mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
SDD
a94e99579f
The xserver local service is reachable from a payload, but a connect made inside the rdebug process is accepted at the service layer and then never dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11 setup read follows and Xlib waits in select. create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch creates the child; the server reads the setup (READ12 ret 0x0C), writes the reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload also had to keep Display* in a11 (callee-saved) instead of reloading it from a RAM cell, and re-run SETF after each Xlib call. Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png. ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
92 lines
4.0 KiB
Plaintext
92 lines
4.0 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:11:10 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; xlaunch.asm -- create a *first-class* process whose e
|
|
0002 ;
|
|
0003 ; The rdebug `jump` payload runs inside the "remote deb
|
|
0004 ; H3 is that this process context is not a valid X clie
|
|
0005 ; therefore calls the OS's own create_process so xhello
|
|
0006 ; with its own PCB, user area (fd table) and 0x6000-byt
|
|
0007 ; Telnet handler does at ROM 07EDA7A0 (bits 3F6D4340..3
|
|
0008 ;
|
|
0009 ; create_process(entry="Telnet", name, 0x6000, 1, a
|
|
0010 ;
|
|
0011 ; create_process = bits 3F706A40 (Ghidra 07EE0D48).
|
|
0012 ;
|
|
0013 ; Markers (32-bit cells, bit addresses):
|
|
0014 ; 01860120 PCB returned by create_process (0 = failu
|
|
0015 ; 01860140 stage (1 = entered, 2 = create_process re
|
|
0016 ; 01860400 entry A14
|
|
0017 ; 01860420 entry SP
|
|
0018 ;
|
|
0019 ; The new process runs xhello.bin, linked at bit 018400
|
|
0020
|
|
0021 00000000 .text
|
|
0022 00000000 _start:
|
|
0023 00000000 0550 setf 16, 0, 0
|
|
0024 00000010 0740 setf 32, 0, 1
|
|
0025 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0026
|
|
0027 00000040 078F move sp, @01860420h, 1 ; entry SP
|
|
00000050 01860420
|
|
0028 00000070 078E move a14, @01860400h, 1 ; entry A14
|
|
00000080 01860400
|
|
0029
|
|
0030 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0031 000000D0 0780 move a0, @01860140h, 1 ; stage = 1
|
|
000000E0 01860140
|
|
0032
|
|
0033 ; ---- create_process(0x01840000, "0::0", 0x6000, 1, 0
|
|
0034 ; Arguments are pushed last-first, upward through A14,
|
|
0035 ; else in this firmware.
|
|
0036 00000100 A3CF move a14, -*sp, 1
|
|
0037 00000110 09EE movi 01862000h, a14, L
|
|
00000120 01862000
|
|
0038 00000140 09E0 movi 0, a0, L
|
|
00000150 00000000
|
|
0039 00000170 920E move a0, *a14+, 1 ; arg4 = 0 (process argument)
|
|
0040 00000180 09E0 movi 1, a0, L
|
|
00000190 00000001
|
|
0041 000001B0 920E move a0, *a14+, 1 ; arg3 = 1
|
|
0042 000001C0 09E0 movi 06000h, a0, L
|
|
000001D0 00006000
|
|
0043 000001F0 920E move a0, *a14+, 1 ; arg2 = stack size
|
|
0044 00000200 09E0 movi 3F30DC00h, a0, L ; ROM "0::0" (any short name wil
|
|
00000210 3F30DC00
|
|
0045 00000230 920E move a0, *a14+, 1 ; arg1 = name
|
|
0046 00000240 09E0 movi 01840000h, a0, L ; xhello entry
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:11:10 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
00000250 01840000
|
|
0047 00000270 920E move a0, *a14+, 1 ; arg0 = entry
|
|
0048 00000280 0D5F calla 3F706A40h ; create_process
|
|
00000290 3F706A40
|
|
0049 000002B0 07AF move @01860420h, sp, 1
|
|
000002C0 01860420
|
|
0050 000002E0 07AE move @01860400h, a14, 1
|
|
000002F0 01860400
|
|
0051
|
|
0052 00000310 0788 move a8, @01860120h, 1 ; MARK PCB
|
|
00000320 01860120
|
|
0053 00000340 09E0 movi 2, a0, L
|
|
00000350 00000002
|
|
0054 00000370 0780 move a0, @01860140h, 1 ; stage = 2
|
|
00000380 01860140
|
|
0055
|
|
0056 000003A0 done:
|
|
0057 000003A0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
000003B0 00FF
|
|
0058 000003C0 09E8 movi 0, a8, L
|
|
000003D0 00000000
|
|
0059 000003F0 0960 rets
|
|
0060 .end
|
|
|
|
No Errors, No Warnings
|