mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
47 lines
1.1 KiB
NASM
47 lines
1.1 KiB
NASM
; socktest.asm -- call the firmware's socket() wrapper and return.
|
|
;
|
|
; Isolates the first call tftp_open makes. Run with rdebug `jump` from the
|
|
; remote-debug process (or from a create_process child) to see whether the
|
|
; socket API is usable in that context.
|
|
;
|
|
; socket = bit 3F5C9A00h (Ghidra 07EB9340)
|
|
; socket(domain, type, protocol) = socket(2, 2, 0)
|
|
;
|
|
; Evidence cells (32-bit, bit addresses):
|
|
; 01874000 stage (1 entered, 2 socket returned)
|
|
; 01874020 socket() return (fd, or a negative errno)
|
|
; 01874200 entry SP
|
|
; 01874220 entry A14
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
move sp, @01874200h, 1
|
|
move a14, @01874220h, 1
|
|
|
|
movi 1, a0, L
|
|
move a0, @01874000h, 1
|
|
|
|
movi 01873800h, a14, L
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1 ; arg2 = protocol
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1 ; arg0 = AF_INET
|
|
calla 3F5C9A00h ; socket
|
|
move @01874200h, sp, 1
|
|
move @01874220h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @01874020h, 1
|
|
|
|
movi 2, a0, L
|
|
move a0, @01874000h, 1
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
.end
|