SDD
f3d26ad687
dwt: trace the bottom diagnostics message box to @0xCB640 and the RAM message table
2026-10-18 17:49:13 +03:00
SDD
225394e1ae
dwt: xtext draws text in a real X window on the VT1200; TFTP retarget fetches the COFF
2026-10-18 17:28:08 +03:00
SDD
efef682b63
dwt/evidence: real-unit Diagnostics dialog and the session-manager hang after the first ROM-test run
2026-10-18 17:07:11 +03:00
SDD
e2c18ee70b
dwt: NVRAM dump over rdebug (settings block) and LANCE address ROM read; both match the model
2026-10-18 17:06:12 +03:00
SDD
0db6dd2e65
dwt: real-unit menu-driven Ethernet Address ROM test passes (All Diagnostics Passed); 24 is the separate port/termination test
2026-10-18 17:02:55 +03:00
SDD
2df00d32e5
dwt: real-unit MOP console works; SHOW reports Monitor Type VR319; TEST refused with DWT IN USE while a window is open
2026-10-18 16:40:19 +03:00
SDD
1c1f804a13
dwt: real X11 app via rdebug -- hostload --real; xhello window on the terminal (status 0, stage 6)
2026-10-18 16:32:58 +03:00
SDD
736e2c84a4
dwt: 50%-pattern real-unit capture at the correct 1280x1024/256-stride geometry
2026-10-18 16:30:30 +03:00
SDD
479d822aca
dwt/screenshot: real geometry is 1280x1024 with a 256-byte stride (160B image + 96B mask); --real captures the full screen
2026-10-18 16:26:37 +03:00
SDD
6adc04ba02
dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling
2026-10-18 16:22:24 +03:00
SDD
71588e5405
dwt/screenshot: --field even for the real unit's line-interleaved framebuffer; the capture now matches the glass
2026-10-18 16:18:27 +03:00
SDD
d6d6a7d44a
dwt: real-unit note -- root background is white, TM stipple is a display-mode/fetch effect, not a setting
2026-10-18 16:12:44 +03:00
SDD
f696a2e8f6
dwt/screenshot: --stretch for the real unit's 1024->1280 display; record geometry and the background stipple
2026-10-18 16:11:24 +03:00
SDD
4a0e1235c7
dwt: first real-unit contact -- TCP 771 and the computed challenge work; ROM peek matches v2.2; screenshot over peek
2026-10-18 15:55:48 +03:00
SDD
c0f142300b
dwt/screenshot.py: network screenshot over rdebug peek (VRAM -> PNG), verified against the live OS
2026-10-18 13:49:19 +03:00
SDD
0e4075958b
dwt: rdebug opcode 8 puts attacker text in the TM Messages box
2026-10-18 11:03:01 +03:00
SDD
05f1895bf5
dwt: visual injection experiments via the returning rdebug jump
2026-10-18 03:22:59 +03:00
SDD
1e5c095b72
dwt: reverse the dwt_prf challenge; remote poke/jump now works
...
The firmware transforms the reply (16-round Feistel per 8-byte record) and
compares it with the host-order copy of the challenge, so the answer is
swap4(inverse_transform(swap4(challenge))). The font stages are memcpy in
this path because dwt_prf initialises only mode 1.
challenge.py implements the transform and its inverse using the firmware's
fixed key/SP table; solve.py answers the challenge over TCP using the
unmodified exploit client. 320 forward vectors, the firmware's own inverse
and three live sessions validate it. A live run with no breakpoints poked
the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM
1024/1024. Notes and evidence under dwt/notes and dwt/evidence.
2026-10-18 02:36:23 +03:00
SDD
041c82cb73
dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform
2026-10-18 02:30:49 +03:00
SDD
5645bb00b3
dwt: exploit client and gate analysis; remote execution blocked at the challenge
2026-10-18 02:20:16 +03:00
SDD
a18881f45d
dwt: MOP console carrier client, protocol notes, and emulator evidence
2026-10-18 02:02:17 +03:00
SDD