SDD
a5769d3d2e
Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients (SERVER, SESSIONMGR/Terminal Manager, WM, VTE). Internal clients use the local service "xserver" via the display string "0::0"; TCP 6000 is a separate authorised listener. Function table and the 4-call hello-window sequence are in dwt/notes/GUI_APPS.md. Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then called XOpenDisplay; it never returns (stage 2, display 0, X-server client watermark unchanged) and the rdebug service dies. Verdict: hard for a self-contained window; shared-RAM UI mutation (opcode 8) is the working route.
2.5 KiB
dwt/gui — X window feasibility payload
Investigation of the VT1200 GUI architecture and whether an rdebug payload can
create its own window. Read dwt/notes/GUI_APPS.md first; this directory is the
reproducible part.
| file | what it is |
|---|---|
xhello.asm |
payload: ABI check (strlen("0::0")==4) then XOpenDisplay, root lookup, XCreateSimpleWindow, XMapWindow, XSync |
build.sh |
TI SDK (GSPA/GSPLNK under DOSBox) wrapper; writes build/, scratch in work/ |
probe.lua |
frame snapshots + marker/PC telemetry (250-frame interval) |
probe2.lua |
same, 25-frame interval, also reads the X server client watermark |
probe3.lua |
breakpoint on the X server accept entry + telemetry |
build/xhello.bin |
assembled payload, linked at bit 0x01840000 |
run/mame.log |
last live run: strlen=4, stage=2, display=0, watermark 1 |
run/gui_frame*.png |
post-injection frames (normal Terminal Manager, no new window) |
Build
./dwt/gui/build.sh dwt/gui/xhello.asm 01840000
Run
The payload needs the OS, i.e. VT1200_SKIP_LEVEL1=1 (documented divergence),
a BOOTP/TFTP server and the LANCE attached. MAME's network device is enabled by
the cfg file, not the command line — without
<network><device tag=":lance" interface="0" .../></network> in
vt1200.cfg the taptun provider is never opened (the tap stays NO-CARRIER).
RUN=$PWD/dwt/gui/run
mkdir -p $RUN/cfg $RUN/nvram
cp dwt/evidence/live-run2/cfg/vt1200.cfg $RUN/cfg/vt1200.cfg
sudo python3 -u harness/serve.py 192.168.99.1 --bootp \
--bootp-iface tap-mess-1000-0 &
VT1200_SKIP_LEVEL1=1 MSG_TRIGGER=$RUN/trigger MSG_DIR=$RUN \
/home/arti/code/k-space/mame0289/vt1200 vt1200 \
-rompath harness/mame/roms -sound none -skip_gameinfo \
-networkprovider taptun -video none -nothrottle \
-cfg_directory $RUN/cfg -nvram_directory $RUN/nvram \
-debug -debugger none -autoboot_script $PWD/dwt/gui/probe2.lua \
-autoboot_delay 0
# once port 771 answers:
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01840000 --file dwt/gui/build/xhello.bin \
--jump 0x01840000 --jump-wait 20
Markers are 32-bit cells at bit 0x01850100 (display), 0x01850110 (root),
0x01850120 (window), 0x01850130 (sync), 0x01850140 (stage),
0x01850160 (strlen).
The observed result is a hang at stage 2 (display=0): XOpenDisplay
blocks in Xlib's select wrapper and the X server's client watermark never moves.
See the note for the verdict and the decisive next experiment.