arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-31 12:05:05 +02:00
Code Wiki Activity
Files
master
vt1200/dwt/gui/run13/mame.log
T
SDD a94e99579f dwt/gui: injected X window works via create_process 
The xserver local service is reachable from a payload, but a connect made
inside the rdebug process is accepted at the service layer and then never
dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11
setup read follows and Xlib waits in select.

create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch
creates the child; the server reads the setup (READ12 ret 0x0C), writes the
reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload
also had to keep Display* in a11 (callee-saved) instead of reloading it from a
RAM cell, and re-run SETF after each Xlib call.

Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png.
ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
2026-10-18 14:28:58 +03:00

198 lines
10 KiB
Plaintext
Raw Permalink Blame History

Warning: -video none doesn't make much sense without -seconds_to_run
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901
vt1200: scanline#1 line=0 enabled=1
vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1
vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901
vt1200: scanline#2 line=0 enabled=1
vt1200: scanline#3 line=1 enabled=1
vt1200: scanline#4 line=2 enabled=1
probe_win: f=100 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=200 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=300 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=400 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=500 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=600 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=700 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=800 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=900 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1000 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1100 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1200 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1300 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1400 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1500 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1600 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1700 stage=6 strlen=4 win_low=10001
probe_win: f=1800 stage=6 strlen=4 win_low=10001
probe_win: f=1900 stage=6 strlen=4 win_low=10001
probe_win: f=2000 stage=6 strlen=4 win_low=10001
probe_win: f=2100 stage=6 strlen=4 win_low=10001
probe_win: f=2200 stage=6 strlen=4 win_low=10001
probe_win: f=2300 stage=6 strlen=4 win_low=10001
probe_win: f=2400 stage=6 strlen=4 win_low=10001
probe_win: f=2500 stage=6 strlen=4 win_low=10001
probe_win: frame 2598 job xhello x6 every 60
probe_win: frame 2598 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02598.png ok=true
probe_win: f=2600 stage=6 strlen=4 win_low=10001
probe_win: frame 2658 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02658.png ok=true
probe_win: f=2700 stage=6 strlen=4 win_low=10001
probe_win: frame 2718 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02718.png ok=true
probe_win: frame 2778 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02778.png ok=true
probe_win: f=2800 stage=6 strlen=4 win_low=10001
probe_win: frame 2838 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02838.png ok=true
probe_win: frame 2898 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02898.png ok=true
probe_win: f=2900 stage=6 strlen=4 win_low=10001
probe_win: f=3000 stage=6 strlen=4 win_low=10001
probe_win: f=3100 stage=6 strlen=4 win_low=10001
probe_win: f=3200 stage=6 strlen=4 win_low=10001
probe_win: f=3300 stage=6 strlen=4 win_low=10001
probe_win: f=3400 stage=6 strlen=4 win_low=10001
probe_win: f=3500 stage=6 strlen=4 win_low=10001
probe_win: f=3600 stage=6 strlen=4 win_low=10001
probe_win: f=3700 stage=6 strlen=4 win_low=10001
probe_win: f=3800 stage=6 strlen=4 win_low=10001
probe_win: f=3900 stage=6 strlen=4 win_low=10001
probe_win: f=4000 stage=6 strlen=4 win_low=10001
probe_win: f=4100 stage=6 strlen=4 win_low=10001
probe_win: f=4200 stage=6 strlen=4 win_low=10001
probe_win: f=4300 stage=6 strlen=4 win_low=10001
probe_win: f=4400 stage=6 strlen=4 win_low=10001
probe_win: f=4500 stage=6 strlen=4 win_low=10001
probe_win: f=4600 stage=6 strlen=4 win_low=10001
probe_win: f=4700 stage=6 strlen=4 win_low=10001
probe_win: f=4800 stage=6 strlen=4 win_low=10001
probe_win: f=4900 stage=6 strlen=4 win_low=10001
probe_win: f=5000 stage=6 strlen=4 win_low=10001
probe_win: f=5100 stage=6 strlen=4 win_low=10001
probe_win: f=5200 stage=6 strlen=4 win_low=10001
probe_win: f=5300 stage=6 strlen=4 win_low=10001
probe_win: f=5400 stage=6 strlen=4 win_low=10001
probe_win: f=5500 stage=6 strlen=4 win_low=10001
probe_win: f=5600 stage=6 strlen=4 win_low=10001
probe_win: f=5700 stage=6 strlen=4 win_low=10001
probe_win: f=5800 stage=6 strlen=4 win_low=10001
probe_win: f=5900 stage=6 strlen=4 win_low=10001
probe_win: f=6000 stage=6 strlen=4 win_low=10001
probe_win: f=6100 stage=6 strlen=4 win_low=10001
probe_win: f=6200 stage=6 strlen=4 win_low=10001
probe_win: f=6300 stage=6 strlen=4 win_low=10001
probe_win: f=6400 stage=6 strlen=4 win_low=10001
probe_win: f=6500 stage=6 strlen=4 win_low=10001
probe_win: f=6600 stage=6 strlen=4 win_low=10001
probe_win: f=6700 stage=6 strlen=4 win_low=10001
probe_win: f=6800 stage=6 strlen=4 win_low=10001
probe_win: f=6900 stage=6 strlen=4 win_low=10001
probe_win: f=7000 stage=6 strlen=4 win_low=10001
probe_win: f=7100 stage=6 strlen=4 win_low=10001
probe_win: f=7200 stage=6 strlen=4 win_low=10001
probe_win: f=7300 stage=6 strlen=4 win_low=10001
probe_win: f=7400 stage=6 strlen=4 win_low=10001
probe_win: f=7500 stage=6 strlen=4 win_low=10001
probe_win: f=7600 stage=6 strlen=4 win_low=10001
probe_win: f=7700 stage=6 strlen=4 win_low=10001
probe_win: f=7800 stage=6 strlen=4 win_low=10001
probe_win: f=7900 stage=6 strlen=4 win_low=10001
probe_win: f=8000 stage=6 strlen=4 win_low=10001
probe_win: f=8100 stage=6 strlen=4 win_low=10001
probe_win: f=8200 stage=6 strlen=4 win_low=10001
probe_win: f=8300 stage=6 strlen=4 win_low=10001
probe_win: f=8400 stage=6 strlen=4 win_low=10001
probe_win: f=8500 stage=6 strlen=4 win_low=10001
probe_win: f=8600 stage=6 strlen=4 win_low=10001
probe_win: f=8700 stage=6 strlen=4 win_low=10001
probe_win: f=8800 stage=6 strlen=4 win_low=10001
probe_win: f=8900 stage=6 strlen=4 win_low=10001
probe_win: f=9000 stage=6 strlen=4 win_low=10001
probe_win: f=9100 stage=6 strlen=4 win_low=10001
probe_win: f=9200 stage=6 strlen=4 win_low=10001
probe_win: f=9300 stage=6 strlen=4 win_low=10001
probe_win: f=9400 stage=6 strlen=4 win_low=10001
probe_win: f=9500 stage=6 strlen=4 win_low=10001
probe_win: f=9600 stage=6 strlen=4 win_low=10001
probe_win: f=9700 stage=6 strlen=4 win_low=10001
probe_win: f=9800 stage=6 strlen=4 win_low=10001
probe_win: f=9900 stage=6 strlen=4 win_low=10001
probe_win: f=10000 stage=6 strlen=4 win_low=10001
probe_win: f=10100 stage=6 strlen=4 win_low=10001
probe_win: f=10200 stage=6 strlen=4 win_low=10001
probe_win: f=10300 stage=6 strlen=4 win_low=10001
probe_win: f=10400 stage=6 strlen=4 win_low=10001
probe_win: f=10500 stage=6 strlen=4 win_low=10001
probe_win: f=10600 stage=6 strlen=4 win_low=10001
probe_win: f=10700 stage=6 strlen=4 win_low=10001
probe_win: f=10800 stage=6 strlen=4 win_low=10001
probe_win: f=10900 stage=6 strlen=4 win_low=10001
probe_win: f=11000 stage=6 strlen=4 win_low=10001
probe_win: f=11100 stage=6 strlen=4 win_low=10001
probe_win: f=11200 stage=6 strlen=4 win_low=10001
probe_win: f=11300 stage=6 strlen=4 win_low=10001
probe_win: f=11400 stage=6 strlen=4 win_low=10001
probe_win: f=11500 stage=6 strlen=4 win_low=10001
probe_win: f=11600 stage=6 strlen=4 win_low=10001
probe_win: f=11700 stage=6 strlen=4 win_low=10001
probe_win: f=11800 stage=6 strlen=4 win_low=10001
probe_win: f=11900 stage=6 strlen=4 win_low=10001
probe_win: f=12000 stage=6 strlen=4 win_low=10001
probe_win: f=12100 stage=6 strlen=4 win_low=10001
probe_win: f=12200 stage=6 strlen=4 win_low=10001
probe_win: f=12300 stage=6 strlen=4 win_low=10001
probe_win: f=12400 stage=6 strlen=4 win_low=10001
probe_win: f=12500 stage=6 strlen=4 win_low=10001
probe_win: f=12600 stage=6 strlen=4 win_low=10001
probe_win: f=12700 stage=6 strlen=4 win_low=10001
probe_win: f=12800 stage=6 strlen=4 win_low=10001
probe_win: f=12900 stage=6 strlen=4 win_low=10001
probe_win: f=13000 stage=6 strlen=4 win_low=10001
probe_win: f=13100 stage=6 strlen=4 win_low=10001
probe_win: f=13200 stage=6 strlen=4 win_low=10001
probe_win: f=13300 stage=6 strlen=4 win_low=10001
probe_win: f=13400 stage=6 strlen=4 win_low=10001
probe_win: f=13500 stage=6 strlen=4 win_low=10001
probe_win: f=13600 stage=6 strlen=4 win_low=10001
probe_win: f=13700 stage=6 strlen=4 win_low=10001
probe_win: f=13800 stage=6 strlen=4 win_low=10001
probe_win: f=13900 stage=6 strlen=4 win_low=10001
probe_win: f=14000 stage=6 strlen=4 win_low=10001
probe_win: f=14100 stage=6 strlen=4 win_low=10001
probe_win: f=14200 stage=6 strlen=4 win_low=10001
probe_win: f=14300 stage=6 strlen=4 win_low=10001
probe_win: f=14400 stage=6 strlen=4 win_low=10001
probe_win: f=14500 stage=6 strlen=4 win_low=10001
probe_win: f=14600 stage=6 strlen=4 win_low=10001
probe_win: f=14700 stage=6 strlen=4 win_low=10001
probe_win: f=14800 stage=6 strlen=4 win_low=10001
probe_win: f=14900 stage=6 strlen=4 win_low=10001
probe_win: f=15000 stage=6 strlen=4 win_low=10001
probe_win: f=15100 stage=6 strlen=4 win_low=10001
probe_win: f=15200 stage=6 strlen=4 win_low=10001
probe_win: f=15300 stage=6 strlen=4 win_low=10001
probe_win: f=15400 stage=6 strlen=4 win_low=10001
probe_win: f=15500 stage=6 strlen=4 win_low=10001
probe_win: f=15600 stage=6 strlen=4 win_low=10001
probe_win: f=15700 stage=6 strlen=4 win_low=10001
probe_win: f=15800 stage=6 strlen=4 win_low=10001
probe_win: f=15900 stage=6 strlen=4 win_low=10001
probe_win: f=16000 stage=6 strlen=4 win_low=10001
probe_win: f=16100 stage=6 strlen=4 win_low=10001
probe_win: f=16200 stage=6 strlen=4 win_low=10001
probe_win: f=16300 stage=6 strlen=4 win_low=10001
probe_win: f=16400 stage=6 strlen=4 win_low=10001
probe_win: f=16500 stage=6 strlen=4 win_low=10001
probe_win: f=16600 stage=6 strlen=4 win_low=10001
probe_win: f=16700 stage=6 strlen=4 win_low=10001
probe_win: f=16800 stage=6 strlen=4 win_low=10001
probe_win: f=16900 stage=6 strlen=4 win_low=10001
probe_win: f=17000 stage=6 strlen=4 win_low=10001
probe_win: f=17100 stage=6 strlen=4 win_low=10001
probe_win: f=17200 stage=6 strlen=4 win_low=10001
probe_win: f=17300 stage=6 strlen=4 win_low=10001
probe_win: f=17400 stage=6 strlen=4 win_low=10001
probe_win: f=17500 stage=6 strlen=4 win_low=10001
probe_win: f=17600 stage=6 strlen=4 win_low=10001
probe_win: f=17700 stage=6 strlen=4 win_low=10001
probe_win: f=17800 stage=6 strlen=4 win_low=10001
probe_win: f=17900 stage=6 strlen=4 win_low=10001
View Git Blame Copy Permalink