mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
a94e99579f
The xserver local service is reachable from a payload, but a connect made inside the rdebug process is accepted at the service layer and then never dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11 setup read follows and Xlib waits in select. create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch creates the child; the server reads the setup (READ12 ret 0x0C), writes the reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload also had to keep Display* in a11 (callee-saved) instead of reloading it from a RAM cell, and re-run SETF after each Xlib call. Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png. ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
61 lines
1.8 KiB
NASM
61 lines
1.8 KiB
NASM
; xlaunch.asm -- create a *first-class* process whose entry is xhello.bin.
|
|
;
|
|
; The rdebug `jump` payload runs inside the "remote debug" process. Hypothesis
|
|
; H3 is that this process context is not a valid X client; this launcher
|
|
; therefore calls the OS's own create_process so xhello runs in a fresh process
|
|
; with its own PCB, user area (fd table) and 0x6000-byte stack, exactly like the
|
|
; Telnet handler does at ROM 07EDA7A0 (bits 3F6D4340..3F6D4440):
|
|
;
|
|
; create_process(entry="Telnet", name, 0x6000, 1, arg)
|
|
;
|
|
; create_process = bits 3F706A40 (Ghidra 07EE0D48).
|
|
;
|
|
; Markers (32-bit cells, bit addresses):
|
|
; 01860120 PCB returned by create_process (0 = failure)
|
|
; 01860140 stage (1 = entered, 2 = create_process returned)
|
|
; 01860400 entry A14
|
|
; 01860420 entry SP
|
|
;
|
|
; The new process runs xhello.bin, linked at bit 01840000 (built separately).
|
|
|
|
.text
|
|
_start:
|
|
setf 16, 0, 0
|
|
setf 32, 0, 1
|
|
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
|
|
move sp, @01860420h, 1 ; entry SP
|
|
move a14, @01860400h, 1 ; entry A14
|
|
|
|
movi 1, a0, L
|
|
move a0, @01860140h, 1 ; stage = 1
|
|
|
|
; ---- create_process(0x01840000, "0::0", 0x6000, 1, 0) ----------
|
|
; Arguments are pushed last-first, upward through A14, as everywhere
|
|
; else in this firmware.
|
|
move a14, -*sp, 1
|
|
movi 01862000h, a14, L
|
|
movi 0, a0, L
|
|
move a0, *a14+, 1 ; arg4 = 0 (process argument)
|
|
movi 1, a0, L
|
|
move a0, *a14+, 1 ; arg3 = 1
|
|
movi 06000h, a0, L
|
|
move a0, *a14+, 1 ; arg2 = stack size
|
|
movi 3F30DC00h, a0, L ; ROM "0::0" (any short name will do)
|
|
move a0, *a14+, 1 ; arg1 = name
|
|
movi 01840000h, a0, L ; xhello entry
|
|
move a0, *a14+, 1 ; arg0 = entry
|
|
calla 3F706A40h ; create_process
|
|
move @01860420h, sp, 1
|
|
move @01860400h, a14, 1
|
|
|
|
move a8, @01860120h, 1 ; MARK PCB
|
|
movi 2, a0, L
|
|
move a0, @01860140h, 1 ; stage = 2
|
|
|
|
done:
|
|
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
movi 0, a8, L
|
|
rets
|
|
.end
|