mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
56 lines
1.6 KiB
NASM
56 lines
1.6 KiB
NASM
; launcher.asm -- run tfetch.bin as a first-class process.
|
|
;
|
|
; The rdebug `jump` runs in the "remote debug" process. The X experiment
|
|
; (dwt/notes/GUI_APPS.md section 10) showed that a service connection made
|
|
; from that context is accepted but never completed; a create_process child
|
|
; works. This launcher is the same shape as dwt/gui/xlaunch.asm:
|
|
;
|
|
; create_process(entry, name, stack_size, 1, arg)
|
|
;
|
|
; create_process = bit 3F706A40h (Ghidra 07EE0D48)
|
|
;
|
|
; The child runs tfetch.bin, linked at bit 01870000h.
|
|
;
|
|
; Evidence cells (32-bit, bit addresses):
|
|
; 01872500 stage (1 entered, 2 create_process returned)
|
|
; 01872520 PCB returned by create_process (0 = failure)
|
|
; 01872540 entry-point argument (poked by the host, little-endian)
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
move sp, @01872700h, 1 ; entry SP
|
|
move a14, @01872720h, 1 ; entry A14
|
|
|
|
movi 1, a0, L
|
|
move a0, @01872500h, 1
|
|
|
|
move a14, -*sp, 1
|
|
movi 01872800h, a14, L ; argument area
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1 ; arg4 = 0
|
|
movi 1, a0, L
|
|
move a0, *a14+, 1 ; arg3 = 1
|
|
movi 04000h, a0, L ; 16 KiB stack
|
|
move a0, *a14+, 1 ; arg2 = stack size
|
|
movi 3F30DC00h, a0, L ; ROM "0::0", any short name
|
|
move a0, *a14+, 1 ; arg1 = name
|
|
move @01872540h, a0, 1 ; arg0 = entry, poked at run time
|
|
move a0, *a14+, 1 ; (little-endian bit address)
|
|
calla 3F706A40h ; create_process
|
|
move @01872700h, sp, 1
|
|
move @01872720h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
|
|
move a8, @01872520h, 1 ; PCB marker
|
|
movi 2, a0, L
|
|
move a0, @01872500h, 1 ; stage = 2
|
|
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
.end
|