SDD 6adc04ba02 dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling

2026-10-18 16:22:24 +03:00

..

evidence

dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling

2026-10-18 16:22:24 +03:00

gui

dwt/gui: injected X window works via create_process

2026-10-18 14:28:58 +03:00

loader

dwt/loader: end-to-end host loader over rdebug

2026-10-18 15:34:25 +03:00

notes

dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling

2026-10-18 16:22:24 +03:00

tcpip

dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

2026-10-18 15:24:34 +03:00

visual

dwt: rdebug opcode 8 puts attacker text in the TM Messages box

2026-10-18 11:03:01 +03:00

challenge_vectors.json

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

challenge.py

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

exploit.py

dwt/exploit.py: default to the computed dwt_prf answer -- echo is the known-failing mode and made a bare --peek look like a closed socket

2026-10-18 11:28:00 +03:00

heapmap.py

dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py

2026-10-18 14:47:14 +03:00

mop_console.py

dwt: MOP console carrier client, protocol notes, and emulator evidence

2026-10-18 02:02:17 +03:00

oracle.lua

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

oracle.py

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

probe_cfg.lua

dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake

2026-10-18 01:55:41 +03:00

probe_ram.lua

dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake

2026-10-18 01:55:41 +03:00

screenshot.py

dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling

2026-10-18 16:22:24 +03:00

solve.py

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00