SDD edc26855fd dwt: full ROM dump over rdebug is byte-identical to vt1200_v22.bin (md5 match)

2026-10-18 17:25:18 +03:00

..

CHALLENGE_ORACLE.md

dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform

2026-10-18 02:30:49 +03:00

CHALLENGE_REVERSE.md

dwt: reverse the dwt_prf challenge; remote poke/jump now works

2026-10-18 02:36:23 +03:00

CROSS.md

dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

2026-10-18 15:24:34 +03:00

DISPLAY_MESSAGE.md

dwt: rdebug opcode 8 puts attacker text in the TM Messages box

2026-10-18 11:03:01 +03:00

EXPLOIT_ATTEMPT.md

dwt: exploit client and gate analysis; remote execution blocked at the challenge

2026-10-18 02:20:16 +03:00

GUI_APPS.md

dwt/gui: injected X window works via create_process

2026-10-18 14:28:58 +03:00

HEAP.md

dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py

2026-10-18 14:47:14 +03:00

LOADER_CROSS.md

dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

2026-10-18 15:24:34 +03:00

LOADER.md

dwt/loader: end-to-end host loader over rdebug

2026-10-18 15:34:25 +03:00

mop-protocol.md

dwt: MOP console carrier client, protocol notes, and emulator evidence

2026-10-18 02:02:17 +03:00

rdebug-static.md

dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1)

2026-10-18 01:55:56 +03:00

REAL_UNIT.md

dwt: full ROM dump over rdebug is byte-identical to vt1200_v22.bin (md5 match)

2026-10-18 17:25:18 +03:00

TCPIP.md

dwt/tcpip: map the socket API and fetch a file over TFTP into RAM

2026-10-18 15:24:34 +03:00

VISUAL_INJECTION.md

dwt: visual injection -- confirm the persistent box on the live OS, and record that the blink is not established (toggle period is ~1536 frames, not 30)

2026-10-18 03:24:38 +03:00