mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
SDD
a94e99579f
The xserver local service is reachable from a payload, but a connect made inside the rdebug process is accepted at the service layer and then never dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11 setup read follows and Xlib waits in select. create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch creates the child; the server reads the setup (READ12 ret 0x0C), writes the reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload also had to keep Display* in a11 (callee-saved) instead of reloading it from a RAM cell, and re-run SETF after each Xlib call. Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png. ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
35 lines
1.1 KiB
Plaintext
35 lines
1.1 KiB
Plaintext
*****************************************************
|
|
GSP COFF Linker, Version 2.00, 87.300
|
|
*****************************************************
|
|
Sun Oct 18 14:26:12 2026
|
|
|
|
OUTPUT FILE NAME: <XHELLO.out>
|
|
ENTRY POINT SYMBOL: 0
|
|
|
|
|
|
SECTION ALLOCATION MAP
|
|
|
|
output attributes/
|
|
section page origin length input sections
|
|
-------- ---- ---------- ---------- ----------------
|
|
.data 0 00000000 00000000
|
|
|
|
.bss 0 00000000 00000000 UNINITIALIZED
|
|
|
|
.text 0 01840000 00000C30
|
|
01840000 00000C30 XHELLO.obj (.text)
|
|
|
|
|
|
GLOBAL SYMBOLS
|
|
|
|
address name address name
|
|
-------- ---- -------- ----
|
|
00000000 .bss 00000000 edata
|
|
00000000 .data 00000000 .bss
|
|
01840000 .text 00000000 end
|
|
00000000 edata 00000000 .data
|
|
00000000 end 01840000 .text
|
|
01840C30 etext 01840C30 etext
|
|
|
|
[6 symbols]
|