# Third-party and open-source code in the VT1200 ROM

A map of the non-DEC code in `vt1200_v22.bin` (md5
`b46a3e442ccb86134d2356bd70d22fd2`), and how each identification was made.

Two kinds of evidence are used, and they are not equivalent:

* **Source IDs** — `$Header:` (RCS) and `@(#)` (SCCS) strings compiled into the
  image. These name the original source file and, for RCS, the revision and
  date. Strong, but they are file names, not a licence statement.
* **Code match** — disassembly compared with a known source tree (e.g. the
  X11R4 sources under `reference/x11/r4`).

Copyright strings are quoted where they exist. **The absence of a copyright
string is not evidence of absence**: most of this code carries its notice in
source comments, which do not survive compilation.

## Summary

| component | evidence | notes |
|---|---|---|
| **MIT X11 R4** | `mfb*`, `pcf*`, `snf*`, `bdf*`, `Xlib` strings; exact match to `reference/x11/r4/.../pcfrbitmaps.c` | X server + Xlib + font parsers |
| **BSD 4.3-era TCP/IP** | `$Header`/`@(#)` IDs for the full socket/TCP/IP/mbuf file set | ported at DEC by `craig`, 1989-10-05/06 |
| **BSD BIND resolver** | `res_comp.c`, `res_init.c`, `res_mkquery.c`, `res_send.c`, `gethostent.c` | classic 4.8/4.9-era resolver |
| **BSD telnet + TN3270** | `telnet.c`, `commands.c`, `network.c`, `ring.c`, `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c` | same 1989 import |
| **BSD inetd** | `inetd.c` | |
| **BSD lpd lineage** | `lpd_lance_devdriver.c` | LANCE driver for the printer daemon |
| **BSD libc pieces** | `strcasecmp.c`, `ctype.c`, `errlst.c`, `inet_addr.c`, `inet_ntoa.c` | mixed with the TI runtime (below) |
| **TI C runtime V2.00** | ROM `strlen`/`strcpy`/`strcmp` match `RTS.SRC` instruction for instruction | proprietary, shipped with the SDK |
| **Bitstream / Bigelow & Holmes / DEC Japan fonts** | copyright strings, font names | third-party, **not** open source |

## 1. MIT X11 R4

The largest non-BSD body. The server is the MIT sample server, with both
framebuffer implementations:

* `mfbValidateGC`, `mfbFaultGlyph`, `mfbFreeGlyphCacheSpace`,
  `mfbDestroyDMD` — monochrome framebuffer (`mfb`).
* `cfb` strings are present as well (colour framebuffer), though the VT1200 is
  monochrome.
* Font formats: `pcfReadBitmaps`, `pcfReadProperties`, `pcfReadMetrics`,
  `pcfReadEncoding`, `pcfReadAccelerators`, `Invalid SNF font file format`,
  `unknown bdf encoding format`.
* Xlib: `BadLength - request length incorrect; internal Xlib error`,
  `Xlib: sequence lost`, `XlibMessage`, `/usr/lib/X11/XErrorDB`.

The PCF error strings match `reference/x11/r4/contrib/server/pcf/fonts/lib/pcf/pcfrbitmaps.c`
byte for byte (including `allocation failure in pcfReadBitmaps (offsets,%d)`,
which R5's monolithic `pcfread.c` does not contain). That is the basis for
calling it R4 rather than "X11 generally".

There is **no X11 copyright string** in the image; the identification is
code-level.

## 2. BSD TCP/IP stack

The file IDs are the classic BSD 4.3/Net-1 set. RCS headers show a bulk import
by `craig` on 1989-10-05/06, with later files (e.g. `route.c`) on 1990-03-15.

| layer | source files |
|---|---|
| sockets / mbufs | `uipc_domain.c`, `uipc_mbuf.c`, `uipc_proto.c`, `uipc_socket.c`, `uipc_socket2.c`, `uipc_usrreq.c`, `sys_socket.c`, `mbuf_calls.c`, `uio.c`, `syscalls.c`, `af.c` |
| TCP | `tcp_input.c`, `tcp_output.c`, `tcp_subr.c`, `tcp_timer.c`, `tcp_usrreq.c`, `tcp_debug.c` |
| UDP / IP / ICMP / raw | `udp_usrreq.c`, `ip_input.c`, `ip_output.c`, `ip_icmp.c`, `raw_ip.c`, `raw_cb.c`, `raw_usrreq.c` |
| interfaces / routing | `if.c`, `if_ether.c`, `if_loop.c`, `if_sl.c`, `route.c`, `in.c`, `in_pcb.c`, `in_cksum.c`, `in_proto.c`, `inet_addr.c`, `inet_ntoa.c` |

`if_sl.c` (SLIP) is the clearest sign that this is the stock BSD file set rather
than a lookalike.

DEC's own additions in the same area are distinguishable by name and by the
absence of SCCS/RCS IDs: `lance_inet_interface.c`, `dwt_file.c`, `dwt_tftp.c`,
`sys_dwt.c`, `server.c`, `init.c`, `test.c`, `xclients_smlat_dispatch.c`,
`inode.c`.

**Licence caveat:** no "Regents of the University of California" string appears
in the image. The BSD notice was in source comments. The RCS/SCCS IDs and the
file set establish lineage; they do not establish the licence text that
accompanied it.

## 3. BSD resolver, telnet and inetd

* **BIND resolver:** `res_comp.c`, `res_init.c`, `res_mkquery.c`,
  `res_send.c`, plus `gethostent.c`. This is the 4.8/4.9-era resolver, the
  source of the "Primary name server IP address %s is invalid." path.
* **telnet:** `telnet.c`, `commands.c`, `main.c`, `network.c`, `ring.c`,
  `sys_bsd.c`, `terminal.c`, `utilities.c`, `tn3270.c`. This is the whole BSD
  telnet client source set, including TN3270.
* **inetd:** `inetd.c`.
* **lpd lineage:** `lpd_lance_devdriver.c` — the LANCE device driver for the
  printer daemon; the `lpd_` prefix points at BSD `lpd`.

## 4. TI C runtime — not open source, but identifiable

The ROM's string and memory functions are the TI RTS V2.00, not BSD:

* ROM `strlen` at `0x07F68B1A` implements exactly
  `rstr = string - 1; n = 0; while (*++rstr) n++;`
* ROM `strcpy` at `0x07F68AE4` matches the RTS loop and return value.
* ROM `strcmp` at `0x07F68AA0` matches the RTS comparison.
* ROM `memcpy` at `0x07F68880` is `PIXBLT_L_L`, consistent with the RTS
  `memcpy` → `movmem`.

The SDK ships `RTS.LIB`, `RTS.SRC` (full source), `FLIB.LIB` and the headers on
the 1987 C-tools floppy (`1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img`,
dir `C2`).

**The allocator is not the RTS one.** `RTS.SRC`'s `memory.c` uses a 1000-byte
static `sys_memory`; the ROM's `malloc` (`0x07EE0246`) is a multi-arena
allocator over the 4 MiB RAM (`0x1E8930` arenas, global pool `0x1E8AC0`). So the
firmware mixes the TI runtime (strings, ctype, qsort, printf) with a different
memory manager.

## 5. Fonts (third-party, not open source)

Copyright strings in the font data:

* `Copyright (c) 1988 Bigelow & Holmes Inc.` — Pellucida.
* `Copyright (c) 1988 Bitstream, Inc., Portions Copyright 1988 Digital
  Equipment Corp.` — Bitstream Terminal.
* `Copyright (c) 1988 Digital Equipment Corporation Japan.` — JISX0208 Kanji.
* `Copyright (c) 1988/1990 Digital Equipment Corp.` — DEC Terminal, DECtech.

## 6. Checked and not found

No `regex`/`regcomp`, no `curses` or `termcap`, no `getopt`, no `crypt`
strings, no MD5, no zlib, no NFS, no SNMP, no Kerberos, no PEX/XIE server
extensions. The `ICE` and `XIE` substring counts are noise ("device",
"service", …), not the X11 protocols.

## 7. Open question: the `dwt_prf` transform

The rdebug challenge is structurally **DES**: eight 64-entry S-box tables at
`0x1C0200`, 6-bit indices, 16 Feistel rounds, a fixed key schedule. There are
no `DES` or `crypt` strings, so the implementation is not attributable from the
binary alone. If it is standard DES with a fixed key, the challenge is much
weaker than the "font render + Feistel" description first suggested.

## Reproduce

```sh
cd /home/arti/code/k-space/vt1200

# every compiled source id, unique
rg -o '@\(#\)[A-Za-z0-9_.-]+|\$Header: [A-Za-z0-9_.-]+' \
   reference/rom-strings.txt | sed 's/@(#)//; s/\$Header: //' | sort -u

# X11 fingerprints
rg -n 'mfb|pcf|snf|bdf|Xlib|XErrorDB' reference/rom-strings.txt

# font copyrights
rg -n 'Copyright \(c\) 1988 (Bigelow|Bitstream)|Digital Equipment Corporation Japan' \
   reference/rom-strings.txt
```