From e2c18ee70b2cb7854c612270e98d60c0631bc341 Mon Sep 17 00:00:00 2001
From: SDD <sdd@local>
Date: Sun, 18 Oct 2026 17:06:12 +0300
Subject: [PATCH] dwt: NVRAM dump over rdebug (settings block) and LANCE
 address ROM read; both match the model

---
 dwt/evidence/real-unit-nvram-raw.bin      | Bin 0 -> 4096 bytes
 dwt/evidence/real-unit-nvram-settings.bin | Bin 0 -> 2048 bytes
 dwt/notes/REAL_UNIT.md                    |  31 ++++++++
 dwt/nvram_dump.py                         |  90 ++++++++++++++++++++++
 4 files changed, 121 insertions(+)
 create mode 100644 dwt/evidence/real-unit-nvram-raw.bin
 create mode 100644 dwt/evidence/real-unit-nvram-settings.bin
 create mode 100644 dwt/nvram_dump.py

diff --git a/dwt/evidence/real-unit-nvram-raw.bin b/dwt/evidence/real-unit-nvram-raw.bin
new file mode 100644
index 0000000000000000000000000000000000000000..7a150538d015a003b063d2a000d8c69f76668e0a
GIT binary patch
literal 4096
zcmeHKJ5Iwu5ZySDphOfDsUlGm5r^=Jkf<mlBn0$8EDD5(Vh%t@%L%BcxBwLm;vP(q
zLs0SZHpceGHd35mz>zgt?aX@q-hK9-p(#&tjAf{Ry6B3MTj}9mUSxnpN(y(dsa3@S
zER;||nfg_7&zxVmc7>9ZskcJ;0~N8!&q_K*?n&jog8aXOqJr-_@IKGGvw?L|9eQqZ
z_W4O`ZeWY3SLe`{E&9<uCbcf~iVn=y0lnYCk>1xf?Zc7Yz7I!kq%YS}mrGd_chHkl
zITwerL*jqI4}9g*=k;3_`qYO*8N7!BHZh?^9dFJeD>HsO7C(!Krq5*jG&Qp3lkhw1
zm~sEs7v>-00G)q~|9*b{_s-m(8)#z_JAayebU%&D@xDh_%zE^>^UkI|mr>1RxdR6-
zTw>S-(aW6zzm`Uk9(nIkyz_XH8r_U^#0TtRFUZBB#x!(-BkZF_<gbxd1Aoai#aGAe
Q<Ijtgx$VH4`b<~b5Wwdqo&W#<

literal 0
HcmV?d00001

diff --git a/dwt/evidence/real-unit-nvram-settings.bin b/dwt/evidence/real-unit-nvram-settings.bin
new file mode 100644
index 0000000000000000000000000000000000000000..0d100f23179bfcca891136f7ad59ef9995ec662d
GIT binary patch
literal 2048
zcmYc?UKJ|D00Jo~3=IVn_CDcYU}!fIl456KWMO8IV%*Mfh$)wmnL&)<2a6F{AwGf`
zpX8|Ahz|in0|Pxn17kf9i7hY;&5iVo4D?J5^{`4~(=sZC6at2NV2C7w%Cyh}LsUT|
zUQudEQNCWbZgD|ka;jcxDv}gkm<GU<0fY=N+Q`&Y4~U7k8=~I|rk{9?5S2*jlT@t`
z^@#LMo_?S%CLj*-_a$3DHjN<jK=}?5o+egime^DgF9r)ID2<^J8gG!e#E@lR@J%f)
zPE1cN#v%m~5@29h!pOh`q!^5V_0v2XdyqI29uOAds$i&~pbXKENkZi@B}TLe0LX(g
A_y7O^

literal 0
HcmV?d00001

diff --git a/dwt/notes/REAL_UNIT.md b/dwt/notes/REAL_UNIT.md
index bf180c3..bbb3764 100644
--- a/dwt/notes/REAL_UNIT.md
+++ b/dwt/notes/REAL_UNIT.md
@@ -251,3 +251,34 @@ The first attempt hung the Terminal Manager; this one completed. The hang is
 not deterministic. The mailbox watcher's reconnect storm during boot is one
 possible co-factor (it spawns a debug process per accepted connection), but the
 diagnostic reset is the other; a single success does not settle which.
+
+### NVRAM and LANCE address ROM, read over rdebug
+
+`dwt/nvram_dump.py` reads 4 KiB at bit `0x6000000` and extracts the 0x800
+settings bytes (low byte of each 16-bit word). Evidence:
+`real-unit-nvram-settings.bin`, `real-unit-nvram-raw.bin`.
+
+Printable settings runs:
+
+```
+0x26f 100.103.0.10      0x28f 172.20.51.0
+0x3cf 1.1.1.1           0x3ef 8.8.8.8
+0x40f retro.k-space.ee
+0x50f 100.103.0.1
+0x597 ROM               0x5e7 ROM
+0x5eb 103.255.254:69
+0x637 100.103.100.103   0x657 255.255.0.0
+0x677 Messages          0x6ca / 0x6ea VTE 1
+```
+
+Both font-path fields persist: the selected `ROM` and the old TFTP
+`103.255.254:69`.
+
+The LANCE address ROM at bit `0x6800000` reads (low bytes of the words):
+
+```
+08 00 2b 16 4b 5a c1 86
+```
+
+byte-identical to the MAME model. The `Ethernet Address ROM Test` passing is
+consistent with this.
diff --git a/dwt/nvram_dump.py b/dwt/nvram_dump.py
new file mode 100644
index 0000000..d168f3e
--- /dev/null
+++ b/dwt/nvram_dump.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Dump the VT1200 NVR (user settings) over rdebug `peek`.
+
+The NVR is at bit `0x6000000`, a 16-bit-wide region.  The firmware's
+`io_settings_copy_expand` copies **0x800 settings bytes, one per 16-bit word**
+(and `io_settings_copy_linear` writes them back the same way).  So:
+
+  raw region   4 KiB  (0x800 words x 2 bytes)
+  settings     2 KiB  (the low byte of each word)
+
+The low byte of a little-endian word is the even byte of the linear byte
+stream, so `raw[0::2]` is the settings block.
+
+    python3 dwt/nvram_dump.py --host 100.103.100.103
+    python3 dwt/nvram_dump.py --host HOST --out nvram.bin --raw nvram-raw.bin
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+
+import exploit
+
+NVR_BASE = 0x6000000
+NVR_BYTES = 0x1000          # 0x800 words x 2 bytes
+SETTINGS_LEN = 0x800        # one byte per word
+
+
+def main(argv):
+    ap = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--host", default="100.103.100.103")
+    ap.add_argument("--port", type=int, default=771)
+    ap.add_argument("--timeout", type=float, default=8.0)
+    ap.add_argument("--out", default="dwt/evidence/nvram-settings.bin")
+    ap.add_argument("--raw", default=None, help="also write the 4 KiB raw region")
+    ap.add_argument("--ascii", action="store_true", default=True,
+                    help="print strings/ASCII (default)")
+    a = ap.parse_args(argv[1:])
+
+    rd = exploit.RDebug(a.host, a.port, a.timeout, False)
+    rd.connect()
+    raw = bytearray()
+    try:
+        for off in range(0, NVR_BYTES, exploit.MAX_XFER):
+            n = min(exploit.MAX_XFER, NVR_BYTES - off)
+            raw += rd.peek(NVR_BASE + off * 8, n)
+    finally:
+        rd.close()
+
+    settings = bytes(raw[0::2])
+    with open(a.out, "wb") as fh:
+        fh.write(settings)
+    print(f"[+] raw  {len(raw)} bytes at bit {NVR_BASE:#010x}")
+    print(f"[+] settings {len(settings)} bytes -> {a.out}")
+    if a.raw:
+        with open(a.raw, "wb") as fh:
+            fh.write(raw)
+        print(f"[+] raw copy -> {a.raw}")
+
+    # Known landmarks from the NVRAM report and the unit's settings.
+    for needle in (b"ROM", b"100.103", b"LAT_", b"DECW$FONT", b"192.168", b":69"):
+        idx = settings.find(needle)
+        if idx >= 0:
+            print(f"    {needle!r} at settings offset 0x{idx:03x}")
+
+    # Printable ASCII runs, useful for reading the settings block.
+    runs, cur = [], bytearray()
+    for i, b in enumerate(settings):
+        if 32 <= b < 127:
+            cur.append(b)
+        else:
+            if len(cur) >= 3:
+                runs.append((i - len(cur), bytes(cur)))
+            cur.clear()
+    if len(cur) >= 3:
+        runs.append((len(settings) - len(cur), bytes(cur)))
+    print(f"[+] {len(runs)} printable runs:")
+    for off, s in runs[:80]:
+        print(f"    0x{off:03x}  {s.decode('latin-1')}")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main(sys.argv))
+    except (exploit.ProtocolError, OSError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        sys.exit(1)