mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
180 lines
2.7 KiB
NASM
180 lines
2.7 KiB
NASM
; copytest.asm -- isolate the byte-copy loop used by tftpc.asm.
|
|
;
|
|
; malloc(01000h), then copy 256 bytes from SRC (values 0..255) with the same
|
|
; dint/movb/addk/dsjs/eint loop. A peek of the destination must show 00..FF.
|
|
;
|
|
; 0187A800 stage (1 entered, 2 copied)
|
|
; 0187A820 destination pointer
|
|
; 0187A840 entry SP
|
|
; 0187A860 entry A14
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
move sp, @0187A840h, 1
|
|
move a14, @0187A860h, 1
|
|
movi 1, a0, L
|
|
move a0, @0187A800h, 1
|
|
|
|
move a14, -*sp, 1
|
|
movi 0187B800h, a14, L
|
|
movi 01000h, a0, L
|
|
move a0, *a14+, 1
|
|
calla 3F701230h
|
|
move @0187A840h, sp, 1
|
|
move @0187A860h, a14, 1
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
move a8, @0187A820h, 1
|
|
move a8, a6
|
|
|
|
dint
|
|
movi SRC, a5, L
|
|
movi 256, a2, L
|
|
copy_bytes:
|
|
movb *a5, a0
|
|
movb a0, *a6
|
|
addk 8, a5
|
|
addk 8, a6
|
|
dsjs a2, copy_bytes
|
|
eint
|
|
|
|
movi 2, a0, L
|
|
move a0, @0187A800h, 1
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
|
|
SRC:
|
|
.word 00100h
|
|
.word 00302h
|
|
.word 00504h
|
|
.word 00706h
|
|
.word 00908h
|
|
.word 00B0Ah
|
|
.word 00D0Ch
|
|
.word 00F0Eh
|
|
.word 01110h
|
|
.word 01312h
|
|
.word 01514h
|
|
.word 01716h
|
|
.word 01918h
|
|
.word 01B1Ah
|
|
.word 01D1Ch
|
|
.word 01F1Eh
|
|
.word 02120h
|
|
.word 02322h
|
|
.word 02524h
|
|
.word 02726h
|
|
.word 02928h
|
|
.word 02B2Ah
|
|
.word 02D2Ch
|
|
.word 02F2Eh
|
|
.word 03130h
|
|
.word 03332h
|
|
.word 03534h
|
|
.word 03736h
|
|
.word 03938h
|
|
.word 03B3Ah
|
|
.word 03D3Ch
|
|
.word 03F3Eh
|
|
.word 04140h
|
|
.word 04342h
|
|
.word 04544h
|
|
.word 04746h
|
|
.word 04948h
|
|
.word 04B4Ah
|
|
.word 04D4Ch
|
|
.word 04F4Eh
|
|
.word 05150h
|
|
.word 05352h
|
|
.word 05554h
|
|
.word 05756h
|
|
.word 05958h
|
|
.word 05B5Ah
|
|
.word 05D5Ch
|
|
.word 05F5Eh
|
|
.word 06160h
|
|
.word 06362h
|
|
.word 06564h
|
|
.word 06766h
|
|
.word 06968h
|
|
.word 06B6Ah
|
|
.word 06D6Ch
|
|
.word 06F6Eh
|
|
.word 07170h
|
|
.word 07372h
|
|
.word 07574h
|
|
.word 07776h
|
|
.word 07978h
|
|
.word 07B7Ah
|
|
.word 07D7Ch
|
|
.word 07F7Eh
|
|
.word 08180h
|
|
.word 08382h
|
|
.word 08584h
|
|
.word 08786h
|
|
.word 08988h
|
|
.word 08B8Ah
|
|
.word 08D8Ch
|
|
.word 08F8Eh
|
|
.word 09190h
|
|
.word 09392h
|
|
.word 09594h
|
|
.word 09796h
|
|
.word 09998h
|
|
.word 09B9Ah
|
|
.word 09D9Ch
|
|
.word 09F9Eh
|
|
.word 0A1A0h
|
|
.word 0A3A2h
|
|
.word 0A5A4h
|
|
.word 0A7A6h
|
|
.word 0A9A8h
|
|
.word 0ABAAh
|
|
.word 0ADACh
|
|
.word 0AFAEh
|
|
.word 0B1B0h
|
|
.word 0B3B2h
|
|
.word 0B5B4h
|
|
.word 0B7B6h
|
|
.word 0B9B8h
|
|
.word 0BBBAh
|
|
.word 0BDBCh
|
|
.word 0BFBEh
|
|
.word 0C1C0h
|
|
.word 0C3C2h
|
|
.word 0C5C4h
|
|
.word 0C7C6h
|
|
.word 0C9C8h
|
|
.word 0CBCAh
|
|
.word 0CDCCh
|
|
.word 0CFCEh
|
|
.word 0D1D0h
|
|
.word 0D3D2h
|
|
.word 0D5D4h
|
|
.word 0D7D6h
|
|
.word 0D9D8h
|
|
.word 0DBDAh
|
|
.word 0DDDCh
|
|
.word 0DFDEh
|
|
.word 0E1E0h
|
|
.word 0E3E2h
|
|
.word 0E5E4h
|
|
.word 0E7E6h
|
|
.word 0E9E8h
|
|
.word 0EBEAh
|
|
.word 0EDECh
|
|
.word 0EFEEh
|
|
.word 0F1F0h
|
|
.word 0F3F2h
|
|
.word 0F5F4h
|
|
.word 0F7F6h
|
|
.word 0F9F8h
|
|
.word 0FBFAh
|
|
.word 0FDFCh
|
|
.word 0FFFEh
|
|
.end
|