arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-30 12:03:54 +02:00
Code Wiki Activity

dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs

Browse Source 
Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients
(SERVER, SESSIONMGR/Terminal Manager, WM, VTE).  Internal clients use the
local service "xserver" via the display string "0::0"; TCP 6000 is a
separate authorised listener.  Function table and the 4-call hello-window
sequence are in dwt/notes/GUI_APPS.md.

Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then
called XOpenDisplay; it never returns (stage 2, display 0, X-server client
watermark unchanged) and the rdebug service dies.  Verdict: hard for a
self-contained window; shared-RAM UI mutation (opcode 8) is the working
route.
This commit is contained in:
SDD committed 2026-10-18 14:08:42 +03:00
1 parent c0f142300b
commit a5769d3d2e
16 files changed
+1765
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

dwt/gui/README.md
+60
View File
@@ -0,0 +1,60 @@
# dwt/gui — X window feasibility payload
Investigation of the VT1200 GUI architecture and whether an rdebug payload can
create its own window. Read `dwt/notes/GUI_APPS.md` first; this directory is the
reproducible part.
| file | what it is |
|---|---|
| `xhello.asm` | payload: ABI check (`strlen("0::0")==4`) then `XOpenDisplay`, root lookup, `XCreateSimpleWindow`, `XMapWindow`, `XSync` |
| `build.sh` | TI SDK (GSPA/GSPLNK under DOSBox) wrapper; writes `build/`, scratch in `work/` |
| `probe.lua` | frame snapshots + marker/PC telemetry (250-frame interval) |
| `probe2.lua` | same, 25-frame interval, also reads the X server client watermark |
| `probe3.lua` | breakpoint on the X server accept entry + telemetry |
| `build/xhello.bin` | assembled payload, linked at bit `0x01840000` |
| `run/mame.log` | last live run: `strlen=4`, `stage=2`, `display=0`, watermark `1` |
| `run/gui_frame*.png` | post-injection frames (normal Terminal Manager, no new window) |
## Build
```sh
./dwt/gui/build.sh dwt/gui/xhello.asm 01840000
```
## Run
The payload needs the OS, i.e. `VT1200_SKIP_LEVEL1=1` (documented divergence),
a BOOTP/TFTP server and the LANCE attached. MAME's network device is enabled by
the **cfg file**, not the command line — without
`<network><device tag=":lance" interface="0" .../></network>` in
`vt1200.cfg` the taptun provider is never opened (the tap stays `NO-CARRIER`).
```sh
RUN=$PWD/dwt/gui/run
mkdir -p $RUN/cfg $RUN/nvram
cp dwt/evidence/live-run2/cfg/vt1200.cfg $RUN/cfg/vt1200.cfg
sudo python3 -u harness/serve.py 192.168.99.1 --bootp \
--bootp-iface tap-mess-1000-0 &
VT1200_SKIP_LEVEL1=1 MSG_TRIGGER=$RUN/trigger MSG_DIR=$RUN \
/home/arti/code/k-space/mame0289/vt1200 vt1200 \
-rompath harness/mame/roms -sound none -skip_gameinfo \
-networkprovider taptun -video none -nothrottle \
-cfg_directory $RUN/cfg -nvram_directory $RUN/nvram \
-debug -debugger none -autoboot_script $PWD/dwt/gui/probe2.lua \
-autoboot_delay 0
# once port 771 answers:
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01840000 --file dwt/gui/build/xhello.bin \
--jump 0x01840000 --jump-wait 20
```
Markers are 32-bit cells at bit `0x01850100` (display), `0x01850110` (root),
`0x01850120` (window), `0x01850130` (sync), `0x01850140` (stage),
`0x01850160` (strlen).
The observed result is a **hang at stage 2** (`display=0`): `XOpenDisplay`
blocks in Xlib's select wrapper and the X server's client watermark never moves.
See the note for the verdict and the decisive next experiment.
dwt/gui/build.sh
Executable
+75
View File
@@ -0,0 +1,75 @@
#!/bin/sh
# Build a VT1200 payload with the 1987 TI TMS34010 SDK (GSPA/GSPLNK under
# DOSBox) -- the same flow as harness/hello-world/build.sh and
# dwt/visual/build.sh, but with all scratch/output under dwt/gui/.
#
# dwt/gui/build.sh SOURCE.asm [ORIGIN_BITS]
#
# Output: dwt/gui/build/<name>.bin, .map, .lst
set -eu
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
DIR=$(cd "$(dirname "$0")" && pwd)
SRC=${1:?usage: build.sh SOURCE.asm [ORIGIN_BITS]}
ORIGIN=${2:-01840000}
NAME=$(basename "$SRC" .asm)
BASE=$(printf '%s' "$NAME" | tr 'a-z' 'A-Z')
WORK="$DIR/work"
OUT="$DIR/build"
IMG="$ROOT/tools/tms34010-sdk/1987-05 TMS34010 SDK/1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img"
DOSBOX_CONF="$ROOT/harness/sdk-scratch/dosbox-bench.conf"
mkdir -p "$WORK" "$OUT"
if [ ! -x "$WORK/GSPA.EXE" ]; then
mcopy -s -n -i "$IMG" "::/A2/*" "$WORK/"
mcopy -s -n -i "$IMG" "::/C2/*" "$WORK/"
fi
cp "$SRC" "$WORK/$BASE.ASM"
case "$ORIGIN" in
[0-9]*) ;;
*) ORIGIN="0$ORIGIN" ;;
esac
printf '%s\n' \
'-a' \
"-o $BASE.out" \
"-m $BASE.map" \
"$BASE.obj" \
'SECTIONS' \
'{' \
" .text ${ORIGIN}h: {}" \
'}' > "$WORK/$BASE.CMD"
sed -i 's/$/\r/' "$WORK/$BASE.CMD"
rm -f "$WORK/$BASE.OBJ" "$WORK/$BASE.OUT" "$WORK/$BASE.LST" \
"$WORK/$BASE.MAP" "$WORK/$BASE.HI" "$WORK/$BASE.LO"
SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
timeout 180 dosbox -conf "$DOSBOX_CONF" -noprimaryconf -nolocalconf \
-c "mount c $WORK" -c "c:" \
-c "gspa $BASE $BASE.obj $BASE.lst -l" \
-c "gsplnk $BASE.cmd" \
-c "exit" -exit >/dev/null 2>&1
if [ ! -f "$WORK/$BASE.OUT" ]; then
echo "build.sh: GSPLNK produced no $BASE.OUT" >&2
exit 1
fi
if [ ! -f "$WORK/$BASE.OBJ" ]; then
echo "build.sh: GSPA produced no $BASE.OBJ" >&2
grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2 || true
exit 1
fi
if grep -q '\*\*\*\*\*' "$WORK/$BASE.LST"; then
echo "build.sh: assembler diagnostics:" >&2
grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2
exit 1
fi
python3 "$ROOT/harness/hello-world/cofextract.py" "$WORK/$BASE.OUT" "$OUT/$NAME.bin"
sed 's/\r$//' "$WORK/$BASE.MAP" > "$OUT/$NAME.map"
cp "$WORK/$BASE.LST" "$OUT/$NAME.lst"
echo "build.sh: $OUT/$NAME.bin ($(wc -c < "$OUT/$NAME.bin") bytes) at bit $ORIGIN"
dwt/gui/build/xhello.bin
BIN
View File
Binary file not shown.
dwt/gui/build/xhello.lst
+219
View File
@@ -0,0 +1,219 @@
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 1
0001 ; xhello.asm -- open a *new* X connection from an rdebu
0002 ; create/map a window on the live DWT X server.
0003 ;
0004 ; Calling convention (the one the firmware itself uses;
0005 ; 07F57044 and the TM at 07E5D2B4):
0006 ;
0007 ; MOVE A14,-*SP,1 ; reserve the slot the ca
0008 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
0009 ; ...
0010 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
0011 ; CALLA target
0012 ;
0013 ; We point A14 at a private argument buffer instead of
0014 ; we keep the entry SP/A14 in RAM so the payload return
0015 ; leaves the stack in an unexpected state.
0016 ;
0017 ; Xlib entry points (Ghidra address -> bit address):
0018 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
0019 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
0020 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
0021 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
0022 ; 7F68B1A strlen(s) -> 3FB458D0
0023 ;
0024 ; Markers (32-bit cells, bit addresses):
0025 ; 01850100 display pointer
0026 ; 01850110 root window
0027 ; 01850120 window id
0028 ; 01850130 XSync return
0029 ; 01850140 stage counter
0030 ; 01850150 strlen("0::0") -- must be 4; if not, we s
0031
0032 00000000 .text
0033 00000000 _start:
0034 00000000 0550 setf 16, 0, 0
0035 00000010 0740 setf 32, 0, 1
0036 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0037
0038 00000040 078F move sp, @01850420h, 1 ; entry SP
00000050 01850420
0039 00000070 078E move a14, @01850400h, 1 ; entry A14
00000080 01850400
0040
0041 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0042 000000D0 0780 move a0, @01850140h, 1 ; stage = 1
000000E0 01850140
0043
0044 ; ---- convention check: strlen("0::0") == 4 ---------
0045 00000100 A3CF move a14, -*sp, 1
0046 00000110 09EE movi 01852000h, a14, L
00000120 01852000
0047 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
00000150 3FACE948
0048 00000170 920E move a0, *a14+, 1 ; arg0
0049 00000180 0D5F calla 3FB458D0h ; strlen
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 2
00000190 3FB458D0
0050 000001B0 07AF move @01850420h, sp, 1
000001C0 01850420
0051 000001E0 07AE move @01850400h, a14, 1
000001F0 01850400
0052 00000210 0788 move a8, @01850160h, 1 ; MARK strlen
00000220 01850160
0053 00000240 09E0 movi 4, a0, L
00000250 00000004
0054 00000270 4808 cmp a0, a8
0055 00000280 CB00 jrne done
00000290 0093
0056
0057 000002A0 09E0 movi 2, a0, L
000002B0 00000002
0058 000002D0 0780 move a0, @01850140h, 1
000002E0 01850140
0059
0060 ; ---- display = XOpenDisplay("0::0") ----------------
0061 00000300 A3CF move a14, -*sp, 1
0062 00000310 09EE movi 01852000h, a14, L
00000320 01852000
0063 00000340 09E0 movi 3FACE948h, a0, L
00000350 3FACE948
0064 00000370 920E move a0, *a14+, 1 ; arg0 = name
0065 00000380 0D5F calla 3F9C2570h ; XOpenDisplay
00000390 3F9C2570
0066 000003B0 07AF move @01850420h, sp, 1
000003C0 01850420
0067 000003E0 07AE move @01850400h, a14, 1
000003F0 01850400
0068 00000410 0788 move a8, @01850100h, 1 ; MARK display
00000420 01850100
0069 00000440 4D08 move a8, a8
0070 00000450 CA77 jreq done
0071
0072 00000460 09E0 movi 3, a0, L
00000470 00000003
0073 00000490 0780 move a0, @01850140h, 1
000004A0 01850140
0074
0075 ; ---- root = *(*(display+0x480)+0x40) ---------------
0076 000004C0 07A6 move @01850100h, a6, 1
000004D0 01850100
0077 000004F0 B6C9 move *a6(0480h), a9, 1
00000500 0480
0078 00000510 B729 move *a9(040h), a9, 1
00000520 0040
0079 00000530 0789 move a9, @01850110h, 1 ; MARK root
00000540 01850110
0080
0081 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
0082 00000560 A3CF move a14, -*sp, 1
0083 00000570 09EE movi 01852000h, a14, L
00000580 01852000
0084 000005A0 09E0 movi 0, a0, L
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 3
000005B0 00000000
0085 000005D0 920E move a0, *a14+, 1 ; background = 0 (black)
0086 000005E0 920E move a0, *a14+, 1 ; border = 0
0087 000005F0 09E0 movi 2, a0, L
00000600 00000002
0088 00000620 920E move a0, *a14+, 1 ; border width
0089 00000630 09E0 movi 200, a0, L
00000640 000000C8
0090 00000660 920E move a0, *a14+, 1 ; height
0091 00000670 09E0 movi 400, a0, L
00000680 00000190
0092 000006A0 920E move a0, *a14+, 1 ; width
0093 000006B0 09E0 movi 100, a0, L
000006C0 00000064
0094 000006E0 920E move a0, *a14+, 1 ; y
0095 000006F0 920E move a0, *a14+, 1 ; x
0096 00000700 932E move a9, *a14+, 1 ; parent
0097 00000710 07A6 move @01850100h, a6, 1
00000720 01850100
0098 00000740 92CE move a6, *a14+, 1 ; display
0099 00000750 0D5F calla 3FD41B90h ; XCreateSimpleWindow
00000760 3FD41B90
0100 00000780 07AF move @01850420h, sp, 1
00000790 01850420
0101 000007B0 07AE move @01850400h, a14, 1
000007C0 01850400
0102 000007E0 0788 move a8, @01850120h, 1 ; MARK window
000007F0 01850120
0103
0104 00000810 09E0 movi 4, a0, L
00000820 00000004
0105 00000840 0780 move a0, @01850140h, 1
00000850 01850140
0106
0107 ; ---- XMapWindow(display, window) -------------------
0108 00000870 A3CF move a14, -*sp, 1
0109 00000880 09EE movi 01852000h, a14, L
00000890 01852000
0110 000008B0 930E move a8, *a14+, 1 ; window
0111 000008C0 07A6 move @01850100h, a6, 1
000008D0 01850100
0112 000008F0 92CE move a6, *a14+, 1 ; display
0113 00000900 0D5F calla 3FD645B0h ; XMapWindow
00000910 3FD645B0
0114 00000930 07AF move @01850420h, sp, 1
00000940 01850420
0115 00000960 07AE move @01850400h, a14, 1
00000970 01850400
0116
0117 00000990 09E0 movi 5, a0, L
000009A0 00000005
0118 000009C0 0780 move a0, @01850140h, 1
000009D0 01850140
0119
0120 ; ---- XSync(display, 0) -----------------------------
0121 000009F0 A3CF move a14, -*sp, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 4
0122 00000A00 09EE movi 01852000h, a14, L
00000A10 01852000
0123 00000A30 09E0 movi 0, a0, L
00000A40 00000000
0124 00000A60 920E move a0, *a14+, 1 ; discard = 0
0125 00000A70 07A6 move @01850100h, a6, 1
00000A80 01850100
0126 00000AA0 92CE move a6, *a14+, 1 ; display
0127 00000AB0 0D5F calla 3FD9F6B0h ; XSync
00000AC0 3FD9F6B0
0128 00000AE0 07AF move @01850420h, sp, 1
00000AF0 01850420
0129 00000B10 07AE move @01850400h, a14, 1
00000B20 01850400
0130 00000B40 0788 move a8, @01850130h, 1 ; MARK sync
00000B50 01850130
0131
0132 00000B70 09E0 movi 6, a0, L
00000B80 00000006
0133 00000BA0 0780 move a0, @01850140h, 1
00000BB0 01850140
0134
0135 00000BD0 done:
0136 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000BE0 00FF
0137 00000BF0 09E8 movi 0, a8, L
00000C00 00000000
0138 00000C20 0960 rets
0139 .end
No Errors, No Warnings
dwt/gui/build/xhello.map
+34
View File
@@ -0,0 +1,34 @@
*****************************************************
GSP COFF Linker, Version 2.00, 87.300
*****************************************************
Sun Oct 18 14:04:58 2026
OUTPUT FILE NAME: <XHELLO.out>
ENTRY POINT SYMBOL: 0
SECTION ALLOCATION MAP
output attributes/
section page origin length input sections
-------- ---- ---------- ---------- ----------------
.data 0 00000000 00000000
.bss 0 00000000 00000000 UNINITIALIZED
.text 0 01840000 00000C30
01840000 00000C30 XHELLO.obj (.text)
GLOBAL SYMBOLS
address name address name
-------- ---- -------- ----
00000000 .bss 00000000 edata
00000000 .data 00000000 .bss
01840000 .text 00000000 end
00000000 edata 00000000 .data
00000000 end 01840000 .text
01840C30 etext 01840C30 etext
[6 symbols]
dwt/gui/probe.lua
+63
View File
@@ -0,0 +1,63 @@
-- probe.lua -- frame snapshots + marker/PC telemetry for the GUI experiments.
--
-- MSG_TRIGGER=<path> "<prefix> <count> <stride>" -> PNG snapshots
-- MSG_DIR=<dir> where PNGs go
--
-- Also prints a marker line every 250 frames, so a wedged machine still leaves
-- evidence of how far the injected payload got:
-- 01850100 display 01850110 root 01850120 window
-- 01850130 sync 01850140 stage 01850150 strlen
local machine = manager.machine
local dir = os.getenv("MSG_DIR") or "."
local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
local screen = nil
for _, s in pairs(machine.screens) do screen = s; break end
local cpu = machine.devices[':maincpu']
local space = cpu.spaces['program']
local frame = 0
local job = nil
local function consume_trigger()
local fh = io.open(trigger, "r")
if not fh then return end
local text = fh:read("*a") or ""
fh:close()
os.remove(trigger)
local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
if not prefix then
print("probe: bad trigger " .. text)
return
end
job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = frame }
print(string.format("probe: frame %d job %s x%d every %d", frame,
prefix, job.left, job.stride))
end
local function u32(addr)
local ok, v = pcall(function() return space:read_u32(addr) end)
if ok then return v end
return 0xdeadbeef
end
emu.register_frame_done(function()
frame = frame + 1
consume_trigger()
if job and frame >= job.next and screen then
local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, frame)
local ok, err = pcall(function() return screen:snapshot(out) end)
print(string.format("probe: frame %d %s ok=%s err=%s", frame,
out, tostring(ok), tostring(err)))
job.left = job.left - 1
job.next = frame + job.stride
if job.left <= 0 then job = nil end
end
if frame % 250 == 0 then
print(string.format("probe: frame %d PC=%08X disp=%08X root=%08X win=%08X sync=%08X stage=%d strlen=%d",
frame, cpu.state['PC'].value,
u32(0x01850100), u32(0x01850110), u32(0x01850120),
u32(0x01850130), u32(0x01850140), u32(0x01850150)))
end
end, "vt1200-gui-probe")
if machine.debugger then machine.debugger.execution_state = 'run' end
dwt/gui/probe2.lua
+47
View File
@@ -0,0 +1,47 @@
-- probe2.lua -- marker + X-server client-table telemetry.
local machine = manager.machine
local dir = os.getenv("MSG_DIR") or "."
local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
local screen = nil
for _, s in pairs(machine.screens) do screen = s; break end
local cpu = machine.devices[':maincpu']
local space = cpu.spaces['program']
local frame = 0
local job = nil
local function consume_trigger()
local fh = io.open(trigger, "r")
if not fh then return end
local text = fh:read("*a") or ""
fh:close(); os.remove(trigger)
local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
if not prefix then return end
job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = frame }
print(string.format("probe2: frame %d job %s x%d every %d", frame, prefix, job.left, job.stride))
end
local function u32(a)
local ok, v = pcall(function() return space:read_u32(a) end)
if ok then return v end
return 0xdeadbeef
end
emu.register_frame_done(function()
frame = frame + 1
consume_trigger()
if job and frame >= job.next and screen then
local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, frame)
pcall(function() return screen:snapshot(out) end)
print(string.format("probe2: frame %d %s", frame, out))
job.left = job.left - 1
job.next = frame + job.stride
if job.left <= 0 then job = nil end
end
if frame % 25 == 0 then
print(string.format("probe2: f=%d PC=%08X st=%d disp=%08X win=%08X xclients=%d strlen=%d",
frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
u32(0x01850120), u32(0x1b8620), u32(0x01850160)))
end
end, "vt1200-gui-probe2")
if machine.debugger then machine.debugger.execution_state = 'run' end
dwt/gui/probe3.lua
+34
View File
@@ -0,0 +1,34 @@
-- probe3.lua -- breakpoint on the X server connection-setup entry (Ghidra
-- 07EB1700) plus marker telemetry. If the server accepts an injected client,
-- an ACCEPT line appears; the boot's own clients prove the probe works.
local machine = manager.machine
local cpu = machine.devices[':maincpu']
local space = cpu.spaces['program']
local frame = 0
local function install()
local dbg = cpu.debug
if not dbg then print("probe3: no cpu.debug") return end
local ok, e = pcall(function()
dbg:bpset(0x3F58B800, "1", 'printf "probe3: ACCEPT pc=%08X\\n",pc; g')
end)
print("probe3: bpset accept=" .. tostring(ok) .. " " .. tostring(e))
end
local function u32(a)
local ok, v = pcall(function() return space:read_u32(a) end)
if ok then return v end
return 0xdeadbeef
end
emu.register_frame_done(function()
frame = frame + 1
if frame == 2 then install() end
if frame % 250 == 0 then
print(string.format("probe3: f=%d PC=%08X st=%d disp=%08X win=%08X wm=%d",
frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
u32(0x01850120), u32(0x1b8620)))
end
end, "vt1200-gui-probe3")
if machine.debugger then machine.debugger.execution_state = 'run' end
dwt/gui/run/gui_frame05752.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 19 KiB

dwt/gui/run/gui_frame15571.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 19 KiB

dwt/gui/run/gui_frame15601.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 19 KiB

dwt/gui/run/mame.log
+728
View File
@@ -0,0 +1,728 @@
Warning: -video none doesn't make much sense without -seconds_to_run
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
vt1200: scanline#1 line=1 enabled=1
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
vt1200: scanline#2 line=0 enabled=1
vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
vt1200: scanline#3 line=1 enabled=1
vt1200: scanline#4 line=2 enabled=1
probe2: f=25 PC=3F7056E0 st=0 disp=00000000 win=00000000 xclients=0 strlen=0
probe2: f=50 PC=3F7056E0 st=0 disp=00000000 win=00000000 xclients=0 strlen=0
probe2: f=75 PC=3F701E60 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=100 PC=3FB44B00 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=125 PC=3F7462F0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=150 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=175 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=200 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=225 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=250 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=275 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=300 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=325 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=350 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=375 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=400 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=425 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=450 PC=3F33EF20 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=475 PC=3FB44DA0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=500 PC=3F351010 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=525 PC=3F22A460 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=550 PC=3F34F1B0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=575 PC=3F3510F0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
probe2: f=600 PC=3FDA4970 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=625 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=650 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=675 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=700 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=725 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=750 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=775 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=800 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=825 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=850 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=875 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=900 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=925 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=950 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=975 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1000 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1025 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1050 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1075 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1100 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1125 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
probe2: f=1150 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1175 PC=3FCCC060 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1200 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1225 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1250 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1325 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1375 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1400 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1450 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1475 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1500 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1525 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1575 PC=3FD97B80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1600 PC=3FB3FA00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1625 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1650 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1675 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1750 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1775 PC=3FD970F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1800 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1850 PC=3FD97560 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1875 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1900 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1925 PC=3FCCBF10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1950 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=1975 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2000 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2025 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2050 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2075 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2125 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2250 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2275 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2300 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2325 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2350 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2375 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2400 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2425 PC=3FD971F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2450 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2475 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2500 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2525 PC=3FCCBF00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2550 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2575 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2625 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2725 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2775 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2800 PC=3FCCC060 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2850 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2900 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2925 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2950 PC=3FD97B60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=2975 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3000 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3025 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3050 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3100 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3150 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3175 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3200 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3300 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3325 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3350 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3375 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3400 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3450 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3475 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3500 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3525 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3600 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3625 PC=3FD97BA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3650 PC=3FB3FA00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3675 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3700 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3725 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3775 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3800 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3825 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3850 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3875 PC=3FD973D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3900 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3950 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=3975 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4025 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4050 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4075 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4100 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4125 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4150 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4200 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4325 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4350 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4375 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4450 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4475 PC=3FD97BA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4525 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4575 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4600 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4650 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4675 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4725 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4800 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4825 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4850 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4875 PC=3FD97180 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4900 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4925 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=4975 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5025 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5050 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5100 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5125 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5150 PC=3FB3FA70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5200 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5225 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5250 PC=3FD97610 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5275 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5325 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5375 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5475 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5525 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5650 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5675 PC=3FCCC030 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5700 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5725 PC=3FD97310 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: frame 5752 job gui x1 every 0
probe2: frame 5752 /home/arti/code/k-space/vt1200/dwt/gui/run/gui_frame05752.png
probe2: f=5775 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5800 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5850 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5875 PC=3FD97590 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5925 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5950 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=5975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6025 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6050 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6125 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6150 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6200 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6225 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6275 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6300 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6350 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6375 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6400 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6425 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6500 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6525 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6575 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6600 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6700 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6750 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6775 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6825 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6850 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6875 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6900 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6925 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6950 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=6975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7000 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7025 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7050 PC=3FB3FA70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7100 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7150 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7175 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7200 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7225 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7250 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7275 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7300 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7325 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7350 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7375 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7450 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7550 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7575 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7600 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7650 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7675 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7700 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7725 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7750 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7775 PC=3FD97560 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7875 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7900 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7925 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=7975 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8025 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8050 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8100 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8125 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8200 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8225 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8250 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8275 PC=3FCCBEC0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8300 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8350 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8375 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8400 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8450 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8475 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8550 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8575 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8625 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8675 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8700 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8725 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8750 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8775 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8850 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8875 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8900 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8925 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8950 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=8975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9000 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9025 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9100 PC=3FD971A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9150 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9275 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9350 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9475 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9525 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9550 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9625 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9700 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9725 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9750 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9775 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9800 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9825 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9900 PC=3FD97150 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9925 PC=3FB3FB10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9950 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=9975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10000 PC=3FD97610 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10025 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10100 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10150 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10175 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10200 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10225 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10250 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10275 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10400 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10450 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10475 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10575 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10625 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10650 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10675 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10700 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10725 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10750 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10775 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10800 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10825 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10875 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10900 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10925 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=10975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11000 PC=3FD97230 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11025 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11100 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11125 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11175 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11225 PC=3FD97570 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11250 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11300 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11325 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11375 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11425 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11450 PC=3FD972A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11475 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11500 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11525 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11550 PC=3FD972B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11600 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11625 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11650 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11675 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11700 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11725 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11825 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11850 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11875 PC=3FD975E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11925 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11950 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=11975 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12000 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12025 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12050 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12125 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12175 PC=3FD97620 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12200 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12225 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12250 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12275 PC=3FD97350 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12300 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12375 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12400 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12425 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12475 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12525 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12575 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12625 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12675 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12700 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12725 PC=3FD971D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12775 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12800 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12875 PC=3FD97310 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12900 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=12975 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13025 PC=3FD97170 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13050 PC=3FCCBED0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13075 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13100 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13150 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13175 PC=3FD97230 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13200 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13225 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13250 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13325 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13375 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13450 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13475 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13500 PC=3FB3FAA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13575 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13625 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13650 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13675 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13700 PC=3FD97B20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13725 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13750 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13775 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13800 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13900 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13925 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13950 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=13975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14025 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14050 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14075 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14100 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14125 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14175 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14200 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14275 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14300 PC=3FD970D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14325 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14375 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14400 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14475 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14500 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14525 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14550 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14575 PC=3FCCBED0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14675 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14700 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14725 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14750 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14775 PC=3FD97AD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14800 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14875 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14900 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=14975 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15025 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15050 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15075 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15100 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15125 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15175 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15225 PC=3FD97540 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15250 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15275 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15300 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15425 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15450 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15500 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15525 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15550 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15600 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15625 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15650 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15675 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15700 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15725 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15750 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15775 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15800 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15825 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15850 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15875 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15950 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=15975 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16000 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16025 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16050 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16100 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16150 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16175 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16200 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16225 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16250 PC=3FD972E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16300 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16325 PC=3FB3FA30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16375 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16400 PC=3FD97590 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16425 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16475 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16500 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16525 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16550 PC=3FD971E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16600 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16625 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16675 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16750 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16800 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16825 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16875 PC=3FD975A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16900 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=16975 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17000 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17025 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17050 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17075 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17100 PC=3FB3FB10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17125 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17150 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17175 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17200 PC=3FD97340 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17225 PC=3FD97540 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17275 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17325 PC=3FB3FAA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17350 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17375 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17400 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17425 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17475 PC=3F708730 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17575 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17600 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17675 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17700 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17750 PC=3FD972E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17800 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17850 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17875 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
probe2: f=17900 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
dwt/gui/run/serve.log
+8
View File
@@ -0,0 +1,8 @@
serving 29 names on ('192.168.99.1', 69)
names: 69, 69/baseline.pcf, 69/evil.pcf, 69/fonts.dir, 69/v1200a.pcf, ROM, X11/baseline.pcf, X11/evil.pcf, X11/fonts.dir, X11/v1200a.pcf, baseline.pcf, evil.pcf, font, font/baseline.pcf, font/evil.pcf, font/fonts.dir, font/v1200a.pcf, fonts, fonts.dir, fonts/baseline.pcf, fonts/evil.pcf, fonts/fonts.dir, fonts/v1200a.pcf, misc/baseline.pcf, misc/evil.pcf, misc/fonts.dir, misc/v1200a.pcf, real.pcf, rom
bootp: L2 responder on tap-mess-1000-0: handing out 192.168.99.2, siaddr 192.168.99.1 (src mac c6:fc:cc:16:f5:66)
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
dwt/gui/xhello.asm
+139
View File
@@ -0,0 +1,139 @@
; xhello.asm -- open a *new* X connection from an rdebug `jump` payload and
; create/map a window on the live DWT X server.
;
; Calling convention (the one the firmware itself uses; see the WM at
; 07F57044 and the TM at 07E5D2B4):
;
; MOVE A14,-*SP,1 ; reserve the slot the callee restores A14 from
; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument first, upward via A14
; ...
; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last
; CALLA target
;
; We point A14 at a private argument buffer instead of the dispatcher frame, and
; we keep the entry SP/A14 in RAM so the payload returns even if a callee
; leaves the stack in an unexpected state.
;
; Xlib entry points (Ghidra address -> bit address):
; 7F384AE XOpenDisplay(name) -> 3F9C2570
; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
; 7F68B1A strlen(s) -> 3FB458D0 (convention check)
;
; Markers (32-bit cells, bit addresses):
; 01850100 display pointer
; 01850110 root window
; 01850120 window id
; 01850130 XSync return
; 01850140 stage counter
; 01850150 strlen("0::0") -- must be 4; if not, we stop before touching Xlib
.text
_start:
setf 16, 0, 0
setf 32, 0, 1
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
move sp, @01850420h, 1 ; entry SP
move a14, @01850400h, 1 ; entry A14
movi 1, a0, L
move a0, @01850140h, 1 ; stage = 1
; ---- convention check: strlen("0::0") == 4 --------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 3FACE948h, a0, L ; ROM "0::0"
move a0, *a14+, 1 ; arg0
calla 3FB458D0h ; strlen
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850160h, 1 ; MARK strlen
movi 4, a0, L
cmp a0, a8
jrne done
movi 2, a0, L
move a0, @01850140h, 1
; ---- display = XOpenDisplay("0::0") ---------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 3FACE948h, a0, L
move a0, *a14+, 1 ; arg0 = name
calla 3F9C2570h ; XOpenDisplay
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850100h, 1 ; MARK display
move a8, a8
jreq done
movi 3, a0, L
move a0, @01850140h, 1
; ---- root = *(*(display+0x480)+0x40) --------------------------
move @01850100h, a6, 1
move *a6(0480h), a9, 1
move *a9(040h), a9, 1
move a9, @01850110h, 1 ; MARK root
; ---- XCreateSimpleWindow(display,root,100,100,400,200,2,0,0) --
move a14, -*sp, 1
movi 01852000h, a14, L
movi 0, a0, L
move a0, *a14+, 1 ; background = 0 (black)
move a0, *a14+, 1 ; border = 0
movi 2, a0, L
move a0, *a14+, 1 ; border width
movi 200, a0, L
move a0, *a14+, 1 ; height
movi 400, a0, L
move a0, *a14+, 1 ; width
movi 100, a0, L
move a0, *a14+, 1 ; y
move a0, *a14+, 1 ; x
move a9, *a14+, 1 ; parent
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
calla 3FD41B90h ; XCreateSimpleWindow
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850120h, 1 ; MARK window
movi 4, a0, L
move a0, @01850140h, 1
; ---- XMapWindow(display, window) ------------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
move a8, *a14+, 1 ; window
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
calla 3FD645B0h ; XMapWindow
move @01850420h, sp, 1
move @01850400h, a14, 1
movi 5, a0, L
move a0, @01850140h, 1
; ---- XSync(display, 0) ----------------------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 0, a0, L
move a0, *a14+, 1 ; discard = 0
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
calla 3FD9F6B0h ; XSync
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850130h, 1 ; MARK sync
movi 6, a0, L
move a0, @01850140h, 1
done:
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
movi 0, a8, L
rets
.end
dwt/notes/CROSS.md
+30
View File
@@ -343,3 +343,33 @@ and frames in `dwt/notes/DISPLAY_MESSAGE.md`.
---
## 2026-10-18 14:10 EEST — GUI apps are X clients; a payload can call Xlib but not get a display
Facts for anyone tempted to "just create a window" (details in
`dwt/notes/GUI_APPS.md`):
* The GUI is a **real X11 dix server in ROM** (process `SERVER`, entry bit
`0x3F362910`) plus Xlib in ROM. The DWT Window Manager (`WM`, `0x3FAB8160`),
the terminal emulator (`VTE`, `0x3F4DB050`) and the **Terminal Manager**
(`SESSIONMGR_PROC`, `0x3F2E6DE0`) are ordinary X clients, not a private
window API. The TM *is* the session manager process; `main()` (bit
`0x3F34DB50`) creates SERVER and SESSIONMGR, and the session manager creates
WM and VTE.
* Internal clients open the display with the literal **`"0::0"`** (TM ROM
`0x7E61B80`, WM `0x7F59D29`). `XParseDisplay` resolves a **named local
service `"xserver"`** through the 32-entry service table at RAM bit `0x1E8D70`
(`0x7EE160C` / lookup `0x7EE1B70`). TCP 6000 is a separate, user/node
authorised listener.
* Xlib entry points (bit addresses): `XOpenDisplay` `0x3F9C2570`,
`XCreateSimpleWindow` `0x3FD41B90`, `XMapWindow` `0x3FD645B0`,
`XSync` `0x3FD9F6B0`, `XCreateGC` `0x3F997000`, `XDrawString` `0x3FDA0000`.
* **Live result:** a 390-byte payload (poke+jump, no breakpoints) called
`strlen("0::0")` successfully (returned 4) using the firmware ABI, then
`XOpenDisplay` **hung**: stage 2, display 0, X-server client watermark
unchanged, rdebug service dead afterwards. The CPU sits in Xlib's select
wrapper. So the ROM is callable, but the `"xserver"` service connect from the
injected process never reaches the server. Do not assume a self-contained X
client is "one call away".
* Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the
realistic route for making the Terminal Manager draw something.
dwt/notes/GUI_APPS.md
+328
View File
@@ -0,0 +1,328 @@
# How the VT1200's GUI apps are built — and what a payload can do with that
Status: **static architecture DONE; injection verdict measured, not assumed.**
A payload *can* call ROM routines with the firmware calling convention (proved
live: `strlen("0::0")` returned 4), but `XOpenDisplay` from the injected process
**never completes**: the run stays at stage 2, the display pointer stays 0, the
X server's client watermark does not move, and the rdebug service stops answering.
Creating a *new* X window from a payload is therefore **hard**, not medium.
All work is static (Ghidra on `vt1200_v22.bin`) plus one live experiment on a
private NVRAM/cfg under the documented `VT1200_SKIP_LEVEL1=1` divergence. ROM
untouched (`md5 b46a3e442ccb86134d2356bd70d22fd2`), no driver edits.
Address convention used here: **Ghidra byte address** and **firmware bit address
(= Ghidra × 8)**. Ghidra address = `0x7E40000 + ROM file offset`.
---
## 1. The model in one paragraph
The terminal runs a small **process-per-application** OS on one TMS34010. RAM is
shared and unprotected; processes are contexts (a PCB from `create_process`, a
stack, a private file table at `*(0x1B3900)+0x100`). The graphics system is a
**real X11 server in ROM** (`dix`, the DEC/Athena server: strings
`Hello, this is the X server`, `CreateWellKnownSockets`,
`Internal error in ConfigureWindow`, `BadWindow - parameter not a Window`). The
GUI applications are **X clients built on Xlib, which is also in ROM**
(`XConnectDisplay`, `Xlib: sequence lost`, `XCreateCursor`-class request
builders). There is **no separate DWT window API**: the "DWT Window Manager" is
an ordinary X client that speaks the X11 WM protocol plus DECwindows atoms
(`DEC_WM_HINTS`, `WM_MOVED`, `DEC_WM_ICON_STATE`, `DEC_WM_TAKE_FOCUS`).
Because RAM is shared, app *state* (the Messages list, window ids, cursors) is
global and a routine in one process can update another app's data — that is why
rdebug opcode 8 can write the Terminal Manager's Messages box without a
connection of its own. The X protocol traffic, however, is done by each app's
own process through its own connection (`Display *` in a global: TM `@0xB78E0`,
WM `@0x27AA80`).
## 2. Function table
### 2.1 Processes / app lifecycle
| what | Ghidra | bits | notes |
|---|---|---|---|
| `create_process(entry,name,stack,1,arg)` | `0x07EE0D48` | `0x3F706A40` | mallocs a 0x39-byte PCB, copies the name, allocates the stack, links it at `@0x1B3860` |
| current-process pointer | — | `0x1B3900` | `+0x100` = user area (fd table) |
| process list head | — | `0x1B3860` | |
| `Main Program` (creates SERVER + SESSIONMGR) | `0x07E69B6A`…`0x07E69C1A` | `0x3F34DB50` | itself a created process (name `Main Program`) |
| X server entry **SERVER** | `0x07E6C522` | `0x3F362910` | dix main; prints `Hello, this is the X server` |
| Session Manager / Terminal Manager **SESSIONMGR_PROC** | `0x07E5CDBC` | `0x3F2E6DE0` | *is* the Terminal Manager (see §3) |
| Window Manager **WM** | `0x07F5702C` | `0x3FAB8160` | DWT WM; prints `DWT Window Manager is here to stay` |
| terminal emulator **VTE** | `0x07E9B60A` | `0x3F4DB050` | DECterm/VTE |
`create_process` argument order (from the pushes at `0x7E69B72`): the first
argument is the **entry point (bit address)**, the second the **name string**,
the third the **stack size**, the fourth a constant `1`, the fifth a pointer/arg.
Example (`main`, `0x07E69BE2`):
```
07E69BC8 MOVK 0x1,A9 ; arg3 = 1
07E69BCC MOVI 0x4E20,A9 ; arg2 = 0x4E20 stack
07E69BD2 MOVI 0x3F34E2E0,A8 ; arg1 = "SESSIONMGR_PROC"
07E69BDA MOVI 0x3F2E6DE0,A9 ; arg0 = entry
07E69BE2 CALLA 0x07EE0D48 ; create_process
```
### 2.2 Xlib (client side, all in ROM)
The request-builder opcode is visible in each function (`MOVB 0xNN` into the
request buffer), which is how these were named; the DB26 `XDrawString` and DB25
`XCreateSimpleWindow` shapes were then checked against their argument blocks.
| Xlib function | Ghidra | bits | shape seen |
|---|---|---|---|
| `XOpenDisplay(name)` | `0x07F384AE` | `0x3F9C2570` | mallocs 0x4D8, parses the name, connects |
| `XParseDisplay` / service lookup | `0x07FA7538` | `0x3FD3A9C0` | splits `host:display.screen`, resolves `"xserver"` |
| `XCreateSimpleWindow(d,p,x,y,w,h,bw,border,bg)` | `0x07FA8372` | `0x3FD41B90` | opcode 1, 9 args |
| `XMapWindow(d,w)` | `0x07FAC8B6` | `0x3FD645B0` | opcode 8, 2 args |
| `XMapSubwindows(d,w)` | `0x07FAC97E` | `0x3FD64BF0` | opcode 9 |
| `XSelectInput(d,w,mask)` | `0x07FB2FAA` | `0x3FD97D50` | ChangeWindowAttributes, mask 0x800 |
| `XChangeWindowAttributes` | `0x07FA70EE` | `0x3FD38770` | opcode 2 |
| `XConfigureWindow` | `0x07FA74A2` | `0x3FD3A510` | opcode 12 |
| `XInternAtom(d,name,only_if_exists)` | `0x07FABC84` | `0x3FD5E420` | opcode 16 |
| `XChangeProperty` | `0x07FA6E66` | `0x3FD37330` | opcode 18 |
| `XCreateGC(d,drawable,mask,values)` | `0x07F32E00` | `0x3F997000` | opcode 55; template copied from ROM `0x2317D0` |
| `XChangeGC` | `0x07F333F0` | `0x3F999F80` | opcode 56 |
| `XSetForeground(d,gc,pixel)` | `0x07FB334C` | `0x3FD99A60` | caches in GC, marks dirty |
| `XSync(d,discard)` | `0x07FB3ED6` | `0x3FD9F6B0` | sends GetInputFocus (43), waits |
| `XDrawString(d,drawable,gc,x,y,s,n)` | `0x07FB4000` | `0x3FDA0000` | opcode 74 (PolyText8) |
| `XLoadFont(d,name)` | `0x07FA95D0` | `0x3FD4AE80` | opcode 45 (OpenFont) |
| `XCopyArea` | `0x07FA7C44` | `0x3FD3E220` | opcode 62 |
| internal PolyFillRectangle fast path | `0x07F33D1E` | `0x3F99E8F0` | opcode 70; not a public entry point |
| `strlen` | `0x07F68B1A` | `0x3FB458D0` | used as the ABI check |
### 2.3 X server internals that matter
| what | Ghidra | bits |
|---|---|---|
| connection setup / accept entry | `0x07EB1700` | `0x3F58B800` |
| auth reject logger (`0x07E7E8D0`) | `0x07E7E8D0` | `0x3F3F4680` |
| client table (32 × 0x80) | RAM | `0x1B6600` |
| client watermark | RAM | `0x1B8620` |
| client bitmap (32 bits) | RAM | `0x1B86A0` |
| well-known socket / service name | ROM `"xserver"` | `0x3F591F08` |
The server's connection path reads the 12-byte X11 setup (`0xEBB1CE(conn,12,buf)`),
checks the byte-order byte, then reads the auth name/data and looks the peer up
in the user/node table. Failure goes to a routine that logs
`Client is not authorized to access server` and closes.
## 3. Terminal Manager: what it is and how it starts
**The Terminal Manager is not a separate application.** It is the UI half of the
process `main()` creates as `SESSIONMGR_PROC` (entry `0x3F2E6DE0`). The single
function that begins at `0x7E5CDBC` runs straight through the display setup
(`0x7E5D0F0`), the TM window creation (`0x7E5D2D0`), the WM launch
(`0x7E5D760`) and the VTE launch (`0x7E5E676`). This is continuous code: the
disassembly has no return between `0x7E5CDBC` and `0x7E5F7xx`.
Startup, quoted:
```
07E5D1FA MOVI 0x3F30DC00,A8 ; "0::0" at ROM 0x7E61B80
07E5D204 CALLA 0x07F384AE ; XOpenDisplay("0::0")
07E5D20A MOVE A8,@0xB78E0 ; TM's Display * (global)
07E5D212 JRNE 0x07E5D228
07E5D216 MOVI 0x3F30DC28,A8 ; "DWTM Failed to open display\n"
07E5D21E CALLA 0x07F6683C ; printf
```
The title string `Terminal Manager V2.2` is at ROM `0x7E61D8B`
(bit `0x3F30EC58`) and is referenced from the same function (`0x7E5E928`).
`Terminal Manager XIO error... restarting...` (`0x7E61B53`) confirms the TM is an
**XIO/Xlib client**, not a private drawing API.
The TM's first window is a 1×1 "WM protocol" window; the visible TM box is built
with the widget toolkit (the code at `0x7E7F24A`, `0x7E8465A`, `0x7E873FE`,
`0x7E94880`, … that calls `XCreateSimpleWindow` + `XMapWindow`).
**Launched from:** `main()`, not a menu or an init list. A menu does exist for
secondary apps — the `Create` menu (`Terminal Window on Host Port`, `TELNET
Terminal Window…`, `PRINT`) calls `create_process` at `0x7E91BA0`/`0x7E91C26`.
## 4. Minimum "hello window" call sequence
From the TM's own code (`0x7E5D2B4`–`0x7E5D2D0`) and the WM's
(`0x7F57044`–`0x7F5704E`). The calling convention is **not** "push on SP": the
caller reserves one slot with `MOVE A14,-*SP,1`, pushes arguments **upward**
with `MOVE arg,*A14+,1` (last argument first), and the callee restores A14/SP.
```
; root = *(*(display+0x480)+0x40) (TM 0x7E5D290..0x7E5D2AA)
MOVE @0xB78E0,A11 ; display
MOVE @0xB7F80,A9 ; default screen number
SLL 0x9,A9 / SLL 0x7,A7 / ADD A7,A9 ; * 0x280 (screen struct)
MOVE *A11(0x480),A7 / ADD A9,A7 ; screens[]
MOVE *A7(0x40),A9 / MOVE A9,@0xB7960 ; root window
; window = XCreateSimpleWindow(display, root, 0,0, 1,1, 0, 0, 1)
MOVE A14,-*SP,1
MOVK 1,A7 / MOVE A7,*A14+,1 ; background = 1
SUB A7,A7 / MOVE A7,*A14+,1 ; border
MOVE A7,*A14+,1 ; border width
MOVK 1,A7 / MOVE A7,*A14+,1 ; height
MOVE A7,*A14+,1 ; width
SUB A7,A7 / MOVE A7,*A14+,1 ; y
MOVE A7,*A14+,1 ; x
MOVE A9,*A14+,1 ; parent = root
MOVE A11,*A14+,1 ; display
CALLA 0x07FA8372 ; -> window id
```
The full minimum is **4 Xlib calls**:
1. `XOpenDisplay("0::0")` — `0x3F9C2570`
2. `XCreateSimpleWindow(d, root, x, y, w, h, bw, border, background)` —
`0x3FD41B90`
3. `XMapWindow(d, win)` — `0x3FD645B0`
4. `XSync(d, 0)` — `0x3FD9F6B0` (flush + round trip)
To draw text add `XLoadFont(d,"fixed")` (`0x3FD4AE80`), `XCreateGC`
(`0x3F997000`) with `GCFont=0x4000`, `XSetForeground` (`0x3FD99A60`) and
`XDrawString` (`0x3FDA0000`). No event loop is needed for a static window; the
server keeps it after the client goes idle.
Globals: only the `Display *` is per-app. There is **no global "current
display" to initialise**; `XOpenDisplay` allocates and returns it. Window ids,
GCs and fonts are server-side resources and are valid for any client.
## 5. The injection experiment (run) and the verdict
Payload: `dwt/gui/xhello.asm` → `dwt/gui/build/xhello.bin` (390 B), linked at bit
`0x01840000`, built with the TI SDK flow (`dwt/gui/build.sh`). It first calls
`strlen("0::0")` as an ABI check (must return 4; if not it returns without
touching Xlib), then `XOpenDisplay`, root lookup, `XCreateSimpleWindow`,
`XMapWindow`, `XSync`, storing a stage counter at bit `0x01850140` and the
display/window at `0x01850100`/`0x01850120`.
Run: `VT1200_SKIP_LEVEL1=1`, private `-nvram_directory`/`-cfg_directory`,
`-networkprovider taptun`, BOOTP/TFTP from `harness/serve.py --bootp`,
`-nothrottle`; frame/marker probe `dwt/gui/probe2.lua`. Injected with
`dwt/visual/inject.py` (`poke` + `jump`, challenge answered by
`dwt/challenge.respond`). The terminal booted to the Terminal Manager, answered
rdebug, and the payload was poked and jumped with no breakpoints.
Result:
```
strlen = 4 <- the firmware calling convention works
stage = 2 <- reached the XOpenDisplay call
display = 0 <- never returned
window = 0
xclient watermark = 1 (unchanged: no new client slot was taken)
jump: NO RETURN within 20 s; the same connection then times out
```
The machine stays alive (frames advance, the TM keeps running) but the
remote-debug process sits in Xlib's `select` wrapper (`0x3FD969F0`, waiting on
the display fd) and the rdebug service stops answering. No window appeared in
the frame dump (`dwt/gui/run/gui_frame15571.png` is the normal TM).
**Verdict: HARD** for "a payload creates its own window through XOpenDisplay".
The window API is ordinary Xlib — the missing piece is the **local transport
handshake**: a connection opened from the injected process is never accepted by
the server (client watermark does not move), so Xlib waits forever. The one
thing that decides it is whether the `"xserver"` service connection can be
established from a process other than the boot-time clients; that is not an API
question and is not answered by the ROM alone.
**MEDIUM** for a narrower goal: *influencing* an existing window. The shared-RAM
UI path is proven — `rdebug` opcode 8 calls the TM's append routine
`0x3F309350` and the text appears in the Messages pane with no connection of its
own. Any payload can call the same TK/UI routines, but they mutate the owning
app's data structures so that the *owner* does the X drawing.
## 6. Internal IPC to the X server
Both boot-time clients open the display with the literal string **`"0::0"`**
(TM at ROM `0x7E61B80`, bit `0x3F30DC00`; WM at `0x7F59D29`, bit `0x3FACE948`).
`XParseDisplay` (`0x7FA7538`) does **not** build a TCP address. It resolves a
**named local service**:
```
07FA766C CALLA 0x07F65C68 ; kernel_lock (per-process critical flag)
07FA7672 MOVI 0x3FD3DCA0,A8 ; "xserver"
07FA767C CALLA 0x07EE160C ; service attach by name
07FA7688 JREQ ... ; null -> unlock, sleep 100 ms, retry
```
`0x7EE160C` is a **service-table lookup/attach**; the lookup itself
(`0x7EE1B70`) scans a **32-entry table at `0x1E8D70`** (4-byte entries) with
`strcmp` against the name. The X server registers the same name on its side
(`"xserver"` appears next to `CreateWellKnownSockets` at `0x7E6A4B0`, and next to
the TCP accept `X Server's TCP Port` at `0x7E591F08`).
So the internal route is: **named local service `xserver`**, reached by
`XOpenDisplay("0::0")`, not TCP and not a Unix socket path. TCP port 6000 is a
*separate* listener; it is gated by the user/node authorisation list
(`Connection request from user %s on node %s rejected`, auth check
`0x7E7E8D0`), which is why an external `xdpyinfo` gets
`Client is not authorized to access server` while the local service clients do
not.
## 7. App inventory
GUI (X clients):
| process | entry (bits) | role |
|---|---|---|
| `SERVER` | `0x3F362910` | X11 dix server, well-known socket `xserver` + TCP 6000 |
| `SESSIONMGR_PROC` | `0x3F2E6DE0` | Session Manager **and** Terminal Manager UI (Messages, Ethernet/IP/LAT, memory bar, Customize/Print Screen panels) |
| `WM` | `0x3FAB8160` | DWT Window Manager: frames, title bars, icon box, DEC WM atoms |
| `VTE` | `0x3F4DB050` | terminal emulator window (created on demand by the TM) |
| `PRINT` | `0x3F3E2590` → `0x7E7C4B2` | print manager, launched from the `Print Screen`/`Create` menu |
Non-GUI processes (same `create_process` mechanism, for completeness):
`INETSERVER`, LAT server (`0x3F2BD3F0`), MOP server (`0x3FAED480`), LANCE server
(`0x3F9DB9A0`), `TCPIP_FONTS` (`0x3F95EB10`), `resolver` (`0x3F5B7EF0`),
`Telnet` (`0x3F6D2F90`), `Route` (`0x3F5BF380`), `rtvalidate` (`0x3F663360`),
`VTE_listen` (`0x3F50F6A0`), `VTE_listen_shr` (`0x3F50F860`), `Bootp`
(`0x3F57B710`), `Inetd` (`0x3F587C00`), `domain_name` (`0x3F5B9510`),
`remote debug` (`0x3F59F320`), `TCP_UP` (`0x3F22F940`), `Terminate_tcp`
(`0x3F22E7F0`), `Main Program` (`0x3F34DB50`), `DWTM`/`VTE` helpers.
There is no file manager, editor, clock or cardfiler in this image; the only
GUI apps are the five above, plus the TM's own modal/panel code in the
`0x7E7xxxx`–`0x7E9xxxx` toolkit range.
## 8. The experiment that would settle the transport question
Run the same payload but **instrument the server side**: breakpoint the server
accept entry `0x3F58B800` and the auth check `0x3F3F4680`, log hits to a file
from a Lua frame hook (MAME's `printf` action did not reach stdout with
`-debugger none` in this run, so use a `wpset`/`bpset` action that increments a
RAM counter, or a Lua hook that samples `PC` every frame), then inject
`xhello.bin`. Three outcomes:
1. Accept never hit → the service connect from a non-boot process never reaches
the server; the next step is to call `0x7EE160C("xserver")` by hand under the
debugger and inspect its return value / the fd it installs.
2. Accept hit, auth rejects → authorise the injected client (the same
user/node table the config UI edits), then the window should appear.
3. Accept hit, auth passes, no reply → the setup packet is wrong; compare the
bytes Xlib writes from the WM's connection with ours.
A second, independent route worth trying: `create_process` a fresh process whose
entry is the payload (`create_process(0x01840000, "GUI", 0x2000, 1, 0)`), so the
X connection is made by a normal new process rather than by the rdebug
dispatcher. That isolates "wrong process context" from "wrong transport".
Not run: the owner's MAME was not running, but the shared tap
(`tap-mess-1000-0` / bridge `vt1200`) was used only after confirming no
`mame0289/vt1200` process existed; a private NVRAM and cfg directory were used
and the run was stopped afterwards. No second MAME was started while another was
live.
## 9. Evidence files
| path | contents |
|---|---|
| `dwt/gui/xhello.asm` | the payload (ABI check + 4 Xlib calls) |
| `dwt/gui/build.sh` | TI SDK build wrapper, output under `dwt/gui/` |
| `dwt/gui/build/xhello.bin`, `.lst`, `.map` | assembled payload, listing, map |
| `dwt/gui/probe.lua`, `probe2.lua`, `probe3.lua` | frame snapshots + marker/PC telemetry + accept breakpoint |
| `dwt/gui/run/mame.log` | boot, markers (`strlen=4`, `stage=2`, `disp=0`, `xclients=1`) |
| `dwt/gui/run/gui_frame15571.png` | post-injection frame: normal Terminal Manager, no new window |