Files
vt1200/dwt/evidence
..

Evidence — MOP Remote Console / VT1200 DWT

All captures are tcpdump -i vt1200 'ether proto 0x6002' against the MAME vt1200 driver with -cfg_directory cfg-net -networkprovider taptun and a private -nvram_directory. Host side of the bridge: c6:fc:cc:16:f5:66; terminal: 08:00:2b:16:4b:5a.

file what it shows
mop-hello.pcap clean OS-up run: Reserve (13), Request ID (5), System ID (7), CCP HELP (17), CRA 425 bytes (19), CCP SHOW, CRA 509 bytes. 135 packets because the terminal acknowledges every poll.
mop-hello.txt tcpdump -nn -e -r text of the above
hello.log full client log: every TX/RX frame hexdumped and decoded, both command texts
dwt-help.txt HELP response bytes, CRLF normalised to LF
dwt-show.txt SHOW response bytes, CRLF normalised to LF
dry-run.txt mop_console.py --dry-run --script HELP,SHOW; frames only, no socket
mop-script3.pcap, script3.log HELP, SHOW, then TEST 0 0. The TEST reply is TEST 0 0\r\n\r\nTesting... (22 bytes, length 24). Subsequent 60-byte CRAs have length 2 and stale SHOW text after the flags — the length field is authoritative.
mop-test00.pcap, test00b.log TEST 0 0 on a fresh boot, alone, with --quiet 10: same Testing... only
test12.log TEST 12 on a fresh boot: same Testing... only
help-after-test.log, help-after-test12.log a HELP attempt after each TEST gets no System ID at all (MOP server no longer answers)
mop-init.pcap, init.log INIT accepted, no reply; only host TX in the capture
help-after-init2.log >90 s after INIT, still no System ID
mop-noos.pcap, noos-attempt1.log, noos-attempt2.log, noos-attempt3.log bare boot (no VT1200_SKIP_LEVEL1), Reserve/RequestID attempts: zero RX
mame-noos-probe.log, pc_probe.lua the same bare boot with a Lua PC probe: PC=3FDCE400 from frame 100 to 3600 (the repo's diagnostics-menu baseline)
wrong-password.log Reserve with verification 0102030405060708; HELP still works, so the VT1200 does not validate the field in this configuration
run-*, scripts/ not mine — the static-analysis agent's probes; leave them alone

The captures contain only the emulated terminal. Nothing here was sent to the real machine.