mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
69 lines
1.3 KiB
NASM
69 lines
1.3 KiB
NASM
; restest.asm -- socket() then the resolver tftp_open uses.
|
|
;
|
|
; socket = 3F5C9A00h socket(2,2,0) -> fd
|
|
; resolve = 3F5933D0h resolve("192.168.99.1") -> -1 or address
|
|
;
|
|
; Evidence cells (32-bit, bit addresses):
|
|
; 01875800 stage (1 entered, 2 socket returned, 3 resolve returned)
|
|
; 01875820 socket() fd
|
|
; 01875840 resolver return
|
|
; 01875A00 entry SP
|
|
; 01875A20 entry A14
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
move sp, @01875A00h, 1
|
|
move a14, @01875A20h, 1
|
|
|
|
movi 1, a0, L
|
|
move a0, @01875800h, 1
|
|
|
|
; socket(2,2,0)
|
|
movi 01875900h, a14, L
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1
|
|
calla 3F5C9A00h
|
|
move @01875A00h, sp, 1
|
|
move @01875A20h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @01875820h, 1 ; fd
|
|
move a8, a9
|
|
|
|
movi 2, a0, L
|
|
move a0, @01875800h, 1
|
|
|
|
; resolve("192.168.99.1")
|
|
movi 01875900h, a14, L
|
|
movi HOST, a0, L
|
|
move a0, *a14+, 1
|
|
calla 3F5933D0h
|
|
move @01875A00h, sp, 1
|
|
move @01875A20h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @01875840h, 1
|
|
|
|
movi 3, a0, L
|
|
move a0, @01875800h, 1
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
|
|
HOST:
|
|
.word 03931h
|
|
.word 02E32h
|
|
.word 03631h
|
|
.word 02E38h
|
|
.word 03939h
|
|
.word 0312Eh
|
|
.word 00000h
|
|
.end
|