From a18881f45d84706b76821706ab84268fe13f0efe Mon Sep 17 00:00:00 2001
From: SDD <sdd@local>
Date: Sun, 18 Oct 2026 02:02:17 +0300
Subject: [PATCH] dwt: MOP console carrier client, protocol notes, and emulator
 evidence

---
 dwt/evidence/README.md             |  28 ++
 dwt/evidence/dry-run.txt           |  31 ++
 dwt/evidence/dwt-help.txt          |  13 +
 dwt/evidence/dwt-show.txt          |  16 +
 dwt/evidence/hello.log             | 183 +++++++++
 dwt/evidence/help-after-init2.log  |  64 +++
 dwt/evidence/help-after-test.log   |  54 +++
 dwt/evidence/help-after-test12.log |  54 +++
 dwt/evidence/init.log              | 253 ++++++++++++
 dwt/evidence/mame-noos-probe.log   |  16 +
 dwt/evidence/mop-hello.pcap        | Bin 0 -> 2405 bytes
 dwt/evidence/mop-hello.txt         | 135 +++++++
 dwt/evidence/mop-init.pcap         | Bin 0 -> 7899 bytes
 dwt/evidence/mop-noos.pcap         | Bin 0 -> 1240 bytes
 dwt/evidence/mop-script3.pcap      | Bin 0 -> 25914 bytes
 dwt/evidence/mop-test00.pcap       | Bin 0 -> 20240 bytes
 dwt/evidence/noos-attempt1.log     |  64 +++
 dwt/evidence/noos-attempt2.log     |  64 +++
 dwt/evidence/noos-attempt3.log     |  64 +++
 dwt/evidence/pc_probe.lua          |  25 ++
 dwt/evidence/script3.log           | 233 +++++++++++
 dwt/evidence/test00b.log           | 233 +++++++++++
 dwt/evidence/test12.log            | 168 ++++++++
 dwt/evidence/wrong-password.log    | 123 ++++++
 dwt/mop_console.py                 | 617 +++++++++++++++++++++++++++++
 dwt/notes/CROSS.md                 |  38 ++
 dwt/notes/mop-protocol.md          | 423 ++++++++++++++++++++
 27 files changed, 2899 insertions(+)
 create mode 100644 dwt/evidence/README.md
 create mode 100644 dwt/evidence/dry-run.txt
 create mode 100644 dwt/evidence/dwt-help.txt
 create mode 100644 dwt/evidence/dwt-show.txt
 create mode 100644 dwt/evidence/hello.log
 create mode 100644 dwt/evidence/help-after-init2.log
 create mode 100644 dwt/evidence/help-after-test.log
 create mode 100644 dwt/evidence/help-after-test12.log
 create mode 100644 dwt/evidence/init.log
 create mode 100644 dwt/evidence/mame-noos-probe.log
 create mode 100644 dwt/evidence/mop-hello.pcap
 create mode 100644 dwt/evidence/mop-hello.txt
 create mode 100644 dwt/evidence/mop-init.pcap
 create mode 100644 dwt/evidence/mop-noos.pcap
 create mode 100644 dwt/evidence/mop-script3.pcap
 create mode 100644 dwt/evidence/mop-test00.pcap
 create mode 100644 dwt/evidence/noos-attempt1.log
 create mode 100644 dwt/evidence/noos-attempt2.log
 create mode 100644 dwt/evidence/noos-attempt3.log
 create mode 100644 dwt/evidence/pc_probe.lua
 create mode 100644 dwt/evidence/script3.log
 create mode 100644 dwt/evidence/test00b.log
 create mode 100644 dwt/evidence/test12.log
 create mode 100644 dwt/evidence/wrong-password.log
 create mode 100755 dwt/mop_console.py
 create mode 100644 dwt/notes/mop-protocol.md

diff --git a/dwt/evidence/README.md b/dwt/evidence/README.md
new file mode 100644
index 0000000..dccefdb
--- /dev/null
+++ b/dwt/evidence/README.md
@@ -0,0 +1,28 @@
+# Evidence — MOP Remote Console / VT1200 DWT
+
+All captures are `tcpdump -i vt1200 'ether proto 0x6002'` against the MAME
+`vt1200` driver with `-cfg_directory cfg-net -networkprovider taptun` and a
+private `-nvram_directory`. Host side of the bridge:
+`c6:fc:cc:16:f5:66`; terminal: `08:00:2b:16:4b:5a`.
+
+| file | what it shows |
+|---|---|
+| `mop-hello.pcap` | clean OS-up run: Reserve (13), Request ID (5), System ID (7), CCP `HELP` (17), CRA 425 bytes (19), CCP `SHOW`, CRA 509 bytes. 135 packets because the terminal acknowledges every poll. |
+| `mop-hello.txt` | `tcpdump -nn -e -r` text of the above |
+| `hello.log` | full client log: every TX/RX frame hexdumped and decoded, both command texts |
+| `dwt-help.txt` | HELP response bytes, CRLF normalised to LF |
+| `dwt-show.txt` | SHOW response bytes, CRLF normalised to LF |
+| `dry-run.txt` | `mop_console.py --dry-run --script HELP,SHOW`; frames only, no socket |
+| `mop-script3.pcap`, `script3.log` | HELP, SHOW, then `TEST 0 0`. The TEST reply is `TEST 0 0\r\n\r\nTesting...` (22 bytes, length 24). Subsequent 60-byte CRAs have length 2 and **stale SHOW text** after the flags — the length field is authoritative. |
+| `mop-test00.pcap`, `test00b.log` | `TEST 0 0` on a fresh boot, alone, with `--quiet 10`: same `Testing...` only |
+| `test12.log` | `TEST 12` on a fresh boot: same `Testing...` only |
+| `help-after-test.log`, `help-after-test12.log` | a HELP attempt after each TEST gets no System ID at all (MOP server no longer answers) |
+| `mop-init.pcap`, `init.log` | `INIT` accepted, no reply; only host TX in the capture |
+| `help-after-init2.log` | >90 s after INIT, still no System ID |
+| `mop-noos.pcap`, `noos-attempt1.log`, `noos-attempt2.log`, `noos-attempt3.log` | bare boot (no `VT1200_SKIP_LEVEL1`), Reserve/RequestID attempts: zero RX |
+| `mame-noos-probe.log`, `pc_probe.lua` | the same bare boot with a Lua PC probe: `PC=3FDCE400` from frame 100 to 3600 (the repo's diagnostics-menu baseline) |
+| `wrong-password.log` | Reserve with verification `0102030405060708`; HELP still works, so the VT1200 does not validate the field in this configuration |
+| `run-*`, `scripts/` | **not mine** — the static-analysis agent's probes; leave them alone |
+
+The captures contain only the emulated terminal. Nothing here was sent to the
+real machine.
diff --git a/dwt/evidence/dry-run.txt b/dwt/evidence/dry-run.txt
new file mode 100644
index 0000000..60fb76a
--- /dev/null
+++ b/dwt/evidence/dry-run.txt
@@ -0,0 +1,31 @@
+dry run: iface=vt1200 src=c6:fc:cc:16:f5:66 dst=08:00:2b:16:4b:5a ethertype=0x6002
+
+Reserve Console (code 13) -- verification = MOP service password
+  payload (46B, padded to 46): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+  0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+
+Request ID (code 5) -- reserved=00 receipt=0000
+  payload (46B, padded to 46): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+  0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+
+Console Command and Poll (code 17), msg=0, data=b'HELP\r'
+  payload (46B, padded to 46): 0700110048454c500d00000000000000000000000000000000000000000000000000000000000000000000000000
+  0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+  0010  11 00 48 45 4c 50 0d 00  00 00 00 00 00 00 00 00  ..HELP..........
+  0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+
+Console Command and Poll (code 17), msg=1, data=b'SHOW\r'
+  payload (46B, padded to 46): 0700110153484f570d00000000000000000000000000000000000000000000000000000000000000000000000000
+  0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+  0010  11 01 53 48 4f 57 0d 00  00 00 00 00 00 00 00 00  ..SHOW..........
+  0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+  0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+
+Dry run: nothing sent.  Remove --dry-run (and run with CAP_NET_RAW).
diff --git a/dwt/evidence/dwt-help.txt b/dwt/evidence/dwt-help.txt
new file mode 100644
index 0000000..aea465e
--- /dev/null
+++ b/dwt/evidence/dwt-help.txt
@@ -0,0 +1,13 @@
+HELP
+
+   DECwindows Terminal Remote Console
+   Commands available:
+   --------------------------------------------------------
+   INIT                      Initialize the system.
+   TEST <p1> [<p2> <p3>]     Execute test(s) p1 through p2.
+                             Mode bits specified by p3.
+   SHOW                      Show the system configuration.
+   HELP                      Type this help text.
+
+
+
DWT>>> 
\ No newline at end of file
diff --git a/dwt/evidence/dwt-show.txt b/dwt/evidence/dwt-show.txt
new file mode 100644
index 0000000..d895086
--- /dev/null
+++ b/dwt/evidence/dwt-show.txt
@@ -0,0 +1,16 @@
+SHOW
+
+   DECwindows Terminal System Configuration
+
+   Configuration Parameter   Parameter Value
+   --------------------------------------------------------
+   Firmware Revision         V2.2
+   Option Memory             Present
+                                SIMM 1 installed
+                                SIMM 2 installed
+                                SIMM 3 installed
+   Image Option              Present
+   Display Type              Monochrome
+   Monitor Type              VR150
+
+
DWT>>> 
\ No newline at end of file
diff --git a/dwt/evidence/hello.log b/dwt/evidence/hello.log
new file mode 100644
index 0000000..f523fdf
--- /dev/null
+++ b/dwt/evidence/hello.log
@@ -0,0 +1,183 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== 'HELP' ===
+  TX  60B  Console Command and Poll: 'HELP'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 48 45 4c 50 0d 00  00 00 00 00 00 00 00 00  ..HELP..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX 443B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 ab 01  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73 6f 6c 65 0d   Remote Console.
+    0040  0a 20 20 20 43 6f 6d 6d  61 6e 64 73 20 61 76 61  .   Commands ava
+    0050  69 6c 61 62 6c 65 3a 0d  0a 20 20 20 2d 2d 2d 2d  ilable:..   ----
+    0060  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0070  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0080  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0090  2d 2d 2d 2d 0d 0a 20 20  20 49 4e 49 54 20 20 20  ----..   INIT   
+    00a0  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    00b0  20 20 20 49 6e 69 74 69  61 6c 69 7a 65 20 74 68     Initialize th
+    00c0  65 20 73 79 73 74 65 6d  2e 0d 0a 20 20 20 54 45  e system...   TE
+    00d0  53 54 20 3c 70 31 3e 20  5b 3c 70 32 3e 20 3c 70  ST <p1> [<p2> <p
+    00e0  33 3e 5d 20 20 20 20 20  45 78 65 63 75 74 65 20  3>]     Execute 
+    00f0  74 65 73 74 28 73 29 20  70 31 20 74 68 72 6f 75  test(s) p1 throu
+    0100  67 68 20 70 32 2e 0d 0a  20 20 20 20 20 20 20 20  gh p2...        
+    0110  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0120  20 20 20 20 20 4d 6f 64  65 20 62 69 74 73 20 73       Mode bits s
+    0130  70 65 63 69 66 69 65 64  20 62 79 20 70 33 2e 0d  pecified by p3..
+    0140  0a 20 20 20 53 48 4f 57  20 20 20 20 20 20 20 20  .   SHOW        
+    0150  20 20 20 20 20 20 20 20  20 20 20 20 20 20 53 68                Sh
+    0160  6f 77 20 74 68 65 20 73  79 73 74 65 6d 20 63 6f  ow the system co
+    0170  6e 66 69 67 75 72 61 74  69 6f 6e 2e 0d 0a 20 20  nfiguration...  
+    0180  20 48 45 4c 50 20 20 20  20 20 20 20 20 20 20 20   HELP           
+    0190  20 20 20 20 20 20 20 20  20 20 20 54 79 70 65 20             Type 
+    01a0  74 68 69 73 20 68 65 6c  70 20 74 65 78 74 2e 0d  this help text..
+    01b0  0a 0a 0a 0d 44 57 54 3e  3e 3e 20                 ....DWT>>> 
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=425B
+    text: HELP....   DECwindows Terminal Remote Console..   Commands available:..   --------------------------------------------------------..   INIT                      Initialize the system...   TEST <p1> [<p2> <p3>]     Execute test(s) p1 through p2...                             Mode bits specified by p3...   SHOW                      Show the system configuration...   HELP                      Type this help text......DWT>>> 
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+--- HELP: 425 bytes of console output ---
+
+=== 'SHOW' ===
+  TX  60B  Console Command and Poll: 'SHOW'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 53 48 4f 57 0d 00  00 00 00 00 00 00 00 00  ..SHOW..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX 527B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 ff 01  .....f..+.KZ`...
+    0010  13 00 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66 69 67 75 72   System Configur
+    0040  61 74 69 6f 6e 0d 0a 0d  0a 20 20 20 43 6f 6e 66  ation....   Conf
+    0050  69 67 75 72 61 74 69 6f  6e 20 50 61 72 61 6d 65  iguration Parame
+    0060  74 65 72 20 20 20 50 61  72 61 6d 65 74 65 72 20  ter   Parameter 
+    0070  56 61 6c 75 65 0d 0a 20  20 20 2d 2d 2d 2d 2d 2d  Value..   ------
+    0080  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0090  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    00a0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    00b0  2d 2d 0d 0a 20 20 20 46  69 72 6d 77 61 72 65 20  --..   Firmware 
+    00c0  52 65 76 69 73 69 6f 6e  20 20 20 20 20 20 20 20  Revision        
+    00d0  20 56 32 2e 32 0d 0a 20  20 20 4f 70 74 69 6f 6e   V2.2..   Option
+    00e0  20 4d 65 6d 6f 72 79 20  20 20 20 20 20 20 20 20   Memory         
+    00f0  20 20 20 20 50 72 65 73  65 6e 74 0d 0a 20 20 20      Present..   
+    0100  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0110  20 20 20 20 20 20 20 20  20 20 20 20 20 53 49 4d               SIM
+    0120  4d 20 31 20 69 6e 73 74  61 6c 6c 65 64 0d 0a 20  M 1 installed.. 
+    0130  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0140  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 53                 S
+    0150  49 4d 4d 20 32 20 69 6e  73 74 61 6c 6c 65 64 0d  IMM 2 installed.
+    0160  0a 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  .               
+    0170  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0180  20 53 49 4d 4d 20 33 20  69 6e 73 74 61 6c 6c 65   SIMM 3 installe
+    0190  64 0d 0a 20 20 20 49 6d  61 67 65 20 4f 70 74 69  d..   Image Opti
+    01a0  6f 6e 20 20 20 20 20 20  20 20 20 20 20 20 20 20  on              
+    01b0  50 72 65 73 65 6e 74 0d  0a 20 20 20 44 69 73 70  Present..   Disp
+    01c0  6c 61 79 20 54 79 70 65  20 20 20 20 20 20 20 20  lay Type        
+    01d0  20 20 20 20 20 20 4d 6f  6e 6f 63 68 72 6f 6d 65        Monochrome
+    01e0  0d 0a 20 20 20 4d 6f 6e  69 74 6f 72 20 54 79 70  ..   Monitor Typ
+    01f0  65 20 20 20 20 20 20 20  20 20 20 20 20 20 20 56  e              V
+    0200  52 31 35 30 0d 0a 0a 0d  44 57 54 3e 3e 3e 20     R150....DWT>>> 
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=509B
+    text: SHOW....   DECwindows Terminal System Configuration....   Configuration Parameter   Parameter Value..   --------------------------------------------------------..   Firmware Revision         V2.2..   Option Memory             Present..                                SIMM 1 installed..                                SIMM 2 installed..                                SIMM 3 installed..   Image Option              Present..   Display Type              Monochrome..   Monitor Type              VR150....DWT>>> 
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 00 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+--- SHOW: 509 bytes of console output ---
+
+Script complete.
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/evidence/help-after-init2.log b/dwt/evidence/help-after-init2.log
new file mode 100644
index 0000000..0f040b7
--- /dev/null
+++ b/dwt/evidence/help-after-init2.log
@@ -0,0 +1,64 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 8s, 8 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 8, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/help-after-test.log b/dwt/evidence/help-after-test.log
new file mode 100644
index 0000000..2324651
--- /dev/null
+++ b/dwt/evidence/help-after-test.log
@@ -0,0 +1,54 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 6s, 6 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 6, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/help-after-test12.log b/dwt/evidence/help-after-test12.log
new file mode 100644
index 0000000..7044a45
--- /dev/null
+++ b/dwt/evidence/help-after-test12.log
@@ -0,0 +1,54 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 5s, 6 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 6, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/init.log b/dwt/evidence/init.log
new file mode 100644
index 0000000..375b1b4
--- /dev/null
+++ b/dwt/evidence/init.log
@@ -0,0 +1,253 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== raw console data 5B: 494e49540d ===
+  TX  60B  Console Command and Poll (raw)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 49 4e 49 54 0d 00  00 00 00 00 00 00 00 00  ..INIT..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+response: 
+no console response data
+
+--- diagnosis -------------------------------------------------
+phase: raw
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 37, frames received: 1
+last TX[0]: 08002b164b5ac6fccc16f566600202001101000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 02001101000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600202001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 02001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600202001101000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 02001101000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600202001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 02001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX[0]: c6fccc16f56608002b164b5a6002370007000000010003030000020002e100030006c6fccc16f5660400020c000500022000060002580207000608002b164b5a64000172000000
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/evidence/mame-noos-probe.log b/dwt/evidence/mame-noos-probe.log
new file mode 100644
index 0000000..2e32a6e
--- /dev/null
+++ b/dwt/evidence/mame-noos-probe.log
@@ -0,0 +1,16 @@
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+PC_PROBE frame=100 PC=3FDCE400
+PC_PROBE frame=200 PC=3FDCE400
+PC_PROBE frame=400 PC=3FDCE400
+PC_PROBE frame=600 PC=3FDCE400
+PC_PROBE frame=1200 PC=3FDCE400
+PC_PROBE frame=2400 PC=3FDCE400
+PC_PROBE frame=3600 PC=3FDCE400
diff --git a/dwt/evidence/mop-hello.pcap b/dwt/evidence/mop-hello.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..775e8bc64c1142e10e30153f0861166ec6d56663
GIT binary patch
literal 2405
zcmbVMK~EDw82!4m6srv(BwW1AQDY#sXiN-gVxUTcg@#rz8Y9zopksD-)}1Y-n)n<1
z3!b@o)p#M|#drWNMvc+<7t{+z=i5b=rQNX0B$Ld}e(&v@+4sJ^t(Pw}NP<6-kWdew
z{_H-wvz3A=wZ=IFm&WGqZSTJy`?<QJoq?<mIB|tso1t7uNS(;w7a&*VZ3=FwEu5Yr
zPu+@k4bo~a0Rsa78ff2O00zB^BxvW<hcp6%pxxEdFz8{Lkgyd5Y0qzm9XAalFk8G`
ziFRn@nh)jDU<B_s;y|vaJ1KajFgSz9-As&nx-!`eA!MdF-Qi|abR?-U+u$bE$s#j^
z!^pHSrO=sMHZ2T;noUXQI^{a8>+HI_KYq&Lf=lzInv&3GluYh$s`Dp|I4wqGS31m?
za6z?VwMM3_T!Gx5vhoGBoGd(WDT*7c(N?-0CY=lNBC&D`Y>W0<i&%LN+~-pVTV>H?
zq|O~lq{SM1m9r+PcZoIW0jskM%l*OCmgpQ2NgBdj<!f!5I$W3@7;VrWT<cnRLM};*
z>6TKy;V4KZlbu<v6$%A{zw+a*Z?WL7)L=B>S}fA9M6M6t&xWK^SuCQxunf6&e)wEH
zx?))Dv*Ox&t%d7~VSVJ<f8%rY=!$V)$hEnc4$+12MpHzKH*)<B<%$<?<a$QaFsy+)
zgJ=A!;_d1R_e9lA6UN&&YSt?c?2!t!slgm(EA#s6C91c*rf|yakGna($!()UZKk@-
zI+rRdhY4BAPvqT_1q(Ao%BmgN-NV<osMt(0({ZZ;FOEM{OXV`j5pGI{>N;yiMC4;5
zCXXRX23=$1-~<6xN43vzY3Z~}+&&PfDhpFIRQEExt5%QP5q6)#rN!LU%c^JmZy9Kh
zUv=NML3?1!h;9$$x+1b65s23^kn6@{pQ}e#4BLKDT<=QBa9uH4268>0^SOF-#keoz
PdiZrHL{|caW3<?Rdf*JF

literal 0
HcmV?d00001

diff --git a/dwt/evidence/mop-hello.txt b/dwt/evidence/mop-hello.txt
new file mode 100644
index 0000000..d8cef42
--- /dev/null
+++ b/dwt/evidence/mop-hello.txt
@@ -0,0 +1,135 @@
+01:59:39.377685 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0900 0d00 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:39.377771 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0400 0500 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:39.378192 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 71: 
+	0x0000:  3700 0700 0000 0100 0303 0000 0200 02e1  7...............
+	0x0010:  0003 0006 c6fc cc16 f566 0400 020c 0005  .........f......
+	0x0020:  0002 2000 0600 0258 0207 0006 0800 2b16  .......X......+.
+	0x0030:  4b5a 6400 0172 0000 00                   KZd..r...
+01:59:39.378395 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0700 1100 4845 4c50 0d00 0000 0000 0000  ....HELP........
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:39.378446 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1101 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:39.381563 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 443: 
+	0x0000:  ab01 1300 4845 4c50 0d0a 0d0a 2020 2044  ....HELP.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2052 656d 6f74 6520 436f 6e73 6f6c  al.Remote.Consol
+	0x0030:  650d 0a20 2020 436f 6d6d 616e 6473 2061  e.....Commands.a
+	0x0040:  7661 696c 6162 6c65 3a0d 0a20 2020 2d2d  vailable:.....--
+	0x0050:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x0060:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x0070:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x0080:  2d2d 2d2d 2d2d 0d0a 2020 2049 4e49 5420  ------.....INIT.
+	0x0090:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x00a0:  2020 2020 2049 6e69 7469 616c 697a 6520  .....Initialize.
+	0x00b0:  7468 6520 7379 7374 656d 2e0d 0a20 2020  the.system......
+	0x00c0:  5445 5354 203c 7031 3e20 5b3c 7032 3e20  TEST.<p1>.[<p2>.
+	0x00d0:  3c70 333e 5d20 2020 2020 4578 6563 7574  <p3>].....Execut
+	0x00e0:  6520 7465 7374 2873 2920 7031 2074 6872  e.test(s).p1.thr
+	0x00f0:  6f75 6768 2070 322e 0d0a 2020 2020 2020  ough.p2.........
+	0x0100:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0110:  2020 2020 2020 204d 6f64 6520 6269 7473  .......Mode.bits
+	0x0120:  2073 7065 6369 6669 6564 2062 7920 7033  .specified.by.p3
+	0x0130:  2e0d 0a20 2020 5348 4f57 2020 2020 2020  ......SHOW......
+	0x0140:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0150:  5368 6f77 2074 6865 2073 7973 7465 6d20  Show.the.system.
+	0x0160:  636f 6e66 6967 7572 6174 696f 6e2e 0d0a  configuration...
+	0x0170:  2020 2048 454c 5020 2020 2020 2020 2020  ...HELP.........
+	0x0180:  2020 2020 2020 2020 2020 2020 2054 7970  .............Typ
+	0x0190:  6520 7468 6973 2068 656c 7020 7465 7874  e.this.help.text
+	0x01a0:  2e0d 0a0a 0a0d 4457 543e 3e3e 20         ......DWT>>>.
+01:59:39.381913 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1301 4845 4c50 0d0a 0d0a 2020 2044  ....HELP.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2052 656d 6f74 6520 436f 6e73       al.Remote.Cons
+01:59:39.778958 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1100 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:39.779474 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1300 4845 4c50 0d0a 0d0a 2020 2044  ....HELP.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2052 656d 6f74 6520 436f 6e73       al.Remote.Cons
+01:59:40.179412 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1101 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:40.179964 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1301 4845 4c50 0d0a 0d0a 2020 2044  ....HELP.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2052 656d 6f74 6520 436f 6e73       al.Remote.Cons
+01:59:40.479915 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0700 1100 5348 4f57 0d00 0000 0000 0000  ....SHOW........
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:40.479991 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1101 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:40.483710 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 527: 
+	0x0000:  ff01 1300 5348 4f57 0d0a 0d0a 2020 2044  ....SHOW.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2053 7973 7465 6d20 436f 6e66 6967  al.System.Config
+	0x0030:  7572 6174 696f 6e0d 0a0d 0a20 2020 436f  uration.......Co
+	0x0040:  6e66 6967 7572 6174 696f 6e20 5061 7261  nfiguration.Para
+	0x0050:  6d65 7465 7220 2020 5061 7261 6d65 7465  meter...Paramete
+	0x0060:  7220 5661 6c75 650d 0a20 2020 2d2d 2d2d  r.Value.....----
+	0x0070:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x0080:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x0090:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
+	0x00a0:  2d2d 2d2d 0d0a 2020 2046 6972 6d77 6172  ----.....Firmwar
+	0x00b0:  6520 5265 7669 7369 6f6e 2020 2020 2020  e.Revision......
+	0x00c0:  2020 2056 322e 320d 0a20 2020 4f70 7469  ...V2.2.....Opti
+	0x00d0:  6f6e 204d 656d 6f72 7920 2020 2020 2020  on.Memory.......
+	0x00e0:  2020 2020 2020 5072 6573 656e 740d 0a20  ......Present...
+	0x00f0:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0100:  2020 2020 2020 2020 2020 2020 2020 2053  ...............S
+	0x0110:  494d 4d20 3120 696e 7374 616c 6c65 640d  IMM.1.installed.
+	0x0120:  0a20 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0130:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0140:  2053 494d 4d20 3220 696e 7374 616c 6c65  .SIMM.2.installe
+	0x0150:  640d 0a20 2020 2020 2020 2020 2020 2020  d...............
+	0x0160:  2020 2020 2020 2020 2020 2020 2020 2020  ................
+	0x0170:  2020 2053 494d 4d20 3320 696e 7374 616c  ...SIMM.3.instal
+	0x0180:  6c65 640d 0a20 2020 496d 6167 6520 4f70  led.....Image.Op
+	0x0190:  7469 6f6e 2020 2020 2020 2020 2020 2020  tion............
+	0x01a0:  2020 5072 6573 656e 740d 0a20 2020 4469  ..Present.....Di
+	0x01b0:  7370 6c61 7920 5479 7065 2020 2020 2020  splay.Type......
+	0x01c0:  2020 2020 2020 2020 4d6f 6e6f 6368 726f  ........Monochro
+	0x01d0:  6d65 0d0a 2020 204d 6f6e 6974 6f72 2054  me.....Monitor.T
+	0x01e0:  7970 6520 2020 2020 2020 2020 2020 2020  ype.............
+	0x01f0:  2056 5231 3530 0d0a 0a0d 4457 543e 3e3e  .VR150....DWT>>>
+	0x0200:  20                                       .
+01:59:40.484086 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1301 5348 4f57 0d0a 0d0a 2020 2044  ....SHOW.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2053 7973 7465 6d20 436f 6e66       al.System.Conf
+01:59:40.880436 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1100 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:40.880961 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1300 5348 4f57 0d0a 0d0a 2020 2044  ....SHOW.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2053 7973 7465 6d20 436f 6e66       al.System.Conf
+01:59:41.281031 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1101 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
+01:59:41.281488 08:00:2b:16:4b:5a > c6:fc:cc:16:f5:66, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0200 1301 5348 4f57 0d0a 0d0a 2020 2044  ....SHOW.......D
+	0x0010:  4543 7769 6e64 6f77 7320 5465 726d 696e  ECwindows.Termin
+	0x0020:  616c 2053 7973 7465 6d20 436f 6e66       al.System.Conf
+01:59:41.581471 c6:fc:cc:16:f5:66 > 08:00:2b:16:4b:5a, ethertype MOP RC (0x6002), length 60: 
+	0x0000:  0100 0f00 0000 0000 0000 0000 0000 0000  ................
+	0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
+	0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............
diff --git a/dwt/evidence/mop-init.pcap b/dwt/evidence/mop-init.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..724922a5eb75eaaad262527b8a592ab39c492b2c
GIT binary patch
literal 7899
zcmb`MT}&KR6vyul%SUNfN~$&5m-}EFv7vF7R)Zm%5TNZ!X%V(iDCiFC07G|omYtz|
zsOW=lJ}3|R;Dd%}j16hiG`?wgX>5&O5737;VydQ3)uhI18&grwnL(yo_Q;-kCz)h+
z_MYGV@4f$f=FZtm=g-Y)A}IVLC<5@Idu3^KCM-k)T;o|Gc5iR(z3}H(+kYQQXq!aH
z57_VuS*J)=P?T;+@Eag&ey<P*;1-^qB2QgHds>vky?`hw5keE%528erc`brM+X6qN
zNl_-WV_LZ=^J0=Bkb@A!KDLkQZn>xyvBR-=ah*n1BgxW4HI8qQ2eQ8ZB1lXFu!`hh
zGi04eY@%6AT@T+1(JY3pW1wp`RzkBFx{%d=wVY-#bzO3{&@6_o9?-RNF+j5zx{$Tl
zUq-W-x+ZQ`(kzCqUeL9$pISpa-y`e&Wi`G>*6U+xe2=W<vImrm*KuHN?N#G@WJPbN
z@jbEzUsL1zK42M_)%YG+J!v(*M^;$dtYjYhfz^0ajqj0Fe_f65k#*n|HNHpIt_Ril
z{&`?645{%wvX<_s@jbH6%&PJI3&6U5O^xr7_0F^!-y`emt!jLq0M?yBHNHpI=|9x?
z9$AxbsPR3r9@?qK_d2kyj8fwj5LJw4EwWlqP%PfF7FqAY-nj5qpSQ<E)}wE$8GB^C
zw_DBFPXeniLiwKeI)kh^lEr(SnFdzPQ)+Y}Ym{X1biD+umU=b1kTpiKc)C6S)~OrR
zew8<m$g22-V)1l+h^*fz7Ec$lo+DX2T^|8!=9U^=$f~_fv3R=90PE+S8j*8&<Atn4
zyC@b<*I8iwR70_Nx{$T^35vzjbq-j4wG@k|3t4j{i>K>jU_BdFqYGItlPsRDi@+*-
zHMmwLn#X$3Y7xsT6YcQJL^_s<yoc`wWuk8Zd-Oc@sN_upvgSz^ue-=<|EzSayNaq}
zh~064>MmBr4z?U>FRm(vtivRWw_`!pi;Jb=6R33Hncv;{z&1};WvEh0+1%1JVP=xn
zge~JnE^TJ?l<Y9lmSe~!D`Q(J!)?}NrPF#QX-oa2Zl?5sl<|yvzxF;4HyDeCAfdn!
z%b1R-r_5<XIwOX(r)<Ya?{S0TEuC@MkPS!W@rG<93YT@!eizX)X$+2oZpW~l$L$)K
z4MT9w8Xq2!*@zch;HOq^wOL6+4w#ND?W{3q4w*($4ot~xofp`7@JM&z;LZ_i;x3VL
z(8>&%!{a&KF|CXjj5a779G}W!4^3N+7^y5MpL8IkvNF`%9gjw%5~uRYl5es6sno=_
zfNQa$rV?4-{77wDcpF({Enf3k>vS<JwhXMxpHfMZXMJR?EcmQ-x)|eytg{`|%QG%-
zG(~aC8(FtW7Qc@(dby~Al#OS8AOD8s?dqaE(dn)xT;9G>LtgW|d$L{6>1o3;a$sKn
zx=T-udr9Fw*M6<Lj`y3n^n{)>AlsZYZCER7E2Jy3C*n3alEpP7+aMj~rq;g3i}svh
z8yUxKmG{NHA39@gZ89v)jP2;Dl#whlBEpWSyC))+)`tzb+Jih*cWZAp?QBY)l5QTz
zYt?3DtU<_LX>X|Eqv=?=0u8%5!uy_tobhkUaIH4r+cw`Gm@<mD2eRrdHUDEEt8vU{
zt<%M@?RUWXGWH+!5Jrt3S+lJ^Yn?8}cp+=xY6Y=x=hZMa{{`>&U4H8SKYuYI>sOM+
x+f0Rkb+bo}E@VB@OR;#ms(_W~r&zqrC$iomSv+0Uz<M*GMi;U^Cs{mQ{{UBYyvYCn

literal 0
HcmV?d00001

diff --git a/dwt/evidence/mop-noos.pcap b/dwt/evidence/mop-noos.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..a59fb2f5a88ad51190bec29e4d22177fb89d008c
GIT binary patch
literal 1240
zcmca|c+)~A1{MYcU}0bca=!h!oVDpACxZ=;4Z<7@+G5^O$NroV`<j-(#L2*m&_Iv{
zGV2dcvsf5d37UXV@B?U8^H=J)3uM-1oMw^cu3td2e*B=0yFg~C|HNe$Y3}+1G>h*K
zF0)9BN03>OIL#u>U5tM(XKi!krb_w(nWgB4%Pi8|#SAnn*aMeYq=gsAtWKO}k>)N|
npjmgksN*h>Sxnxz%p%QQ>_D^pd~umYT6lrXD#B?NY3>35%RHV~

literal 0
HcmV?d00001

diff --git a/dwt/evidence/mop-script3.pcap b/dwt/evidence/mop-script3.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..41817d5ed32ee2d030f44e31d020ee23f97c3531
GIT binary patch
literal 25914
zcmeI)dvH|M9S886&6AL*3_hyZnX94@X(9=r)d@jNKmr5<i9CV{S&|J|Om^e$hL?b;
zB8s+J+uAx~{{bH((oq|bjzt|U@~|o$2^|R1f{u2a`b4Ut0`~XaWplXP{KEc{-#^SG
zGns_2_ml6r_jk@c=ia;7v$cJ#$4arxM~an1|0q1xv9RMZ`ik%AGs7Bj;gqWF$KJm1
z>xNp-04v*UaK`Uoop(8BrC6zF6wC`?l@GP7o9RdRj3tVttMy!GrPI%ntmI_N@>rht
ztz;`L_KFnClSRMCV_RvKXSOHZN{ek%ZzY9j6R<mo?Y_C`)*x%rgsJ6;H5%6YtmUx=
zVgDxh0c&`HWo@Bt@ab&shNQu<T$$OKwr!V8C|>Lj)CU)b?Mh#$*&pyW*)x32!HCZ;
z4hF)(CSUYr#lhxgZ=gPGdlz~AP2TxUz8j)H&+X+$bmP)#rIi$+n~&0fKjQZ``Iq_Z
zNTbgVFAYb0&3Vy{DkoG_+J!CoMfTjnmVzSsc2rSyl$fx@SJz6pBffBCcsR#y$)}A&
z!PW(hc1uBQ<8FS{$sd&k>wWfoe<W;&TYPo?2EVV~p1;&?85P^GV$v<My5G2>F}V1Y
zkak@#(BNOt8uCW`!9Z+dltK3!S1xTq3;kic(bv>M$(KZElg!NQl3A5SMbtPtl)oEg
zO3ZmEJ=Wl)Xo)3sC}C|IpT?9cl~{u1g_ptVC^nWWm!QO8Jy?^)=Mt9wiFw9y<r3_#
zv6SoQ?MX~7bZ-<zV%-~78*9nBH>`(WPqNPSSkX^s8-Jwk9nHnpL`AeWp?jM`&5pg?
z@iV*J8}c^$BEAq6ulatax2ZKYDD<-L=SKVSM1QDxu{Y$S(Poi9Ons%Rhs-R<D~P`2
zmKO9OyNrgT(9*8|#y905U)UFjL|^6jkJJBAQCe1J=iB~3IO1(;^3^A}MS*yWQKxND
z+U#B6vro3bk?Pd!CH`<rlXs~d9S0n*DhmdJbu@Z4$96US(;o?jx_RNu8Tn&I(wGq+
zGEg4-{$|S7SsoZN5-$%}n|7r$T|hQu!20YT#&YEnlr5}lKgs5E35E<<ou3-Zl}oU{
zipXj&N@j8mq#+}E_8MuAJoB&t%QKF%WJ3n5)#HujY~xR?!6p}t1C@0C^amE?<>htF
z2u>L?U^UGhz_d|T6R>g*n|<$`Fv{9Ej;ygIrj1UEhD*We4b}?QlC=@m^iEUv&Rp^~
z-Wf2bH<u-7<BgQ-zSqq-;j#pMXcAfDW@R!pA)ENa3b2-J;y;<JwN*N~U>#yDS+1#M
z?X1?x1uLb7vt+rZk=0SlS+e5@Yp|EIWVy=8s;T2FSuR-1Sxc5{23Z>$baKJ^h_z(7
z>dESSBeQG4y8$cPlgshgf_I2n@OrV}jSU=USnw_*_Ma2EAy#%6U|o7MXUUoitF1J-
ztGUk8Td&vmVCPQeBFfhHuvW5`>?{DQY<6=0`u^-+-{Vm3nqx}LS-F_3Cw@kUHE4m(
z#0=KtMq{~h3D);_lJ(|za}A>}6Af4|78}czOR&C&)xI}{nY73zjIdJoah7bt2&=Q%
z?EAj%uMsKdFm06OT28rMn`LUXFS+g_>y5X#T(UC>EbDE~lATFlb-Z(q_L&51Xcrez
zwl0LVj<sZG5?DF!nq1EA#IFmxn<uo9b>8|^l~RNCN)b1&lC=@m(GJr_SJ@^$!dkx|
z>yN{F=;ngq8dlCL87lh=)_XH_*3oy9_1mXCD!E|Q7wW8iVI6#Tph~WL$eMSh&e|8&
z*eyDB4{KYwPTj-$;Uk^8Uqx2(^*VJA%ezab?qTh()2aJ=$vV7Qr|w~Sr|Q%_tS8>r
zsr%JrjUBC1_pplJ)Tw(|KVz?9$i{nEg-3Mi{ywtmC+gHatg8>`)IF>dcj(mp{bUW@
zrc?K@_EqWBJuKgsI(5H>tj)zbbq}kiQ>X4>9S!J=_psKaoXeaaWy={@yID)NY<PgI
zk+XIB5UjgD)9FL7a_`aUL%$;HjzQ*jxO0vvTh74R$Xc@H%)?~eb%9PUSUXrtmg^C+
zaxd1&1uMi_vRsdowQ*i{*YZ#4y6JPo{&XC7N|KcatSZ)$H5b;D@#?Exu%8p#{c};7
z@w=e;1!ukqYQY+E6KBb02CxcBjOASIUKGCzO1T_2K^wYT?LJS|JD2L51z@di*SX*W
zD>BKn(K!;yM(!8L`r&b%3qG)x=j)8zu)g2k!(C9pD*Vr6-FS)4><8AC=ebc$R;#eW
z6Le-j?PRTg%v>~e)r4Sw!D`LZse4#oZPls!Xs$Urb-$5vJ^d%0x`%b!O*(ZCYv*2_
zy5B_B@DVz753BJtow|p$;#QryhxKtCR}-=sF|2FqIZM{JUnFb#UwWu7!4*kZ1Il`+
zFG1gib@vB7)R!RFU$MVZxs{D<$^&Z&YsscOFOzjihE6V6b6883>s7KY8>o{DR*<!1
zxwewE?WF<QGvd9(uKPr%xv(zyl(S^bg*E$g^WcPYirDKX3BZ<p!9|okNdRjVYsp3;
zST`KY?0=Hr?0=E~hjP<#Q)14_mAzA7A6Z-8?BQ~m;6wmx(ObrH<q|we0PETR=v-ce
zb??W<a^(^{NdPOjoI7#K-YEcU3v0=`H>_(O%<6xqK>s@h@ZN&c-zk9dnEp#sw(c&F
z_&WtU$x7?#;Sj-)0qb#kzAb+J$dya*P61dig>}}Lu)M9ta^(`dQvg=Y0B$`YTbsao
zfwgGJ5bXQ?WTjP`eczXB1+bEim?73>33EMkzo}K1C0OTtL%Ci$Y>uPTlC4c(9cL}s
z<nt(54}7hY3)UXilI8lIEbBX+T(E|*mMqsXvMxBLlM7ZAYsqpY9q(B9GJEY#R$s6#
zpU7Pgk>yGzt6~yo$#TJ3!&<Ujsbn3Ptdk3tX9{P@a;1|st&Fo|`wLcxwPd-@Co3Z}
zOM6W|jM(cQ<%U>lZjvWCB{eNQBY|NXRxNAEnhR^qA53$dr`=w!$-yQ)#x+;ACWmz?
zYsn_<ur7HrtA9;?_OHotC~KcGCFZPL*_wPfSyzR6n3yHdE8{PLRT?ptE0<tR4(tAh
zxRbD~^kIGVu(4dZ1Z#3wA77y}!G@JHl(S?L>>T7;WcIyt@+sS2uvTUDaPdEWz!Ufi
zYuGwdt9{8;Ox6*akjMYtiqc~gvxr@p&)vtAosVIyXD!(Y3f6|vrn%0t?ez%??9ee>
zb8&*g-%m;4845c3u*S2Ntm<GL`g;!#bR|%2@t455z1H;jzEmBoi@xdMfv)&3P2lTn
zvL2y#6vi(>^d%Rp@`F0dU|4%1I=yrbS;u#nE3>XPCa|C4FM+kYTIUupti?ynmF&Lc
zsv>LKM6M6X>K@j!2XyKl)<bvb)IF?2X*y@8xnx~brBnB?Zu&x}?qSiXPNhHIMpolK
zow|or-K<mhu*P_}<)&<wQB79KtvYoNtMI=%bq}lTE}goEm2<vM-Pe%ydV@~g!`lCY
zPTj-W{D@B7&m-&04|VDu*4kw{bq{OLc{+7pOV*EdI&}|g(|0;`53B8zm5uA1Cb)bJ
zYsi&4b?+tX&_Zs1$!<fyntD5D$<DQ~o}fRy$j-mw6ORPG!m@v_Gv>g0YJ|?dUqY6z
zfUA4iat78q){-q}mXVcvtxhgjx3iWk*K)E-uh+>1E5ur|Tu+j<o_!!kb{t`4e96sy
zWx1Y)^*_#%<$^VxwPd-TA#3F~I=Nuwe#=?1T+fm9>6P3gv9kRIYwA^;CCl{!S)b%^
zmMj;n(N}YpELS^Ox8-t{EElY`tR>5}iLA-_I=Nu2U@cj$9b~1orD$Ijdym*#w{oXS
z*<paSfwg4Kg;l;SwX3;GSH-{%+0HdrcH0KlG}e;MSYX|`JGK9|&Dnq328Xh<!<3k_
za%Hz|VD0*Vo3zLl^{{q-Xe?JQ!EKuZWc~YPZjh9fKCBb38q1YSaN7pf<{8}LS@tL;
ztfQ<YZ)2M`z5h|l{zoahdz2ET_U(LAw(c&F_@k7t#szimW56mt<qt);atR)#{1;if
zOMAE;BDjVD>o-%3<;o>^loFQzAa@s3b`4|TiH?QO%rry4^E!=eG6m}hYsn^4*|6s5
o<bri^6=%tEol912HD}587pzBFOO|U8S--B;$pvdCYsqr`AIrQZW&i*H

literal 0
HcmV?d00001

diff --git a/dwt/evidence/mop-test00.pcap b/dwt/evidence/mop-test00.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..0ed99adb5a934a274261c74c912091381bec65c9
GIT binary patch
literal 20240
zcmeI)Yj9NM83*vQn|ny46x0H?bE<L)lt=>BNzJ4}00|HbBwP}1S&|d7xHon;KoEoq
zQfR&L!Ir5r&Oj-ap(Aq9R<MqR5wuo1B+MWcYISUfsTV9LA|}%3zsu&Z>^@;1c)mD8
zW-{b*&M*J>oaa5~ecyBR=z(3EoJP7~f211@`etQE`@;Qi-DH%~*Z9mfhTbx<?qJ8?
zZuz3A-kD?M+dEwKD_9p<E8WPrs$g#btL^QZjQi<F_>3lsrmJ_}V`S0K97bB2VK@!v
z`$n3P8Qmh?aOTk;a+*e_;hgErGBTt4G#ZW|?E*G<m}_niqnA-Lwz|d~ZVtbC!(nY^
zEvL~7$2Y|fSOrJyT=C8Qp3&RRm7AYiV}-(Q--5!z!eq@|MOOZ{4Ca(lt`sw2Ggy1e
za(PS8Mp)<C?KZ}jnk?7P$l5q4T_qQ+fq%~CEy3}Eb$n_*ZwZdqBV;|b)yZ3eT(DfF
zS-d68b@E6L-V)?mO}S<baPXEO7p#(fI&}|gf0a(%!#e+Oow{E`mZL<c?qSV4tW)=}
zjy34i{i9@^eo3e9Va=VSQ}?hoy{}XEYstEIq)y$#y6;V$x`#Dnu1?*<DmklD_dh4g
zHBP7QVGTT?Q}?hgEYhj_b!6TCx=!80I$Ebw_plm1)2aLQWbH23se4#;$93u+*5^K*
zx`(wky(e=|a~M4Z_eWT5tR)*W{er9?&D7~buvUGd(}!RUS*_ED9w*D&E0a0)vgr)0
z-K-^>&OAxhLpST>f^~?sWVtqwRnS)_7px#_$#OkI*3NnPUDLnqnCD%ZoJOaA{q5<W
z3)8=7r%E;-!i4tH^zV6MzyDM2mLw|=Saqx=Yc8ybqts`+U_T```Q$z~Hrp*KzWQX>
zfYpCAXUS%}u!_gnR{U)D*4S*9a>Y${o06T~9b~<Io6cPT*4kY;%<+=75mtD--Nx&g
z?Y=<P*UzM><bt)lNaxB8>%zf2m0UZ?y04$k=m*xm9o$t-b{=7c#_EiIc9FGhV|1Y{
zaj{L73sy^^PTj*gb3mu=Be`mI>V7xn+WH5bx`#D;v`*c_dgGW*-R~i5@KBw)ht>R=
zPTj*=F-@oLVV!E=YC<+5hILmXXUY1|i)2mtV>k6B7^%a`sqCh{1S?sv9{He~`V!>Y
zi{q8S&1_^t9#~6ROE%<rg{*$rI=NugvX(5@t7QGKhfXe7e%6xZIzZN6Ue3`T5g#M=
z*^hLZ3+v{OIZM`DST&#Kb~QJCh<MG<f529r<|1a%h<N<iNmVHfhp7j`TFqLrD-o=c
zj$C6OT_x}t-`wqv-qBn%95zjJ%-HfJZeOE+Nyx0Rf?l`J<uRvPUVqp!%l*EP-(y8K
zEBAZ7E?;BFbS-wdJ+Ap4>nD+)54*;X$j%j$D{3f0l8*|XJM4CO+{-L8+-#Yl)==2;
z7Djf8JX0$T6qT8?N(04ZW@%tV*_;S5cB$3SLb=2AL~C%Uzzh`8&Ov|6f@U*N9Njs|
zpStv;N`Iqe&Uc4HW+-4axSQNoqdC9T42+2GSUvuM8Oe99ZuT#^ETq}s_cgf}v;<vY
zx8E1t8D)@s=bF|4TIdd$&6X!X$(M#{m)zX^F*9n)%F0Zf$~~QSiN&8vr_tLHDY2AJ
z<vV2k>CJAI%LF$9SS@eaRzfa8iNSjAKRU~cupT{STM4;@$IG*vyK$m>qbO4A-pI9=
zwPf8J)?L5MGkVe@20r84c#*nyBo|*3)sfzW?rj$;CdX8waX&MwTtS!D3R^+?js5j>
zm!~CqQMkswKP>X6#<_#uC9a@FSDVG|5cQR=9x}bSkS6Q&?E?YyA+wS$N5R&vU*n6a
zpcS%w;mB5Tzqs<7>Wa!rv&eM&LSdK3V>PC@N3nR15m)R{;dL#rVl9YEb$RwN?ohzv
zYBeL*fw-+I{XTyKUA?@~Lrveh!~S5B4W~~nx_dZXGh&wvl*g3E?6Qq74_q=*FOTD7
zrOnV8)57}AOxsGxB`8~1FNJjGn6O+ewv~`ec)VuiaPtY-+yuFHuohi11efc7kma0X
zANz#$Bf)$E*2OdSB{snl=6Y<MU8@O}AlEs{_2U2R^B8Z*<|eQ@SW7neJWtlzFLZLj
zYG*B3t_x&!p4Z6*YtUDmCCk-8)^|HNOLiV%)v}f>m!q?N;mhpWoh%ou+sAS1A+lU)
zWL1ynELkpC>sd>dD}$^P6LfOHa!%wdS*|RyCRcKn?0CTnvX(4YAF{G@^SUOfN>8Z<
z5qr<m+$ENp>u{!}XJlq&r*PSZRnJ<o=E7S4YrDDex7}-=lY@0^<eDp+lf$}=wPb^K
zSpBx--I$Yq`{(31mG!@~ODw)}WpnbuWDN{<GcZe`SH?DhRS~wWgj|9-IjnV0a5rID
z>BBnnq-`bS63oeAow`G3fDNnQPR^1IunUlDv3>002cNRz1#3-SH;ezV6Q07qum)|m
zYxR0^m6LUr2IR4~=#_3zGl+e-h<lDHyC1{a##*u)6s+wd?dHap?KR(^z}|T`*IeA7
zuqv9`suHYGtR<^DSpWKKH!pOhP;IeIU_DrG_xS6nI#{=!>*j^7*dI;d-<f1>sL<)9
zu&UnEnFhl;8rJEhwPbZ3vR7skj(rNpDYgl$wmCYFfMG2;Yp-NqPp&$$_K)NGkgV=u
zJ$FK<?qNN?NT=>${WDYN?lg<6K6N^E4{OwEow|qByhf+)XOp$y9i6&|HOs40_pnAd
zx#^~Clre{_@@YDC59{9l>eM}~2`hE#9@gMKI(0vntk;@!>K@jyuXXAk*6s~Dbw7`+
zPd?PCdsxpd)2Vw{N4}#|_w{6b)1XuLuy%f>Q}?h|TsE^wxTgu0uVM8api}oQvQ94K
zj+g8)1guF9a+d5~3u_bo2ervxA(mYWVg2A&I@cUnza6S`?3a=?znH6g*>nchX4aBT
zXO@vQ^v626U@c@VS+3<|-Cv@U3)UjmlI7Y$);9Kq9NBq<mHinv_Lb$@3hQ&ulI4Om
zg|%e4eoxlJ=X7$x8ule;$#OkU*2e?5S7K$y3)ZB8oF&Wk0$CpwaF#3=tdT=FOO|UF
zS+j?6mMj;nO{^u$wTG+;MLM})tza!#u0v#Hu1eQl6?>Q1X$QDlrR+4o+Rj?C=EACa
zJ)^6+N~>aE`yb?*D|>7MYcgxeMl7%%YRkCs*yh{+*aoNac)ML<@s%rkYy<1?2i%}V
zHjstY_MvSh<Pto#IYHLDuW%PhS?R;-eATuRatR*Wz}h{Pn>@>2rG#~!wd8GF>B_qC
zD&>t=De>~<m9J8w)V`c=mu+GfNc~kxSfzfQ=NPa?U-mzWNXR94mGUH6f3N6fJw&jE
z0c*oV+e*kKc$E@X(|g=gP}v$rk8j!+ZkcXh`s3GWWP>SKXIM)%n93*XY^_c%Sbgg_
iOO~rAS@m-`OLn|qJ<VFOT)oJ8s$M4-tT$Lomh1nh8!nyz

literal 0
HcmV?d00001

diff --git a/dwt/evidence/noos-attempt1.log b/dwt/evidence/noos-attempt1.log
new file mode 100644
index 0000000..0f040b7
--- /dev/null
+++ b/dwt/evidence/noos-attempt1.log
@@ -0,0 +1,64 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 8s, 8 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 8, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/noos-attempt2.log b/dwt/evidence/noos-attempt2.log
new file mode 100644
index 0000000..0f040b7
--- /dev/null
+++ b/dwt/evidence/noos-attempt2.log
@@ -0,0 +1,64 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 8s, 8 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 8, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/noos-attempt3.log b/dwt/evidence/noos-attempt3.log
new file mode 100644
index 0000000..0f040b7
--- /dev/null
+++ b/dwt/evidence/noos-attempt3.log
@@ -0,0 +1,64 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  no System ID after 8s, 8 frames sent.
+
+--- diagnosis -------------------------------------------------
+phase: connect (no System ID)
+iface=vt1200 dst=08:00:2b:16:4b:5a src=c6:fc:cc:16:f5:66 ethertype=0x6002
+frames sent: 8, frames received: 0
+last TX[0]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[1]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[2]: 08002b164b5ac6fccc16f566600209000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 09000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last TX[3]: 08002b164b5ac6fccc16f566600204000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+  payload (no Ethernet header): 04000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+last RX: none
+Hints:
+  * DWT is part of the OS session manager; it does not exist in the
+    power-on diagnostics menu.  Boot past level 1 first.
+  * The MOP service password is the 8-byte Reserve Console verification
+    value; wrong password = silent ignore (nothing comes back).
+  * A MOP frame payload is padded to 46 bytes; the 2-byte length field
+    is authoritative.  Use --dry-run to inspect frames.
+---------------------------------------------------------------
diff --git a/dwt/evidence/pc_probe.lua b/dwt/evidence/pc_probe.lua
new file mode 100644
index 0000000..b58580f
--- /dev/null
+++ b/dwt/evidence/pc_probe.lua
@@ -0,0 +1,25 @@
+-- pc_probe.lua -- print the PC at selected emulated frames while the bare
+-- (no VT1200_SKIP_LEVEL1) boot runs, so a MOP probe sent at the same time can
+-- be tied to the known diagnostics-menu park PC (3FDCE400).
+--
+--   stdbuf -oL <mame> vt1200 ... -debug -debugger none \
+--       -autoboot_script dwt/evidence/pc_probe.lua -autoboot_delay 0
+
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local pc = cpu.state['PC']
+local frames = 0
+local marks = { [100]=true, [200]=true, [400]=true, [600]=true,
+                [1200]=true, [2400]=true, [3600]=true }
+
+emu.register_frame_done(function()
+    frames = frames + 1
+    if marks[frames] then
+        print(string.format("PC_PROBE frame=%d PC=%08X", frames, pc.value))
+    end
+end, "vt1200-pc-probe")
+
+if machine.debugger then
+    machine.debugger.visible_cpu = cpu
+    machine.debugger.execution_state = 'run'
+end
diff --git a/dwt/evidence/script3.log b/dwt/evidence/script3.log
new file mode 100644
index 0000000..b4be4c5
--- /dev/null
+++ b/dwt/evidence/script3.log
@@ -0,0 +1,233 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== 'HELP' ===
+  TX  60B  Console Command and Poll: 'HELP'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 48 45 4c 50 0d 00  00 00 00 00 00 00 00 00  ..HELP..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX 443B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 ab 01  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73 6f 6c 65 0d   Remote Console.
+    0040  0a 20 20 20 43 6f 6d 6d  61 6e 64 73 20 61 76 61  .   Commands ava
+    0050  69 6c 61 62 6c 65 3a 0d  0a 20 20 20 2d 2d 2d 2d  ilable:..   ----
+    0060  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0070  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0080  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0090  2d 2d 2d 2d 0d 0a 20 20  20 49 4e 49 54 20 20 20  ----..   INIT   
+    00a0  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    00b0  20 20 20 49 6e 69 74 69  61 6c 69 7a 65 20 74 68     Initialize th
+    00c0  65 20 73 79 73 74 65 6d  2e 0d 0a 20 20 20 54 45  e system...   TE
+    00d0  53 54 20 3c 70 31 3e 20  5b 3c 70 32 3e 20 3c 70  ST <p1> [<p2> <p
+    00e0  33 3e 5d 20 20 20 20 20  45 78 65 63 75 74 65 20  3>]     Execute 
+    00f0  74 65 73 74 28 73 29 20  70 31 20 74 68 72 6f 75  test(s) p1 throu
+    0100  67 68 20 70 32 2e 0d 0a  20 20 20 20 20 20 20 20  gh p2...        
+    0110  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0120  20 20 20 20 20 4d 6f 64  65 20 62 69 74 73 20 73       Mode bits s
+    0130  70 65 63 69 66 69 65 64  20 62 79 20 70 33 2e 0d  pecified by p3..
+    0140  0a 20 20 20 53 48 4f 57  20 20 20 20 20 20 20 20  .   SHOW        
+    0150  20 20 20 20 20 20 20 20  20 20 20 20 20 20 53 68                Sh
+    0160  6f 77 20 74 68 65 20 73  79 73 74 65 6d 20 63 6f  ow the system co
+    0170  6e 66 69 67 75 72 61 74  69 6f 6e 2e 0d 0a 20 20  nfiguration...  
+    0180  20 48 45 4c 50 20 20 20  20 20 20 20 20 20 20 20   HELP           
+    0190  20 20 20 20 20 20 20 20  20 20 20 54 79 70 65 20             Type 
+    01a0  74 68 69 73 20 68 65 6c  70 20 74 65 78 74 2e 0d  this help text..
+    01b0  0a 0a 0a 0d 44 57 54 3e  3e 3e 20                 ....DWT>>> 
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=425B
+    text: HELP....   DECwindows Terminal Remote Console..   Commands available:..   --------------------------------------------------------..   INIT                      Initialize the system...   TEST <p1> [<p2> <p3>]     Execute test(s) p1 through p2...                             Mode bits specified by p3...   SHOW                      Show the system configuration...   HELP                      Type this help text......DWT>>> 
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+--- HELP: 425 bytes of console output ---
+
+=== 'SHOW' ===
+  TX  60B  Console Command and Poll: 'SHOW'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 53 48 4f 57 0d 00  00 00 00 00 00 00 00 00  ..SHOW..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX 527B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 ff 01  .....f..+.KZ`...
+    0010  13 00 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66 69 67 75 72   System Configur
+    0040  61 74 69 6f 6e 0d 0a 0d  0a 20 20 20 43 6f 6e 66  ation....   Conf
+    0050  69 67 75 72 61 74 69 6f  6e 20 50 61 72 61 6d 65  iguration Parame
+    0060  74 65 72 20 20 20 50 61  72 61 6d 65 74 65 72 20  ter   Parameter 
+    0070  56 61 6c 75 65 0d 0a 20  20 20 2d 2d 2d 2d 2d 2d  Value..   ------
+    0080  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0090  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    00a0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    00b0  2d 2d 0d 0a 20 20 20 46  69 72 6d 77 61 72 65 20  --..   Firmware 
+    00c0  52 65 76 69 73 69 6f 6e  20 20 20 20 20 20 20 20  Revision        
+    00d0  20 56 32 2e 32 0d 0a 20  20 20 4f 70 74 69 6f 6e   V2.2..   Option
+    00e0  20 4d 65 6d 6f 72 79 20  20 20 20 20 20 20 20 20   Memory         
+    00f0  20 20 20 20 50 72 65 73  65 6e 74 0d 0a 20 20 20      Present..   
+    0100  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0110  20 20 20 20 20 20 20 20  20 20 20 20 20 53 49 4d               SIM
+    0120  4d 20 31 20 69 6e 73 74  61 6c 6c 65 64 0d 0a 20  M 1 installed.. 
+    0130  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0140  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 53                 S
+    0150  49 4d 4d 20 32 20 69 6e  73 74 61 6c 6c 65 64 0d  IMM 2 installed.
+    0160  0a 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  .               
+    0170  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0180  20 53 49 4d 4d 20 33 20  69 6e 73 74 61 6c 6c 65   SIMM 3 installe
+    0190  64 0d 0a 20 20 20 49 6d  61 67 65 20 4f 70 74 69  d..   Image Opti
+    01a0  6f 6e 20 20 20 20 20 20  20 20 20 20 20 20 20 20  on              
+    01b0  50 72 65 73 65 6e 74 0d  0a 20 20 20 44 69 73 70  Present..   Disp
+    01c0  6c 61 79 20 54 79 70 65  20 20 20 20 20 20 20 20  lay Type        
+    01d0  20 20 20 20 20 20 4d 6f  6e 6f 63 68 72 6f 6d 65        Monochrome
+    01e0  0d 0a 20 20 20 4d 6f 6e  69 74 6f 72 20 54 79 70  ..   Monitor Typ
+    01f0  65 20 20 20 20 20 20 20  20 20 20 20 20 20 20 56  e              V
+    0200  52 31 35 30 0d 0a 0a 0d  44 57 54 3e 3e 3e 20     R150....DWT>>> 
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=509B
+    text: SHOW....   DECwindows Terminal System Configuration....   Configuration Parameter   Parameter Value..   --------------------------------------------------------..   Firmware Revision         V2.2..   Option Memory             Present..                                SIMM 1 installed..                                SIMM 2 installed..                                SIMM 3 installed..   Image Option              Present..   Display Type              Monochrome..   Monitor Type              VR150....DWT>>> 
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 00 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 53 48 4f 57 0d 0a  0d 0a 20 20 20 44 45 43  ..SHOW....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+--- SHOW: 509 bytes of console output ---
+
+=== 'TEST 0 0' ===
+  TX  60B  Console Command and Poll: 'TEST 0 0'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 0b 00  ..+.KZ.....f`...
+    0010  11 00 54 45 53 54 20 30  20 30 0d 00 00 00 00 00  ..TEST 0 0......
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 18 00  .....f..+.KZ`...
+    0010  13 00 54 45 53 54 20 30  20 30 0d 0a 0d 0a 54 65  ..TEST 0 0....Te
+    0020  73 74 69 6e 67 2e 2e 2e  54 65 72 6d 69 6e 61 6c  sting...Terminal
+    0030  20 53 79 73 74 65 6d 20  43 6f 6e 66               System Conf
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=22B
+    text: TEST 0 0....Testing...
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+--- TEST 0 0: 22 bytes of console output ---
+
+Script complete.
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/evidence/test00b.log b/dwt/evidence/test00b.log
new file mode 100644
index 0000000..b4a61c3
--- /dev/null
+++ b/dwt/evidence/test00b.log
@@ -0,0 +1,233 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== raw console data 9B: 54455354203020300d ===
+  TX  60B  Console Command and Poll (raw)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 0b 00  ..+.KZ.....f`...
+    0010  11 00 54 45 53 54 20 30  20 30 0d 00 00 00 00 00  ..TEST 0 0......
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 18 00  .....f..+.KZ`...
+    0010  13 00 54 45 53 54 20 30  20 30 0d 0a 0d 0a 54 65  ..TEST 0 0....Te
+    0020  73 74 69 6e 67 2e 2e 2e  04 00 02 0c 00 05 00 02  sting...........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00               ....X......
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=22B
+    text: TEST 0 0....Testing...
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+response: 54455354203020300d0a0d0a54657374696e672e2e2e
+text: TEST 0 0....Testing...
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/evidence/test12.log b/dwt/evidence/test12.log
new file mode 100644
index 0000000..e54a427
--- /dev/null
+++ b/dwt/evidence/test12.log
@@ -0,0 +1,168 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0000000000000000)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== raw console data 8B: 544553542031320d ===
+  TX  60B  Console Command and Poll (raw)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 0a 00  ..+.KZ.....f`...
+    0010  11 00 54 45 53 54 20 31  32 0d 00 00 00 00 00 00  ..TEST 12.......
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 17 00  .....f..+.KZ`...
+    0010  13 00 54 45 53 54 20 31  32 0d 0a 0d 0a 54 65 73  ..TEST 12....Tes
+    0020  74 69 6e 67 2e 2e 2e 66  04 00 02 0c 00 05 00 02  ting...f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00               ....X......
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=21B
+    text: TEST 12....Testing...
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+response: 544553542031320d0a0d0a54657374696e672e2e2e
+text: TEST 12....Testing...
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/evidence/wrong-password.log b/dwt/evidence/wrong-password.log
new file mode 100644
index 0000000..5584c0e
--- /dev/null
+++ b/dwt/evidence/wrong-password.log
@@ -0,0 +1,123 @@
+Connecting to 08:00:2b:16:4b:5a on vt1200 (ethertype 0x6002) ...
+  TX  60B  Reserve Console (verification=0102030405060708)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 09 00  ..+.KZ.....f`...
+    0010  0d 01 02 03 04 05 06 07  08 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Request ID
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 04 00  ..+.KZ.....f`...
+    0010  05 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  71B  System ID from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 37 00  .....f..+.KZ`.7.
+    0010  07 00 00 00 01 00 03 03  00 00 02 00 02 e1 00 03  ................
+    0020  00 06 c6 fc cc 16 f5 66  04 00 02 0c 00 05 00 02  .......f........
+    0030  20 00 06 00 02 58 02 07  00 06 08 00 2b 16 4b 5a   ....X......+.KZ
+    0040  64 00 01 72 00 00 00                              d..r...
+  System ID info:
+    functions = 0xe1 (loop, console carrier, data link counters, console reservation)
+    maintenance version: 030000
+    console user: c6fccc16f566
+    reservation timer: 12
+    console command size: 32
+    console response size: 600
+    hardware address: 08002b164b5a
+    communication device: 72
+  Console carrier available -- connected.
+
+=== 'HELP' ===
+  TX  60B  Console Command and Poll: 'HELP'
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 07 00  ..+.KZ.....f`...
+    0010  11 00 48 45 4c 50 0d 00  00 00 00 00 00 00 00 00  ..HELP..........
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX 443B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 ab 01  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73 6f 6c 65 0d   Remote Console.
+    0040  0a 20 20 20 43 6f 6d 6d  61 6e 64 73 20 61 76 61  .   Commands ava
+    0050  69 6c 61 62 6c 65 3a 0d  0a 20 20 20 2d 2d 2d 2d  ilable:..   ----
+    0060  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0070  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0080  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  ----------------
+    0090  2d 2d 2d 2d 0d 0a 20 20  20 49 4e 49 54 20 20 20  ----..   INIT   
+    00a0  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    00b0  20 20 20 49 6e 69 74 69  61 6c 69 7a 65 20 74 68     Initialize th
+    00c0  65 20 73 79 73 74 65 6d  2e 0d 0a 20 20 20 54 45  e system...   TE
+    00d0  53 54 20 3c 70 31 3e 20  5b 3c 70 32 3e 20 3c 70  ST <p1> [<p2> <p
+    00e0  33 3e 5d 20 20 20 20 20  45 78 65 63 75 74 65 20  3>]     Execute 
+    00f0  74 65 73 74 28 73 29 20  70 31 20 74 68 72 6f 75  test(s) p1 throu
+    0100  67 68 20 70 32 2e 0d 0a  20 20 20 20 20 20 20 20  gh p2...        
+    0110  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20                  
+    0120  20 20 20 20 20 4d 6f 64  65 20 62 69 74 73 20 73       Mode bits s
+    0130  70 65 63 69 66 69 65 64  20 62 79 20 70 33 2e 0d  pecified by p3..
+    0140  0a 20 20 20 53 48 4f 57  20 20 20 20 20 20 20 20  .   SHOW        
+    0150  20 20 20 20 20 20 20 20  20 20 20 20 20 20 53 68                Sh
+    0160  6f 77 20 74 68 65 20 73  79 73 74 65 6d 20 63 6f  ow the system co
+    0170  6e 66 69 67 75 72 61 74  69 6f 6e 2e 0d 0a 20 20  nfiguration...  
+    0180  20 48 45 4c 50 20 20 20  20 20 20 20 20 20 20 20   HELP           
+    0190  20 20 20 20 20 20 20 20  20 20 20 54 79 70 65 20             Type 
+    01a0  74 68 69 73 20 68 65 6c  70 20 74 65 78 74 2e 0d  this help text..
+    01b0  0a 0a 0a 0d 44 57 54 3e  3e 3e 20                 ....DWT>>> 
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=425B
+    text: HELP....   DECwindows Terminal Remote Console..   Commands available:..   --------------------------------------------------------..   INIT                      Initialize the system...   TEST <p1> [<p2> <p3>]     Execute test(s) p1 through p2...                             Mode bits specified by p3...   SHOW                      Show the system configuration...   HELP                      Type this help text......DWT>>> 
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 00 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x00 msg=0 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  RX  60B  Console Response and Acknowledge from 08:00:2b:16:4b:5a
+    0000  c6 fc cc 16 f5 66 08 00  2b 16 4b 5a 60 02 02 00  .....f..+.KZ`...
+    0010  13 01 48 45 4c 50 0d 0a  0d 0a 20 20 20 44 45 43  ..HELP....   DEC
+    0020  77 69 6e 64 6f 77 73 20  54 65 72 6d 69 6e 61 6c  windows Terminal
+    0030  20 52 65 6d 6f 74 65 20  43 6f 6e 73               Remote Cons
+    CRA flags=0x01 msg=1 cmd_lost=False resp_lost=False data=0B
+  TX  60B  Release Console
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 01 00  ..+.KZ.....f`...
+    0010  0f 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
+  TX  60B  Console Command and Poll (empty poll)
+    0000  08 00 2b 16 4b 5a c6 fc  cc 16 f5 66 60 02 02 00  ..+.KZ.....f`...
+    0010  11 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
+    0030  00 00 00 00 00 00 00 00  00 00 00 00              ............
diff --git a/dwt/mop_console.py b/dwt/mop_console.py
new file mode 100755
index 0000000..0aaebfa
--- /dev/null
+++ b/dwt/mop_console.py
@@ -0,0 +1,617 @@
+#!/usr/bin/env python3
+"""
+mop_console.py -- minimal DEC MOP Remote Console ("console carrier") client.
+
+Talks the DEC Maintenance Operations Protocol Remote Console protocol
+(Ethernet protocol type 0x6002) directly to a MAC address.  No IP, no
+DECnet stack, no dependencies beyond the Python standard library.
+
+It was written against the VT1200 (DWT remote console) but the framing is
+the generic MOP console carrier, so it should talk to a DECserver too.
+
+Protocol references (see dwt/notes/mop-protocol.md for the full write-up):
+  * DEC MOP Functional Specification v3.0.0 / v4.0.0, section 5.3
+    (Reserve Console 13, Release Console 15, Console Command and Poll 17,
+    Console Response and Acknowledge 19, System ID 7, Request ID 5).
+  * latd's moprc.cc -- a working console requester; establishes the on-wire
+    header: 2-byte little-endian length, then the 1-byte function code.
+  * VSI DECnet-Plus Network Management Guide section 10.2.2.1 -- the
+    8-byte "verification" value in Reserve Console is the MOP service
+    password, default 0000000000000000.
+
+Wire format of a frame (Ethernet II):
+    dst[6] src[6] ethertype=0x6002
+    len_lo len_hi            little-endian: bytes following this field
+    code                     MOP message code
+    body[...]                code-specific
+    0x00 padding             to the 46-byte Ethernet payload minimum
+
+Capability: needs CAP_NET_RAW.  Either run as root (`sudo python3 ...`) or
+grant the interpreter the capability:
+    sudo setcap cap_net_raw+ep "$(readlink -f "$(which python3)")"
+
+Examples:
+    sudo ./mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a HELP
+    sudo ./mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a --script
+    sudo ./mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a --raw 48454c50
+    ./mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a --dry-run --script
+"""
+
+from __future__ import annotations
+
+import argparse
+import binascii
+import fcntl
+import os
+import select
+import socket
+import struct
+import sys
+import time
+
+ETHERTYPE_MOPRC = 0x6002
+ETHERTYPE_MOPDL = 0x6001          # documented for contrast; not used
+MOP_MULTICAST = "ab:00:00:02:00:00"
+BROADCAST = "ff:ff:ff:ff:ff:ff"
+
+# MOP function codes (MOP spec 5.3; latd moprc.h uses the same numbers)
+CODE_REQUEST_ID = 5               # "Request ID"
+CODE_BOOT = 6
+CODE_SYSTEM_ID = 7                # "System ID"
+CODE_REQUEST_COUNTERS = 9
+CODE_COUNTERS = 11
+CODE_RESERVE_CONSOLE = 13
+CODE_RELEASE_CONSOLE = 15
+CODE_CONSOLE_COMMAND_POLL = 17    # host -> terminal, carries console input
+CODE_CONSOLE_RESPONSE = 19        # terminal -> host, carries console output
+
+CODE_NAMES = {
+    CODE_REQUEST_ID: "Request ID",
+    CODE_BOOT: "Boot",
+    CODE_SYSTEM_ID: "System ID",
+    CODE_REQUEST_COUNTERS: "Request Counters",
+    CODE_COUNTERS: "Counters",
+    CODE_RESERVE_CONSOLE: "Reserve Console",
+    CODE_RELEASE_CONSOLE: "Release Console",
+    CODE_CONSOLE_COMMAND_POLL: "Console Command and Poll",
+    CODE_CONSOLE_RESPONSE: "Console Response and Acknowledge",
+}
+
+
+def mac_bytes(text: str) -> bytes:
+    parts = text.replace("-", ":").split(":")
+    if len(parts) != 6:
+        raise argparse.ArgumentTypeError(f"bad MAC address: {text!r}")
+    try:
+        return bytes(int(p, 16) for p in parts)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"bad MAC address: {text!r}")
+
+
+def mac_text(raw: bytes) -> str:
+    return ":".join(f"{b:02x}" for b in raw)
+
+
+def iface_mac(iface: str) -> bytes:
+    """SIOCGIFHWADDR for an interface name, without shelling out."""
+    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        info = fcntl.ioctl(
+            s.fileno(),
+            0x8927,  # SIOCGIFHWADDR
+            struct.pack("256s", iface.encode()[:15]),
+        )
+    finally:
+        s.close()
+    return info[18:24]
+
+
+def printable(data: bytes) -> str:
+    return "".join(chr(b) if 32 <= b < 127 else "." for b in data)
+
+
+def hexdump(data: bytes, prefix: str = "    ") -> str:
+    """Classic 16-byte hex dump with printable gutter."""
+    lines = []
+    for off in range(0, len(data), 16):
+        chunk = data[off:off + 16]
+        hexpart = " ".join(f"{b:02x}" for b in chunk)
+        hexpart = hexpart[:23] + " " + hexpart[23:] if len(chunk) > 8 else hexpart
+        lines.append(f"{prefix}{off:04x}  {hexpart:<48}  {printable(chunk)}")
+    return "\n".join(lines)
+
+
+def encode_message(code: int, body: bytes = b"", pad_to: int = 46) -> bytes:
+    """MOP payload: LE length (code+body), code, body, zero pad."""
+    length = 1 + len(body)
+    payload = struct.pack("<H", length) + bytes([code]) + body
+    if len(payload) < pad_to:
+        payload += b"\x00" * (pad_to - len(payload))
+    return payload
+
+
+def parse_message(payload: bytes) -> tuple[int, int, bytes]:
+    """Return (declared_length, code, body).  body may include padding."""
+    if len(payload) < 3:
+        raise ValueError(f"short MOP payload ({len(payload)} bytes)")
+    length = struct.unpack_from("<H", payload, 0)[0]
+    code = payload[2]
+    # The sender pads to 46 bytes; the length field is authoritative.
+    body = payload[3:min(len(payload), 2 + length)]
+    return length, code, body
+
+
+def ethernet_frame(dst: bytes, src: bytes, payload: bytes,
+                   ethertype: int = ETHERTYPE_MOPRC) -> bytes:
+    return dst + src + struct.pack(">H", ethertype) + payload
+
+
+class MopConsole:
+    def __init__(self, iface: str, dst: bytes, src: bytes | None,
+                 ethertype: int, verification: bytes, verbose: bool = True):
+        self.iface = iface
+        self.dst = dst
+        self.src = src if src is not None else iface_mac(iface)
+        self.ethertype = ethertype
+        self.verification = verification
+        self.verbose = verbose
+        self.sock = None
+        self.seq = 0                 # host command message-number bit
+        self.receipt = 0
+        self.attempts = 0
+        self.sent_log: list[bytes] = []
+        self.recv_log: list[bytes] = []
+
+    # ---- transport -----------------------------------------------------
+    def open(self):
+        try:
+            self.sock = socket.socket(
+                socket.AF_PACKET, socket.SOCK_RAW, socket.htons(self.ethertype)
+            )
+        except PermissionError:
+            sys.exit(
+                "mop_console: permission denied opening an AF_PACKET socket.\n"
+                "  Need root or CAP_NET_RAW, e.g.\n"
+                f"    sudo python3 {sys.argv[0]} ...\n"
+                "  or: sudo setcap cap_net_raw+ep \"$(readlink -f \"$(which python3)\")\""
+            )
+        self.sock.bind((self.iface, 0))
+        self.sock.setblocking(False)
+
+    def close(self):
+        if self.sock:
+            self.sock.close()
+            self.sock = None
+
+    def send_frame(self, code: int, body: bytes = b"", note: str = ""):
+        payload = encode_message(code, body)
+        frame = ethernet_frame(self.dst, self.src, payload, self.ethertype)
+        self.attempts += 1
+        self.sent_log.append(frame)
+        if self.verbose:
+            label = note or CODE_NAMES.get(code, f"code {code}")
+            print(f"  TX {len(frame):3d}B  {label}")
+            print(hexdump(frame))
+        self.sock.send(frame)
+
+    def recv_frames(self, timeout: float):
+        """Yield (frame, code, body) for frames addressed to us."""
+        end = time.monotonic() + timeout
+        while True:
+            remain = end - time.monotonic()
+            if remain <= 0:
+                return
+            r, _, _ = select.select([self.sock], [], [], remain)
+            if not r:
+                return
+            try:
+                frame = self.sock.recv(65535)
+            except BlockingIOError:
+                continue
+            if len(frame) < 14 + 3:
+                continue
+            etype = struct.unpack_from(">H", frame, 12)[0]
+            if etype != self.ethertype:
+                continue
+            src = frame[6:12]
+            dst = frame[0:6]
+            # Ignore our own transmitted frame echoed back by AF_PACKET
+            # (with --dst broadcast the destination check alone would miss it).
+            if src == self.src:
+                continue
+            # Accept unicast to us and broadcast/multicast.
+            if dst != self.src and dst[0] & 1 == 0:
+                continue
+            try:
+                _, code, body = parse_message(frame[14:])
+            except ValueError:
+                continue
+            self.recv_log.append(frame)
+            yield frame, src, code, body
+
+    # ---- protocol ------------------------------------------------------
+    def reserve(self):
+        self.send_frame(CODE_RESERVE_CONSOLE, self.verification,
+                        "Reserve Console (verification=%s)"
+                        % self.verification.hex())
+
+    def request_id(self):
+        body = bytes([0]) + struct.pack("<H", self.receipt)
+        self.send_frame(CODE_REQUEST_ID, body, "Request ID")
+
+    @staticmethod
+    def parse_system_id(body: bytes):
+        if len(body) < 3:
+            return None, {}
+        info = body[3:]
+        entries = {}
+        i = 0
+        while i + 3 <= len(info):
+            itype = info[i] | (info[i + 1] << 8)
+            ilen = info[i + 2]
+            i += 3
+            if i + ilen > len(info):
+                break
+            entries[itype] = info[i:i + ilen]
+            i += ilen
+        functions = entries.get(2, b"\x00")
+        functions = functions[0] if functions else 0
+        return functions, entries
+
+    def connect(self, timeout: float = 20.0, interval: float = 2.0,
+                require_console: bool = True) -> bool:
+        """Reserve + Request ID, wait for System ID.  Mirrors moprc's handshake."""
+        start = time.monotonic()
+        next_send = start
+        got_any = False
+        print(f"Connecting to {mac_text(self.dst)} on {self.iface} "
+              f"(ethertype 0x{self.ethertype:04x}) ...")
+        while time.monotonic() - start < timeout:
+            if time.monotonic() >= next_send:
+                self.reserve()
+                self.request_id()
+                next_send = time.monotonic() + interval
+            for frame, src, code, body in self.recv_frames(0.25):
+                got_any = True
+                print(f"  RX {len(frame):3d}B  {CODE_NAMES.get(code, f'code {code}')}"
+                      f" from {mac_text(src)}")
+                print(hexdump(frame))
+                if code != CODE_SYSTEM_ID:
+                    continue
+                functions, entries = self.parse_system_id(body)
+                self.show_system_id(entries, functions)
+                if functions is None:
+                    continue
+                if require_console and not (functions & 0x20):
+                    print("  System ID says console carrier (function bit 5) "
+                          "is NOT supported.")
+                    return False
+                print("  Console carrier available -- connected.")
+                return True
+        print(f"  no System ID after {timeout:.0f}s, {self.attempts} frames sent.")
+        return False
+
+    @staticmethod
+    def show_system_id(entries: dict, functions: int | None):
+        print("  System ID info:")
+        if functions is not None:
+            names = ["loop", "dump", "primary loader", "multi-block loader",
+                     "boot", "console carrier", "data link counters",
+                     "console reservation"]
+            bits = [n for b, n in enumerate(names) if functions & (1 << b)]
+            print(f"    functions = 0x{functions:02x} ({', '.join(bits) or 'none'})")
+        labels = {1: "maintenance version", 3: "console user",
+                  4: "reservation timer", 5: "console command size",
+                  6: "console response size", 7: "hardware address",
+                  100: "communication device", 200: "software id",
+                  300: "system processor", 400: "data link"}
+        for itype, value in entries.items():
+            if itype in (0, 2):
+                continue
+            label = labels.get(itype, f"info type {itype}")
+            if itype in (4, 5, 6) and len(value) >= 2:
+                print(f"    {label}: {struct.unpack_from('<H', value)[0]}")
+            elif itype in (200,) and value and 0 < value[0] < 32:
+                text = value[1:1 + value[0]].decode("latin-1", "replace")
+                print(f"    {label}: {text!r}")
+            else:
+                print(f"    {label}: {value.hex()}")
+
+    def send_data(self, data: bytes, note: str = ""):
+        """Console Command and Poll.  Control flags: bit0 msg number, bit1 break."""
+        flags = self.seq & 1
+        self.send_frame(CODE_CONSOLE_COMMAND_POLL, bytes([flags]) + data,
+                        note or f"Console Command and Poll ({len(data)} data bytes)")
+        self.seq ^= 1
+
+    def poll(self):
+        self.send_data(b"", "Console Command and Poll (empty poll)")
+
+    def collect(self, quiet: float = 0.8, poll_interval: float = 0.3,
+                max_time: float = 45.0) -> bytes:
+        """Collect one console response.
+
+        The protocol is polled.  The VT1200 answers a poll by re-sending its
+        whole response buffer (and, for an empty response, a CRA whose length
+        field is 2 but whose frame still carries stale buffer bytes).  So the
+        length field is authoritative, and a repeated chunk is either an exact
+        duplicate or a *superset* of the previous chunk -- replace, don't
+        append, in that case.  Polls stop once no new data has appeared for
+        `quiet` seconds.
+        """
+        out = bytearray()
+        last_chunk = b""
+        last_new = 0.0
+        last_poll = -1.0
+        polls = 0
+        start = time.monotonic()
+        while time.monotonic() - start < max_time:
+            now = time.monotonic()
+            if now - last_poll >= poll_interval and polls < 40:
+                self.poll()
+                polls += 1
+                last_poll = now
+            for frame, src, code, body in self.recv_frames(0.1):
+                print(f"  RX {len(frame):3d}B  {CODE_NAMES.get(code, f'code {code}')}"
+                      f" from {mac_text(src)}")
+                print(hexdump(frame))
+                if code == CODE_CONSOLE_RESPONSE:
+                    if len(body) >= 1:
+                        data = body[1:]
+                        flags = body[0]
+                        print(f"    CRA flags=0x{flags:02x} msg={flags & 1} "
+                              f"cmd_lost={bool(flags & 2)} resp_lost={bool(flags & 4)}"
+                              f" data={len(data)}B")
+                        if data:
+                            if data == last_chunk:
+                                print("    (duplicate response chunk -- ignored)")
+                            elif last_chunk and data.startswith(last_chunk):
+                                out = out[:-len(last_chunk)] + data
+                                last_chunk = data
+                                last_new = time.monotonic()
+                                print(f"    text (buffer grew): {printable(data)}")
+                            elif last_chunk and last_chunk.startswith(data):
+                                print("    (shorter stale chunk -- ignored)")
+                            else:
+                                out += data
+                                last_chunk = data
+                                last_new = time.monotonic()
+                                print(f"    text: {printable(data)}")
+                    last_poll = time.monotonic()
+                elif code == CODE_SYSTEM_ID:
+                    functions, entries = self.parse_system_id(body)
+                    self.show_system_id(entries, functions)
+                else:
+                    print(f"    body: {body.hex()}")
+            if last_new and time.monotonic() - last_new >= quiet:
+                break
+            if not last_new and polls >= 4 and time.monotonic() - last_poll > 1.0:
+                break
+        return bytes(out)
+
+    def command(self, line: str, quiet: float = 1.5) -> bytes:
+        print(f"\n=== {line!r} ===")
+        self.send_data(line.encode("latin-1", "replace") + b"\r",
+                       f"Console Command and Poll: {line!r}")
+        return self.collect(quiet=quiet)
+
+    def release(self):
+        self.send_frame(CODE_RELEASE_CONSOLE, b"", "Release Console")
+
+
+def diag(args, client: MopConsole, phase: str, rx: bool):
+    print("\n--- diagnosis -------------------------------------------------")
+    print(f"phase: {phase}")
+    print(f"iface={args.iface} dst={args.mac} src={mac_text(client.src)} "
+          f"ethertype=0x{client.ethertype:04x}")
+    print(f"frames sent: {len(client.sent_log)}, frames received: {len(client.recv_log)}")
+    for i, frame in enumerate(client.sent_log[-4:]):
+        print(f"last TX[{i}]: {frame.hex()}")
+        print(f"  payload (no Ethernet header): {frame[14:].hex()}")
+    if client.recv_log:
+        for i, frame in enumerate(client.recv_log[-4:]):
+            print(f"last RX[{i}]: {frame.hex()}")
+    else:
+        print("last RX: none")
+    print("Hints:")
+    print("  * DWT is part of the OS session manager; it does not exist in the")
+    print("    power-on diagnostics menu.  Boot past level 1 first.")
+    print("  * The MOP service password is the 8-byte Reserve Console verification")
+    print("    value; wrong password = silent ignore (nothing comes back).")
+    print("  * A MOP frame payload is padded to 46 bytes; the 2-byte length field")
+    print("    is authoritative.  Use --dry-run to inspect frames.")
+    print("---------------------------------------------------------------")
+
+
+def parse_verification(text: str) -> bytes:
+    """Accept 0-16 hex digits, '%X...' NCL form, or 0x....  Pads to 8 bytes.
+
+    NCL/DECnet-Plus semantics: leftmost digit pair is the first byte on the
+    wire (lowest address).  NCP integer semantics are handled by --password-int.
+    """
+    t = text.strip()
+    if t.lower().startswith("0x"):
+        t = t[2:]
+    elif t.lower().startswith("%x"):
+        t = t[2:]
+    t = t.replace(":", "").replace("-", "")
+    if len(t) % 2:
+        t = "0" + t
+    raw = bytes.fromhex(t)
+    if len(raw) > 8:
+        raise SystemExit(f"--password: {len(raw)} bytes, maximum is 8")
+    return raw + b"\x00" * (8 - len(raw))
+
+
+def parse_password_int(text: str) -> bytes:
+    """NCP semantics: the password is an integer; byte 0 is the low byte."""
+    value = int(text, 16)
+    return value.to_bytes(8, "little")
+
+
+def build_argparser():
+    p = argparse.ArgumentParser(
+        description="DEC MOP Remote Console (console carrier) client",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=__doc__.split("Examples:")[1] if "Examples:" in __doc__ else None,
+    )
+    p.add_argument("--iface", default="vt1200", help="Ethernet interface (default vt1200)")
+    p.add_argument("--mac", default="08:00:2b:16:4b:5a",
+                   help="terminal MAC (default 08:00:2b:16:4b:5a)")
+    p.add_argument("--src-mac", default=None,
+                   help="source MAC (default: the interface's own MAC)")
+    p.add_argument("--ethertype", default="0x6002",
+                   help="MOP protocol type (default 0x6002; 0x6001 is Dump/Load)")
+    p.add_argument("--dst", default=None,
+                   help=f"override destination MAC, e.g. {BROADCAST} or {MOP_MULTICAST}")
+    p.add_argument("--password", default=None,
+                   help="8-byte Reserve Console verification value, hex "
+                        "(NCL/DECnet-Plus byte order; default 0000000000000000)")
+    p.add_argument("--password-int", default=None,
+                   help="service password as an NCP-style integer (low byte first)")
+    p.add_argument("--connect-timeout", type=float, default=20.0,
+                   help="seconds to wait for System ID (default 20)")
+    p.add_argument("--retry-interval", type=float, default=2.0,
+                   help="seconds between Reserve/RequestID retries (default 2)")
+    p.add_argument("--quiet", type=float, default=1.5,
+                   help="stop collecting after this many quiet seconds (default 1.5)")
+    p.add_argument("--no-release", action="store_true",
+                   help="do not send Release Console at the end")
+    p.add_argument("--dry-run", action="store_true",
+                   help="print the frames that would be sent; no socket")
+    p.add_argument("--script", nargs="?", const="HELP,SHOW,TEST 0 0",
+                   default=None, metavar="CMDS",
+                   help="run comma-separated commands (default HELP,SHOW,TEST 0 0)")
+    p.add_argument("--raw", default=None, metavar="HEX",
+                   help="send arbitrary console data bytes (inside Console "
+                        "Command and Poll)")
+    p.add_argument("--raw-frame", default=None, metavar="HEX",
+                   help="send a complete MOP payload (length field + code + body)")
+    p.add_argument("--no-connect", action="store_true",
+                   help="skip Reserve/Request ID (send data immediately)")
+    p.add_argument("cmd", nargs="*", help="command line to send, e.g. HELP")
+    return p
+
+
+def dry_run(args, dst: bytes, src: bytes, verification: bytes, ethertype: int):
+    print(f"dry run: iface={args.iface} src={mac_text(src)} dst={mac_text(dst)} "
+          f"ethertype=0x{ethertype:04x}")
+    cmds = []
+    if args.script is not None:
+        cmds = [c.strip() for c in args.script.split(",") if c.strip()]
+    elif args.raw_frame:
+        pass
+    elif args.raw:
+        cmds = [None]
+    elif args.cmd:
+        cmds = [" ".join(args.cmd)]
+    else:
+        cmds = ["HELP"]
+
+    def show(label, code, body):
+        payload = encode_message(code, body)
+        frame = ethernet_frame(dst, src, payload, ethertype)
+        print(f"\n{label}")
+        print(f"  payload ({len(payload)}B, padded to 46): {payload.hex()}")
+        print(hexdump(frame, prefix="  "))
+
+    if not args.no_connect:
+        show("Reserve Console (code 13) -- verification = MOP service password",
+             CODE_RESERVE_CONSOLE, verification)
+        show("Request ID (code 5) -- reserved=00 receipt=0000",
+             CODE_REQUEST_ID, b"\x00\x00\x00")
+    if args.raw_frame:
+        raw = bytes.fromhex(args.raw_frame.replace(" ", ""))
+        frame = ethernet_frame(dst, src, raw, ethertype)
+        print("\nraw MOP payload as given")
+        print(f"  payload: {raw.hex()}")
+        print(hexdump(frame, prefix="  "))
+    else:
+        for i, c in enumerate(cmds):
+            data = (b"" if c is None else c.encode() + b"\r")
+            if c is None:
+                data = bytes.fromhex(args.raw.replace(" ", ""))
+            show(f"Console Command and Poll (code 17), msg={i & 1}, data={data!r}",
+                 CODE_CONSOLE_COMMAND_POLL, bytes([i & 1]) + data)
+    print("\nDry run: nothing sent.  Remove --dry-run (and run with CAP_NET_RAW).")
+
+
+def main(argv=None):
+    args = build_argparser().parse_args(argv)
+    dst = mac_bytes(args.dst or args.mac)
+    src = mac_bytes(args.src_mac) if args.src_mac else iface_mac(args.iface)
+    ethertype = int(args.ethertype, 0)
+
+    if args.password and args.password_int:
+        raise SystemExit("use either --password or --password-int, not both")
+    if args.password_int:
+        verification = parse_password_int(args.password_int)
+    elif args.password:
+        verification = parse_verification(args.password)
+    else:
+        verification = b"\x00" * 8
+
+    if args.dry_run:
+        dry_run(args, dst, src, verification, ethertype)
+        return 0
+
+    client = MopConsole(args.iface, dst, src, ethertype, verification)
+    client.open()
+    ok = True
+    try:
+        if not args.no_connect:
+            ok = client.connect(args.connect_timeout, args.retry_interval)
+            if not ok:
+                diag(args, client, "connect (no System ID)", False)
+                return 2
+
+        if args.raw_frame:
+            raw = bytes.fromhex(args.raw_frame.replace(" ", ""))
+            frame = ethernet_frame(dst, client.src, raw, ethertype)
+            client.sent_log.append(frame)
+            print(f"\n=== raw MOP payload {raw.hex()} ===")
+            print(hexdump(frame))
+            client.sock.send(frame)
+            out = client.collect(quiet=args.quiet, max_time=10.0)
+            if out:
+                print(f"response text: {printable(out)}")
+            else:
+                print("no console response data")
+                diag(args, client, "raw-frame", False)
+        elif args.script is not None:
+            cmds = [c.strip() for c in args.script.split(",") if c.strip()]
+            for c in cmds:
+                out = client.command(c, quiet=args.quiet)
+                print(f"--- {c}: {len(out)} bytes of console output ---")
+                if not out:
+                    print("  (no response data)")
+            print("\nScript complete.")
+        elif args.raw:
+            data = bytes.fromhex(args.raw.replace(" ", ""))
+            print(f"\n=== raw console data {len(data)}B: {data.hex()} ===")
+            client.send_data(data, "Console Command and Poll (raw)")
+            out = client.collect(quiet=args.quiet, max_time=10.0)
+            print(f"response: {out.hex()}")
+            if out:
+                print(f"text: {printable(out)}")
+            else:
+                print("no console response data")
+                diag(args, client, "raw", False)
+        else:
+            line = " ".join(args.cmd) if args.cmd else "HELP"
+            out = client.command(line, quiet=args.quiet)
+            if not out:
+                diag(args, client, f"command {line!r}", False)
+                ok = False
+    finally:
+        if ok and not args.no_release:
+            # No poll after Release: the terminal treats it as a new request
+            # and re-sends its (now stale) response buffer.
+            client.release()
+            time.sleep(0.2)
+        client.close()
+    return 0 if ok else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md
index 9e3941b..f455b82 100644
--- a/dwt/notes/CROSS.md
+++ b/dwt/notes/CROSS.md
@@ -87,3 +87,41 @@ Facts that change the transport assumption (details + quotes in
    path: a 4-entry text-command table at RAM bit `0xA5C20` (byte `0x14B84`),
    parsed by `0x07E59186(char*, int)` from the console character ring at bit
    `0xF4D10`. There are exactly four names; no undocumented fifth entry.
+
+## 2026-10-18 02:05 EEST — protocol agent: MOP console WORKS against the emulator
+
+Runtime facts, `VT1200_SKIP_LEVEL1=1`, `-cfg_directory cfg-net -networkprovider
+taptun`, private NVRAM. Capture `dwt/evidence/mop-hello.pcap`, log
+`dwt/evidence/hello.log`.
+
+* `Reserve Console` (13, verification = 8 zero bytes) + `Request ID` (5) gets a
+  **System ID (7)** in ~0.5 ms. Decode of the VT1200 reply:
+  maintenance 3.0.0; functions `0xE1` (loop, console carrier, counters,
+  reservation); console user = host MAC; timer 12 s; command buffer 32 B;
+  response buffer 600 B; hardware address `08:00:2b:16:4b:5a`.
+* `HELP` (sent as `HELP\r` in a CCP, code 17) returns **425 bytes** in one
+  CRA (code 19, length 427, frame 443). `SHOW` returns **509 bytes** (frame
+  527). Full text in `dwt/evidence/dwt-help.txt` and
+  `dwt/evidence/dwt-show.txt`.
+* **No challenge/password on this path.** Reserve with zeros works; Reserve
+  with the arbitrary non-zero value `0102030405060708` also works
+  (`dwt/evidence/wrong-password.log`). The `dwt_prf` challenge is the **TCP
+  debug listener** per `rdebug-static.md` §6, not MOP.
+* **DWT is OS-only.** Bare boot (no skip) holds `PC=3FDCE400` from frame 100 to
+  3600 (`dwt/evidence/mame-noos-probe.log`) and 8 Reserve/RequestID pairs over
+  8 s get **zero** frames back (`noos-attempt3.log`, `mop-noos.pcap`).
+* `TEST 0 0` and `TEST 12` are accepted and print `…Testing...`, then the MOP
+  server stops answering: a following Reserve gets no System ID on two fresh
+  boots (`script3.log`, `test00b.log`, `test12.log`, `help-after-test*.log`).
+  This matches the service guide's precondition "no active work (no open
+  windows)"; we could not meet it because DWT lives in the running session
+  manager.
+* `INIT` gets **no reply** and the terminal stops answering MOP for >90 s
+  (`init.log`, `help-after-init2.log`) — consistent with a reset/reboot.
+
+**Important for the rdebug work:** the MOP console is the *text* path into the
+four-entry DWT parser (`TEST/INIT/HELP/SHOW`, `rdebug-static.md` §9). It is
+**not** the rdebug binary-opcode path. `--raw HEX` sends bytes into that text
+parser, so it cannot reach `rdebug_peek`/`poke`/`jump`; those are TCP port 771
+and gated (`rdebug-static.md` §1/§7). Use this client for the documented
+console, not as an rdebug transport.
diff --git a/dwt/notes/mop-protocol.md b/dwt/notes/mop-protocol.md
new file mode 100644
index 0000000..2261afa
--- /dev/null
+++ b/dwt/notes/mop-protocol.md
@@ -0,0 +1,423 @@
+# DEC MOP Remote Console (console carrier) — protocol notes and VT1200 DWT results
+
+Status: **the protocol works against the MAME VT1200**. `HELP` and `SHOW` were
+answered by the firmware; `TEST` and `INIT` were accepted but do not return a
+usable console reply (details in §6). The client is `dwt/mop_console.py`.
+
+Everything below is either read from a cited source or was observed on the
+emulator. Where the two disagree, the observation is called out as such.
+
+---
+
+## 1. Sources
+
+| source | what it establishes |
+|---|---|
+| DEC, *DECnet Digital Network Architecture — Maintenance Operations Protocol Functional Specification*, **v3.0.0**, Dec 1983, order AA-X436A-TK. PDF: <http://decnet.ipv7.net/docs/dundas/aa-x436a-tk.pdf> (text extracted locally with `pdftotext -layout`) | MOP message codes and bodies, §5.3 “Remote Console” pp. 79–87; Ethernet protocol types and multicast addresses, Appendix B.3 pp. B-1/B-2 |
+| DEC, *MOP Functional Specification*, **v4.0.0**, Jun 1992, EK-DNA11-FS-001. PDF: <https://bitsavers.org/pdf/dec/decnet/EK-DNA11-FS-001_MOP_Functional_Specification_V4.0.0_Jun92.pdf> | later revision of the same protocol (linked from the revision table at <https://gunkies.org/wiki/Maintenance_Operations_Protocol>) |
+| Mats O Jansson, `mopd` 2.5.3, `common/mopdef.h` and `common/rc.c`: <https://sources.debian.org/src/mopd/1:2.5.3-21/common/mopdef.h/> | independent constants: `MOP_K_PROTO_RC 0x6002`; codes 5/7/9/11/13/15/17/19; multicast `ab:00:00:02:00:00` |
+| Christine Caulfield, `latd`'s `moprc.cc` / `moprc.h`: <https://github.com/cguldenschuh/latd/blob/main/moprc.cc> | a working console **requester**: the on-wire header (2-byte little-endian length, then code), the Reserve + Request ID handshake, the System ID function-bit check, CCP/CRA flag handling, Release |
+| libpcap `ethertype.h`: <https://github.com/the-tcpdump-group/libpcap/blob/master/ethertype.h> | all four ethertypes: `MOPDL 0x6001`, `MOPRC 0x6002`, `DN 0x6003`, `LAT 0x6004` |
+| VSI, *DECnet-Plus for OpenVMS Network Management Guide*, §10.2.2.1 and Appendix F: <https://docs.vmssoftware.com/vsi-decnet-plus-network-management-guide/> | the 8-byte Reserve-Console **verification** value is the MOP service password; byte order for NCL vs NCP; `ccr` is the DECnet-Plus console client |
+| `docs/EK-V1000-SV-002_service-guide.txt` §2.2 (this repo) | the VT1200 side: NCP `CONNECT VIA <circuit> PHYSICAL ADDRESS <MAC>`, `DWT>>>` prompt, `INIT`/`SHOW`/`TEST`/`HELP`, `TEST` parameters and P3 mode bits |
+
+Ethertypes were **not** taken on trust:
+
+* `0x6001` MOP Dump/Load — libpcap; also `60-01` in MOP §B.3.
+* `0x6002` MOP Remote Console — libpcap, `mopdef.h`, MOP §B.3 (“60-02 Remote Console”), and observed on the wire.
+* `0x6003` DECnet (DNA Routing) — libpcap; the MOP spec does not claim it.
+* `0x6004` LAT — libpcap.
+
+Only `0x6002` is used here.
+
+---
+
+## 2. Frame layout
+
+Ethernet II, protocol type **0x6002**, destination = the terminal’s unicast MAC
+(or the protocol’s multicast `ab:00:00:02:00:00`; the VT1200 answers unicast,
+which is all we needed):
+
+```
+offset  size  field
+0       6     destination MAC
+6       6     source MAC
+12      2     ethertype 0x6002 (big-endian on the wire)
+14      2     MOP length, little-endian
+16      1     MOP function code
+17      ...   code-specific body
+ end    ...   zero padding to a 46-byte Ethernet payload minimum
+```
+
+The **length counts the bytes after the length field** (code + body), and
+excludes the length itself and any padding. `moprc.cc` builds every message
+that way (`buf[0] = len+2; buf[1] = 0; buf[2] = code; …`) and the VT1200 does
+the same: a `SHOW` reply is a 527-byte frame with length `0x01FF` = 511 =
+1 code + 1 flags + 509 data.
+
+**The length field is authoritative, not the frame size.** This is not
+theoretical: when polled for a second response the VT1200 emits a 60-byte frame
+whose length field is `2` but whose bytes after the CRA flags are **stale text
+from the previous response buffer** (observed: `SHOW` leftovers after the
+`TEST` reply). A client that trusts the frame size will print garbage.
+`dwt/evidence/mop-script3.pcap` contains both cases.
+
+There is **no version byte, no session id and no checksum** on this path. The
+MOP spec’s Remote Console messages are additions to MOP 2.1 (§5.3); the fields
+above are the whole header.
+
+### Function codes used
+
+From MOP §5.3 and `mopdef.h`:
+
+| code | message | body |
+|---|---|---|
+| 5 | Request ID | reserved (1, = 0) + receipt number (2, LE) |
+| 6 | Boot | verification + processor/control/software id (not used) |
+| 7 | System ID | reserved (1, = 0) + receipt (2, LE) + TLVs |
+| 9 | Request Counters | receipt (2) |
+| 11 | Counters | receipt (2) + counter block |
+| **13** | **Reserve Console** | **verification (8)** — the MOP service password |
+| **15** | **Release Console** | empty |
+| **17** | **Console Command and Poll** | control flags (1) + console data (*) |
+| **19** | **Console Response and Acknowledge** | control flags (1) + console data (*) |
+
+Codes 16 and 18 are explicitly reserved by MOP §5.
+
+### System ID TLVs
+
+Body after the reserved byte and receipt is a sequence of
+`type (2, LE) | length (1) | value (length)` entries. The VT1200’s reply
+(`dwt/evidence/mop-hello.pcap`) decodes as:
+
+```
+37 00                 length = 55
+07                    code = System ID
+00                    reserved
+00 00                 receipt
+01 00 03 03 00 00     maintenance version 3.0.0
+02 00 02 e1 00        functions = 0x00E1
+03 00 06 c6 fc cc 16 f5 66   console user = host MAC
+04 00 02 0c 00        reservation timer = 12 s
+05 00 02 20 00        console command buffer = 32 bytes
+06 00 02 58 02        console response buffer = 600 bytes
+07 00 06 08 00 2b 16 4b 5a   hardware address
+64 00 01 72           communication device = 0x72
+00 00 00              padding (parsed as an empty type-0 entry)
+```
+
+Function bitmap (**type 2, bit 5** = console carrier, 0x20):
+
+```
+bit 0 loop, 1 dump, 2 primary loader, 3 multi-block loader, 4 boot,
+bit 5 console carrier, 6 data link counters, 7 console reservation
+```
+
+`0xE1` therefore means loop + console carrier + counters + reservation.
+`moprc` refuses to proceed unless `functions & 0x20` (and prints “target does
+not support remote console” otherwise).
+
+---
+
+## 3. Session and sequence handling
+
+`moprc`’s sequence is the reference implementation and was followed exactly:
+
+1. **Reserve Console (13)** with an 8-byte verification value.
+2. **Request ID (5)** with reserved `0` and a 2-byte receipt number.
+3. Wait for **System ID (7)**. This is the “connected” condition; check
+   function bit 5.
+4. **Console Command and Poll (17)** carries console input. The control-flags
+   byte has:
+   * bit 0 — **message number**, a one-bit sequence number toggled for each
+     command;
+   * bit 1 — **break**, prepend a serial break to the command data.
+5. **Console Response and Acknowledge (19)** carries console output. Its flags:
+   * bit 0 — message number being acknowledged;
+   * bit 1 — command data lost (resend);
+   * bit 2 — response data lost (overrun).
+6. **Release Console (15)** with no body.
+
+There is no connection id beyond the 48-bit MAC pair, and no per-message
+acknowledgement other than the poll/response alternation. The protocol is
+half-duplex and polled: the terminal buffers console output and sends it in a
+CRA when it is polled. **Do not keep polling after data arrives** unless you
+want the response repeated — the VT1200 re-sends its whole response buffer on
+every poll, and an empty response is a CRA with length 2 whose frame may still
+carry stale bytes (§2). `mop_console.py` polls only until the first data, then
+drains, treating an exact repeat as a duplicate and a superset as a buffer
+that grew.
+
+Data is a raw byte stream. A command line is the ASCII text plus `\r` (the
+DWT parser and the real terminal use CR; `moprc` translates LF to CR). The
+terminal echoes the input and answers with CRLF text and the `DWT>>> ` prompt.
+
+---
+
+## 4. Password / verification
+
+`Reserve Console`’s 8-byte VERIFICATION is the **MOP service password**
+(MOP §5.3.6: “a verification code that must match before the receiving system
+can honor the request”). VSI §10.2.2.1 says a server that requires a password
+**ignores the request** if it is wrong — there is no negative reply, so the
+symptom is exactly “Target does not respond”. The default is
+`%X0000000000000000`.
+
+Byte order (VSI §10.2.2.1):
+
+* **NCL / DECnet-Plus**: the value is an octet string; the **leftmost** hex
+  pair is the first byte on the wire.
+* **NCP (Phase IV)**: the value is an unsigned integer; the **rightmost**
+  digits are the low byte, so bytes go out reversed. NCP `123456789ABCD`
+  becomes NCL `%XCDAB896745230100`, transmitted `CD AB 89 67 45 23 01 00`.
+
+The client supports both: `--password HEX` (NCL order, zero-padded to 8) and
+`--password-int HEX` (NCP integer order, little-endian).
+
+**The VT1200 did not challenge us.** Reserve with eight zero bytes works, and
+Reserve with the arbitrary non-zero value `0102030405060708` also works
+(`dwt/evidence/wrong-password.log`): the firmware accepted the reservation and
+answered `HELP`. So in this configuration the verification field is not
+validated (or no password is configured). There is no challenge/response
+handshake on the MOP path.
+
+The ROM string `dwt_prf: challenge failed - size error (expecting %d, got %d)`
+is **not** this path. Per `dwt/notes/rdebug-static.md` §6, `dwt_prf`
+(`0x07EB3FB8`) is the 16-byte challenge of the **TCP remote-debug listener**
+(`DEBUG TCP Port`, 771), and that listener is separately gated closed by the
+configuration word at bit `0xAECD2`. MOP never calls it.
+
+---
+
+## 5. What the emulator actually replied
+
+Setup: `VT1200_SKIP_LEVEL1=1`, `-cfg_directory cfg-net -networkprovider taptun`,
+private NVRAM, OS booted to the Terminal Manager. Capture:
+`dwt/evidence/mop-hello.pcap` (tcpdump filter `ether proto 0x6002`), log:
+`dwt/evidence/hello.log`.
+
+Sequence (timestamps from the pcap):
+
+```
+19.715674  host -> terminal  Reserve Console   payload 0900 0d00 0000000000000000
+19.715796  host -> terminal  Request ID        payload 0400 0500 0000
+19.716371  term -> host      System ID         71-byte frame, length 0x37
+19.716620  host -> terminal  CCP "HELP\r"       payload 0700 1100 48454c500d
+19.716674  host -> terminal  CCP poll (flags 1)
+19.719929  term -> host      CRA               443-byte frame, length 0x01AB = 427
+19.720308  term -> host      CRA (empty ack, stale bytes, length 2)
+...
+20.822062  term -> host      CRA SHOW          527-byte frame, length 0x01FF = 511
+```
+
+The first CRA data is the whole 425-byte HELP response in **one frame**:
+
+```
+ab01 1300 48454c50 0d0a 0d0a
+   2020 2044 4543 7769 6e64 6f77 7320 5465 726d 696e 616c ...
+...
+   0d0a 0a0a 0d44 5754 3e3e 3e20
+```
+
+i.e. `HELP\r\n\r\n   DECwindows Terminal Remote Console\r\n…DWT>>> `.
+`SHOW` is 509 bytes (`dwt/evidence/dwt-show.txt`):
+
+```
+SHOW
+
+   DECwindows Terminal System Configuration
+
+   Configuration Parameter   Parameter Value
+   --------------------------------------------------------
+   Firmware Revision         V2.2
+   Option Memory             Present
+                                SIMM 1 installed
+                                SIMM 2 installed
+                                SIMM 3 installed
+   Image Option              Present
+   Display Type              Monochrome
+   Monitor Type              VR150
+
+DWT>>>
+```
+
+`HELP` (`dwt/evidence/dwt-help.txt`) lists exactly the four documented
+commands and their syntax; it matches the ROM strings and the static analysis
+(`rdebug-static.md` §9).
+
+---
+
+## 6. `TEST` and `INIT`
+
+The service guide says remote diagnostics requires a reset and **no active work
+(no open windows)**. DWT lives inside the running session manager, so with the
+Terminal Manager open we could not give it that state. The observed behaviour
+is consistent with that precondition, but note what is and is not established:
+
+**`TEST 0 0` and `TEST 12`** (two different tests, two fresh boots, private
+NVRAM): the terminal accepts the line and replies
+
+```
+TEST 0 0
+
+Testing...
+```
+
+(22 bytes, CRA length 24; `dwt/evidence/test00b.log`, `test12.log`), and then
+**no further console output is produced**, even with continued polling for
+10 s. Worse, the MOP server then stops answering: a following `Reserve` gets
+no System ID (`help-after-test.log`, `help-after-test12.log`). We tried a
+longer wait (test 0: more than a minute after the command) with the same
+result. So the documented `TEST` is reachable and parses, but does not return
+the `OK` / `DWT>>>` the service guide shows in this OS-up configuration. We
+cannot distinguish “test is running and has taken over the machine” from “the
+session manager was stopped by the test” from the console alone. This is an
+honest gap, not a protocol failure: the frame carrying `Testing...` has correct
+length, code and flags.
+
+**`INIT`**: accepted, **no reply at all**, and the terminal stops answering
+MOP for >90 s afterwards (`dwt/evidence/init.log`, `help-after-init2.log`);
+consistent with a reset/reboot. Do not run this against the real terminal.
+
+**Why not run `TEST` in the pre-OS menu?** DWT does not exist there — see §7.
+
+---
+
+## 7. Does DWT answer before the OS boots? No.
+
+Two configurations were tested.
+
+**OS-up** (`VT1200_SKIP_LEVEL1=1`, `-cfg_directory cfg-net`, private NVRAM):
+System ID in 0.5 ms, HELP/SHOW as above.
+
+**Bare boot** (no `VT1200_SKIP_LEVEL1`), which is the repo’s level-0
+diagnostics-menu baseline `PC=3FDCE400` (`harness/mame/README.md`). A Lua probe
+printed the PC and a client sent Reserve/RequestID at the same time:
+
+```
+PC_PROBE frame=100  PC=3FDCE400
+PC_PROBE frame=200  PC=3FDCE400
+PC_PROBE frame=400  PC=3FDCE400
+PC_PROBE frame=600  PC=3FDCE400
+PC_PROBE frame=1200 PC=3FDCE400
+PC_PROBE frame=2400 PC=3FDCE400
+PC_PROBE frame=3600 PC=3FDCE400
+```
+
+while **8 Reserve/RequestID pairs over 8 s got zero frames back**
+(`dwt/evidence/noos-attempt3.log`, `mop-noos.pcap`, `mame-noos-probe.log`).
+Earlier without the probe, two 8 s attempts (16 pairs) were also silent
+(`noos-attempt1.log`, `noos-attempt2.log`).
+
+So the DWT console is part of the booted OS/session manager, not the power-on
+diagnostics code. That matches the ROM string
+`Session Manager : Cannot create MOP-Server` and the static analysis showing
+the TEXT parser and the four-command table live in the OS image.
+
+Caveat: the OS-up runs use `VT1200_SKIP_LEVEL1=1`, a **deliberate harness
+divergence** (modelled board input; the real machine reads IP3 low). These
+results are evidence about the OS/DWT path, not about the real terminal’s POST.
+
+---
+
+## 8. Client
+
+`dwt/mop_console.py`, stdlib only (`socket.AF_PACKET`, `select`, `struct`,
+`fcntl`). No scapy.
+
+* `--iface` (default `vt1200`), `--mac` (default `08:00:2b:16:4b:5a`),
+  `--src-mac` (default: the interface MAC).
+* `connect` = Reserve + Request ID; prints the System ID decode; requires
+  function bit 5.
+* one command: `… HELP` or `… --raw HEX`.
+* `--script [CMDS]` defaults to `HELP,SHOW,TEST 0 0`; `--script HELP,SHOW`
+  runs a subset. Every TX/RX frame is hexdumped and decoded.
+* `--raw HEX` sends arbitrary **console data** inside a CCP. `--raw-frame HEX`
+  sends a complete MOP payload (length + code + body) for protocol experiments.
+* `--password HEX` / `--password-int HEX`, `--ethertype` (default 0x6002),
+  `--dst` (unicast/broadcast/multicast override), `--no-connect`,
+  `--no-release`, `--quiet`, `--connect-timeout`, `--dry-run`.
+* Timeout diagnosis prints the phase, the last frames sent (full hex and
+  payload-only hex), whether anything was received, and the common causes
+  (wrong password = silent ignore; pre-OS menu; wrong ethertype).
+* `--dry-run` needs no socket and prints the exact frames.
+
+**Privileges:** `AF_PACKET` send needs `CAP_NET_RAW`. Run with `sudo`, or grant
+the interpreter the capability once:
+
+```sh
+sudo setcap cap_net_raw+ep "$(readlink -f "$(which python3)")"
+```
+
+`tcpdump` on this host works for user `arti` via the `wireshark` group; the
+client itself does not.
+
+### Reproduce
+
+```sh
+# once per boot of the host
+./harness/net-setup.sh
+
+# terminal: OS-up headless run (private NVRAM, ~20 s wall to the Terminal Manager)
+cd harness/mame
+VT1200_SKIP_LEVEL1=1 /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+  -rompath roms -sound none -skip_gameinfo -lightgun -lightgun_device mouse \
+  -cfg_directory cfg-net -networkprovider taptun \
+  -video none -nothrottle -seconds_to_run 600 \
+  -nvram_directory /home/arti/code/k-space/vt1200/.vt1200-scratch/dwt-nv
+
+# capture (second shell)
+sudo tcpdump -i vt1200 -U -w dwt/evidence/mop-hello.pcap 'ether proto 0x6002'
+
+# client (third shell, after the Terminal Manager is up)
+sudo python3 dwt/mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a \
+  --script HELP,SHOW
+```
+
+Expected: 425 bytes for HELP, 509 for SHOW, each in one CRA frame.
+
+For the pre-OS check, drop `VT1200_SKIP_LEVEL1=1` (and add
+`-debug -debugger none -autoboot_script dwt/evidence/pc_probe.lua` if you want
+the `PC=3FDCE400` confirmation). For `TEST`/`INIT`:
+
+```sh
+sudo python3 dwt/mop_console.py --iface vt1200 --mac 08:00:2b:16:4b:5a \
+  --quiet 10 --raw "$(printf 'TEST 0 0\r' | xxd -p | tr -d '\n')"
+```
+
+`--dry-run` version of the whole script (no privileges):
+
+```sh
+python3 dwt/mop_console.py --dry-run --script HELP,SHOW
+```
+
+---
+
+## 9. What changed between attempts
+
+* The first attempt used the `moprc` framing verbatim and worked on the first
+  OS-up try; no ethertype or addressing fallback was needed. (`0x6001` is
+  Dump/Load and was not tried because `0x6002` answered.)
+* The first collector polled continuously. The VT1200 answers every poll by
+  re-sending its buffer, so the first HELP capture had **1235 frames** for one
+  HELP (not kept; the behaviour is visible in the duplicate 60-byte CRAs in
+  `mop-script3.pcap`). The client now stops polling once data has arrived, and
+  treats a repeated chunk as a duplicate and a superset as a grown buffer. The
+  clean run is `mop-hello.pcap` — 135 packets because the terminal emits an
+  empty CRA for every poll, but only three carry data (`System ID`, HELP, SHOW).
+* A 0.8–1.0 s quiet window cut `TEST` off after `Testing...`; extending it to
+  10 s and then polling for over a minute confirmed there is no further data,
+  so the `TEST` result is not a client timeout.
+* The “no DWT before OS” claim was first one silent attempt (not enough), then
+  repeated 16 silent handshakes, then tied to `PC=3FDCE400` with a frame probe.
+
+## 10. Open points
+
+* Whether `TEST` would complete if the terminal were reset with no active
+  windows (the service guide’s precondition). DWT lives in the session
+  manager, so “no session manager” and “DWT reachable” appear mutually
+  exclusive in this firmware; a real terminal may behave differently.
+* Whether the VT1200 has a non-empty maintenance password setting in NVR that
+  would make the 8-byte verification meaningful. Our fresh private NVR is
+  all-zero and the firmware ignored even a wrong non-zero value.
+* `dwt_prf` / TCP port 771 is the other agent’s path, not this one.