mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
a5769d3d2e
Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients (SERVER, SESSIONMGR/Terminal Manager, WM, VTE). Internal clients use the local service "xserver" via the display string "0::0"; TCP 6000 is a separate authorised listener. Function table and the 4-call hello-window sequence are in dwt/notes/GUI_APPS.md. Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then called XOpenDisplay; it never returns (stage 2, display 0, X-server client watermark unchanged) and the rdebug service dies. Verdict: hard for a self-contained window; shared-RAM UI mutation (opcode 8) is the working route.
35 lines
1.2 KiB
Lua
35 lines
1.2 KiB
Lua
-- probe3.lua -- breakpoint on the X server connection-setup entry (Ghidra
|
|
-- 07EB1700) plus marker telemetry. If the server accepts an injected client,
|
|
-- an ACCEPT line appears; the boot's own clients prove the probe works.
|
|
local machine = manager.machine
|
|
local cpu = machine.devices[':maincpu']
|
|
local space = cpu.spaces['program']
|
|
local frame = 0
|
|
|
|
local function install()
|
|
local dbg = cpu.debug
|
|
if not dbg then print("probe3: no cpu.debug") return end
|
|
local ok, e = pcall(function()
|
|
dbg:bpset(0x3F58B800, "1", 'printf "probe3: ACCEPT pc=%08X\\n",pc; g')
|
|
end)
|
|
print("probe3: bpset accept=" .. tostring(ok) .. " " .. tostring(e))
|
|
end
|
|
|
|
local function u32(a)
|
|
local ok, v = pcall(function() return space:read_u32(a) end)
|
|
if ok then return v end
|
|
return 0xdeadbeef
|
|
end
|
|
|
|
emu.register_frame_done(function()
|
|
frame = frame + 1
|
|
if frame == 2 then install() end
|
|
if frame % 250 == 0 then
|
|
print(string.format("probe3: f=%d PC=%08X st=%d disp=%08X win=%08X wm=%d",
|
|
frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
|
|
u32(0x01850120), u32(0x1b8620)))
|
|
end
|
|
end, "vt1200-gui-probe3")
|
|
|
|
if machine.debugger then machine.debugger.execution_state = 'run' end
|