-- live_check.lua -- verification with NO breakpoints and no memory writes.
--
-- This script only reads RAM/VRAM once per frame.  There is no bpset anywhere,
-- so the exploit cannot be attributed to any debugger action: the only thing
-- the emulator does is report what the firmware and the payload left in memory.
local machine = manager.machine
local cpu = machine.devices[':maincpu']
local dbg = machine.debugger
local space = cpu.spaces['program']
if not dbg then machine:exit(); return end
dbg.visible_cpu = cpu

local MAGIC1 = 0x01810000
local MAGIC2 = 0x01810010
local COUNT  = 0x01810020
local VRAM   = 0x04019040
local f = 0
local done_at = nil
local last = nil

emu.register_frame_done(function()
	f = f + 1
	if f % 500 == 0 then
		print(string.format("CHECK frame %d MAGIC1=%04X MAGIC2=%04X COUNT=%04X",
			f, space:read_u16(MAGIC1), space:read_u16(MAGIC2), space:read_u16(COUNT)))
	end
	if done_at == nil and space:read_u16(MAGIC1) == 0xDEAD then
		done_at = f
		local filled, holes = 0, 0
		for r = 0, 63 do
			for c = 0, 15 do
				if space:read_u16(VRAM + r * 1024 + c * 16) == 0xFFFF then
					filled = filled + 1
				else
					holes = holes + 1
				end
			end
		end
		print(string.format("CHECK payload-ran: MAGIC1=%04X MAGIC2=%04X COUNT=%04X",
			space:read_u16(MAGIC1), space:read_u16(MAGIC2), space:read_u16(COUNT)))
		print(string.format("CHECK payload-ran: VRAM block %d/1024 words FFFF, %d holes",
			filled, holes))
	end
	if done_at and f >= done_at + 120 then
		print(string.format("CHECK exiting at frame %d (payload seen at %d)", f, done_at))
		machine:exit()
	end
	if f >= 12000 then
		print("CHECK timeout: no payload markers")
		machine:exit()
	end
end, "vt1200-live-check")
dbg.execution_state = 'run'