mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
97 lines
2.1 KiB
NASM
97 lines
2.1 KiB
NASM
; udptest.asm -- socket() + sendto() a real TFTP RRQ.
|
|
;
|
|
; socket = 3F5C9A00h socket(2,2,0) -> fd
|
|
; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to, tolen) -> n
|
|
;
|
|
; The RRQ is the packet the firmware itself would send for
|
|
; "dwt/tcpip/probe.bin" in octet mode. A server log line for this packet is
|
|
; proof that UDP transmit works from the calling process; no reply is read.
|
|
;
|
|
; Evidence cells (32-bit, bit addresses):
|
|
; 01876800 stage (1 entered, 2 sendto returned)
|
|
; 01876820 socket fd
|
|
; 01876840 sendto return
|
|
; 01876A00 entry SP
|
|
; 01876A20 entry A14
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
move sp, @01876A00h, 1
|
|
move a14, @01876A20h, 1
|
|
|
|
movi 1, a0, L
|
|
move a0, @01876800h, 1
|
|
|
|
movi 01877000h, a14, L
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1 ; arg2 = protocol
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
|
movi 2, a0, L
|
|
move a0, *a14+, 1 ; arg0 = AF_INET
|
|
calla 3F5C9A00h
|
|
move @01876A00h, sp, 1
|
|
move @01876A20h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @01876820h, 1
|
|
move a8, a9
|
|
|
|
movi 2, a0, L
|
|
move a0, @01876800h, 1
|
|
|
|
; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16)
|
|
movi 01877000h, a14, L
|
|
movi 16, a0, L
|
|
move a0, *a14+, 1 ; arg5 = 16
|
|
movi SADDR, a0, L
|
|
move a0, *a14+, 1 ; arg4 = &sockaddr
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1 ; arg3 = flags
|
|
movi 28, a0, L
|
|
move a0, *a14+, 1 ; arg2 = length
|
|
movi RRQ, a0, L
|
|
move a0, *a14+, 1 ; arg1 = packet
|
|
move a9, *a14+, 1 ; arg0 = fd
|
|
calla 3F5D3D70h
|
|
move @01876A00h, sp, 1
|
|
move @01876A20h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @01876840h, 1
|
|
|
|
movi 3, a0, L
|
|
move a0, @01876800h, 1
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
|
|
RRQ:
|
|
.word 00100h ; opcode 1 (00 01)
|
|
.word 07764h ; "dw"
|
|
.word 02F74h ; "t/"
|
|
.word 06374h ; "tc"
|
|
.word 06970h ; "pi"
|
|
.word 02F70h ; "p/"
|
|
.word 07270h ; "pr"
|
|
.word 0626Fh ; "ob"
|
|
.word 02E65h ; "e."
|
|
.word 06962h ; "bi"
|
|
.word 0006Eh ; "n\0"
|
|
.word 0636Fh ; "oc"
|
|
.word 06574h ; "te"
|
|
.word 00074h ; "t\0"
|
|
SADDR:
|
|
.word 00002h ; sin_family = AF_INET
|
|
.word 04500h ; sin_port = htons(69)
|
|
.word 0A8C0h ; 192.168
|
|
.word 00163h ; .99.1
|
|
.word 0
|
|
.word 0
|
|
.word 0
|
|
.word 0
|
|
.end
|