From bebc0ccbc1af24259787341419eb657a366a3c77 Mon Sep 17 00:00:00 2001 From: SDD Date: Sun, 18 Oct 2026 15:25:43 +0300 Subject: [PATCH] reference: map the ROM's third-party code -- MIT X11 R4, BSD 4.3 TCP/IP + BIND + telnet, TI RTS, and the font licences --- reference/third-party-code.md | 153 ++++++++++++++++++++++++++++++++++ 1 file changed, 153 insertions(+) create mode 100644 reference/third-party-code.md diff --git a/reference/third-party-code.md b/reference/third-party-code.md new file mode 100644 index 0000000..65dc816 --- /dev/null +++ b/reference/third-party-code.md @@ -0,0 +1,153 @@ +# Third-party and open-source code in the VT1200 ROM + +A map of the non-DEC code in `vt1200_v22.bin` (md5 +`b46a3e442ccb86134d2356bd70d22fd2`), and how each identification was made. + +Two kinds of evidence are used, and they are not equivalent: + +* **Source IDs** — `$Header:` (RCS) and `@(#)` (SCCS) strings compiled into the + image. These name the original source file and, for RCS, the revision and + date. Strong, but they are file names, not a licence statement. +* **Code match** — disassembly compared with a known source tree (e.g. the + X11R4 sources under `reference/x11/r4`). + +Copyright strings are quoted where they exist. **The absence of a copyright +string is not evidence of absence**: most of this code carries its notice in +source comments, which do not survive compilation. + +## Summary + +| component | evidence | notes | +|---|---|---| +| **MIT X11 R4** | `mfb*`, `pcf*`, `snf*`, `bdf*`, `Xlib` strings; exact match to `reference/x11/r4/.../pcfrbitmaps.c` | X server + Xlib + font parsers | +| **BSD 4.3-era TCP/IP** | `$Header`/`@(#)` IDs for the full socket/TCP/IP/mbuf file set | ported at DEC by `craig`, 1989-10-05/06 | +| **BSD BIND resolver** | `res_comp.c`, `res_init.c`, `res_mkquery.c`, `res_send.c`, `gethostent.c` | classic 4.8/4.9-era resolver | +| **BSD telnet + TN3270** | `telnet.c`, `commands.c`, `network.c`, `ring.c`, `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c` | same 1989 import | +| **BSD inetd** | `inetd.c` | | +| **BSD lpd lineage** | `lpd_lance_devdriver.c` | LANCE driver for the printer daemon | +| **BSD libc pieces** | `strcasecmp.c`, `ctype.c`, `errlst.c`, `inet_addr.c`, `inet_ntoa.c` | mixed with the TI runtime (below) | +| **TI C runtime V2.00** | ROM `strlen`/`strcpy`/`strcmp` match `RTS.SRC` instruction for instruction | proprietary, shipped with the SDK | +| **Bitstream / Bigelow & Holmes / DEC Japan fonts** | copyright strings, font names | third-party, **not** open source | + +## 1. MIT X11 R4 + +The largest non-BSD body. The server is the MIT sample server, with both +framebuffer implementations: + +* `mfbValidateGC`, `mfbFaultGlyph`, `mfbFreeGlyphCacheSpace`, + `mfbDestroyDMD` — monochrome framebuffer (`mfb`). +* `cfb` strings are present as well (colour framebuffer), though the VT1200 is + monochrome. +* Font formats: `pcfReadBitmaps`, `pcfReadProperties`, `pcfReadMetrics`, + `pcfReadEncoding`, `pcfReadAccelerators`, `Invalid SNF font file format`, + `unknown bdf encoding format`. +* Xlib: `BadLength - request length incorrect; internal Xlib error`, + `Xlib: sequence lost`, `XlibMessage`, `/usr/lib/X11/XErrorDB`. + +The PCF error strings match `reference/x11/r4/contrib/server/pcf/fonts/lib/pcf/pcfrbitmaps.c` +byte for byte (including `allocation failure in pcfReadBitmaps (offsets,%d)`, +which R5's monolithic `pcfread.c` does not contain). That is the basis for +calling it R4 rather than "X11 generally". + +There is **no X11 copyright string** in the image; the identification is +code-level. + +## 2. BSD TCP/IP stack + +The file IDs are the classic BSD 4.3/Net-1 set. RCS headers show a bulk import +by `craig` on 1989-10-05/06, with later files (e.g. `route.c`) on 1990-03-15. + +| layer | source files | +|---|---| +| sockets / mbufs | `uipc_domain.c`, `uipc_mbuf.c`, `uipc_proto.c`, `uipc_socket.c`, `uipc_socket2.c`, `uipc_usrreq.c`, `sys_socket.c`, `mbuf_calls.c`, `uio.c`, `syscalls.c`, `af.c` | +| TCP | `tcp_input.c`, `tcp_output.c`, `tcp_subr.c`, `tcp_timer.c`, `tcp_usrreq.c`, `tcp_debug.c` | +| UDP / IP / ICMP / raw | `udp_usrreq.c`, `ip_input.c`, `ip_output.c`, `ip_icmp.c`, `raw_ip.c`, `raw_cb.c`, `raw_usrreq.c` | +| interfaces / routing | `if.c`, `if_ether.c`, `if_loop.c`, `if_sl.c`, `route.c`, `in.c`, `in_pcb.c`, `in_cksum.c`, `in_proto.c`, `inet_addr.c`, `inet_ntoa.c` | + +`if_sl.c` (SLIP) is the clearest sign that this is the stock BSD file set rather +than a lookalike. + +DEC's own additions in the same area are distinguishable by name and by the +absence of SCCS/RCS IDs: `lance_inet_interface.c`, `dwt_file.c`, `dwt_tftp.c`, +`sys_dwt.c`, `server.c`, `init.c`, `test.c`, `xclients_smlat_dispatch.c`, +`inode.c`. + +**Licence caveat:** no "Regents of the University of California" string appears +in the image. The BSD notice was in source comments. The RCS/SCCS IDs and the +file set establish lineage; they do not establish the licence text that +accompanied it. + +## 3. BSD resolver, telnet and inetd + +* **BIND resolver:** `res_comp.c`, `res_init.c`, `res_mkquery.c`, + `res_send.c`, plus `gethostent.c`. This is the 4.8/4.9-era resolver, the + source of the "Primary name server IP address %s is invalid." path. +* **telnet:** `telnet.c`, `commands.c`, `main.c`, `network.c`, `ring.c`, + `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c`. This is the whole BSD + telnet client source set, including TN3270. +* **inetd:** `inetd.c`. +* **lpd lineage:** `lpd_lance_devdriver.c` — the LANCE device driver for the + printer daemon; the `lpd_` prefix points at BSD `lpd`. + +## 4. TI C runtime — not open source, but identifiable + +The ROM's string and memory functions are the TI RTS V2.00, not BSD: + +* ROM `strlen` at `0x07F68B1A` implements exactly + `rstr = string - 1; n = 0; while (*++rstr) n++;` +* ROM `strcpy` at `0x07F68AE4` matches the RTS loop and return value. +* ROM `strcmp` at `0x07F68AA0` matches the RTS comparison. +* ROM `memcpy` at `0x07F68880` is `PIXBLT_L_L`, consistent with the RTS + `memcpy` → `movmem`. + +The SDK ships `RTS.LIB`, `RTS.SRC` (full source), `FLIB.LIB` and the headers on +the 1987 C-tools floppy (`1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img`, +dir `C2`). + +**The allocator is not the RTS one.** `RTS.SRC`'s `memory.c` uses a 1000-byte +static `sys_memory`; the ROM's `malloc` (`0x07EE0246`) is a multi-arena +allocator over the 4 MiB RAM (`0x1E8930` arenas, global pool `0x1E8AC0`). So the +firmware mixes the TI runtime (strings, ctype, qsort, printf) with a different +memory manager. + +## 5. Fonts (third-party, not open source) + +Copyright strings in the font data: + +* `Copyright (c) 1988 Bigelow & Holmes Inc.` — Pellucida. +* `Copyright (c) 1988 Bitstream, Inc., Portions Copyright 1988 Digital + Equipment Corp.` — Bitstream Terminal. +* `Copyright (c) 1988 Digital Equipment Corporation Japan.` — JISX0208 Kanji. +* `Copyright (c) 1988/1990 Digital Equipment Corp.` — DEC Terminal, DECtech. + +## 6. Checked and not found + +No `regex`/`regcomp`, no `curses` or `termcap`, no `getopt`, no `crypt` +strings, no MD5, no zlib, no NFS, no SNMP, no Kerberos, no PEX/XIE server +extensions. The `ICE` and `XIE` substring counts are noise ("device", +"service", …), not the X11 protocols. + +## 7. Open question: the `dwt_prf` transform + +The rdebug challenge is structurally **DES**: eight 64-entry S-box tables at +`0x1C0200`, 6-bit indices, 16 Feistel rounds, a fixed key schedule. There are +no `DES` or `crypt` strings, so the implementation is not attributable from the +binary alone. If it is standard DES with a fixed key, the challenge is much +weaker than the "font render + Feistel" description first suggested. + +## Reproduce + +```sh +cd /home/arti/code/k-space/vt1200 + +# every compiled source id, unique +rg -o '@\(#\)[A-Za-z0-9_.-]+|\$Header: [A-Za-z0-9_.-]+' \ + reference/rom-strings.txt | sed 's/@(#)//; s/\$Header: //' | sort -u + +# X11 fingerprints +rg -n 'mfb|pcf|snf|bdf|Xlib|XErrorDB' reference/rom-strings.txt + +# font copyrights +rg -n 'Copyright \(c\) 1988 (Bigelow|Bitstream)|Digital Equipment Corporation Japan' \ + reference/rom-strings.txt +```