SDD 8588340527 dwt/loader: end-to-end host loader over rdebug ...

hostload.py drives one rdebug connection: jump(malloc) for the COFF buffer,
poke the COFF, poke the loader at 0x01880000, write the descriptor, call the
loader, and verify status 0 plus app evidence (marker cells or xhello stage 6
and a VRAM screenshot). --tftp uses the existing tftpc.bin fetch instead of a
host poke. Adds evidence for two/three fresh boots and appends the integrate
section to dwt/notes/LOADER.md, including the bit-offset result-block layout
and the create_process clobber of the descriptor.

2026-10-18 15:34:25 +03:00

..

evidence

dwt/screenshot.py: network screenshot over rdebug peek (VRAM -> PNG), verified against the live OS

2026-10-18 13:49:19 +03:00

gui

dwt/gui: injected X window works via create_process

2026-10-18 14:28:58 +03:00

loader

dwt/loader: end-to-end host loader over rdebug

2026-10-18 15:34:25 +03:00

notes

dwt/loader: end-to-end host loader over rdebug

2026-10-18 15:34:25 +03:00

tcpip

dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

2026-10-18 15:24:34 +03:00

visual

dwt: rdebug opcode 8 puts attacker text in the TM Messages box

2026-10-18 11:03:01 +03:00

challenge_vectors.json

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

challenge.py

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

exploit.py

dwt/exploit.py: default to the computed dwt_prf answer -- echo is the known-failing mode and made a bare --peek look like a closed socket

2026-10-18 11:28:00 +03:00

heapmap.py

dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py

2026-10-18 14:47:14 +03:00

mop_console.py

dwt: MOP console carrier client, protocol notes, and emulator evidence

2026-10-18 02:02:17 +03:00

oracle.lua

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

oracle.py

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

probe_cfg.lua

dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake

2026-10-18 01:55:41 +03:00

probe_ram.lua

dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake

2026-10-18 01:55:41 +03:00

screenshot.py

dwt/screenshot.py: network screenshot over rdebug peek (VRAM -> PNG), verified against the live OS

2026-10-18 13:49:19 +03:00

solve.py

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00