync flushes the last PolyText8 ----------------- + move a14, -*sp, 1 + movi 01894000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 ; discard = 0 + move a11, *a14+, 1 ; display + calla 3FD9F6B0h ; XSync + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @01842140h, 1 ; MARK final sync + + movi 9, a0, L + move a0, @01842000h, 1 ; stage = 9 (text drawn and flushed) + jruc done + +failed: + movi 0FFh, a0, L + move a0, @01842000h, 1 + +done: + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + movi 0, a8, L + rets + +MSG1: .byte "HELLO VT1200", 0 +MSG2: .byte "text works", 0 +FONTNAME: .byte "-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-8-ISO8859-1", 0 + + ; 224 bytes of padding: marker cells 01842000h..0184217Fh live here. + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + .end diff --git a/dwt/loader/build/xtext.bin b/dwt/loader/build/xtext.bin new file mode 100644 index 0000000..2780c0c Binary files /dev/null and b/dwt/loader/build/xtext.bin differ diff --git a/dwt/loader/build/xtext.coff b/dwt/loader/build/xtext.coff new file mode 100644 index 0000000..e78c90a Binary files /dev/null and b/dwt/loader/build/xtext.coff differ diff --git a/dwt/loader/build/xtext.lst b/dwt/loader/build/xtext.lst new file mode 100644 index 0000000..9ae2f9a --- /dev/null +++ b/dwt/loader/build/xtext.lst @@ -0,0 +1,879 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; xtext.asm -- open a window on the live DWT X server a + 0002 ; + 0003 ; Run as a first-class process created by the COFF load + 0004 ; in the rdebug dispatcher's context: a connect made fr + 0005 ; accepted at the service layer but the server never re + 0006 ; XOpenDisplay returns an unusable Display. A fresh pr + 0007 ; + 0008 ; This is xhello.asm plus the text path: + 0009 ; XLoadFont(d,"fixed") 3FD4AE80 + 0010 ; XCreateGC(d,win,mask,&values) 3F997000 + 0011 ; XSetForeground(d,gc,1) 3FD99A60 + 0012 ; XMapWindow(d,win) 3FD645B0 + 0013 ; XSync(d,0) / XDrawString(...) loop 3FD9F6B0 / 3 + 0014 ; + 0015 ; The GC is created with a zero value-mask, so the serv + 0016 ; screen's default GC (which carries the server's defau + 0017 ; draw is repeated with an XSync between iterations so + 0018 ; WM has framed/reparented/mapped the window; a single + 0019 ; when the window is reparented. + 0020 ; + 0021 ; Calling convention (the one the firmware itself uses; + 0022 ; 07F57044 and the TM at 07E5D2B4): + 0023 ; + 0024 ; MOVE A14,-*SP,1 ; reserve the slot the ca + 0025 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument + 0026 ; ... + 0027 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen + 0028 ; CALLA target + 0029 ; + 0030 ; The callee's `rets 2` pops the return address and the + 0031 ; restored by the call itself; A14 is restored from tha + 0032 ; entry SP/A14 in RAM and restore them after each call: + 0033 ; Xlib data structures use the same free heap, and a cl + 0034 ; turns the next call into a wild push. That exact pat + 0035 ; version of this payload at XCreateGC. + 0036 ; + 0037 ; Xlib clobbers the CPU's SETF field state, so the ABI' + 0038 ; re-established after every call. The Display pointer + 0039 ; are kept in callee-saved registers (a11/a10/a12). + 0040 ; + 0041 ; Markers live in 224 bytes of zero padding at the end + 0042 ; NOT in the free heap: the first version's cells at 01 + 0043 ; by the OS heap (the string "Exiting\n" landed on them + 0044 ; + 0045 ; 01842000 stage (1 start, 2 display, 3 window, 4 fo + 0046 ; 7 map, 8 synced/drawn, 9 flushed, + 0047 ; 01842020 display pointer + 0048 ; 01842040 font id returned by XLoadFont + 0049 ; 01842060 window id + 0050 ; 01842080 GC id returned by XCreateGC + 0051 ; 018420A0 XSetForeground return + 0052 ; 018420C0 XMapWindow return + 0053 ; 018420E0 last XSync return + 0054 ; 01842100 first XDrawString return + 0055 ; 01842120 second XDrawString return + 0056 ; 01842140 final XSync return + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 0057 ; 01841760 strlen("0::0") -- must be 4 + 0058 ; + 0059 ; Scratch: 01894000 argument area + 0060 + 0061 00000000 .text + 0062 00000000 _start: + 0063 00000000 0550 setf 16, 0, 0 + 0064 00000010 0740 setf 32, 0, 1 + 0065 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0066 + 0067 00000040 09E0 movi 1, a0, L + 00000050 00000001 + 0068 00000070 0780 move a0, @01842000h, 1 ; stage = 1 + 00000080 01842000 + 0069 + 0070 ; ---- convention check: strlen("0::0") == 4 --------- + 0071 000000A0 A3CF move a14, -*sp, 1 + 0072 000000B0 09EE movi 01894000h, a14, L + 000000C0 01894000 + 0073 000000E0 09E0 movi 3FACE948h, a0, L ; ROM "0::0" + 000000F0 3FACE948 + 0074 00000110 920E move a0, *a14+, 1 ; arg0 + 0075 00000120 0D5F calla 3FB458D0h ; strlen + 00000130 3FB458D0 + 0076 00000150 0550 setf 16, 0, 0 + 0077 00000160 0740 setf 32, 0, 1 + 0078 00000170 0788 move a8, @01842160h, 1 ; MARK strlen + 00000180 01842160 + 0079 000001A0 09E0 movi 4, a0, L + 000001B0 00000004 + 0080 000001D0 4808 cmp a0, a8 + 0081 000001E0 CB00 jrne failed + 000001F0 0126 + 0082 + 0083 00000200 09E0 movi 2, a0, L + 00000210 00000002 + 0084 00000230 0780 move a0, @01842000h, 1 ; stage = 2 + 00000240 01842000 + 0085 + 0086 ; ---- display = XOpenDisplay("0::0") ---------------- + 0087 00000260 A3CF move a14, -*sp, 1 + 0088 00000270 09EE movi 01894000h, a14, L + 00000280 01894000 + 0089 000002A0 09E0 movi 3FACE948h, a0, L + 000002B0 3FACE948 + 0090 000002D0 920E move a0, *a14+, 1 ; arg0 = name + 0091 000002E0 0D5F calla 3F9C2570h ; XOpenDisplay + 000002F0 3F9C2570 + 0092 00000310 0550 setf 16, 0, 0 + 0093 00000320 0740 setf 32, 0, 1 + 0094 00000330 4D0B move a8, a11 ; Display * (callee-saved) + 0095 00000340 078B move a11, @01842020h, 1 ; MARK display + 00000350 01842020 + 0096 00000370 4D6B move a11, a11 + 0097 00000380 CA00 jreq failed + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 00000390 010C + 0098 + 0099 ; ---- root = *(*(display+0x480)+0x40) --------------- + 0100 000003A0 B76A move *a11(0480h), a10, 1 + 000003B0 0480 + 0101 000003C0 B74A move *a10(040h), a10, 1 + 000003D0 0040 + 0102 + 0103 000003E0 09E0 movi 3, a0, L + 000003F0 00000003 + 0104 00000410 0780 move a0, @01842000h, 1 ; stage = 3 + 00000420 01842000 + 0105 + 0106 ; ---- window = XCreateSimpleWindow(d,root,100,100,400 + 0107 00000440 A3CF move a14, -*sp, 1 + 0108 00000450 09EE movi 01894000h, a14, L + 00000460 01894000 + 0109 00000480 09E0 movi 0, a0, L + 00000490 00000000 + 0110 000004B0 920E move a0, *a14+, 1 ; background = 0 (black) + 0111 000004C0 09E0 movi 1, a0, L + 000004D0 00000001 + 0112 000004F0 920E move a0, *a14+, 1 ; border = 1 (white) + 0113 00000500 09E0 movi 2, a0, L + 00000510 00000002 + 0114 00000530 920E move a0, *a14+, 1 ; border width + 0115 00000540 09E0 movi 200, a0, L + 00000550 000000C8 + 0116 00000570 920E move a0, *a14+, 1 ; height + 0117 00000580 09E0 movi 400, a0, L + 00000590 00000190 + 0118 000005B0 920E move a0, *a14+, 1 ; width + 0119 000005C0 09E0 movi 100, a0, L + 000005D0 00000064 + 0120 000005F0 920E move a0, *a14+, 1 ; y + 0121 00000600 920E move a0, *a14+, 1 ; x + 0122 00000610 934E move a10, *a14+, 1 ; parent = root + 0123 00000620 936E move a11, *a14+, 1 ; display + 0124 00000630 0D5F calla 3FD41B90h ; XCreateSimpleWindow + 00000640 3FD41B90 + 0125 00000660 0550 setf 16, 0, 0 + 0126 00000670 0740 setf 32, 0, 1 + 0127 00000680 4D0A move a8, a10 ; window id + 0128 00000690 078A move a10, @01842060h, 1 ; MARK window + 000006A0 01842060 + 0129 000006C0 4D4A move a10, a10 + 0130 000006D0 CA00 jreq failed + 000006E0 00D7 + 0131 + 0132 000006F0 09E0 movi 4, a0, L + 00000700 00000004 + 0133 00000720 0780 move a0, @01842000h, 1 ; stage = 4 + 00000730 01842000 + 0134 + 0135 ; ---- font = XLoadFont(display, "fixed") ------------ + 0136 00000750 A3CF move a14, -*sp, 1 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 0137 00000760 09EE movi 01894000h, a14, L + 00000770 01894000 + 0138 00000790 09E0 movi FONTNAME, a0, L + 000007A0 000015E0' + 0139 000007C0 920E move a0, *a14+, 1 ; arg1 = name + 0140 000007D0 936E move a11, *a14+, 1 ; arg0 = display + 0141 000007E0 0D5F calla 3FD4AE80h ; XLoadFont + 000007F0 3FD4AE80 + 0142 00000810 0550 setf 16, 0, 0 + 0143 00000820 0740 setf 32, 0, 1 + 0144 00000830 4D09 move a8, a9 ; Font (callee-saved) + 0145 00000840 0789 move a9, @01842040h, 1 ; MARK font + 00000850 01842040 + 0146 00000870 4D29 move a9, a9 + 0147 00000880 CA00 jreq failed + 00000890 00BC + 0148 + 0149 000008A0 09E0 movi 5, a0, L + 000008B0 00000005 + 0150 000008D0 0780 move a0, @01842000h, 1 ; stage = 5 + 000008E0 01842000 + 0151 + 0152 ; ---- gc = XCreateGC(d, window, 0, NULL) ------------ + 0153 ; mask 0 -> server default GC values (no value-list to + 0154 00000900 A3CF move a14, -*sp, 1 + 0155 00000910 09EE movi 01894000h, a14, L + 00000920 01894000 + 0156 00000940 09E0 movi 0, a0, L + 00000950 00000000 + 0157 00000970 920E move a0, *a14+, 1 ; arg3 = values + 0158 00000980 920E move a0, *a14+, 1 ; arg2 = mask 0 + 0159 00000990 934E move a10, *a14+, 1 ; arg1 = drawable + 0160 000009A0 936E move a11, *a14+, 1 ; arg0 = display + 0161 000009B0 0D5F calla 3F997000h ; XCreateGC + 000009C0 3F997000 + 0162 000009E0 0550 setf 16, 0, 0 + 0163 000009F0 0740 setf 32, 0, 1 + 0164 00000A00 4D0C move a8, a12 ; GC (callee-saved) + 0165 00000A10 078C move a12, @01842080h, 1 ; MARK gc + 00000A20 01842080 + 0166 00000A40 4D8C move a12, a12 + 0167 00000A50 CA00 jreq failed + 00000A60 009F + 0168 + 0169 ; ---- XSetForeground(display, gc, 1) ---------------- + 0170 00000A70 A3CF move a14, -*sp, 1 + 0171 00000A80 09EE movi 01894000h, a14, L + 00000A90 01894000 + 0172 00000AB0 09E0 movi 1, a0, L + 00000AC0 00000001 + 0173 00000AE0 920E move a0, *a14+, 1 ; arg2 = pixel 1 (white) + 0174 00000AF0 938E move a12, *a14+, 1 ; arg1 = gc + 0175 00000B00 936E move a11, *a14+, 1 ; arg0 = display + 0176 00000B10 0D5F calla 3FD99A60h ; XSetForeground + 00000B20 3FD99A60 + 0177 00000B40 0550 setf 16, 0, 0 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 5 + + 0178 00000B50 0740 setf 32, 0, 1 + 0179 00000B60 0788 move a8, @018420A0h, 1 ; MARK setfg + 00000B70 018420A0 + 0180 00000B90 09E0 movi 6, a0, L + 00000BA0 00000006 + 0181 00000BC0 0780 move a0, @01842000h, 1 ; stage = 6 + 00000BD0 01842000 + 0182 + 0183 ; ---- XMapWindow(display, window) ------------------- + 0184 00000BF0 A3CF move a14, -*sp, 1 + 0185 00000C00 09EE movi 01894000h, a14, L + 00000C10 01894000 + 0186 00000C30 934E move a10, *a14+, 1 ; window + 0187 00000C40 936E move a11, *a14+, 1 ; display + 0188 00000C50 0D5F calla 3FD645B0h ; XMapWindow + 00000C60 3FD645B0 + 0189 00000C80 0550 setf 16, 0, 0 + 0190 00000C90 0740 setf 32, 0, 1 + 0191 00000CA0 0788 move a8, @018420C0h, 1 ; MARK map + 00000CB0 018420C0 + 0192 00000CD0 09E0 movi 7, a0, L + 00000CE0 00000007 + 0193 00000D00 0780 move a0, @01842000h, 1 ; stage = 7 + 00000D10 01842000 + 0194 + 0195 ; ---- sync + draw, repeated: the WM needs time to fra + 0196 00000D30 09E9 movi 4, a9, L + 00000D40 00000004 + 0197 00000D60 draw_loop: + 0198 00000D60 A3CF move a14, -*sp, 1 + 0199 00000D70 09EE movi 01894000h, a14, L + 00000D80 01894000 + 0200 00000DA0 09E0 movi 0, a0, L + 00000DB0 00000000 + 0201 00000DD0 920E move a0, *a14+, 1 ; discard = 0 + 0202 00000DE0 936E move a11, *a14+, 1 ; display + 0203 00000DF0 0D5F calla 3FD9F6B0h ; XSync (flush + round trip) + 00000E00 3FD9F6B0 + 0204 00000E20 0550 setf 16, 0, 0 + 0205 00000E30 0740 setf 32, 0, 1 + 0206 00000E40 0788 move a8, @018420E0h, 1 ; MARK last sync + 00000E50 018420E0 + 0207 + 0208 ; ---- XDrawString(display, window, gc, 20, 80, msg1, + 0209 00000E70 A3CF move a14, -*sp, 1 + 0210 00000E80 09EE movi 01894000h, a14, L + 00000E90 01894000 + 0211 00000EB0 09E0 movi 12, a0, L + 00000EC0 0000000C + 0212 00000EE0 920E move a0, *a14+, 1 ; arg6 = length + 0213 00000EF0 09E0 movi MSG1, a0, L + 00000F00 00001520' + 0214 00000F20 920E move a0, *a14+, 1 ; arg5 = string + 0215 00000F30 09E0 movi 80, a0, L + 00000F40 00000050 + 0216 00000F60 920E move a0, *a14+, 1 ; arg4 = y + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 6 + + 0217 00000F70 09E0 movi 20, a0, L + 00000F80 00000014 + 0218 00000FA0 920E move a0, *a14+, 1 ; arg3 = x + 0219 00000FB0 938E move a12, *a14+, 1 ; arg2 = gc + 0220 00000FC0 934E move a10, *a14+, 1 ; arg1 = window + 0221 00000FD0 936E move a11, *a14+, 1 ; arg0 = display + 0222 00000FE0 0D5F calla 3FDA0000h ; XDrawString + 00000FF0 3FDA0000 + 0223 00001010 0550 setf 16, 0, 0 + 0224 00001020 0740 setf 32, 0, 1 + 0225 00001030 0788 move a8, @01842100h, 1 ; MARK draw1 + 00001040 01842100 + 0226 + 0227 ; ---- XDrawString(display, window, gc, 20, 120, msg2, + 0228 00001060 A3CF move a14, -*sp, 1 + 0229 00001070 09EE movi 01894000h, a14, L + 00001080 01894000 + 0230 000010A0 09E0 movi 10, a0, L + 000010B0 0000000A + 0231 000010D0 920E move a0, *a14+, 1 ; arg6 = length + 0232 000010E0 09E0 movi MSG2, a0, L + 000010F0 00001588' + 0233 00001110 920E move a0, *a14+, 1 ; arg5 = string + 0234 00001120 09E0 movi 120, a0, L + 00001130 00000078 + 0235 00001150 920E move a0, *a14+, 1 ; arg4 = y + 0236 00001160 09E0 movi 20, a0, L + 00001170 00000014 + 0237 00001190 920E move a0, *a14+, 1 ; arg3 = x + 0238 000011A0 938E move a12, *a14+, 1 ; arg2 = gc + 0239 000011B0 934E move a10, *a14+, 1 ; arg1 = window + 0240 000011C0 936E move a11, *a14+, 1 ; arg0 = display + 0241 000011D0 0D5F calla 3FDA0000h ; XDrawString + 000011E0 3FDA0000 + 0242 00001200 0550 setf 16, 0, 0 + 0243 00001210 0740 setf 32, 0, 1 + 0244 00001220 0788 move a8, @01842120h, 1 ; MARK draw2 + 00001230 01842120 + 0245 + 0246 ; DSJS has a short range; trampoline to the long backw + 0247 00001250 3829 dsjs a9, draw_next + 0248 00001260 C001 jruc draw_done + 0249 00001270 draw_next: + 0250 00001270 C0AE jruc draw_loop + 0251 00001280 draw_done: + 0252 + 0253 00001280 09E0 movi 8, a0, L + 00001290 00000008 + 0254 000012B0 0780 move a0, @01842000h, 1 ; stage = 8 + 000012C0 01842000 + 0255 + 0256 ; ---- final XSync flushes the last PolyText8 -------- + 0257 000012E0 A3CF move a14, -*sp, 1 + 0258 000012F0 09EE movi 01894000h, a14, L + 00001300 01894000 + 0259 00001320 09E0 movi 0, a0, L + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 7 + + 00001330 00000000 + 0260 00001350 920E move a0, *a14+, 1 ; discard = 0 + 0261 00001360 936E move a11, *a14+, 1 ; display + 0262 00001370 0D5F calla 3FD9F6B0h ; XSync + 00001380 3FD9F6B0 + 0263 000013A0 0550 setf 16, 0, 0 + 0264 000013B0 0740 setf 32, 0, 1 + 0265 000013C0 0788 move a8, @01842140h, 1 ; MARK final sync + 000013D0 01842140 + 0266 + 0267 000013F0 09E0 movi 9, a0, L + 00001400 00000009 + 0268 00001420 0780 move a0, @01842000h, 1 ; stage = 9 (text drawn and flu + 00001430 01842000 + 0269 00001450 C006 jruc done + 0270 + 0271 00001460 failed: + 0272 00001460 09E0 movi 0FFh, a0, L + 00001470 000000FF + 0273 00001490 0780 move a0, @01842000h, 1 + 000014A0 01842000 + 0274 + 0275 000014C0 done: + 0276 000014C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 000014D0 00FF + 0277 000014E0 09E8 movi 0, a8, L + 000014F0 00000000 + 0278 00001510 0960 rets + 0279 + 0280 00001520 48 MSG1: .byte "HELLO VT1200", 0 + 00001528 45 + 00001530 4C + 00001538 4C + 00001540 4F + 00001548 20 + 00001550 56 + 00001558 54 + 00001560 31 + 00001568 32 + 00001570 30 + 00001578 30 + 00001580 00 + 0281 00001588 74 MSG2: .byte "text works", 0 + 00001590 65 + 00001598 78 + 000015A0 74 + 000015A8 20 + 000015B0 77 + 000015B8 6F + 000015C0 72 + 000015C8 6B + 000015D0 73 + 000015D8 00 + 0282 000015E0 2D FONTNAME: .byte "-DEC-Terminal-Medium-R-Normal--14-140- + 000015E8 44 + 000015F0 45 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 8 + + 000015F8 43 + 00001600 2D + 00001608 54 + 00001610 65 + 00001618 72 + 00001620 6D + 00001628 69 + 00001630 6E + 00001638 61 + 00001640 6C + 00001648 2D + 00001650 4D + 00001658 65 + 00001660 64 + 00001668 69 + 00001670 75 + 00001678 6D + 00001680 2D + 00001688 52 + 00001690 2D + 00001698 4E + 000016A0 6F + 000016A8 72 + 000016B0 6D + 000016B8 61 + 000016C0 6C + 000016C8 2D + 000016D0 2D + 000016D8 31 + 000016E0 34 + 000016E8 2D + 000016F0 31 + 000016F8 34 + 00001700 30 + 00001708 2D + 00001710 37 + 00001718 35 + 00001720 2D + 00001728 37 + 00001730 35 + 00001738 2D + 00001740 43 + 00001748 2D + 00001750 38 + 00001758 2D + 00001760 49 + 00001768 53 + 00001770 4F + 00001778 38 + 00001780 38 + 00001788 35 + 00001790 39 + 00001798 2D + 000017A0 31 + 000017A8 00 + 0283 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 9 + + 0284 ; 224 bytes of padding: marker cells 01842000h..018421 + 0285 000017B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000017B8 00 + 000017C0 00 + 000017C8 00 + 000017D0 00 + 000017D8 00 + 000017E0 00 + 000017E8 00 + 000017F0 00 + 000017F8 00 + 00001800 00 + 00001808 00 + 00001810 00 + 00001818 00 + 00001820 00 + 00001828 00 + 0286 00001830 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001838 00 + 00001840 00 + 00001848 00 + 00001850 00 + 00001858 00 + 00001860 00 + 00001868 00 + 00001870 00 + 00001878 00 + 00001880 00 + 00001888 00 + 00001890 00 + 00001898 00 + 000018A0 00 + 000018A8 00 + 0287 000018B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000018B8 00 + 000018C0 00 + 000018C8 00 + 000018D0 00 + 000018D8 00 + 000018E0 00 + 000018E8 00 + 000018F0 00 + 000018F8 00 + 00001900 00 + 00001908 00 + 00001910 00 + 00001918 00 + 00001920 00 + 00001928 00 + 0288 00001930 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001938 00 + 00001940 00 + 00001948 00 + 00001950 00 + 00001958 00 + 00001960 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 10 + + 00001968 00 + 00001970 00 + 00001978 00 + 00001980 00 + 00001988 00 + 00001990 00 + 00001998 00 + 000019A0 00 + 000019A8 00 + 0289 000019B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000019B8 00 + 000019C0 00 + 000019C8 00 + 000019D0 00 + 000019D8 00 + 000019E0 00 + 000019E8 00 + 000019F0 00 + 000019F8 00 + 00001A00 00 + 00001A08 00 + 00001A10 00 + 00001A18 00 + 00001A20 00 + 00001A28 00 + 0290 00001A30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001A38 00 + 00001A40 00 + 00001A48 00 + 00001A50 00 + 00001A58 00 + 00001A60 00 + 00001A68 00 + 00001A70 00 + 00001A78 00 + 00001A80 00 + 00001A88 00 + 00001A90 00 + 00001A98 00 + 00001AA0 00 + 00001AA8 00 + 0291 00001AB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001AB8 00 + 00001AC0 00 + 00001AC8 00 + 00001AD0 00 + 00001AD8 00 + 00001AE0 00 + 00001AE8 00 + 00001AF0 00 + 00001AF8 00 + 00001B00 00 + 00001B08 00 + 00001B10 00 + 00001B18 00 + 00001B20 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 11 + + 00001B28 00 + 0292 00001B30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001B38 00 + 00001B40 00 + 00001B48 00 + 00001B50 00 + 00001B58 00 + 00001B60 00 + 00001B68 00 + 00001B70 00 + 00001B78 00 + 00001B80 00 + 00001B88 00 + 00001B90 00 + 00001B98 00 + 00001BA0 00 + 00001BA8 00 + 0293 00001BB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001BB8 00 + 00001BC0 00 + 00001BC8 00 + 00001BD0 00 + 00001BD8 00 + 00001BE0 00 + 00001BE8 00 + 00001BF0 00 + 00001BF8 00 + 00001C00 00 + 00001C08 00 + 00001C10 00 + 00001C18 00 + 00001C20 00 + 00001C28 00 + 0294 00001C30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001C38 00 + 00001C40 00 + 00001C48 00 + 00001C50 00 + 00001C58 00 + 00001C60 00 + 00001C68 00 + 00001C70 00 + 00001C78 00 + 00001C80 00 + 00001C88 00 + 00001C90 00 + 00001C98 00 + 00001CA0 00 + 00001CA8 00 + 0295 00001CB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001CB8 00 + 00001CC0 00 + 00001CC8 00 + 00001CD0 00 + 00001CD8 00 + 00001CE0 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 12 + + 00001CE8 00 + 00001CF0 00 + 00001CF8 00 + 00001D00 00 + 00001D08 00 + 00001D10 00 + 00001D18 00 + 00001D20 00 + 00001D28 00 + 0296 00001D30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001D38 00 + 00001D40 00 + 00001D48 00 + 00001D50 00 + 00001D58 00 + 00001D60 00 + 00001D68 00 + 00001D70 00 + 00001D78 00 + 00001D80 00 + 00001D88 00 + 00001D90 00 + 00001D98 00 + 00001DA0 00 + 00001DA8 00 + 0297 00001DB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001DB8 00 + 00001DC0 00 + 00001DC8 00 + 00001DD0 00 + 00001DD8 00 + 00001DE0 00 + 00001DE8 00 + 00001DF0 00 + 00001DF8 00 + 00001E00 00 + 00001E08 00 + 00001E10 00 + 00001E18 00 + 00001E20 00 + 00001E28 00 + 0298 00001E30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001E38 00 + 00001E40 00 + 00001E48 00 + 00001E50 00 + 00001E58 00 + 00001E60 00 + 00001E68 00 + 00001E70 00 + 00001E78 00 + 00001E80 00 + 00001E88 00 + 00001E90 00 + 00001E98 00 + 00001EA0 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 13 + + 00001EA8 00 + 0299 00001EB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001EB8 00 + 00001EC0 00 + 00001EC8 00 + 00001ED0 00 + 00001ED8 00 + 00001EE0 00 + 00001EE8 00 + 00001EF0 00 + 00001EF8 00 + 00001F00 00 + 00001F08 00 + 00001F10 00 + 00001F18 00 + 00001F20 00 + 00001F28 00 + 0300 00001F30 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001F38 00 + 00001F40 00 + 00001F48 00 + 00001F50 00 + 00001F58 00 + 00001F60 00 + 00001F68 00 + 00001F70 00 + 00001F78 00 + 00001F80 00 + 00001F88 00 + 00001F90 00 + 00001F98 00 + 00001FA0 00 + 00001FA8 00 + 0301 00001FB0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00001FB8 00 + 00001FC0 00 + 00001FC8 00 + 00001FD0 00 + 00001FD8 00 + 00001FE0 00 + 00001FE8 00 + 00001FF0 00 + 00001FF8 00 + 00002000 00 + 00002008 00 + 00002010 00 + 00002018 00 + 00002020 00 + 00002028 00 + 0302 00002030 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002038 00 + 00002040 00 + 00002048 00 + 00002050 00 + 00002058 00 + 00002060 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 14 + + 00002068 00 + 00002070 00 + 00002078 00 + 00002080 00 + 00002088 00 + 00002090 00 + 00002098 00 + 000020A0 00 + 000020A8 00 + 0303 000020B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000020B8 00 + 000020C0 00 + 000020C8 00 + 000020D0 00 + 000020D8 00 + 000020E0 00 + 000020E8 00 + 000020F0 00 + 000020F8 00 + 00002100 00 + 00002108 00 + 00002110 00 + 00002118 00 + 00002120 00 + 00002128 00 + 0304 00002130 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002138 00 + 00002140 00 + 00002148 00 + 00002150 00 + 00002158 00 + 00002160 00 + 00002168 00 + 00002170 00 + 00002178 00 + 00002180 00 + 00002188 00 + 00002190 00 + 00002198 00 + 000021A0 00 + 000021A8 00 + 0305 000021B0 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 000021B8 00 + 000021C0 00 + 000021C8 00 + 000021D0 00 + 000021D8 00 + 000021E0 00 + 000021E8 00 + 000021F0 00 + 000021F8 00 + 00002200 00 + 00002208 00 + 00002210 00 + 00002218 00 + 00002220 00 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:23:21 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 15 + + 00002228 00 + 0306 00002230 00 .byte 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 + 00002238 00 + 00002240 00 + 00002248 00 + 00002250 00 + 00002258 00 + 00002260 00 + 00002268 00 + 00002270 00 + 00002278 00 + 00002280 00 + 00002288 00 + 00002290 00 + 00002298 00 + 000022A0 00 + 000022A8 00 + 0307 .end + + No Errors, No Warnings diff --git a/dwt/loader/build/xtext.map b/dwt/loader/build/xtext.map new file mode 100644 index 0000000..d35df26 --- /dev/null +++ b/dwt/loader/build/xtext.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 17:23:21 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01840000 000022B0 + 01840000 000022B0 XTEXT.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01840000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01840000 .text +018422B0 etext 018422B0 etext + +[6 symbols] diff --git a/dwt/loader/build/xtext.obj b/dwt/loader/build/xtext.obj new file mode 100644 index 0000000..303450d Binary files /dev/null and b/dwt/loader/build/xtext.obj differ diff --git a/dwt/loader/evidence/real-unit-xtext/baseline.png b/dwt/loader/evidence/real-unit-xtext/baseline.png new file mode 100644 index 0000000..2609290 Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/baseline.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.log b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.log new file mode 100644 index 0000000..be114b9 --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.log @@ -0,0 +1,148 @@ +Warning: -video none doesn't make much sense without -seconds_to_run +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +LOADER: payload dwt/loader/build/loader.bin (1220 B) -> bit 01880000 +LOADER: COFF dwt/loader/build/xtext.coff (1430 B) -> bit 01900000 +LOADER: file magic=0090 nscns=3 opthdr=28 optmagic=0108 entry=00000000 textstart=01840000 +LOADER: sec .data paddr=00000000 size=0 bits (0 B) scnptr=0xa8 flags=0x40 +LOADER: sec .bss paddr=00000000 size=0 bits (0 B) scnptr=0 flags=0x80 +LOADER: sec .text paddr=01840000 size=8368 bits (1046 B) scnptr=0xa8 flags=0x20 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: scanline#1 line=1 enabled=1 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +XTEXT f=50 pc=3F7056E0 st=0 str=0 disp=00000000 font=00000000 win=00000000 gc=00000000 d1=00000000 d2=00000000 sp0=00000000 a140=00000000 wpc=00000000 wa=00000000 wd=00000000 +XTB f=50 entry=00000000 spsave=00000000 a14save=00000000 sp_now=00000000 a14_now=00000000 cell_sp=00000000 strlen_at=00000000 +XTEXT f=100 pc=3FB44B00 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=150 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=200 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=250 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=300 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=350 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=400 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=450 pc=3F33EF20 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=500 pc=3F351010 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=550 pc=3F34F1B0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=600 pc=3F7EFA50 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=650 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=700 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=750 pc=3F598DD0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=800 pc=3F598F60 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=850 pc=3F598DE0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=850 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=900 pc=3F579C20 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=900 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=950 pc=3F57A160 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=950 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1000 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1000 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1050 pc=3F579B10 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1050 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1100 pc=3F579BE0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1150 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1200 pc=3F589450 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1250 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1300 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1350 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1400 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1450 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1500 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1550 pc=3F598DB0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1600 pc=3F579F90 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1650 pc=3F579B60 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1700 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1750 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1800 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1850 pc=3F5798C0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1850 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1900 pc=00000F00 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1900 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1950 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1950 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2000 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2000 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2050 pc=3F579AB0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2050 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2100 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2150 pc=3F589480 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2200 pc=3F579CC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2250 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2300 pc=3F5799D0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2350 pc=3F598DD0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2400 pc=3F579B80 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2450 pc=3F579B10 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2500 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +LOADER: loader poked 610 words, readback 0 bad at 01880000 +LOADER: COFF poked 715 words, readback 0 bad at 01900000 +LOADER: pre-filled .bss 00000000..00000000 with A5A5 +LOADER: descriptor @01882C00 magic=4C44/5231 buf=01900000 len=1430 mode=0 +LOADER: will resume at 3F579970 after create_process +LOADER: frame 2500: entered loader at 01880000 (caller SP=007F52B0) +XTSP f=2501 pc=3F8BA540 sp=00476570 a14=004158A0 sp0=55555555 a140=55555555 st=4294901815 +XTSP f=2502 pc=3F85E420 sp=004765D0 a14=00415A80 sp0=0093C910 a140=00983650 st=4294901815 +XTSP f=2503 pc=3FB446C0 sp=0093C150 a14=01894540 sp0=00988D70 a140=0093F010 st=4294901815 +XTSP f=2504 pc=3FB44400 sp=00476370 a14=00416190 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2505 pc=3FB44420 sp=00476230 a14=00416190 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2506 pc=3F85B0A0 sp=004763B0 a14=00415E00 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2507 pc=3F228760 sp=004768D0 a14=004156C0 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2508 pc=3F350E70 sp=004768B0 a14=00415C80 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTEXT f=2550 pc=3F579FF0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2600 pc=3F57A0E0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2650 pc=3F57A2F0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2700 pc=3F579BF0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2750 pc=3F57A740 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2800 pc=3F57A0E0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +LOADER: result status=0 (OK) entry=01840000 text=01840000/8368 bits data=00000000/0 bits bss=00000000/0 bits relocs=0 pcb=003FFBD0 nscns=3 len=1430 +LOADER: placed .text at 01840000: 1046 bytes, 10 differing +LOADER: xtext: stage=9 strlen=4 display=0093C910 font=009884B0 window=00400001 gc=0098E1B0 draw1=0000000C draw2=0000000A +LOADER: PC at inspection = 3F57A0E0 +LOADER: snapshot /home/arti/code/k-space/vt1200/dwt/gui/run-xtext18/loader_frame2800.png ok=true +Average speed: 339.08% (38 seconds) diff --git a/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.png b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.png new file mode 100644 index 0000000..a2f6653 Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run1.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.log b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.log new file mode 100644 index 0000000..f386bca --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.log @@ -0,0 +1,148 @@ +Warning: -video none doesn't make much sense without -seconds_to_run +vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901 +LOADER: payload dwt/loader/build/loader.bin (1220 B) -> bit 01880000 +LOADER: COFF dwt/loader/build/xtext.coff (1494 B) -> bit 01900000 +LOADER: file magic=0090 nscns=3 opthdr=28 optmagic=0108 entry=00000000 textstart=01840000 +LOADER: sec .data paddr=00000000 size=0 bits (0 B) scnptr=0xa8 flags=0x40 +LOADER: sec .bss paddr=00000000 size=0 bits (0 B) scnptr=0 flags=0x80 +LOADER: sec .text paddr=01840000 size=8880 bits (1110 B) scnptr=0xa8 flags=0x20 +vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901 +vt1200: scanline#1 line=1 enabled=1 +vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1 +vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901 +vt1200: scanline#2 line=0 enabled=1 +vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901 +vt1200: scanline#3 line=1 enabled=1 +vt1200: scanline#4 line=2 enabled=1 +XTEXT f=50 pc=3F7056E0 st=0 str=0 disp=00000000 font=00000000 win=00000000 gc=00000000 d1=00000000 d2=00000000 sp0=00000000 a140=00000000 wpc=00000000 wa=00000000 wd=00000000 +XTB f=50 entry=00000000 spsave=00000000 a14save=00000000 sp_now=00000000 a14_now=00000000 cell_sp=00000000 strlen_at=00000000 +XTEXT f=100 pc=3FB44B00 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=150 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=200 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=250 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=300 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=350 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=400 pc=3F579870 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=450 pc=3F33EF20 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=500 pc=3F351010 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=550 pc=3F34F1B0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=600 pc=3F7EFA50 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=650 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=700 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=750 pc=3F598DD0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=800 pc=3F598F60 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=850 pc=3F598DE0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=850 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=900 pc=3F579C20 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=900 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=950 pc=3F57A160 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=950 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1000 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1000 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1050 pc=3F579B10 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1050 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1100 pc=3F579BE0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1150 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1200 pc=3F589450 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1250 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1300 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1350 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1400 pc=3F579990 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1450 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1500 pc=3F57A100 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1550 pc=3F598DB0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1600 pc=3F579F90 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1650 pc=3F579B60 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1700 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1750 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1800 pc=3F57A0E0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1850 pc=3F5798C0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1850 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1900 pc=00000F00 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1900 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=1950 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=1950 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2000 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2000 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2050 pc=3F579AB0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2050 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2100 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2100 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2150 pc=3F589480 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2150 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2200 pc=3F579CC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2200 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2250 pc=3F579FC0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2250 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2300 pc=3F5799D0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2300 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2350 pc=3F598DD0 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2350 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2400 pc=3F579B80 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2400 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2450 pc=3F579B10 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2450 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2500 pc=3F579970 st=1431655765 str=1431655765 disp=55555555 font=55555555 win=55555555 gc=55555555 d1=55555555 d2=55555555 sp0=55555555 a140=55555555 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2500 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +LOADER: loader poked 610 words, readback 0 bad at 01880000 +LOADER: COFF poked 747 words, readback 0 bad at 01900000 +LOADER: pre-filled .bss 00000000..00000000 with A5A5 +LOADER: descriptor @01882C00 magic=4C44/5231 buf=01900000 len=1494 mode=0 +LOADER: will resume at 3F579970 after create_process +LOADER: frame 2500: entered loader at 01880000 (caller SP=007F52B0) +XTSP f=2501 pc=3F229790 sp=004768D0 a14=004156C0 sp0=55555555 a140=55555555 st=4294901815 +XTSP f=2502 pc=3F85E5D0 sp=004765D0 a14=00415A80 sp0=0093C910 a140=00983650 st=4294901815 +XTSP f=2503 pc=3FB446C0 sp=0093C150 a14=01894540 sp0=00988D70 a140=0093F010 st=4294901815 +XTSP f=2504 pc=3F85BD50 sp=004763B0 a14=00416130 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2505 pc=3F85BDF0 sp=004763B0 a14=00416130 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2506 pc=3F726D60 sp=00476550 a14=00415D40 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2507 pc=3F227990 sp=00476A50 a14=00415600 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTSP f=2508 pc=3F227DC0 sp=00476A70 a14=00415600 sp0=003FFBD0 a140=001B3860 st=4294901815 +XTEXT f=2550 pc=3F579FF0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2550 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2600 pc=3F57A0E0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2600 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2650 pc=3F57A2F0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2650 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2700 pc=3F579BF0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2700 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2750 pc=3F57A740 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2750 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +XTEXT f=2800 pc=3F57A0E0 st=9 str=4 disp=0093C910 font=009884B0 win=00400001 gc=0098E1B0 d1=0000000C d2=0000000A sp0=0098E1B0 a140=0098E1B0 wpc=55555555 wa=55555555 wd=55555555 +XTB f=2800 entry=55555555 spsave=55555555 a14save=55555555 sp_now=55555555 a14_now=55555555 cell_sp=55555555 strlen_at=55555555 +LOADER: result status=0 (OK) entry=01840000 text=01840000/8880 bits data=00000000/0 bits bss=00000000/0 bits relocs=0 pcb=003FFBD0 nscns=3 len=1494 +LOADER: placed .text at 01840000: 1110 bytes, 18 differing +LOADER: xtext: stage=9 strlen=4 display=0093C910 font=009884B0 window=00400001 gc=0098E1B0 draw1=0000000C draw2=0000000A +LOADER: PC at inspection = 3F57A0E0 +LOADER: snapshot /home/arti/code/k-space/vt1200/dwt/gui/run-xtext19/loader_frame2800.png ok=true +Average speed: 333.01% (38 seconds) diff --git a/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.png b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.png new file mode 100644 index 0000000..a2f6653 Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/emulator-xtext-run2.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-load1.log b/dwt/loader/evidence/real-unit-xtext/real-unit-load1.log new file mode 100644 index 0000000..bd9c5e0 --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-load1.log @@ -0,0 +1,29 @@ +[.] COFF /home/arti/code/k-space/vt1200/dwt/loader/build/xtext.coff: 1494 B, 3 sections, entry=0x01840000 sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26 + .data paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .bss paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .text paddr=0x01840000 size=8880 bits (1110 B) nreloc=0 +[.] connected 100.103.100.103:771; opcode 7 -> flag=0x0 b'Done\n\x00' +[.] jump returned 0x00887390 (8942480) +[+] jump(malloc) -> 0x00887390; bit 0x00887390 = byte 0x110e72, 1494 bytes, bit range 0x00887390..0x0088a240 +[+] COFF poked 1494 B at 0x00887390 (747 words, 0 differing bytes) + readback[0:1024] 90 00 03 00 89 00 d5 6a fe 04 00 00 0c 00 00 00 1c 00 03 01 08 01 c7 00 b0 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 00 00 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 2e 74 65 78 74 00 00 00 00 00 84 01 00 00 84 01 b0 22 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 50 05 40 07 8f 09 00 ff e0 09 01 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 48 e9 ac 3f 0e 92 5f 0d d0 58 b4 3f 50 05 40 07 88 07 60 21 84 01 e0 09 04 00 00 00 08 48 00 cb 26 01 e0 09 02 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 48 e9 ac 3f 0e 92 5f 0d 70 25 9c 3f 50 05 40 07 0b 4d 8b 07 20 20 84 01 6b 4d 00 ca 0c 01 6a b7 80 04 4a b7 40 00 e0 09 03 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 e0 09 01 00 00 00 0e 92 e0 09 02 00 00 00 0e 92 e0 09 c8 00 00 00 0e 92 e0 09 90 01 00 00 0e 92 e0 09 64 00 00 00 0e 92 0e 92 4e 93 6e 93 5f 0d 90 1b d4 3f 50 05 40 07 0a 4d 8a 07 60 20 84 01 4a 4d 00 ca d7 00 e0 09 04 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 e0 15 84 01 0e 92 6e 93 5f 0d 80 ae d4 3f 50 05 40 07 09 4d 89 07 40 20 84 01 29 4d 00 ca bc 00 e0 09 05 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 0e 92 4e 93 6e 93 5f 0d 00 70 99 3f 50 05 40 07 0c 4d 8c 07 80 20 84 01 8c 4d 00 ca 9f 00 cf a3 ee 09 00 40 89 01 e0 09 01 00 00 00 0e 92 8e 93 6e 93 5f 0d 60 9a d9 3f 50 05 40 07 88 07 a0 20 84 01 e0 09 06 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 4e 93 6e 93 5f 0d b0 45 d6 3f 50 05 40 07 88 07 c0 20 84 01 e0 09 07 00 00 00 80 07 00 20 84 01 e9 09 04 00 00 00 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 6e 93 5f 0d b0 f6 d9 3f 50 05 40 07 88 07 e0 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 0c 00 00 00 0e 92 e0 09 20 15 84 01 0e 92 e0 09 50 00 00 00 0e 92 e0 09 14 00 00 00 0e 92 8e 93 4e 93 6e 93 5f 0d 00 00 da 3f 50 05 40 07 88 07 00 21 84 01 cf a3 ee 09 00 40 89 01 e0 09 0a 00 00 00 0e 92 e0 09 88 15 84 01 0e 92 e0 09 78 00 00 00 0e 92 e0 09 14 00 00 00 0e 92 8e 93 4e 93 6e 93 5f 0d 00 00 da 3f 50 05 40 07 88 07 20 21 84 01 29 38 01 c0 ae c0 e0 09 08 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 6e 93 5f 0d b0 f6 d9 3f 50 05 40 07 88 07 40 21 84 01 e0 09 09 00 00 00 80 07 00 20 84 01 06 c0 e0 09 ff 00 00 00 80 07 00 20 84 01 af 09 ff 00 e8 09 00 00 00 00 60 09 48 45 4c 4c 4f 20 56 54 31 32 30 30 00 74 65 78 74 20 77 6f 72 6b 73 00 2d 44 45 43 2d 54 65 72 6d 69 6e 61 6c 2d 4d 65 64 69 75 6d 2d 52 2d 4e 6f 72 6d 61 6c 2d 2d 31 34 2d 31 34 30 2d 37 35 2d 37 35 2d 43 2d 38 2d 49 53 4f 38 38 35 39 2d 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[+] loader poked 1220 B at 0x01880000 (610 words, 0 differing) +[.] descriptor @ 0x01882c00: 44 4c 31 52 90 73 88 00 d6 05 00 00 01 00 00 00 (magic 4C44/5231, buf=0x00887390, len=1494, mode=1) +[.] jump returned 0x00000000 (0) +[.] loader A8=0x0 (OK) +[.] result block @ 0x1882d00 (cell offsets are bit offsets): + +0x000 status 0x00000000 + +0x020 entry 0x01840000 + +0x040 text_addr 0x01840000 + +0x060 text_size 0x000022b0 + +0x080 data_addr 0x00000000 + +0x0a0 data_size 0x00000000 + +0x0c0 bss_addr 0x00000000 + +0x0e0 bss_size 0x00000000 + +0x100 relocs 0x00000000 + +0x120 pcb 0x00846410 + +0x140 nscns 0x00000003 + +0x160 coff_len 0x000005d6 + +0x180 loader_base 0x01880000 +[.] no app-specific verifier (name is neither marker nor xhello); status/result only +[+] PASS: status=0 pcb=0x00846410 entry=0x01840000 (xtext) diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-load2.log b/dwt/loader/evidence/real-unit-xtext/real-unit-load2.log new file mode 100644 index 0000000..ceb98e3 --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-load2.log @@ -0,0 +1,29 @@ +[.] COFF /home/arti/code/k-space/vt1200/dwt/loader/build/xtext.coff: 1494 B, 3 sections, entry=0x01840000 sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26 + .data paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .bss paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .text paddr=0x01840000 size=8880 bits (1110 B) nreloc=0 +[.] connected 100.103.100.103:771; opcode 7 -> flag=0x0 b'Done\n\x00' +[.] jump returned 0x008a3610 (9057808) +[+] jump(malloc) -> 0x008a3610; bit 0x008a3610 = byte 0x1146c2, 1494 bytes, bit range 0x008a3610..0x008a64c0 +[+] COFF poked 1494 B at 0x008a3610 (747 words, 0 differing bytes) + readback[0:1024] 90 00 03 00 89 00 d5 6a fe 04 00 00 0c 00 00 00 1c 00 03 01 08 01 c7 00 b0 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 00 00 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 2e 74 65 78 74 00 00 00 00 00 84 01 00 00 84 01 b0 22 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 50 05 40 07 8f 09 00 ff e0 09 01 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 48 e9 ac 3f 0e 92 5f 0d d0 58 b4 3f 50 05 40 07 88 07 60 21 84 01 e0 09 04 00 00 00 08 48 00 cb 26 01 e0 09 02 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 48 e9 ac 3f 0e 92 5f 0d 70 25 9c 3f 50 05 40 07 0b 4d 8b 07 20 20 84 01 6b 4d 00 ca 0c 01 6a b7 80 04 4a b7 40 00 e0 09 03 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 e0 09 01 00 00 00 0e 92 e0 09 02 00 00 00 0e 92 e0 09 c8 00 00 00 0e 92 e0 09 90 01 00 00 0e 92 e0 09 64 00 00 00 0e 92 0e 92 4e 93 6e 93 5f 0d 90 1b d4 3f 50 05 40 07 0a 4d 8a 07 60 20 84 01 4a 4d 00 ca d7 00 e0 09 04 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 e0 15 84 01 0e 92 6e 93 5f 0d 80 ae d4 3f 50 05 40 07 09 4d 89 07 40 20 84 01 29 4d 00 ca bc 00 e0 09 05 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 0e 92 4e 93 6e 93 5f 0d 00 70 99 3f 50 05 40 07 0c 4d 8c 07 80 20 84 01 8c 4d 00 ca 9f 00 cf a3 ee 09 00 40 89 01 e0 09 01 00 00 00 0e 92 8e 93 6e 93 5f 0d 60 9a d9 3f 50 05 40 07 88 07 a0 20 84 01 e0 09 06 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 4e 93 6e 93 5f 0d b0 45 d6 3f 50 05 40 07 88 07 c0 20 84 01 e0 09 07 00 00 00 80 07 00 20 84 01 e9 09 04 00 00 00 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 6e 93 5f 0d b0 f6 d9 3f 50 05 40 07 88 07 e0 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 0c 00 00 00 0e 92 e0 09 20 15 84 01 0e 92 e0 09 50 00 00 00 0e 92 e0 09 14 00 00 00 0e 92 8e 93 4e 93 6e 93 5f 0d 00 00 da 3f 50 05 40 07 88 07 00 21 84 01 cf a3 ee 09 00 40 89 01 e0 09 0a 00 00 00 0e 92 e0 09 88 15 84 01 0e 92 e0 09 78 00 00 00 0e 92 e0 09 14 00 00 00 0e 92 8e 93 4e 93 6e 93 5f 0d 00 00 da 3f 50 05 40 07 88 07 20 21 84 01 29 38 01 c0 ae c0 e0 09 08 00 00 00 80 07 00 20 84 01 cf a3 ee 09 00 40 89 01 e0 09 00 00 00 00 0e 92 6e 93 5f 0d b0 f6 d9 3f 50 05 40 07 88 07 40 21 84 01 e0 09 09 00 00 00 80 07 00 20 84 01 06 c0 e0 09 ff 00 00 00 80 07 00 20 84 01 af 09 ff 00 e8 09 00 00 00 00 60 09 48 45 4c 4c 4f 20 56 54 31 32 30 30 00 74 65 78 74 20 77 6f 72 6b 73 00 2d 44 45 43 2d 54 65 72 6d 69 6e 61 6c 2d 4d 65 64 69 75 6d 2d 52 2d 4e 6f 72 6d 61 6c 2d 2d 31 34 2d 31 34 30 2d 37 35 2d 37 35 2d 43 2d 38 2d 49 53 4f 38 38 35 39 2d 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[+] loader poked 1220 B at 0x01880000 (610 words, 0 differing) +[.] descriptor @ 0x01882c00: 44 4c 31 52 10 36 8a 00 d6 05 00 00 01 00 00 00 (magic 4C44/5231, buf=0x008a3610, len=1494, mode=1) +[.] jump returned 0x00000000 (0) +[.] loader A8=0x0 (OK) +[.] result block @ 0x1882d00 (cell offsets are bit offsets): + +0x000 status 0x00000000 + +0x020 entry 0x01840000 + +0x040 text_addr 0x01840000 + +0x060 text_size 0x000022b0 + +0x080 data_addr 0x00000000 + +0x0a0 data_size 0x00000000 + +0x0c0 bss_addr 0x00000000 + +0x0e0 bss_size 0x00000000 + +0x100 relocs 0x00000000 + +0x120 pcb 0x00843950 + +0x140 nscns 0x00000003 + +0x160 coff_len 0x000005d6 + +0x180 loader_base 0x01880000 +[.] no app-specific verifier (name is neither marker nor xhello); status/result only +[+] PASS: status=0 pcb=0x00843950 entry=0x01840000 (xtext2) diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp1.txt b/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp1.txt new file mode 100644 index 0000000..e56a50f --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp1.txt @@ -0,0 +1,7 @@ +0x01842000 peek 0x01842000 (4) -> 09 00 00 00 +0x01842020 peek 0x01842020 (4) -> 90 e4 86 00 +0x01842040 peek 0x01842040 (4) -> b0 8f 87 00 +0x01842060 peek 0x01842060 (4) -> 01 00 70 00 +0x01842100 peek 0x01842100 (4) -> 0c 00 00 00 +0x01842120 peek 0x01842120 (4) -> 0a 00 00 00 +0x01842160 peek 0x01842160 (4) -> 04 00 00 00 diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp2.txt b/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp2.txt new file mode 100644 index 0000000..dc8adf8 --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-markers-tftp2.txt @@ -0,0 +1,7 @@ +0x01842000 peek 0x01842000 (4) -> 09 00 00 00 +0x01842020 peek 0x01842020 (4) -> 10 37 88 00 +0x01842040 peek 0x01842040 (4) -> b0 9b 9f 00 +0x01842060 peek 0x01842060 (4) -> 01 00 80 00 +0x01842100 peek 0x01842100 (4) -> 0c 00 00 00 +0x01842120 peek 0x01842120 (4) -> 0a 00 00 00 +0x01842160 peek 0x01842160 (4) -> 04 00 00 00 diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-markers1.txt b/dwt/loader/evidence/real-unit-xtext/real-unit-markers1.txt new file mode 100644 index 0000000..bfc1b4a --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-markers1.txt @@ -0,0 +1,12 @@ +0x01842000 peek 0x01842000 (4) -> 09 00 00 00 +0x01842020 peek 0x01842020 (4) -> 90 a2 88 00 +0x01842040 peek 0x01842040 (4) -> 90 0e 85 00 +0x01842060 peek 0x01842060 (4) -> 01 00 50 00 +0x01842080 peek 0x01842080 (4) -> 30 4a 89 00 +0x018420A0 peek 0x018420a0 (4) -> 30 4a 89 00 +0x018420C0 peek 0x018420c0 (4) -> 30 4a 89 00 +0x018420E0 peek 0x018420e0 (4) -> 01 00 00 00 +0x01842100 peek 0x01842100 (4) -> 0c 00 00 00 +0x01842120 peek 0x01842120 (4) -> 0a 00 00 00 +0x01842140 peek 0x01842140 (4) -> 01 00 00 00 +0x01842160 peek 0x01842160 (4) -> 04 00 00 00 diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-markers2.txt b/dwt/loader/evidence/real-unit-xtext/real-unit-markers2.txt new file mode 100644 index 0000000..07c31be --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-markers2.txt @@ -0,0 +1,9 @@ +0x01842000 peek 0x01842000 (4) -> 09 00 00 00 +0x01842020 peek 0x01842020 (4) -> 10 65 8a 00 +0x01842040 peek 0x01842040 (4) -> d0 0d 8b 00 +0x01842060 peek 0x01842060 (4) -> 01 00 60 00 +0x01842080 peek 0x01842080 (4) -> d0 6a 8b 00 +0x01842100 peek 0x01842100 (4) -> 0c 00 00 00 +0x01842120 peek 0x01842120 (4) -> 0a 00 00 00 +0x01842140 peek 0x01842140 (4) -> 01 00 00 00 +0x01842160 peek 0x01842160 (4) -> 04 00 00 00 diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-tftp1.log b/dwt/loader/evidence/real-unit-xtext/real-unit-tftp1.log new file mode 100644 index 0000000..86a321d --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-tftp1.log @@ -0,0 +1,30 @@ +[.] COFF /home/arti/code/k-space/vt1200/dwt/loader/build/xtext.coff: 1494 B, 3 sections, entry=0x01840000 sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26 + .data paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .bss paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .text paddr=0x01840000 size=8880 bits (1110 B) nreloc=0 +[.] connected 100.103.100.103:771; opcode 7 -> flag=0x0 b'Done\n\x00' +[.] tftpc poked 686 B at 0x01870000 (343 words, 0 differing) +[.] jump returned 0x00000000 (0) +[.] tftpc markers: stage=4 fd=1 buf=0xa621d0 total=1494 last=474 block=0x300 done=0x5a5a5a5 +[.] server RRQ (dwt/loader/evidence/real-unit-xtext/tftp-server-run1.log): 17:26:19 RRQ 100.103.100.103:1071 requested 'xtext.coff' (1494 bytes) +[+] TFTP fetch verified byte-for-byte: 1494 B at 0x00a621d0 (sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26) +[+] loader poked 1220 B at 0x01880000 (610 words, 0 differing) +[.] descriptor @ 0x01882c00: 44 4c 31 52 d0 21 a6 00 d6 05 00 00 01 00 00 00 (magic 4C44/5231, buf=0x00a621d0, len=1494, mode=1) +[.] jump returned 0x00000000 (0) +[.] loader A8=0x0 (OK) +[.] result block @ 0x1882d00 (cell offsets are bit offsets): + +0x000 status 0x00000000 + +0x020 entry 0x01840000 + +0x040 text_addr 0x01840000 + +0x060 text_size 0x000022b0 + +0x080 data_addr 0x00000000 + +0x0a0 data_size 0x00000000 + +0x0c0 bss_addr 0x00000000 + +0x0e0 bss_size 0x00000000 + +0x100 relocs 0x00000000 + +0x120 pcb 0x008458d0 + +0x140 nscns 0x00000003 + +0x160 coff_len 0x000005d6 + +0x180 loader_base 0x01880000 +[.] no app-specific verifier (name is neither marker nor xhello); status/result only +[+] PASS: status=0 pcb=0x008458d0 entry=0x01840000 (xtext_tftp) diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-tftp2.log b/dwt/loader/evidence/real-unit-xtext/real-unit-tftp2.log new file mode 100644 index 0000000..d32614e --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/real-unit-tftp2.log @@ -0,0 +1,30 @@ +[.] COFF /home/arti/code/k-space/vt1200/dwt/loader/build/xtext.coff: 1494 B, 3 sections, entry=0x01840000 sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26 + .data paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .bss paddr=0x00000000 size=0 bits (0 B) nreloc=0 + .text paddr=0x01840000 size=8880 bits (1110 B) nreloc=0 +[.] connected 100.103.100.103:771; opcode 7 -> flag=0x0 b'Done\n\x00' +[.] tftpc poked 686 B at 0x01870000 (343 words, 0 differing) +[.] jump returned 0x00000000 (0) +[.] tftpc markers: stage=4 fd=1 buf=0xb23290 total=1494 last=474 block=0x300 done=0x5a5a5a5 +[.] server RRQ (dwt/loader/evidence/real-unit-xtext/tftp-server-run2.log): 17:26:55 RRQ 100.103.100.103:1081 requested 'xtext.coff' (1494 bytes) +[+] TFTP fetch verified byte-for-byte: 1494 B at 0x00b23290 (sha256=4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26) +[+] loader poked 1220 B at 0x01880000 (610 words, 0 differing) +[.] descriptor @ 0x01882c00: 44 4c 31 52 90 32 b2 00 d6 05 00 00 01 00 00 00 (magic 4C44/5231, buf=0x00b23290, len=1494, mode=1) +[.] jump returned 0x00000000 (0) +[.] loader A8=0x0 (OK) +[.] result block @ 0x1882d00 (cell offsets are bit offsets): + +0x000 status 0x00000000 + +0x020 entry 0x01840000 + +0x040 text_addr 0x01840000 + +0x060 text_size 0x000022b0 + +0x080 data_addr 0x00000000 + +0x0a0 data_size 0x00000000 + +0x0c0 bss_addr 0x00000000 + +0x0e0 bss_size 0x00000000 + +0x100 relocs 0x00000000 + +0x120 pcb 0x0083f5d0 + +0x140 nscns 0x00000003 + +0x160 coff_len 0x000005d6 + +0x180 loader_base 0x01880000 +[.] no app-specific verifier (name is neither marker nor xhello); status/result only +[+] PASS: status=0 pcb=0x0083f5d0 entry=0x01840000 (xtext_tftp2) diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run1.png b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run1.png new file mode 100644 index 0000000..fce1171 Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run1.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run2.png b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run2.png new file mode 100644 index 0000000..a147b80 Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-run2.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp1.png b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp1.png new file mode 100644 index 0000000..936656c Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp1.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp2.png b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp2.png new file mode 100644 index 0000000..8c3aa1e Binary files /dev/null and b/dwt/loader/evidence/real-unit-xtext/real-unit-xtext-tftp2.png differ diff --git a/dwt/loader/evidence/real-unit-xtext/tftp-server-run1.log b/dwt/loader/evidence/real-unit-xtext/tftp-server-run1.log new file mode 100644 index 0000000..3234b1d --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/tftp-server-run1.log @@ -0,0 +1,2 @@ +tftp: serving 1494 bytes (xtext.coff) for any name on ('100.103.255.254', 69) +17:26:19 RRQ 100.103.100.103:1071 requested 'xtext.coff' (1494 bytes) diff --git a/dwt/loader/evidence/real-unit-xtext/tftp-server-run2.log b/dwt/loader/evidence/real-unit-xtext/tftp-server-run2.log new file mode 100644 index 0000000..3909341 --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/tftp-server-run2.log @@ -0,0 +1,2 @@ +tftp: serving 1494 bytes (xtext.coff) for any name on ('100.103.255.254', 69) +17:26:55 RRQ 100.103.100.103:1081 requested 'xtext.coff' (1494 bytes) diff --git a/dwt/loader/evidence/real-unit-xtext/xtext_probe.lua b/dwt/loader/evidence/real-unit-xtext/xtext_probe.lua new file mode 100644 index 0000000..33f451c --- /dev/null +++ b/dwt/loader/evidence/real-unit-xtext/xtext_probe.lua @@ -0,0 +1,358 @@ +-- loader.lua -- debugger-assisted COFF loader acceptance harness. +-- +-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to +-- the OS, then at frame LOADER_AT pokes: +-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin) +-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000) +-- * the loader descriptor at 0x01882C00 +-- and sets PC = 0x01880000. It does not use the network, the rdebug service +-- or any firmware transport: this is the debugger-assisted milestone. +-- +-- The loader itself copies the COFF sections to their linked bit addresses and +-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes +-- the input and reads the result; it never writes the app's code or markers. +-- +-- Env: +-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin) +-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff) +-- LOADER_BUF COFF buffer bit address (default 0x01900000) +-- LOADER_AT injection frame (default 2500) +-- LOADER_END inspection/exit frame (default 2700) +-- LOADER_OUT evidence directory (default dwt/loader/evidence) +-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0) +-- LOADER_VERBOSE 1 = print the result block every 25 frames + +local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end + +local machine = manager.machine +local cpu = machine.devices[':maincpu'] +local dbg = machine.debugger +local prog = cpu.spaces['program'] + +if not dbg then + print("LOADER: debugger not enabled; pass -debug") + machine:exit() + return +end + +local AT = tonumber(os.getenv("LOADER_AT") or "2500") +local ENDF = tonumber(os.getenv("LOADER_END") or "2700") +local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin" +local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff" +local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000") +local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence" +local SNAP = os.getenv("LOADER_SNAP") == "1" +local MODE = tonumber(os.getenv("LOADER_MODE") or "0") +local A8DESC = os.getenv("LOADER_A8_DESC") == "1" +local VERBOSE = os.getenv("LOADER_VERBOSE") == "1" + +local LOADER_BASE = 0x01880000 +local DESC = 0x01882C00 +local RESULT = 0x01882D00 +local RETURN_STUB = 0x01883100 +local RETURN_SP = 0x01883110 + +local function rd(p) return io.open(p, "rb") end +local function slurp(p) + local f, err = rd(p) + if not f then error("cannot open " .. p .. ": " .. tostring(err)) end + local s = f:read("*a") + f:close() + return s +end + +local function u16(s, o) + return s:byte(o + 1) + s:byte(o + 2) * 256 +end + +local function u32(s, o) + return s:byte(o + 1) + s:byte(o + 2) * 256 + + s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216 +end + +local function parse_coff(d) + local c = { data = d } + c.magic = u16(d, 0) + c.nscns = u16(d, 2) + c.opthdr = u16(d, 16) + c.sections = {} + if c.opthdr > 0 then + c.optmagic = u16(d, 20) + c.entry = u32(d, 20 + 16) + c.textstart = u32(d, 20 + 20) + c.datastart = u32(d, 20 + 24) + end + local base = 20 + c.opthdr + for i = 0, c.nscns - 1 do + local o = base + i * 40 + local name = d:sub(o + 1, o + 8):gsub("%z", "") + c.sections[#c.sections + 1] = { + name = name, + paddr = u32(d, o + 8), + size = u32(d, o + 16), -- bits + scnptr = u32(d, o + 20), + flags = u32(d, o + 36), + } + end + return c +end + +local function poke_bytes(bitaddr, data) + local n = math.floor((#data + 1) / 2) + for i = 0, n - 1 do + local lo = data:byte(i * 2 + 1) or 0 + local hi = data:byte(i * 2 + 2) or 0 + prog:write_u16(bitaddr + i * 16, lo + hi * 256) + end + return n +end + +local function verify_bytes(bitaddr, data) + local n = math.floor((#data + 1) / 2) + local bad = 0 + for i = 0, n - 1 do + local lo = data:byte(i * 2 + 1) or 0 + local hi = data:byte(i * 2 + 2) or 0 + if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then + bad = bad + 1 + end + end + return n, bad +end + +local function w32(a, v) prog:write_u32(a, v) end +local function r32(a) + local ok, v = pcall(function() return prog:read_u32(a) end) + if ok then return v end + return 0xDEADBEEF +end + +local loader = slurp(BIN) +local coff = slurp(COFF) +local app = parse_coff(coff) + +print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE))) +print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF))) +print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s", + app.magic, app.nscns, app.opthdr, + app.optmagic and string.format("%04X", app.optmagic) or "none", + hex(app.entry or 0), hex(app.textstart or 0))) +for _, s in ipairs(app.sections) do + print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x", + s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags)) +end + +local TRACE = os.getenv("LOADER_TRACE") == "1" + +local frames = 0 +local injected = false +local done = false +local last_count = -1 + +local function status_name(v) + local t = { + [0] = "OK", + [1] = "bad descriptor", + [2] = "truncated COFF / section headers", + [3] = "bad COFF magic", + [4] = "section size not whole words", + [5] = "target outside RAM", + [6] = "target overlaps loader page or COFF buffer", + [7] = "relocation records present (unsupported)", + [8] = "target not in a free-list block", + [9] = "no entry point", + } + return t[v] or ("error " .. tostring(v)) +end + +local function result_dump() + local st = r32(RESULT + 0x000) + print(string.format( + "LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d", + st, status_name(st), hex(r32(RESULT + 0x020)), + hex(r32(RESULT + 0x040)), r32(RESULT + 0x060), + hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0), + hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0), + r32(RESULT + 0x100), hex(r32(RESULT + 0x120)), + r32(RESULT + 0x140), r32(RESULT + 0x160))) +end + +local function inject() + -- 1. loader itself + local n, bad = 0, 0 + poke_bytes(LOADER_BASE, loader) + n, bad = verify_bytes(LOADER_BASE, loader) + print(string.format("LOADER: loader poked %d words, readback %d bad at %s", + n, bad, hex(LOADER_BASE))) + + -- 2. COFF image + poke_bytes(BUF, coff) + n, bad = verify_bytes(BUF, coff) + print(string.format("LOADER: COFF poked %d words, readback %d bad at %s", + n, bad, hex(BUF))) + + -- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful + for _, s in ipairs(app.sections) do + if s.flags & 0x80 ~= 0 then + for i = 0, math.floor(s.size / 16) - 1 do + prog:write_u16(s.paddr + i * 16, 0xA5A5) + end + print(string.format("LOADER: pre-filled .bss %s..%s with A5A5", + hex(s.paddr), hex(s.paddr + s.size))) + end + end + + -- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin) + w32(DESC + 0x00, 0) + prog:write_u16(DESC + 0x00, 0x4C44) + prog:write_u16(DESC + 0x10, 0x5231) + w32(DESC + 0x20, BUF) + w32(DESC + 0x40, #coff) + w32(DESC + 0x60, MODE) + print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d", + hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10), + hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60))) + + -- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC + -- itself); mode 1 returns here, and the stub resumes the interrupted + -- PC so the caller yields and the scheduler can run the child. + local orig_pc = cpu.state['PC'].value + if MODE == 1 then + prog:write_u16(RETURN_STUB, 0xC080) -- jauc + prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF) + prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF) + else + prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self + end + + -- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at + -- the return slot so mode=1 would return to the spin stub. + -- Leave SP alone for mode 0: the loader pushes onto the current + -- process stack, then restores it and resumes at ORIG_PC. (mode 1 + -- would use the return stub.) + w32(0x01882A20, orig_pc) -- LD_ORIG_PC + print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc))) + cpu.state['A8'].value = A8DESC and DESC or 0 + if MODE == 1 then + -- Simulate a CALLA from the current process: push the return + -- address on the *firmware* stack (a real transport would do this). + local sp = cpu.state['SP'].value - 0x20 + w32(sp, RETURN_STUB) + cpu.state['SP'].value = sp + end + cpu.state['PC'].value = LOADER_BASE + injected = true + print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)", + frames, hex(LOADER_BASE), hex(cpu.state['SP'].value))) +end + +local function inspect() + result_dump() + + -- Verify the placement from RAM: .text/.data must equal the file bytes. + for _, s in ipairs(app.sections) do + if s.scnptr ~= 0 and s.size > 0 then + local nb = math.floor(s.size / 8) + local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb) + local _, bad = verify_bytes(s.paddr, bytes) + print(string.format("LOADER: placed %s at %s: %d bytes, %d differing", + s.name, hex(s.paddr), nb, bad)) + end + end + + local base = COFF:match("([^/]+)$") or COFF + if base:find("marker") then + print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d", + hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)), + hex(r32(0x018E0060)), r32(0x018E0080))) + elseif base:find("xhello") then + print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s", + r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)), + hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130)))) + elseif base:find("xtext") then + print(string.format("LOADER: xtext: stage=%d strlen=%d display=%s font=%s window=%s gc=%s draw1=%s draw2=%s", + r32(0x01842000), r32(0x01842160), hex(r32(0x01842020)), + hex(r32(0x01842040)), hex(r32(0x01842060)), hex(r32(0x01842080)), + hex(r32(0x01842100)), hex(r32(0x01842120)))) + end + print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value))) +end + +emu.register_frame_done(function() + frames = frames + 1 + if frames % 50 == 0 then + print(string.format("XTEXT f=%d pc=%s st=%d str=%d disp=%s font=%s win=%s gc=%s d1=%s d2=%s sp0=%s a140=%s wpc=%s wa=%s wd=%s", + frames, hex(cpu.state['PC'].value), r32(0x01842000), r32(0x01842160), + hex(r32(0x01842020)), hex(r32(0x01842040)), hex(r32(0x01842060)), + hex(r32(0x01842080)), hex(r32(0x01842100)), hex(r32(0x01842120)), + hex(r32(0x018420A0)), hex(r32(0x018420C0)), + hex(r32(0x01896000)), hex(r32(0x01896020)), hex(r32(0x01896040)))) + end + if injected and frames >= AT and frames <= AT + 8 then + print(string.format("XTSP f=%d pc=%s sp=%s a14=%s sp0=%s a140=%s st=%d", + frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value), + hex(cpu.state['A14'].value), hex(r32(0x01894500)), hex(r32(0x01894520)), r32(0x01895000))) + end + if frames == AT and not injected then + inject() + if TRACE then dbg:command("trace dwt/loader/evidence/real-unit-xtext/xtrace.tr") end + end + if injected and TRACE and frames == AT + 80 then + dbg:command("trace off") + print("LOADER: trace written to dwt/loader/evidence/real-unit-xtext/xtrace.tr") + end + if injected and not done then + if TRACE and frames <= AT + 40 then + print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s", + frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value), + hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)), + hex(r32(RESULT + 0x020)))) + end + local st = r32(RESULT + 0x000) + -- status 0 means OK; nonzero is final too once parsing has begun + if st ~= 0xFFFFFFFF and not done then + -- The loader writes 0 on success. A nonzero status is final + -- only after it has been written once (it is 0 from power-on, + -- so require the loader to have run: PC no longer at entry or + -- the app counter moved). + end + if VERBOSE and frames % 25 == 0 then + result_dump() + end + if base_contains_marker then + local c = r32(0x018E0080) + if c ~= last_count then + if last_count ~= -1 then + print(string.format("LOADER: marker counter %d -> %d (child running)", + last_count, c)) + end + last_count = c + end + end + end + if frames >= ENDF then + if injected then + done = true + inspect() + if SNAP then + local screen = nil + for _, s in pairs(machine.screens) do screen = s break end + if screen then + local out = OUT .. "/loader_frame" .. frames .. ".png" + local ok, err = pcall(function() return screen:snapshot(out) end) + print(string.format("LOADER: snapshot %s ok=%s %s", + out, tostring(ok), tostring(err or ""))) + end + end + end + machine:exit() + end +end, "vt1200-loader") + +-- (Lua has no forward use of a name defined later; set a small flag here.) +base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil + +-- (no debugger breakpoints; the app is observed through its marker cells.) + +dbg.visible_cpu = cpu +dbg.execution_state = 'run' diff --git a/dwt/notes/REAL_UNIT.md b/dwt/notes/REAL_UNIT.md index e41039d..6b749c8 100644 --- a/dwt/notes/REAL_UNIT.md +++ b/dwt/notes/REAL_UNIT.md @@ -322,3 +322,69 @@ no revision or bank difference. The dump is reproducible with: ```sh python3 dwt/rom_dump.py --host 100.103.100.103 ``` + +### X11 text app on the real unit (`xtext`) + +`dwt/gui/xtext.asm` is `xhello` plus the text path: `XOpenDisplay("0::0")`, +`XCreateSimpleWindow` (400x200 at 100,100, black client area), `XLoadFont`, +`XCreateGC`, `XSetForeground(1)`, `XMapWindow`, then four iterations of +`XSync` + `XDrawString("HELLO VT1200")` + `XDrawString("text works")` and a +final `XSync`. Linked at bit `0x01840000`; loaded with +`dwt/loader/hostload.py --real` and with `--tftp` (below). + +Two real-unit loads (pcb `0x00846410`, `0x00843950`) and two TFTP runs +(pcb `0x008458d0`, `0x0083f5d0`) all returned loader `A8=0`, `entry +0x01840000`, and left `stage=9`, `strlen=4`, `draw1=0x0c`, `draw2=0x0a` +(the two `XDrawString` return values are the string lengths). Text is visible +in `dwt/evidence/real-unit-xtext.png`, `real-unit-xtext-2.png`, +`real-unit-xtext-tftp.png`, and `real-unit-xtext-tftp2.png`; the same app +renders in MAME (`dwt/loader/evidence/real-unit-xtext/emulator-xtext-run{1,2}.png`). +**Several windows are visible in the later screenshots because the owner moved +windows around**; the app window is identified by its content +(`HELLO VT1200` / `text works`) and its `stage=9` markers, not by counting +windows. + +What worked, exactly: + +* **Font:** `"fixed"` returns **0** from `XLoadFont` on this server (the + string exists in ROM as the default-font name, but is not an openable + resource). The ROM's built-in DEC font works: + `-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-8-ISO8859-1` + (`font` marker `0x00850e90`). `XLoadFont` is called for evidence; the GC + does not need the id. +* **GC:** `XCreateGC(d,win,0,NULL)` works. Passing `mask=GCFont (0x4000)` + with an `XGCValues` block (font at byte +60) **hung the connection**: the + app reached `stage=7` (mapped) but the first `XSync` never returned and + `draw1` stayed 0. With mask 0 the server fills the GC from the screen's + default GC, whose font is usable, and the draws return 12/10. +* **Window timing:** one early draw can be lost when the WM reparents the + window. The working shape draws repeatedly, with an `XSync` before each + pair; four iterations were enough (48 also ran, but the first was still + inside `XSync` at the inspection frame). +* **Saved SP/A14 in RAM is a trap.** The first version saved entry SP/A14 at + `0x01894500/20` and reloaded them after every call. The OS heap overwrote + those cells (a string `Exiting\n` landed on them), the next call restored + SP from garbage and the app died at `XCreateGC`. The callee's `rets 2` + already restores SP and A14, so the working version does not restore them + from RAM at all. Diagnostic markers were moved into zero padding at the end + of the app's own `.text` (`0x01842000`); the earlier cells at `0x01895000` + were also overwritten by the heap. +* **ROM unchanged:** `md5 b46a3e442ccb86134d2356bd70d22fd2`. + +Self-contained TFTP delivery of the text app: `dwt/tcpip/tftpr.asm` is +`tftpc.asm` retargeted to server `100.103.255.254:69` and RRQ `xtext.coff` +(20-byte request: `xtext.coff\0octet\0`). Served with +`dwt/tcpip/serve_probe.py 100.103.255.254 --file dwt/loader/build/xtext.coff` +and loaded with `hostload.py --tftp --real`. Two runs, both verified +byte-for-byte (`sha256 4f713d33be8a36dfa14be8a3e4a0451bcabc1a12b1b40ddca385697104a63b26`): + +``` +17:26:19 RRQ 100.103.100.103:1071 requested 'xtext.coff' (1494 bytes) +17:26:55 RRQ 100.103.100.103:1081 requested 'xtext.coff' (1494 bytes) +``` + +The build name must be <= 8 characters: `tftpc_real` silently fails (no +`TFTPC_REAL.OUT`); `tftpr` is safe. + +Evidence: `dwt/loader/evidence/real-unit-xtext/` (loads, markers, server logs, +screenshots, emulator runs, `xtext_probe.lua`). diff --git a/dwt/tcpip/build/tftpr.bin b/dwt/tcpip/build/tftpr.bin new file mode 100644 index 0000000..07e33d9 Binary files /dev/null and b/dwt/tcpip/build/tftpr.bin differ diff --git a/dwt/tcpip/build/tftpr.lst b/dwt/tcpip/build/tftpr.lst new file mode 100644 index 0000000..9f208b2 --- /dev/null +++ b/dwt/tcpip/build/tftpr.lst @@ -0,0 +1,381 @@ +GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 1 + + 0001 ; tftpr.asm -- tftpc.asm retargeted for the real unit a + 0002 ; Server: 100.103.255.254:69; RRQ name: "xtext.coff". + 0003 ; + 0004 ; tftpc.asm -- minimal TFTP read client built on the fi + 0005 ; + 0006 ; The firmware's own tftp_open() calls a resolver that + 0007 ; called from the rdebug process (dwt/notes/TCPIP.md), + 0008 ; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one + 0009 ; + 0010 ; socket = 3F5C9A00h socket(2,2,0) -> fd + 0011 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, t + 0012 ; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags, + 0013 ; close = 3F5E8930h close(fd) + 0014 ; malloc = 3F701230h malloc(bytes) -> bit pointer + 0015 ; + 0016 ; The transfer is 600 bytes, so DATA 1 is 512 (full) an + 0017 ; (short); the short block ends the transfer. ACKs go + 0018 ; recvfrom reports, not to a hard-coded port. + 0019 ; + 0020 ; Evidence cells (32-bit, bit addresses): + 0021 ; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4 + 0022 ; 0187C020 fd + 0023 ; 0187C040 destination buffer (malloc) + 0024 ; 0187C060 total bytes fetched + 0025 ; 0187C080 last recvfrom length + 0026 ; 0187C0A0 last DATA block word as read from the wir + 0027 ; 0187C0C0 marker 05A5A5A5h when the fetch completed + 0028 ; 0187C200 entry SP + 0029 ; 0187C220 entry A14 + 0030 ; + 0031 ; Scratch (fixed bit addresses, above this image): + 0032 ; 01875000 argument area + 0033 ; 01876000 receive buffer (2048 bytes) + 0034 ; 0187A000 recvfrom source sockaddr + 0035 ; 0187A080 recvfrom sockaddr length + 0036 ; 0187A100 ACK packet (4 bytes) + 0037 + 0038 00000000 .text + 0039 00000000 _start: + 0040 00000000 0550 setf 16, 0, 0 + 0041 00000010 0740 setf 32, 0, 1 + 0042 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00000030 FF00 + 0043 00000040 078F move sp, @0187C200h, 1 + 00000050 0187C200 + 0044 00000070 078E move a14, @0187C220h, 1 + 00000080 0187C220 + 0045 + 0046 000000A0 09E0 movi 1, a0, L + 000000B0 00000001 + 0047 000000D0 0780 move a0, @0187C000h, 1 + 000000E0 0187C000 + 0048 + 0049 ; ---- buf = malloc(010000h) ------------------------- + 0050 00000100 A3CF move a14, -*sp, 1 + 0051 00000110 09EE movi 01875000h, a14, L + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 2 + + 00000120 01875000 + 0052 00000140 09E0 movi 010000h, a0, L + 00000150 00010000 + 0053 00000170 920E move a0, *a14+, 1 + 0054 00000180 0D5F calla 3F701230h + 00000190 3F701230 + 0055 000001B0 07AF move @0187C200h, sp, 1 + 000001C0 0187C200 + 0056 000001E0 07AE move @0187C220h, a14, 1 + 000001F0 0187C220 + 0057 00000210 0550 setf 16, 0, 0 + 0058 00000220 0740 setf 32, 0, 1 + 0059 00000230 0788 move a8, @0187C040h, 1 + 00000240 0187C040 + 0060 00000260 4D0B move a8, a11 ; dest cursor (callee-saved) + 0061 00000270 4D08 move a8, a8 + 0062 00000280 CA00 jreq fail + 00000290 010F + 0063 + 0064 000002A0 09E0 movi 2, a0, L + 000002B0 00000002 + 0065 000002D0 0780 move a0, @0187C000h, 1 + 000002E0 0187C000 + 0066 + 0067 ; ---- fd = socket(2,2,0) ---------------------------- + 0068 00000300 09EE movi 01875000h, a14, L + 00000310 01875000 + 0069 00000330 09E0 movi 0, a0, L + 00000340 00000000 + 0070 00000360 920E move a0, *a14+, 1 + 0071 00000370 09E0 movi 2, a0, L + 00000380 00000002 + 0072 000003A0 920E move a0, *a14+, 1 + 0073 000003B0 09E0 movi 2, a0, L + 000003C0 00000002 + 0074 000003E0 920E move a0, *a14+, 1 + 0075 000003F0 0D5F calla 3F5C9A00h + 00000400 3F5C9A00 + 0076 00000420 07AF move @0187C200h, sp, 1 + 00000430 0187C200 + 0077 00000450 07AE move @0187C220h, a14, 1 + 00000460 0187C220 + 0078 00000480 0550 setf 16, 0, 0 + 0079 00000490 0740 setf 32, 0, 1 + 0080 000004A0 0788 move a8, @0187C020h, 1 + 000004B0 0187C020 + 0081 000004D0 4D09 move a8, a9 ; fd (callee-saved) + 0082 000004E0 4D08 move a8, a8 + 0083 000004F0 C400 jrlt fail + 00000500 00E8 + 0084 + 0085 ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) ------------- + 0086 00000510 09EE movi 01875000h, a14, L + 00000520 01875000 + 0087 00000540 09E0 movi 16, a0, L + 00000550 00000010 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 3 + + 0088 00000570 920E move a0, *a14+, 1 + 0089 00000580 09E0 movi SADDR, a0, L + 00000590 000014F0' + 0090 000005B0 920E move a0, *a14+, 1 + 0091 000005C0 09E0 movi 0, a0, L + 000005D0 00000000 + 0092 000005F0 920E move a0, *a14+, 1 + 0093 00000600 09E0 movi 20, a0, L + 00000610 00000014 + 0094 00000630 920E move a0, *a14+, 1 + 0095 00000640 09E0 movi RRQ, a0, L + 00000650 00001450' + 0096 00000670 920E move a0, *a14+, 1 + 0097 00000680 932E move a9, *a14+, 1 + 0098 00000690 0D5F calla 3F5D3D70h + 000006A0 3F5D3D70 + 0099 000006C0 07AF move @0187C200h, sp, 1 + 000006D0 0187C200 + 0100 000006F0 07AE move @0187C220h, a14, 1 + 00000700 0187C220 + 0101 00000720 0550 setf 16, 0, 0 + 0102 00000730 0740 setf 32, 0, 1 + 0103 00000740 4D08 move a8, a8 + 0104 00000750 C400 jrlt fail + 00000760 00C2 + 0105 + 0106 00000770 09E0 movi 3, a0, L + 00000780 00000003 + 0107 000007A0 0780 move a0, @0187C000h, 1 + 000007B0 0187C000 + 0108 000007D0 4400 sub a0, a0 + 0109 000007E0 0780 move a0, @0187C060h, 1 ; total = 0 + 000007F0 0187C060 + 0110 + 0111 00000810 recv_loop: + 0112 ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) --- + 0113 ; arg5 is a POINTER to the socklen (as tftp_read passe + 0114 ; value is initialised to 16 first. + 0115 00000810 09E0 movi 16, a0, L + 00000820 00000010 + 0116 00000840 0780 move a0, @0187A080h, 1 ; fromlen = 16 + 00000850 0187A080 + 0117 00000870 09EE movi 01875000h, a14, L + 00000880 01875000 + 0118 000008A0 09E0 movi 0187A080h, a0, L + 000008B0 0187A080 + 0119 000008D0 920E move a0, *a14+, 1 ; arg5 = &fromlen + 0120 000008E0 09E0 movi 0187A000h, a0, L + 000008F0 0187A000 + 0121 00000910 920E move a0, *a14+, 1 ; arg4 = &from + 0122 00000920 09E0 movi 0, a0, L + 00000930 00000000 + 0123 00000950 920E move a0, *a14+, 1 ; arg3 = flags + 0124 00000960 09E0 movi 00800h, a0, L + 00000970 00000800 + 0125 00000990 920E move a0, *a14+, 1 ; arg2 = 2048 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 4 + + 0126 000009A0 09E0 movi 01876000h, a0, L + 000009B0 01876000 + 0127 000009D0 920E move a0, *a14+, 1 ; arg1 = receive buffer + 0128 000009E0 932E move a9, *a14+, 1 ; arg0 = fd + 0129 000009F0 0D5F calla 3F5D7D50h + 00000A00 3F5D7D50 + 0130 00000A20 07AF move @0187C200h, sp, 1 + 00000A30 0187C200 + 0131 00000A50 07AE move @0187C220h, a14, 1 + 00000A60 0187C220 + 0132 00000A80 0550 setf 16, 0, 0 + 0133 00000A90 0740 setf 32, 0, 1 + 0134 + 0135 00000AA0 0788 move a8, @0187C080h, 1 ; last length + 00000AB0 0187C080 + 0136 00000AD0 4D08 move a8, a8 + 0137 00000AE0 C600 jrle fail + 00000AF0 0089 + 0138 + 0139 ; opcode: wire 00 03 -> little-endian word 0300h + 0140 00000B00 05A0 move @01876000h, a0, 0 + 00000B10 01876000 + 0141 00000B30 0B40 cmpi 0300h, a0 + 00000B40 FCFF + 0142 00000B50 CB00 jrne fail ; only DATA is accepted + 00000B60 0082 + 0143 + 0144 00000B70 05A4 move @01876010h, a4, 0 ; block number, wire order + 00000B80 01876010 + 0145 00000BA0 0784 move a4, @0187C0A0h, 1 + 00000BB0 0187C0A0 + 0146 + 0147 00000BD0 4D03 move a8, a3 + 0148 00000BE0 1483 subk 4, a3 ; payload length + 0149 + 0150 ; ---- total += payload, dest += payload ------------- + 0151 00000BF0 07A1 move @0187C060h, a1, 1 + 00000C00 0187C060 + 0152 00000C20 4061 add a3, a1 + 0153 00000C30 0781 move a1, @0187C060h, 1 ; total += payload (bytes) + 00000C40 0187C060 + 0154 00000C60 4D66 move a11, a6 ; copy destination + 0155 00000C70 4C62 move a3, a2 + 0156 00000C80 2462 sll 3, a2 ; bytes -> bits: pointers are bit addresse + 0157 00000C90 404B add a2, a11 ; dest cursor advances now (do NOT add by + 0158 + 0159 ; ---- copy payload from BUF+4 to a6, one byte at a ti + 0160 ; Interrupts are disabled for the copy so a 512-byte c + 0161 ; with respect to the firmware's ISRs. + 0162 00000CA0 0360 dint + 0163 00000CB0 09E5 movi 01876020h, a5, L + 00000CC0 01876020 + 0164 00000CE0 4C62 move a3, a2 + 0165 00000CF0 0783 move a3, @0187C0E0h, 1 ; payload length + 00000D00 0187C0E0 + 0166 00000D20 0782 move a2, @0187C140h, 1 ; copy count + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 5 + + 00000D30 0187C140 + 0167 00000D50 0786 move a6, @0187C120h, 1 ; write start + 00000D60 0187C120 + 0168 00000D80 078B move a11, @0187C100h, 1 ; cursor after advance + 00000D90 0187C100 + 0169 00000DB0 0785 move a5, @0187C160h, 1 ; source + 00000DC0 0187C160 + 0170 00000DE0 CA05 jreq copy_done + 0171 00000DF0 copy_bytes: + 0172 00000DF0 8EA0 movb *a5, a0 + 0173 00000E00 8C06 movb a0, *a6 + 0174 00000E10 1105 addk 8, a5 ; one byte + 0175 00000E20 1106 addk 8, a6 + 0176 00000E30 3CA2 dsjs a2, copy_bytes + 0177 00000E40 copy_done: + 0178 00000E40 0D60 eint + 0179 + 0180 ; ---- ACK: 00 04 ---------------- + 0181 00000E50 09E0 movi 00400h, a0, L + 00000E60 00000400 + 0182 00000E80 0580 move a0, @0187A100h, 0 + 00000E90 0187A100 + 0183 00000EB0 0584 move a4, @0187A110h, 0 + 00000EC0 0187A110 + 0184 + 0185 00000EE0 09EE movi 01875000h, a14, L + 00000EF0 01875000 + 0186 00000F10 09E0 movi 16, a0, L + 00000F20 00000010 + 0187 00000F40 920E move a0, *a14+, 1 + 0188 00000F50 09E0 movi 0187A000h, a0, L + 00000F60 0187A000 + 0189 00000F80 920E move a0, *a14+, 1 + 0190 00000F90 09E0 movi 0, a0, L + 00000FA0 00000000 + 0191 00000FC0 920E move a0, *a14+, 1 + 0192 00000FD0 09E0 movi 4, a0, L + 00000FE0 00000004 + 0193 00001000 920E move a0, *a14+, 1 + 0194 00001010 09E0 movi 0187A100h, a0, L + 00001020 0187A100 + 0195 00001040 920E move a0, *a14+, 1 + 0196 00001050 932E move a9, *a14+, 1 + 0197 00001060 0D5F calla 3F5D3D70h + 00001070 3F5D3D70 + 0198 00001090 07AF move @0187C200h, sp, 1 + 000010A0 0187C200 + 0199 000010C0 07AE move @0187C220h, a14, 1 + 000010D0 0187C220 + 0200 000010F0 0550 setf 16, 0, 0 + 0201 00001100 0740 setf 32, 0, 1 + 0202 00001110 4D08 move a8, a8 + 0203 00001120 C426 jrlt fail + 0204 + 0205 ; short block ends the transfer; full block means read + 0206 00001130 07A2 move @0187C080h, a2, 1 + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 6 + + 00001140 0187C080 + 0207 00001160 1482 subk 4, a2 + 0208 00001170 0B42 cmpi 512, a2 + 00001180 FDFF + 0209 00001190 C402 jrlt close_it + 0210 000011A0 C000 jruc recv_loop + 000011B0 FF65 + 0211 + 0212 000011C0 close_it: + 0213 000011C0 09E0 movi 4, a0, L + 000011D0 00000004 + 0214 000011F0 0780 move a0, @0187C000h, 1 + 00001200 0187C000 + 0215 00001220 09EE movi 01875000h, a14, L + 00001230 01875000 + 0216 00001250 932E move a9, *a14+, 1 + 0217 00001260 0D5F calla 3F5E8930h ; close(fd) + 00001270 3F5E8930 + 0218 00001290 07AF move @0187C200h, sp, 1 + 000012A0 0187C200 + 0219 000012C0 07AE move @0187C220h, a14, 1 + 000012D0 0187C220 + 0220 000012F0 0550 setf 16, 0, 0 + 0221 00001300 0740 setf 32, 0, 1 + 0222 00001310 09E0 movi 05A5A5A5h, a0, L + 00001320 05A5A5A5 + 0223 00001340 0780 move a0, @0187C0C0h, 1 + 00001350 0187C0C0 + 0224 00001370 4508 sub a8, a8 + 0225 00001380 C009 jruc epilogue + 0226 + 0227 00001390 fail: + 0228 00001390 09E0 movi 0FFh, a0, L + 000013A0 000000FF + 0229 000013C0 0780 move a0, @0187C000h, 1 + 000013D0 0187C000 + 0230 000013F0 09E8 movi 0FFFFFFFFh, a8, L + 00001400 FFFFFFFF + 0231 00001420 epilogue: + 0232 00001420 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + 00001430 00FF + 0233 00001440 0960 rets + 0234 + 0235 00001450 RRQ: + 0236 00001450 0100 .word 00100h ; opcode 1 (00 01) + 0237 00001460 7478 .word 07478h ; "xt" + 0238 00001470 7865 .word 07865h ; "ex" + 0239 00001480 2E74 .word 02E74h ; "t." + 0240 00001490 6F63 .word 06F63h ; "co" + 0241 000014A0 6666 .word 06666h ; "ff" + 0242 000014B0 6F00 .word 06F00h ; "\0o" (NUL ends the name, mode starts + 0243 000014C0 7463 .word 07463h ; "ct" + 0244 000014D0 7465 .word 07465h ; "et" + 0245 000014E0 0000 .word 00000h ; "\0" + pad + 0246 000014F0 SADDR: + 0247 000014F0 0002 .word 00002h ; sin_family = AF_INET + GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 17:26:10 2026 + (c) Copyright 1985, 1987, Texas Instruments Inc. + + PAGE 7 + + 0248 00001500 4500 .word 04500h ; sin_port = htons(69) + 0249 00001510 6764 .word 06764h ; 100.103 + 0250 00001520 FEFF .word 0FEFFh ; .255.254 + 0251 00001530 0000 .word 0 + 0252 00001540 0000 .word 0 + 0253 00001550 0000 .word 0 + 0254 00001560 0000 .word 0 + 0255 .end + + No Errors, No Warnings diff --git a/dwt/tcpip/build/tftpr.map b/dwt/tcpip/build/tftpr.map new file mode 100644 index 0000000..0aaa8bf --- /dev/null +++ b/dwt/tcpip/build/tftpr.map @@ -0,0 +1,34 @@ +***************************************************** +GSP COFF Linker, Version 2.00, 87.300 +***************************************************** +Sun Oct 18 17:26:10 2026 + +OUTPUT FILE NAME: +ENTRY POINT SYMBOL: 0 + + +SECTION ALLOCATION MAP + + output attributes/ +section page origin length input sections +-------- ---- ---------- ---------- ---------------- +.data 0 00000000 00000000 + +.bss 0 00000000 00000000 UNINITIALIZED + +.text 0 01870000 00001570 + 01870000 00001570 TFTPR.obj (.text) + + +GLOBAL SYMBOLS + +address name address name +-------- ---- -------- ---- +00000000 .bss 00000000 edata +00000000 .data 00000000 .bss +01870000 .text 00000000 end +00000000 edata 00000000 .data +00000000 end 01870000 .text +01871570 etext 01871570 etext + +[6 symbols] diff --git a/dwt/tcpip/tftpr.asm b/dwt/tcpip/tftpr.asm new file mode 100644 index 0000000..800d2ad --- /dev/null +++ b/dwt/tcpip/tftpr.asm @@ -0,0 +1,255 @@ +; tftpr.asm -- tftpc.asm retargeted for the real unit at 100.103.100.103. +; Server: 100.103.255.254:69; RRQ name: "xtext.coff". +; +; tftpc.asm -- minimal TFTP read client built on the firmware's socket API. +; +; The firmware's own tftp_open() calls a resolver that does not return when +; called from the rdebug process (dwt/notes/TCPIP.md), so this payload speaks +; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one file. +; +; socket = 3F5C9A00h socket(2,2,0) -> fd +; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n +; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags, from, fromlen) -> n +; close = 3F5E8930h close(fd) +; malloc = 3F701230h malloc(bytes) -> bit pointer +; +; The transfer is 600 bytes, so DATA 1 is 512 (full) and DATA 2 is 88 +; (short); the short block ends the transfer. ACKs go to the sockaddr that +; recvfrom reports, not to a hard-coded port. +; +; Evidence cells (32-bit, bit addresses): +; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4 closed, 0FFh failed) +; 0187C020 fd +; 0187C040 destination buffer (malloc) +; 0187C060 total bytes fetched +; 0187C080 last recvfrom length +; 0187C0A0 last DATA block word as read from the wire +; 0187C0C0 marker 05A5A5A5h when the fetch completed +; 0187C200 entry SP +; 0187C220 entry A14 +; +; Scratch (fixed bit addresses, above this image): +; 01875000 argument area +; 01876000 receive buffer (2048 bytes) +; 0187A000 recvfrom source sockaddr +; 0187A080 recvfrom sockaddr length +; 0187A100 ACK packet (4 bytes) + + .text +_start: + setf 16, 0, 0 + setf 32, 0, 1 + mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7 + move sp, @0187C200h, 1 + move a14, @0187C220h, 1 + + movi 1, a0, L + move a0, @0187C000h, 1 + + ; ---- buf = malloc(010000h) ------------------------------------ + move a14, -*sp, 1 + movi 01875000h, a14, L + movi 010000h, a0, L + move a0, *a14+, 1 + calla 3F701230h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @0187C040h, 1 + move a8, a11 ; dest cursor (callee-saved) + move a8, a8 + jreq fail + + movi 2, a0, L + move a0, @0187C000h, 1 + + ; ---- fd = socket(2,2,0) -------------------------------------- + movi 01875000h, a14, L + movi 0, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + movi 2, a0, L + move a0, *a14+, 1 + calla 3F5C9A00h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, @0187C020h, 1 + move a8, a9 ; fd (callee-saved) + move a8, a8 + jrlt fail + + ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) ------------------------ + movi 01875000h, a14, L + movi 16, a0, L + move a0, *a14+, 1 + movi SADDR, a0, L + move a0, *a14+, 1 + movi 0, a0, L + move a0, *a14+, 1 + movi 20, a0, L + move a0, *a14+, 1 + movi RRQ, a0, L + move a0, *a14+, 1 + move a9, *a14+, 1 + calla 3F5D3D70h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a8 + jrlt fail + + movi 3, a0, L + move a0, @0187C000h, 1 + sub a0, a0 + move a0, @0187C060h, 1 ; total = 0 + +recv_loop: + ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) ------------- + ; arg5 is a POINTER to the socklen (as tftp_read passes it); the + ; value is initialised to 16 first. + movi 16, a0, L + move a0, @0187A080h, 1 ; fromlen = 16 + movi 01875000h, a14, L + movi 0187A080h, a0, L + move a0, *a14+, 1 ; arg5 = &fromlen + movi 0187A000h, a0, L + move a0, *a14+, 1 ; arg4 = &from + movi 0, a0, L + move a0, *a14+, 1 ; arg3 = flags + movi 00800h, a0, L + move a0, *a14+, 1 ; arg2 = 2048 + movi 01876000h, a0, L + move a0, *a14+, 1 ; arg1 = receive buffer + move a9, *a14+, 1 ; arg0 = fd + calla 3F5D7D50h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + + move a8, @0187C080h, 1 ; last length + move a8, a8 + jrle fail + + ; opcode: wire 00 03 -> little-endian word 0300h + move @01876000h, a0, 0 + cmpi 0300h, a0 + jrne fail ; only DATA is accepted + + move @01876010h, a4, 0 ; block number, wire order + move a4, @0187C0A0h, 1 + + move a8, a3 + subk 4, a3 ; payload length + + ; ---- total += payload, dest += payload ----------------------- + move @0187C060h, a1, 1 + add a3, a1 + move a1, @0187C060h, 1 ; total += payload (bytes) + move a11, a6 ; copy destination + move a3, a2 + sll 3, a2 ; bytes -> bits: pointers are bit addresses + add a2, a11 ; dest cursor advances now (do NOT add bytes) + + ; ---- copy payload from BUF+4 to a6, one byte at a time ------ + ; Interrupts are disabled for the copy so a 512-byte copy is atomic + ; with respect to the firmware's ISRs. + dint + movi 01876020h, a5, L + move a3, a2 + move a3, @0187C0E0h, 1 ; payload length + move a2, @0187C140h, 1 ; copy count + move a6, @0187C120h, 1 ; write start + move a11, @0187C100h, 1 ; cursor after advance + move a5, @0187C160h, 1 ; source + jreq copy_done +copy_bytes: + movb *a5, a0 + movb a0, *a6 + addk 8, a5 ; one byte + addk 8, a6 + dsjs a2, copy_bytes +copy_done: + eint + + ; ---- ACK: 00 04 -------------------------- + movi 00400h, a0, L + move a0, @0187A100h, 0 + move a4, @0187A110h, 0 + + movi 01875000h, a14, L + movi 16, a0, L + move a0, *a14+, 1 + movi 0187A000h, a0, L + move a0, *a14+, 1 + movi 0, a0, L + move a0, *a14+, 1 + movi 4, a0, L + move a0, *a14+, 1 + movi 0187A100h, a0, L + move a0, *a14+, 1 + move a9, *a14+, 1 + calla 3F5D3D70h + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + move a8, a8 + jrlt fail + + ; short block ends the transfer; full block means read again + move @0187C080h, a2, 1 + subk 4, a2 + cmpi 512, a2 + jrlt close_it + jruc recv_loop + +close_it: + movi 4, a0, L + move a0, @0187C000h, 1 + movi 01875000h, a14, L + move a9, *a14+, 1 + calla 3F5E8930h ; close(fd) + move @0187C200h, sp, 1 + move @0187C220h, a14, 1 + setf 16, 0, 0 + setf 32, 0, 1 + movi 05A5A5A5h, a0, L + move a0, @0187C0C0h, 1 + sub a8, a8 + jruc epilogue + +fail: + movi 0FFh, a0, L + move a0, @0187C000h, 1 + movi 0FFFFFFFFh, a8, L +epilogue: + mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7 + rets + +RRQ: + .word 00100h ; opcode 1 (00 01) + .word 07478h ; "xt" + .word 07865h ; "ex" + .word 02E74h ; "t." + .word 06F63h ; "co" + .word 06666h ; "ff" + .word 06F00h ; "\0o" (NUL ends the name, mode starts) + .word 07463h ; "ct" + .word 07465h ; "et" + .word 00000h ; "\0" + pad +SADDR: + .word 00002h ; sin_family = AF_INET + .word 04500h ; sin_port = htons(69) + .word 06764h ; 100.103 + .word 0FEFFh ; .255.254 + .word 0 + .word 0 + .word 0 + .word 0 + .end