dwt: exploit client and gate analysis; remote execution blocked at the challenge

dwt/evidence/scripts/dump_static.lua

@@ -0,0 +1,34 @@
+-- dump_static.lua -- dump the 128-byte block at bit 0x1BE810 (the source the
+-- challenge expands) and the table pointers, at frame 3000.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local space = cpu.spaces['program']
+if not dbg then machine:exit(); return end
+dbg.visible_cpu = cpu
+local f = 0
+local function dump(label, bit, n)
+	local t = {}
+	print(string.format("--- %s @bit 0x%X (byte 0x%X)", label, bit, bit >> 3))
+	for i = 0, n - 1 do
+		t[#t + 1] = string.format("%02X", space:read_u8(bit + i * 8))
+		if (#t == 16) then print(table.concat(t, " ")); t = {} end
+	end
+	if #t > 0 then print(table.concat(t, " ")) end
+end
+emu.register_frame_done(function()
+	f = f + 1
+	if f == 1 then
+		print(string.format("PTRS frame1 @1C0200=%08X @1C0220=%08X @1C0240=%08X @1C0260=%08X",
+			space:read_u32(0x1c0200), space:read_u32(0x1c0220),
+			space:read_u32(0x1c0240), space:read_u32(0x1c0260)))
+	end
+	if f == 3000 then
+		dump("0x1BE800", 0x1be800, 320)
+		print(string.format("PTRS frame3000 @1C0200=%08X @1C0220=%08X @1C0240=%08X @1C0260=%08X",
+			space:read_u32(0x1c0200), space:read_u32(0x1c0220),
+			space:read_u32(0x1c0240), space:read_u32(0x1c0260)))
+		machine:exit()
+	end
+end, "dump-static")
+dbg.execution_state = 'run'