arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-31 12:05:05 +02:00
Code Wiki Activity
Files
master
vt1200/dwt/gui/build/xhello.lst
T
SDD a94e99579f dwt/gui: injected X window works via create_process 
The xserver local service is reachable from a payload, but a connect made
inside the rdebug process is accepted at the service layer and then never
dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11
setup read follows and Xlib waits in select.

create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch
creates the child; the server reads the setup (READ12 ret 0x0C), writes the
reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload
also had to keep Display* in a11 (callee-saved) instead of reloading it from a
RAM cell, and re-run SETF after each Xlib call.

Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png.
ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
2026-10-18 14:28:58 +03:00

230 lines
10 KiB
Plaintext
Raw Permalink Blame History

GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 1
0001 ; xhello.asm -- open a *new* X connection and create/ma
0002 ; DWT X server.
0003 ;
0004 ; Run as a first-class process created by xlaunch.asm (
0005 ; the rdebug dispatcher's context: a connect made from
0006 ; accepted at the service layer but the server never re
0007 ; XOpenDisplay returns an unusable Display. A fresh pr
0008 ;
0009 ; Calling convention (the one the firmware itself uses;
0010 ; 07F57044 and the TM at 07E5D2B4):
0011 ;
0012 ; MOVE A14,-*SP,1 ; reserve the slot the ca
0013 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
0014 ; ...
0015 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
0016 ; CALLA target
0017 ;
0018 ; Xlib clobbers the CPU's SETF field state, so the ABI'
0019 ; re-established after every call. The Display pointer
0020 ; kept in a11/a10 (both callee-saved by every Xlib entr
0021 ; be overwritten by the new process's stack, a register
0022 ;
0023 ; Xlib entry points (Ghidra address -> bit address):
0024 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
0025 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
0026 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
0027 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
0028 ; 7F68B1A strlen(s) -> 3FB458D0
0029 ;
0030 ; Markers (32-bit cells, bit addresses; diagnostic only
0031 ; 01890100 display pointer
0032 ; 01890110 root window
0033 ; 01890120 window id
0034 ; 01890130 XSync return
0035 ; 01890140 stage counter
0036 ; 01890160 strlen("0::0") -- must be 4; if not, we s
0037
0038 00000000 .text
0039 00000000 _start:
0040 00000000 0550 setf 16, 0, 0
0041 00000010 0740 setf 32, 0, 1
0042 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0043
0044 00000040 078F move sp, @01890420h, 1 ; entry SP
00000050 01890420
0045 00000070 078E move a14, @01890400h, 1 ; entry A14
00000080 01890400
0046
0047 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0048 000000D0 0780 move a0, @01890140h, 1 ; stage = 1
000000E0 01890140
0049
0050 ; ---- convention check: strlen("0::0") == 4 ---------
0051 00000100 A3CF move a14, -*sp, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 2
0052 00000110 09EE movi 01892000h, a14, L
00000120 01892000
0053 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
00000150 3FACE948
0054 00000170 920E move a0, *a14+, 1 ; arg0
0055 00000180 0D5F calla 3FB458D0h ; strlen
00000190 3FB458D0
0056 000001B0 07AF move @01890420h, sp, 1
000001C0 01890420
0057 000001E0 07AE move @01890400h, a14, 1
000001F0 01890400
0058 00000210 0550 setf 16, 0, 0 ; Xlib leaves the field sizes changed;
0059 00000220 0740 setf 32, 0, 1 ; re-establish the ABI's 32-bit field 1
0060 00000230 0788 move a8, @01890160h, 1 ; MARK strlen
00000240 01890160
0061 00000260 09E0 movi 4, a0, L
00000270 00000004
0062 00000290 4808 cmp a0, a8
0063 000002A0 CB00 jrne done
000002B0 0091
0064
0065 000002C0 09E0 movi 2, a0, L
000002D0 00000002
0066 000002F0 0780 move a0, @01890140h, 1
00000300 01890140
0067
0068 ; ---- display = XOpenDisplay("0::0") ----------------
0069 00000320 A3CF move a14, -*sp, 1
0070 00000330 09EE movi 01892000h, a14, L
00000340 01892000
0071 00000360 09E0 movi 3FACE948h, a0, L
00000370 3FACE948
0072 00000390 920E move a0, *a14+, 1 ; arg0 = name
0073 000003A0 0D5F calla 3F9C2570h ; XOpenDisplay
000003B0 3F9C2570
0074 000003D0 07AF move @01890420h, sp, 1
000003E0 01890420
0075 00000400 07AE move @01890400h, a14, 1
00000410 01890400
0076 00000430 0550 setf 16, 0, 0
0077 00000440 0740 setf 32, 0, 1
0078 00000450 4D0B move a8, a11 ; keep the Display in a callee-saved re
0079 00000460 078B move a11, @01890100h, 1 ; MARK display
00000470 01890100
0080 00000490 4D6B move a11, a11
0081 000004A0 CA72 jreq done
0082
0083 000004B0 09E0 movi 3, a0, L
000004C0 00000003
0084 000004E0 0780 move a0, @01890140h, 1
000004F0 01890140
0085
0086 ; ---- root = *(*(display+0x480)+0x40) ---------------
0087 00000510 B76A move *a11(0480h), a10, 1
00000520 0480
0088 00000530 B74A move *a10(040h), a10, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 3
00000540 0040
0089 00000550 078A move a10, @01890110h, 1 ; MARK root
00000560 01890110
0090
0091 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
0092 00000580 A3CF move a14, -*sp, 1
0093 00000590 09EE movi 01892000h, a14, L
000005A0 01892000
0094 000005C0 09E0 movi 0, a0, L
000005D0 00000000
0095 000005F0 920E move a0, *a14+, 1 ; background = 0 (black)
0096 00000600 920E move a0, *a14+, 1 ; border = 0
0097 00000610 09E0 movi 2, a0, L
00000620 00000002
0098 00000640 920E move a0, *a14+, 1 ; border width
0099 00000650 09E0 movi 200, a0, L
00000660 000000C8
0100 00000680 920E move a0, *a14+, 1 ; height
0101 00000690 09E0 movi 400, a0, L
000006A0 00000190
0102 000006C0 920E move a0, *a14+, 1 ; width
0103 000006D0 09E0 movi 100, a0, L
000006E0 00000064
0104 00000700 920E move a0, *a14+, 1 ; y
0105 00000710 920E move a0, *a14+, 1 ; x
0106 00000720 934E move a10, *a14+, 1 ; parent = root
0107 00000730 936E move a11, *a14+, 1 ; display
0108 00000740 0D5F calla 3FD41B90h ; XCreateSimpleWindow
00000750 3FD41B90
0109 00000770 07AF move @01890420h, sp, 1
00000780 01890420
0110 000007A0 07AE move @01890400h, a14, 1
000007B0 01890400
0111 000007D0 0550 setf 16, 0, 0
0112 000007E0 0740 setf 32, 0, 1
0113 000007F0 4D0A move a8, a10 ; window id (root no longer needed)
0114 00000800 078A move a10, @01890120h, 1 ; MARK window
00000810 01890120
0115
0116 00000830 09E0 movi 4, a0, L
00000840 00000004
0117 00000860 0780 move a0, @01890140h, 1
00000870 01890140
0118
0119 ; ---- XMapWindow(display, window) -------------------
0120 00000890 A3CF move a14, -*sp, 1
0121 000008A0 09EE movi 01892000h, a14, L
000008B0 01892000
0122 000008D0 934E move a10, *a14+, 1 ; window
0123 000008E0 936E move a11, *a14+, 1 ; display
0124 000008F0 0D5F calla 3FD645B0h ; XMapWindow
00000900 3FD645B0
0125 00000920 07AF move @01890420h, sp, 1
00000930 01890420
0126 00000950 07AE move @01890400h, a14, 1
00000960 01890400
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 4
0127 00000980 0550 setf 16, 0, 0
0128 00000990 0740 setf 32, 0, 1
0129
0130 000009A0 09E0 movi 5, a0, L
000009B0 00000005
0131 000009D0 0780 move a0, @01890140h, 1
000009E0 01890140
0132
0133 ; ---- XSync(display, 0) -----------------------------
0134 00000A00 A3CF move a14, -*sp, 1
0135 00000A10 09EE movi 01892000h, a14, L
00000A20 01892000
0136 00000A40 09E0 movi 0, a0, L
00000A50 00000000
0137 00000A70 920E move a0, *a14+, 1 ; discard = 0
0138 00000A80 936E move a11, *a14+, 1 ; display
0139 00000A90 0D5F calla 3FD9F6B0h ; XSync
00000AA0 3FD9F6B0
0140 00000AC0 07AF move @01890420h, sp, 1
00000AD0 01890420
0141 00000AF0 07AE move @01890400h, a14, 1
00000B00 01890400
0142 00000B20 0550 setf 16, 0, 0
0143 00000B30 0740 setf 32, 0, 1
0144 00000B40 0788 move a8, @01890130h, 1 ; MARK sync
00000B50 01890130
0145
0146 00000B70 09E0 movi 6, a0, L
00000B80 00000006
0147 00000BA0 0780 move a0, @01890140h, 1
00000BB0 01890140
0148
0149 00000BD0 done:
0150 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000BE0 00FF
0151 00000BF0 09E8 movi 0, a8, L
00000C00 00000000
0152 00000C20 0960 rets
0153 .end
No Errors, No Warnings
View Git Blame Copy Permalink