SDD 1e5c095b72 dwt: reverse the dwt_prf challenge; remote poke/jump now works ...

The firmware transforms the reply (16-round Feistel per 8-byte record) and
compares it with the host-order copy of the challenge, so the answer is
swap4(inverse_transform(swap4(challenge))).  The font stages are memcpy in
this path because dwt_prf initialises only mode 1.

challenge.py implements the transform and its inverse using the firmware's
fixed key/SP table; solve.py answers the challenge over TCP using the
unmodified exploit client.  320 forward vectors, the firmware's own inverse
and three live sessions validate it.  A live run with no breakpoints poked
the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM
1024/1024.  Notes and evidence under dwt/notes and dwt/evidence.

2026-10-18 02:36:23 +03:00

..

cfg

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

debug-challenge.log

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

debug-live.log

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

mame.log

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

serve.log

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00