mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
1e5c095b72
The firmware transforms the reply (16-round Feistel per 8-byte record) and compares it with the host-order copy of the challenge, so the answer is swap4(inverse_transform(swap4(challenge))). The font stages are memcpy in this path because dwt_prf initialises only mode 1. challenge.py implements the transform and its inverse using the firmware's fixed key/SP table; solve.py answers the challenge over TCP using the unmodified exploit client. 320 forward vectors, the firmware's own inverse and three live sessions validate it. A live run with no breakpoints poked the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM 1024/1024. Notes and evidence under dwt/notes and dwt/evidence.
92 lines
11 KiB
Plaintext
92 lines
11 KiB
Plaintext
Warning: -video none doesn't make much sense without -seconds_to_run
|
|
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
|
|
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
|
|
vt1200: scanline#1 line=1 enabled=1
|
|
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
|
|
vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
|
|
vt1200: scanline#2 line=0 enabled=1
|
|
vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
|
|
vt1200: scanline#3 line=1 enabled=1
|
|
vt1200: scanline#4 line=2 enabled=1
|
|
ORACLE start frame=1000 p200=00000000 p400=00000000
|
|
ORACLE init done @1C0200=0090C8D0 @1C0220=00000000 @1C0240=00000000 @1C0260=00910910 @1C0400=00000001
|
|
ORACLE KP=00910910 FP=0090C8D0
|
|
ORACLE KEY 2C3E1F020130080D2D23281F080019120B333920171A00063227333C09041308370E1D18020B0107112D3C2B292C12203A3B250702003D030A1E3B0B272C00103B110B1C2010212E052D2B2C11092A10262725320410113D2B063D2D0239220030371C0D0006143512193F310A302204351F232B3004061323082E3E2D1A2400
|
|
ORACLE FTAB 0082800000000000008000000282800002808000028200000200000000800000000200000082800002828000000200000202800002808000000080000200000002020000000280000002800000820000008200000080800000808000020280000280000002008000020080000280000000000000020200000282000000008000008000000282800002000000008080000082800000008000000080000002000002808000008000000082000002008000000200000200000002028000028200000282800002800000008080000202800002008000020200000282000000828000020200000002800000028000000000000280000000820000000000000280800010400840004000400040000010400800000008001000000010000840104000401000004010400840004008400000004000400040000008001000000010000840004008001000080010400040000000000000004000400000104008000000084010000800100000400000000000400800104000000040084000000840104000000000000010400800100008400000080010400040000008400040084000400000000008400040004010000000104008401040080010000000004000000000004010400000004008400000080010000040100008001040004010000040100008000040080000000000004000401040000000000040100008401040084000400800040100000001010400000000040001040001000400000000040101000001000404000100040000040400000400000100040101040400010000000104040100000000000404000000000101040001000000010100000001040400010404010100040100040001010000000100040100040400000004010104000100000000000400010104000000040400010004010000000001000001010400010004000000000001000004000100040101040001000404000004000100000000000004000104040100040000010000000004040101040400000004010100000101000400000400000104040100040401000000000104040101000400000004000104000101000010408040100080401000804000000040104000400040800000408000100080000000000010400000104000401040804000008000000000400040000000408000000080001000000000400000104080400000000000400000100080401000004000408000000080401000004000400000100000401040004010408040000080400040000000408000104000401040804000008000000000000000000010400040100000400040004000408000000080001040804010008040100080400000004010408040000080000000800010000000004080001000804010400040004080001000804010000000004000001040804000000000004000001000004010400080000000800004010000040180000021000004008000000000000020000004018000042000000400800000018000042080000021000004218000040000000020000000010000042000000420000000008000002080000421800004218000000100000421800000200000000000000021800004010000000100000021800004000000040080000021800000000000000100000020000004018000002180000420800000010000002000000421800004018000042080000000000000010000042180000421800004000000002180000421000004010000000000000420000000218000040080000001800000200000040000000000000004208000040180000020080000100000201000200000082020100000201008000000082020100000200000200010082020000000200008000010080020000020001000000010082000000000000008002000082000100020000000202000082000100800000008002010080020100000000008202000002020100820000000202000002020100000001000200010080000000800201000202000082020100000200008200000080000100000200000200010000000100820000008000010082020100020200000002010082020000020201000000000080020100800000000200000000020100820200000200000080020000820001000000000002020100000001008002000082000100000100001001002010400020000000000040000010400020104100000041002010410020000100000000000010000020100000000000002010010020104000000040002010410000100100000040002010000020000100200041002010010000000100200040000010400000104100200041000010000000000000200041000000000020004100000001000010400020104000201001002010010020100000001001000000000020004000200001000000410020104000001041000000410020104000001000002010410020000100200041000000000000100000001041002000000000104100000001002000400000100000200040002000400000100100020080008000800000000020020080208000000082008000820000000000000082000020000000208200802080008020000080208200802000008000020000000000002082000000800080008200800000008020020000200200002080008020820080000000000000000000020000208200000080008000820080200000002002008020000000200000802080008000020000000200002080008000020080200000800082000000020000008000002082000020800000008000002002008000800000000200802082000020020000008000002080008000820080008000000002008020800080200000802002008000020080000200002000000000800080208
|
|
ORACLE SEED 55F861C7E51311D4C800000000000000000000000000000000000000000000000000000000003A322A221A120A023C342C241C140C043E362E261E160E06403830282018100839312921191109013B332B231B130B033D352D251D150D053F372F271F170F07280830103818402027072F0F37173F1F26062E0E36163E1E2505
|
|
ORACLE R1 39312921191109013A322A221A120A023B332B231B130B033C342C243F372F271F170F073E362E261E160E063D352D251D150D051C140C04
|
|
ORACLE R2 01020406080A0C0E0F11131517191B1C0E110B180105031C0F06150A17130C041A0810071B140D0229341F252F371E28332D21302C31273822352E2A32241D200E040D01020F0B08030A060C05090007000F07040E020D010A060C0B0905030804010E080D06020B0F0C0907030A05000F0C080204090107050B030E0A00060D
|
|
ORACLE R3 0E110B180105031C0F06150A17130C041A0810071B140D0229341F252F371E28332D21302C31273822352E2A32241D200E040D01020F0B08030A060C05090007000F07040E020D010A060C0B0905030804010E080D06020B0F0C0907030A05000F0C080204090107050B030E0A00060D0F01080E060B03040907020D0C00050A
|
|
ORACLE R4 8000000040000000200000001000000008000000040000000200000001000000080000000400000002000000010000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
|
ORACLE 00000000000000000000000000000000 90DE09B47285581790DE09B472855817
|
|
ORACLE FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6A81040BF22944796A81040BF2294479
|
|
ORACLE 71471D94EC8993C744BCD8CFCB3CC5A6 51BB36A47ABF37381DFBB4E88A2E7E0F
|
|
ORACLE 6819A8E6CAA4E23B69BD418941DA1EDC 96E3FFE7D578C80316D03D45E6993285
|
|
ORACLE 4ED83613C682494C19E2740EA94A4F39 AC206B3295B638C37446B2D1C42B8104
|
|
ORACLE 4920C6AE776DB8BE592551547A3428E1 56354353B10EA5DC8A98A50255B3958C
|
|
ORACLE 414D180A3571DE14F241770BEA0537B5 989EFDFA11AA33978EEA9BBEBA20600C
|
|
ORACLE DD78A93A16592A906BB244A8F2E6CB5A 8996F85FBD87D4D750A112135CF14EAB
|
|
ORACLE 837EBA11F2B0CB3609B3D85E48C5F432 0655BA88004D24A665E001E441C31D24
|
|
ORACLE 5CF848225FC0AFC9D53E111E624A8060 E703106CFD05FC6656F34FF7D76CB603
|
|
ORACLE 4D4314C0B59687CB950F8F9E79E2FFC8 DF0A6E99502D24FA98F4EEB82A4045AD
|
|
ORACLE FD789CFD0AFBC080D0A0B14E83B7BE0B B110596B898A77BC027D16CBEDE12282
|
|
ORACLE D5741FAE367B8AEBCE2D956336B5CF8E EE2D417EBD755A0A852EA62EDB3C493E
|
|
ORACLE FAD19C64CF60D4CE95B01BD00B85FE73 3D7A77DEA62599F8C155F770AC5E8A88
|
|
ORACLE 54E9D2732DB74DADEBE5E1473794DC9D E528ADCF75B272FC23D20640A436BBF3
|
|
ORACLE 8AD941EF664964CB5A47473BB30DB7AF 4A86CAFE092B8493911CFF5075875316
|
|
ORACLE 027B26A952A2472B26106CE035D99F0C D4131B34AEE4BF72912281B9F6FED1B4
|
|
ORACLE E46A8235870DE78F583B2E2833A562D8 707BDCDA6A0FA41D5477C560DAFAFA0A
|
|
ORACLE 170112E65D95F17AB6842DC7E6DC8FF5 9A1D870CC5D7B23FEB59C1D8933FF1C8
|
|
ORACLE 425B57CFEA04D531C766C72F43A77606 7E5E1204D9D29E8D1E19F7AD2535AA3E
|
|
ORACLE CB538FC306E7C2B5D21B1C9403F3256E 6FDB62EA2174929825EE2240EF63626E
|
|
ORACLE DA84B9554787A7CADF9F0BE79B6A6B50 73EBF9713D40B9697B865953D8B83578
|
|
ORACLE 564994D804F033F2B3AC32DE4477D88F EE9696DEB3C42F68C2DF20D04A348BDF
|
|
ORACLE E6BE9F5E56ECD471D7BEF1E9F346BACF 7FAC94CF4EF2359271D4E346CA3C85C8
|
|
ORACLE F0BC1ABC1108BB4A9210673E61C12172 47AFE67DCAD7D549B6554BE1ABC3332B
|
|
ORACLE 9CDF0283CE8DD540E99C72CD0393DB9A 5C1C456B64ED113841EA4B88098B9377
|
|
ORACLE D1821808E487D2D5A51DB14B1128772D FF5D23AC047F111548F28D0CA649AEC3
|
|
ORACLE 35C1D95C69C1214C4C0F852B83AA44CB 5135421CDAA67783843C091DADD36DCF
|
|
ORACLE 3075865334C6F1AA25AD0B9F0E0452D8 20B9FA93A4A126F9D4948177AC12964A
|
|
ORACLE E93B1D81DDE031B038F1229A2BE27078 63CDAE2DC350A52AED062870599461AF
|
|
ORACLE 476C5D37BB1B8FE24A966AD00FAD2B8D 0C3BC8A120F4BD0DAA96B2ED5503DBA0
|
|
ORACLE F125C589E4437C82E41942B3B292D4BA 8E6D5EE61A3C87F2AFB31085D60BED18
|
|
ORACLE 4D3F944A2FE025954DB2C976CB7C7A62 4665CA8F16DA416331098B4AEA105D04
|
|
ORACLE 8357C90D34407ADB8A5FDD0DD214EAA8 7FB2EDE7F618009C24CF2A33D6B93DE2
|
|
ORACLE 79C72424496C2ADA64D91D2BFCC7B56F 38DEC7DC3C4FA396D79E9BB73FFB04D9
|
|
ORACLE D8AA22A48631A4D3609BE94141C02A5B 1AAE71F6BE60D7AB81EF7F373344DDAC
|
|
ORACLE 05DA045FC21817CAC7E1608559E857CE B5B3509AFD63555A2FE6D245195B2DF1
|
|
ORACLE 28F4C8E7936D7181A0A661E7B9EC0BEB 7FEE411EE6451EC3B4D552882C549A3E
|
|
ORACLE 27522D91503A637DB0A48A1C9936D595 83A4D4046364DA46AC757DCC0CF32635
|
|
ORACLE AA0FB16E114C5AFE80563A97F0F2056F 70D5FFCEC75445F5F43BF99E9C810F22
|
|
ORACLE 18069653AC2C860A56F8918A7509AADD D102633E9962A9EC6880E56CE896981F
|
|
ORACLE 98D2D8D1B926D7623A856EE8A0299101 9E17968E15D59EB1CD60B8A50C5AC68A
|
|
ORACLE 11CE373C8E45F98AF1B77065A6BA4BBD C9AB7C6A08094AA356785A793DC6ACE2
|
|
ORACLE 291532A743535EC5040AF5737FE826B6 CCAC4D89D191B2AC94D7408FA6CC637C
|
|
ORACLE 488309E5AEDD3415B9B81D46E29F324F 0B18041E0B1F9E1067F8D73DD7EA1359
|
|
ORACLE 95B1BA89672C693E17BDC6D0468A3DA9 1AC8B7CD2153F0D7560DD01C2F3350DC
|
|
ORACLE F6FB03E6C44CAEC2E5D490C4E212D7A8 F005BEA9600AFFDD9DFC0D0CB22BAE77
|
|
ORACLE 137C650FDD0870E6AB77D996AD644DF0 1721E413829999D72E299FDDC90ED988
|
|
ORACLE 53101ED688EADFAAAFE1C1785E6AB0E3 198D6F5D48E871893EB8021879EBD290
|
|
ORACLE DD502DD05D3FEAD4F80E275E6CD0CFA4 1EFDB76D5D6562164472FE16919F9908
|
|
ORACLE 9799514FB21040E54DB9A9FA0EFF3816 61668CA3EB55AFDE098765474F0214F9
|
|
ORACLE 290409659F294F21365CA7C03B243ADD 34C661B93EA3FC5807200523CD7AFC3C
|
|
ORACLE FA6E95E7FA15488BF93340E2AA2AE45A DFD211AC91F37A00D0FEDB2053130598
|
|
ORACLE 3170F2665A1E18E59D385253D2BA06B2 3186138A51A9DCAFD2DBE5BA917F8C2B
|
|
ORACLE B467E13618516FB3E9277DC7EA412FC7 C9833E21C3CCA1FB1F0B62D70EF6E299
|
|
ORACLE 2B6DE06A4877BC38657A1FB0E9E9AC3C 50C38CE713037E39D7910CFAFC93FA27
|
|
ORACLE FD5C2DD5C31C2E76576D5842869E8E74 3F17031DD00F7FF4BD46F9139F744547
|
|
ORACLE 51D1C90A208BB431C6FA076F380AA493 A1B5AEFE499705C7DAE88B4144A7C7D0
|
|
ORACLE 0D26725CB5CEFDEC79DDCAEB36987B7A 7B959B4A2FF45C6FA44B18B79526F8AE
|
|
ORACLE D976A8DE99B277E9F7910127777364CE 676CF65222A36203EA7E0D08D10CD3E1
|
|
ORACLE 1C9CA863A4C0532C8850CA59B2876EF1 1C592CF1DEEAC8B085D38AA929085528
|
|
ORACLE FC33727E6D447E77321605725E7E6706 536CC388800FFB82C20495F9F776FABC
|
|
ORACLE 6196C6814A48A84FBC9D5125B2C3DEF0 0E2827D97E4B02A88FC27A15B67B3EEF
|
|
ORACLE F2E02181529940F5AE610CE5A4822253 D77E71E2163A1CA4718FBCD7A4648FDA
|
|
ORACLE 16ECC44F5DC0756C4D9C56E7EDA44390 88E12D0CE0C3A16A6F75C593DC4B3D75
|
|
ORACLE F355AD8002093579A24A0E1B03D70FCC 13953DEC4B9BBB6E06E826E35B8A566C
|
|
ORACLE 71769B65977F319D7325D2361D8316E9 2615C2F94166C11702C42E5F7A6FA5E6
|
|
ORACLE 376B0D1233EDD61B48A901AA32D5A68A 97D1344A149F2F03C8C9E0DD81D3D6A0
|
|
ORACLE AC0D425AAEDE55F86610BCABF8B7CE13 5912C8C3E0F8048164AA9B6ACC8991FA
|
|
ORACLE F6F839D09E9C9BF5D656E02BE8D45EA5 39835C18989E656D3CCD3C6FFAC31C50
|
|
Average speed: 317.77% (13 seconds)
|