mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
SDD
1e5c095b72
The firmware transforms the reply (16-round Feistel per 8-byte record) and compares it with the host-order copy of the challenge, so the answer is swap4(inverse_transform(swap4(challenge))). The font stages are memcpy in this path because dwt_prf initialises only mode 1. challenge.py implements the transform and its inverse using the firmware's fixed key/SP table; solve.py answers the challenge over TCP using the unmodified exploit client. 320 forward vectors, the firmware's own inverse and three live sessions validate it. A live run with no breakpoints poked the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM 1024/1024. Notes and evidence under dwt/notes and dwt/evidence.
26 lines
714 B
Plaintext
26 lines
714 B
Plaintext
MAME debugger version 0.289 (mame0289-dirty)
|
|
Currently targeting vt1200 (VT1200 X terminal (v2.2 firmware))
|
|
Breakpoint 1 set
|
|
Breakpoint 2 set
|
|
Breakpoint 3 set
|
|
Breakpoint 4 set
|
|
Breakpoint 5 set
|
|
Breakpoint 6 set
|
|
Breakpoint 7 set
|
|
Breakpoint 8 set
|
|
Breakpoint 9 set
|
|
LIVE2 accept_debug_conn entry pc=3F58AD60
|
|
|
|
LIVE2 dispatcher entry pc=3F59F320
|
|
|
|
LIVE2 dwt_prf challenge entry pc=3F59FDC0
|
|
|
|
LIVE2 challenge sent a13=007AE7B0 wire=3DB79CF3.8EB50000.C0A86302.3EB794F3 host=F39CB73D.0000B58E.0263A8C0.F394B73E
|
|
|
|
LIVE2 pre-transform reply=71C08104.AF81012D.BE5884F7.634E8818
|
|
|
|
LIVE2 memcmp-args expecting=F39CB73D.0000B58E.0263A8C0.F394B73E got=F39CB73D.0000B58E.0263A8C0.F394B73E
|
|
|
|
LIVE2 challenge memcmp a8=00000000 (0=equal)
|
|
|