SDD dcca6bee4d dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py

2026-10-18 14:47:14 +03:00

..

CHALLENGE_ORACLE.md

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

CHALLENGE_REVERSE.md

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

CROSS.md

dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs

2026-10-18 14:08:42 +03:00

DISPLAY_MESSAGE.md

dwt: rdebug opcode 8 puts attacker text in the TM Messages box

2026-10-18 11:03:01 +03:00

EXPLOIT_ATTEMPT.md

dwt: exploit client and gate analysis; remote execution blocked at the challenge

2026-10-18 02:20:16 +03:00

GUI_APPS.md

dwt/gui: injected X window works via create_process

2026-10-18 14:28:58 +03:00

HEAP.md

dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py

2026-10-18 14:47:14 +03:00

mop-protocol.md

dwt: MOP console carrier client, protocol notes, and emulator evidence

2026-10-18 02:02:17 +03:00

rdebug-static.md

dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1)

2026-10-18 01:55:56 +03:00

VISUAL_INJECTION.md

dwt: visual injection -- confirm the persistent box on the live OS, and record that the blink is not established (toggle period is ~1536 frames, not 30)

2026-10-18 03:24:38 +03:00