mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
1e5c095b72
The firmware transforms the reply (16-round Feistel per 8-byte record) and compares it with the host-order copy of the challenge, so the answer is swap4(inverse_transform(swap4(challenge))). The font stages are memcpy in this path because dwt_prf initialises only mode 1. challenge.py implements the transform and its inverse using the firmware's fixed key/SP table; solve.py answers the challenge over TCP using the unmodified exploit client. 320 forward vectors, the firmware's own inverse and three live sessions validate it. A live run with no breakpoints poked the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM 1024/1024. Notes and evidence under dwt/notes and dwt/evidence.
18 lines
907 B
Plaintext
18 lines
907 B
Plaintext
Validation of dwt/challenge.py against emulator ground truth
|
|
================================================================
|
|
dwt/evidence/oracle-forward-boot1.log: 70/70 16-byte vectors (each = 2 independent records)
|
|
dwt/evidence/oracle-forward-boot2.log: 70/70 16-byte vectors (each = 2 independent records)
|
|
fresh-boot key identical: True; SP table identical: True
|
|
key[0:16] = 2C3E1F020130080D2D23281F08001912
|
|
|
|
dwt/challenge_vectors.json: 180/180 vectors
|
|
|
|
firmware inverse function 0x3F5AADA0 vs challenge.invert(): 6/6
|
|
|
|
live TCP challenges answered with computed bytes (dwt/evidence/live-run*/):
|
|
run 1 connection 1: memcmp a8=00000000, opcode 7 -> Done, peek ROM ok
|
|
run 1 connection 2: memcmp a8=00000000, poke+jump, MAGIC DEAD/BEEF/0400, VRAM 1024/1024
|
|
run 2 (no breakpoints at all): opcode 7 + peek + poke + jump, markers identical
|
|
|
|
TOTAL forward vectors matched: 140 (oracle) + 180 (json) = 320
|