arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-30 12:03:54 +02:00
Code Wiki Activity

Commit Graph

  • a4ed68c0e4 README: rewrite as the project front page -- status, findings, tidbits master arti 2026-10-30 12:03:01 +02:00
  • 8ff16b5b73 NETWORK_REPORT: machine-generated coverage -- 26 unmapped entries found and mapped arti 2026-10-30 11:25:54 +02:00
  • c02d475678 NETWORK_REPORT: map the remaining function entries; explain the label-vs-entry gap arti 2026-10-30 01:43:59 +02:00
  • 3a685b2775 NETWORK_REPORT: map the TCP helpers, socket/queue helpers and utilities arti 2026-10-30 01:43:21 +02:00
  • 8c8e0c4e24 NETWORK_REPORT: map the last addressed functions (codec table, dispatchers, re-arm) arti 2026-10-30 01:42:05 +02:00
  • 8d8f8656df NETWORK_REPORT: correct 54.4's coverage claim in place arti 2026-10-30 01:41:06 +02:00
  • 68f3c677df NETWORK_REPORT: cite the tcp_dooptions/tcp_mss call sites instead of an em dash arti 2026-10-30 01:40:55 +02:00
  • a390601aa9 NETWORK_REPORT: finish the mapping honestly -- glue vs source, plus quotes arti 2026-10-30 01:40:42 +02:00
  • 1364b37e83 NETWORK_REPORT: PCB offsets confirmed against struct inpcb arti 2026-10-30 01:39:49 +02:00
  • b8899645d0 NETWORK_REPORT: finish the BSD mapping (rip_input, tcp_input switches, ICMP checksums) arti 2026-10-30 01:39:37 +02:00
  • 3ad5a691b8 NETWORK_REPORT: map every reversed function to 4.4BSD source arti 2026-10-30 01:39:09 +02:00
  • b5fe6935e1 NETWORK_REPORT: CSRG tree provenance; IDON clearing shown to be optional arti 2026-10-30 01:35:58 +02:00
  • b534bab7d7 NETWORK_REPORT: provenance from 386BSD history, corroborating the ICMP case set arti 2026-10-30 01:31:48 +02:00
  • 874d1fbbf5 networking RE report + LANCE payload variants arti 2026-10-30 01:25:21 +02:00
  • 41b0979aef c-hello: first C program on the VT1200, running on real hardware arti 2026-10-29 18:25:38 +02:00
  • 6338095683 tools: add as34/ld34 TMS34010 binutils, ported to 64-bit Linux arti 2026-10-22 14:19:14 +03:00
  • f3d26ad687 dwt: trace the bottom diagnostics message box to @0xCB640 and the RAM message table SDD 2026-10-18 17:49:13 +03:00
  • 225394e1ae dwt: xtext draws text in a real X window on the VT1200; TFTP retarget fetches the COFF SDD 2026-10-18 17:28:08 +03:00
  • 3c16824f5b dwt: record that the owner moved windows on the real unit (extra windows are not a bug) SDD 2026-10-18 17:28:01 +03:00
  • edc26855fd dwt: full ROM dump over rdebug is byte-identical to vt1200_v22.bin (md5 match) SDD 2026-10-18 17:25:18 +03:00
  • 09f8607466 dwt/tcpip: LAN TFTP client (100.103.255.254) and a verified self-contained fetch + load on the real unit SDD 2026-10-18 17:12:00 +03:00
  • efef682b63 dwt/evidence: real-unit Diagnostics dialog and the session-manager hang after the first ROM-test run SDD 2026-10-18 17:07:11 +03:00
  • e2c18ee70b dwt: NVRAM dump over rdebug (settings block) and LANCE address ROM read; both match the model SDD 2026-10-18 17:06:12 +03:00
  • 0db6dd2e65 dwt: real-unit menu-driven Ethernet Address ROM test passes (All Diagnostics Passed); 24 is the separate port/termination test SDD 2026-10-18 17:02:55 +03:00
  • 6195556524 dwt: mailbox_watch.py -- poll 0x27C190/0x16F0 across a boot; results are consumed before rdebug is reachable SDD 2026-10-18 16:57:45 +03:00
  • 2df00d32e5 dwt: real-unit MOP console works; SHOW reports Monitor Type VR319; TEST refused with DWT IN USE while a window is open SDD 2026-10-18 16:40:19 +03:00
  • 1c1f804a13 dwt: real X11 app via rdebug -- hostload --real; xhello window on the terminal (status 0, stage 6) SDD 2026-10-18 16:32:58 +03:00
  • 736e2c84a4 dwt: 50%-pattern real-unit capture at the correct 1280x1024/256-stride geometry SDD 2026-10-18 16:30:30 +03:00
  • 479d822aca dwt/screenshot: real geometry is 1280x1024 with a 256-byte stride (160B image + 96B mask); --real captures the full screen SDD 2026-10-18 16:26:37 +03:00
  • 6adc04ba02 dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling SDD 2026-10-18 16:22:24 +03:00
  • 71588e5405 dwt/screenshot: --field even for the real unit's line-interleaved framebuffer; the capture now matches the glass SDD 2026-10-18 16:18:27 +03:00
  • d6d6a7d44a dwt: real-unit note -- root background is white, TM stipple is a display-mode/fetch effect, not a setting SDD 2026-10-18 16:12:44 +03:00
  • f696a2e8f6 dwt/screenshot: --stretch for the real unit's 1024->1280 display; record geometry and the background stipple SDD 2026-10-18 16:11:24 +03:00
  • 4a0e1235c7 dwt: first real-unit contact -- TCP 771 and the computed challenge work; ROM peek matches v2.2; screenshot over peek SDD 2026-10-18 15:55:48 +03:00
  • 8588340527 dwt/loader: end-to-end host loader over rdebug SDD 2026-10-18 15:34:25 +03:00
  • bebc0ccbc1 reference: map the ROM's third-party code -- MIT X11 R4, BSD 4.3 TCP/IP + BIND + telnet, TI RTS, and the font licences SDD 2026-10-18 15:25:43 +03:00
  • 01923ecb69 dwt/tcpip: map the socket API and fetch a file over TFTP into RAM SDD 2026-10-18 15:24:34 +03:00
  • 139d89a10c dwt/loader: COFF loader places GSPLNK images and runs them via create_process SDD 2026-10-18 15:19:44 +03:00
  • dcca6bee4d dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py SDD 2026-10-18 14:47:14 +03:00
  • a94e99579f dwt/gui: injected X window works via create_process SDD 2026-10-18 14:28:58 +03:00
  • a5769d3d2e dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs SDD 2026-10-18 14:08:31 +03:00
  • c0f142300b dwt/screenshot.py: network screenshot over rdebug peek (VRAM -> PNG), verified against the live OS SDD 2026-10-18 13:49:19 +03:00
  • 2cc3ab1c79 dwt/exploit.py: default to the computed dwt_prf answer -- echo is the known-failing mode and made a bare --peek look like a closed socket SDD 2026-10-18 11:28:00 +03:00
  • 0e4075958b dwt: rdebug opcode 8 puts attacker text in the TM Messages box SDD 2026-10-18 11:03:01 +03:00
  • 619aff0a93 dwt: visual injection -- confirm the persistent box on the live OS, and record that the blink is not established (toggle period is ~1536 frames, not 30) SDD 2026-10-18 03:24:38 +03:00
  • 05f1895bf5 dwt: visual injection experiments via the returning rdebug jump SDD 2026-10-18 03:22:59 +03:00
  • 1e5c095b72 dwt: reverse the dwt_prf challenge; remote poke/jump now works SDD 2026-10-18 02:36:23 +03:00
  • 041c82cb73 dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform SDD 2026-10-18 02:30:49 +03:00
  • 5645bb00b3 dwt: exploit client and gate analysis; remote execution blocked at the challenge SDD 2026-10-18 02:20:16 +03:00
  • 2c7b2e8c2e dwt: gate B is real; challenge args must follow the answer SDD 2026-10-18 02:19:54 +03:00
  • bd58af3569 dwt: gate A is a 2-bit field and is open; correct the static reading SDD 2026-10-18 02:07:18 +03:00
  • a18881f45d dwt: MOP console carrier client, protocol notes, and emulator evidence SDD 2026-10-18 02:02:17 +03:00
  • 0a1042e81f dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1) SDD 2026-10-18 01:55:56 +03:00
  • 68a1aeabdc dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake SDD 2026-10-18 01:55:41 +03:00
  • be32e8a138 harness: regenerate duart2_default_tm_frame3000.png -- the cited evidence image predated the LANCE and contradicted the README (no MAC on screen) SDD 2026-10-18 01:21:41 +03:00
  • 1608a68cdb hello-world: the TMS34010 SDK assembles code that runs on the emulated VT1200 SDD 2026-10-18 01:20:38 +03:00
  • 0c3d24b93b tools/tms34010-sdk: the two dis34 bugs are fixed (af7d3565a5) -- record it, with the 2623/6235-line scale of the correction SDD 2026-10-18 00:55:12 +03:00
  • af7d3565a5 dis34: print long relative JR as jr and surface B-file SP as b15 SDD 2026-10-18 00:54:34 +03:00
  • 8bc8d90ea6 tools/tms34010-sdk: record the results -- GSPA (not as34), byte-exact round trip at bit 0x3F208000, 1990 tools are OS/2, dosemu 5x faster, plus the traps SDD 2026-10-18 00:40:25 +03:00
  • 7d299451da reference: TMS34010 SDK investigation; prove GSPA round trip SDD 2026-10-18 00:39:32 +03:00
  • 960b256b00 tools/tms34010-sdk: add DOSBOX.md -- how to run the SDK's DOS tools headless and at speed, with measurements SDD 2026-10-18 00:12:18 +03:00
  • 1ec84abf03 tools: TMS34010 SDK (curated) -- the 1987 ASM/LNK package and the 1990 Code Generation Tools, so the project has an assembler/linker/compiler it was missing; scanned docs excluded SDD 2026-10-17 23:59:24 +03:00
  • c21cab05f8 harness: net-setup.sh -- recreate the tap+bridge the harness needs (they do not survive a reboot) SDD 2026-10-17 14:15:17 +03:00
  • 307df67f9d harness/mame: the TFTP PCF loader skips BITMAPS, so the n*4 overflow is not on that path arti 2026-10-17 14:14:07 +03:00
  • 3a51b95317 harness/fontwork: reproduction scripts for the TFTP Disk-full investigation arti 2026-10-16 22:03:49 +03:00
  • 7efb4880f0 harness: the TFTP font 'Disk full' is the terminal's own tftp_close, not a storage or map bug arti 2026-10-16 22:03:16 +03:00
  • 1051bf2940 patches: MAME is now pushed as a full repo (branch vt1200-local) -- correct the README, which said it was not, and say why the patch is still kept SDD 2026-10-16 17:50:58 +03:00
  • 1561e34967 patches: capture the MAME local edits as a 50-line patch (the MAME remote rejects shallow updates, so a mirror would cost GBs for a 50-line diff) SDD 2026-10-16 17:42:13 +03:00
  • 264d5330ad harness/serve.py: optional BOOTP responder (--bootp) so the VT1200 gets an IP at boot SDD 2026-10-16 17:27:00 +03:00
  • d4a3ccc42c harness: model the battery-backed NVR at bit 0x6000000 arti 2026-10-16 17:25:04 +03:00
  • b6da987aae harness: dump the LANCE DMA; the C - LANCE TEST's failing frame carries no FCS by design arti 2026-10-16 17:12:02 +03:00
  • 5ed4048720 gitignore: ignore root RAM dumps (ROM stays tracked) and the Ghidra transient lock; untrack the lock file SDD 2026-10-16 17:11:29 +03:00
  • f05200e44e gitignore: cover test frame dumps written into the project root, not just harness/mame/ SDD 2026-10-16 17:11:01 +03:00
  • 82ab65bc82 run.sh: document ScrollLock (UI_TOGGLE_UI) as the fix when MAME's menu stops responding, and that closing the window is a clean exit SDD 2026-10-16 17:01:04 +03:00
  • 14f78f3cbe plan: the network provider must be selected per device (interface=-1 is none); index 0 = taptun on this build; NVRAM must not be isolated SDD 2026-10-16 16:56:24 +03:00
  • b65d9ef670 run.sh net: the per-device interface selection must PERSIST (an empty cfg dir produces no tap); -networkprovider alone does not choose one SDD 2026-10-16 16:54:08 +03:00
  • b356553825 run.sh net: use a private cfg directory -- a saved per-device interface=-1 silently overrides -networkprovider and no tap is ever opened SDD 2026-10-16 16:53:14 +03:00
  • a0d752062f run.sh: add a net mode (skip + tablet + networkprovider taptun) for the crash-work configuration SDD 2026-10-16 16:48:40 +03:00
  • 7612fcbda9 reference: LANCE loopback-FCS datasheet evidence (MAME condition is right) SDD 2026-10-16 16:46:47 +03:00
  • 60b0b02e3c run.sh+README: fix the stale tablet comment; amend rule 2 with the orchestrator's own collision (uncommitted edits get swept too) SDD 2026-10-16 16:41:16 +03:00
  • d1be7da1f1 run.sh: replace the now-redundant tablet mode with a faithful mouse mode (tablet is the default) SDD 2026-10-16 16:40:52 +03:00
  • 634246ecb1 harness: LANCE Ethernet -- register file, 8-byte address ROM, INT1 and byte<->bit DMA SDD 2026-10-16 16:39:21 +03:00
  • 7bf195e615 reference: commit skip_frame3000.png (the X11 weave, cited as evidence in the README); ignore worker scratch SDD 2026-10-16 16:23:15 +03:00
  • 97dbea7fed reference: commit the real-boot frame evidence (33MB) with a NOTES.md; gitignore the 201MB source recording SDD 2026-10-16 16:22:59 +03:00
  • f46363b473 AGENTS.md: symlink to harness/mame/README.md so agent harnesses auto-read the working conventions (single source, no drift) SDD 2026-10-16 16:20:37 +03:00
  • 6d8097360c harness: the VSXXX-AB tablet is the default pointing device; VT1200_MOUSE=1 forces the faithful mouse back SDD 2026-10-16 16:19:46 +03:00
  • 7f0b2ff27c plan: record host-side tap/bridge plumbing for the LANCE network milestone (MAME's tap is tap-mess-<uid>-0, not tap0) SDD 2026-10-16 16:17:43 +03:00
  • 0e2d7d9d0d docs: PROTOCOL.md tablet coordinate range (0..2199) and the device-code discriminator, confirmed against the running OS SDD 2026-10-16 16:10:11 +03:00
  • 942a45800b run.sh: tablet mode (skip + VSXXX-AB absolute pointing); lightgun options in COMMON, verified inert by frame-md5 A/B SDD 2026-10-16 16:09:51 +03:00
  • 065f946e2f harness: VSXXX-AB tablet on DUART2, driven by the absolute host pointer arti 2026-10-16 16:07:36 +03:00
  • 02acabb7ef harness: real LK401 keyboard + VSXXX-AA mouse devices on DUART2 arti 2026-10-16 15:33:30 +03:00
  • 7e65692b54 reference: DUART counter/timer period when CTUR/CTLR unprogrammed -- datasheet does not settle it SDD 2026-10-16 15:00:20 +03:00
  • a6b6ae82ef docs: correct Q4 of the level-1 bypass analysis -- a level-1 failure is NOT fatal (superseded answer kept as record) SDD 2026-10-16 14:57:54 +03:00
  • 41454d5d4c harness: the stub level-1 run continues past both DUART failures; correct the "fatal/LED loop" claim arti 2026-10-16 14:56:47 +03:00
  • 7296a86034 run.sh: add the stub mode and document VT1200_IO_PATH_STUB as a non-faithful opt-in SDD 2026-10-16 14:32:07 +03:00
  • f7caf9aed8 harness: opt-in VT1200_IO_PATH_STUB stand-in for the level-0 keyboard-port test fixture SDD 2026-10-16 14:31:20 +03:00
  • 215fd573db docs: level-0 I/O test is not honestly satisfiable by any documented device; record why and the only honest route to close it SDD 2026-10-16 14:17:10 +03:00
  • a1e3ebfaff reference: the level-0 10-byte puzzle -- count-only, no loopback, no 10-byte device message SDD 2026-10-16 14:16:37 +03:00
  • d017953d52 docs: plan the LANCE Ethernet model + network font delivery SDD 2026-10-16 14:16:05 +03:00
  • 47dac6b283 docs: DUART2 modelled; Terminal Manager reached; the bare run's old level-1 pass was a latch artefact (honest failure now) SDD 2026-10-16 14:00:23 +03:00