opencode.energia.arti.ee/vt1200
1
0 Fork 0
forked from arti/vt1200
Code Pull Requests Activity

dwt/gui: injected X window works via create_process

Browse Source 
The xserver local service is reachable from a payload, but a connect made
inside the rdebug process is accepted at the service layer and then never
dequeued: the server's accept callback runs (3F34EC50), but no 12-byte X11
setup read follows and Xlib waits in select.

create_process(entry,name,stack,1,arg) from a new process fixes it. xlaunch
creates the child; the server reads the setup (READ12 ret 0x0C), writes the
reply (8 + 0x90), and xhello creates/maps/syncs a 400x200 window. The payload
also had to keep Display* in a11 (callee-saved) instead of reloading it from a
RAM cell, and re-run SETF after each Xlib call.

Final breakpoint-free frame: dwt/gui/evidence/xhello_window_frame2838.png.
ROM untouched (b46a3e442ccb86134d2356bd70d22fd2).
This commit is contained in:
SDD committed 2026-10-18 14:28:58 +03:00
1 parent a5769d3d2e
commit a94e99579f
19 files changed
+23964 -272
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

dwt/gui/README.md
+43 -25
View File
@@ -1,24 +1,37 @@
# dwt/gui — X window feasibility payload
# dwt/gui — injected X window (working)
Investigation of the VT1200 GUI architecture and whether an rdebug payload can
create its own window. Read `dwt/notes/GUI_APPS.md` first; this directory is the
reproducible part.
Investigation of the VT1200 GUI architecture and whether an injected payload can
create its own window. Read `dwt/notes/GUI_APPS.md` first (especially the new
§10); this directory is the reproducible part.
**Result:** yes. The payload must run in a process created by the firmware's own
`create_process` (not in the rdebug dispatcher), and it must keep the `Display *`
in a callee-saved register rather than reloading it from a RAM cell. The final
breakpoint-free run shows the window at frame 2838:
`evidence/xhello_window_frame2838.png` (black 400x200 window at 100,100, framed
by the WM).
| file | what it is |
|---|---|
| `xhello.asm` | payload: ABI check (`strlen("0::0")==4`) then `XOpenDisplay`, root lookup, `XCreateSimpleWindow`, `XMapWindow`, `XSync` |
| `xhello.asm` | the window payload: ABI check (`strlen("0::0")==4`), `XOpenDisplay`, root lookup, `XCreateSimpleWindow`, `XMapWindow`, `XSync`; Display in `a11`, window in `a10`, `setf` re-established after every call |
| `xlaunch.asm` | 128-byte launcher: `create_process(xhello, name, 0x6000, 1, 0)` — the Telnet handler's call shape |
| `build.sh` | TI SDK (GSPA/GSPLNK under DOSBox) wrapper; writes `build/`, scratch in `work/` |
| `probe.lua` | frame snapshots + marker/PC telemetry (250-frame interval) |
| `probe2.lua` | same, 25-frame interval, also reads the X server client watermark |
| `probe3.lua` | breakpoint on the X server accept entry + telemetry |
| `probe_win.lua` | **breakpoint-free** final probe: marker log + PNG snapshots on a trigger file |
| `probe.lua` / `probe2.lua` / `probe3.lua` | earlier probes (marker/PC telemetry; `probe3` targets the mis-identified `3F58B800`) |
| `trace_accept.lua` | instrumented run: service attach/lookup, server accept callback, 12-byte setup read, setup-reply write, Xlib read, process create |
| `build/xhello.bin` | assembled payload, linked at bit `0x01840000` |
| `run/mame.log` | last live run: `strlen=4`, `stage=2`, `display=0`, watermark `1` |
| `run/gui_frame*.png` | post-injection frames (normal Terminal Manager, no new window) |
| `build/xlaunch.bin` | assembled launcher, linked at bit `0x01860000` |
| `evidence/xhello_window_frame2838.png` | the window, after a run with no breakpoints |
| `evidence/transport_evidence.txt` | quoted accept/read/reply lines from the instrumented runs |
| `run12/debug.log` | full instrumented trace of the successful fresh-process run |
| `run13/` | final run: `mame.log`, snapshots, private cfg/nvram |
| `run/` | the earlier failing experiment (rdebug context, stage 2) |
## Build
```sh
./dwt/gui/build.sh dwt/gui/xhello.asm 01840000
./dwt/gui/build.sh dwt/gui/xhello.asm 01840000 # 390 bytes
./dwt/gui/build.sh dwt/gui/xlaunch.asm 01860000 # 128 bytes
```
## Run
@@ -30,31 +43,36 @@ the **cfg file**, not the command line — without
`vt1200.cfg` the taptun provider is never opened (the tap stays `NO-CARRIER`).
```sh
RUN=$PWD/dwt/gui/run
RUN=$PWD/dwt/gui/run13
mkdir -p $RUN/cfg $RUN/nvram
cp dwt/evidence/live-run2/cfg/vt1200.cfg $RUN/cfg/vt1200.cfg
cp harness/mame/cfg-net/vt1200.cfg $RUN/cfg/vt1200.cfg
sudo python3 -u harness/serve.py 192.168.99.1 --bootp \
--bootp-iface tap-mess-1000-0 &
sudo python3 -u harness/serve.py 192.168.99.1 --bootp &
VT1200_SKIP_LEVEL1=1 MSG_TRIGGER=$RUN/trigger MSG_DIR=$RUN \
/home/arti/code/k-space/mame0289/vt1200 vt1200 \
-rompath harness/mame/roms -sound none -skip_gameinfo \
-networkprovider taptun -video none -nothrottle \
-cfg_directory $RUN/cfg -nvram_directory $RUN/nvram \
-debug -debugger none -autoboot_script $PWD/dwt/gui/probe2.lua \
-debug -debugger none -autoboot_script $PWD/dwt/gui/probe_win.lua \
-autoboot_delay 0
# once port 771 answers:
# once 192.168.99.2:771 answers (rdebug creates a fresh process per connection)
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01840000 --file dwt/gui/build/xhello.bin \
--jump 0x01840000 --jump-wait 20
--poke-file 0x01840000 --file dwt/gui/build/xhello.bin
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01860000 --file dwt/gui/build/xlaunch.bin \
--jump 0x01860000 --jump-wait 8
# snapshots: write "<prefix> <count> <stride>" into $RUN/trigger
echo 'xhello 6 60' > $RUN/trigger
```
Markers are 32-bit cells at bit `0x01850100` (display), `0x01850110` (root),
`0x01850120` (window), `0x01850130` (sync), `0x01850140` (stage),
`0x01850160` (strlen).
Markers are diagnostic cells at bit `0x01890100` (display), `01890110` (root),
`01890120` (window), `01890130` (sync), `01890140` (stage), `01890160`
(strlen). In the successful run the stage reaches 6 and `strlen` is 4.
The observed result is a **hang at stage 2** (`display=0`): `XOpenDisplay`
blocks in Xlib's select wrapper and the X server's client watermark never moves.
See the note for the verdict and the decisive next experiment.
Do **not** call Xlib in the rdebug process: the service attach and the server's
accept callback succeed, but the server never reads the 12-byte setup, and
Xlib waits forever. See §10 of the note for the trace and the remaining
open question.
dwt/gui/build/xhello.bin
BIN
View File
Binary file not shown.
dwt/gui/build/xhello.lst
+204 -194
View File
@@ -1,219 +1,229 @@
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 1
0001 ; xhello.asm -- open a *new* X connection from an rdebu
0002 ; create/map a window on the live DWT X server.
0001 ; xhello.asm -- open a *new* X connection and create/ma
0002 ; DWT X server.
0003 ;
0004 ; Calling convention (the one the firmware itself uses;
0005 ; 07F57044 and the TM at 07E5D2B4):
0006 ;
0007 ; MOVE A14,-*SP,1 ; reserve the slot the ca
0008 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
0009 ; ...
0010 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
0011 ; CALLA target
0012 ;
0013 ; We point A14 at a private argument buffer instead of
0014 ; we keep the entry SP/A14 in RAM so the payload return
0015 ; leaves the stack in an unexpected state.
0016 ;
0017 ; Xlib entry points (Ghidra address -> bit address):
0018 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
0019 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
0020 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
0021 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
0022 ; 7F68B1A strlen(s) -> 3FB458D0
0023 ;
0024 ; Markers (32-bit cells, bit addresses):
0025 ; 01850100 display pointer
0026 ; 01850110 root window
0027 ; 01850120 window id
0028 ; 01850130 XSync return
0029 ; 01850140 stage counter
0030 ; 01850150 strlen("0::0") -- must be 4; if not, we s
0031
0032 00000000 .text
0033 00000000 _start:
0034 00000000 0550 setf 16, 0, 0
0035 00000010 0740 setf 32, 0, 1
0036 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0004 ; Run as a first-class process created by xlaunch.asm (
0005 ; the rdebug dispatcher's context: a connect made from
0006 ; accepted at the service layer but the server never re
0007 ; XOpenDisplay returns an unusable Display. A fresh pr
0008 ;
0009 ; Calling convention (the one the firmware itself uses;
0010 ; 07F57044 and the TM at 07E5D2B4):
0011 ;
0012 ; MOVE A14,-*SP,1 ; reserve the slot the ca
0013 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
0014 ; ...
0015 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
0016 ; CALLA target
0017 ;
0018 ; Xlib clobbers the CPU's SETF field state, so the ABI'
0019 ; re-established after every call. The Display pointer
0020 ; kept in a11/a10 (both callee-saved by every Xlib entr
0021 ; be overwritten by the new process's stack, a register
0022 ;
0023 ; Xlib entry points (Ghidra address -> bit address):
0024 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
0025 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
0026 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
0027 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
0028 ; 7F68B1A strlen(s) -> 3FB458D0
0029 ;
0030 ; Markers (32-bit cells, bit addresses; diagnostic only
0031 ; 01890100 display pointer
0032 ; 01890110 root window
0033 ; 01890120 window id
0034 ; 01890130 XSync return
0035 ; 01890140 stage counter
0036 ; 01890160 strlen("0::0") -- must be 4; if not, we s
0037
0038 00000040 078F move sp, @01850420h, 1 ; entry SP
00000050 01850420
0039 00000070 078E move a14, @01850400h, 1 ; entry A14
00000080 01850400
0040
0041 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0042 000000D0 0780 move a0, @01850140h, 1 ; stage = 1
000000E0 01850140
0038 00000000 .text
0039 00000000 _start:
0040 00000000 0550 setf 16, 0, 0
0041 00000010 0740 setf 32, 0, 1
0042 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0043
0044 ; ---- convention check: strlen("0::0") == 4 ---------
0045 00000100 A3CF move a14, -*sp, 1
0046 00000110 09EE movi 01852000h, a14, L
00000120 01852000
0047 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
00000150 3FACE948
0048 00000170 920E move a0, *a14+, 1 ; arg0
0049 00000180 0D5F calla 3FB458D0h ; strlen
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
0044 00000040 078F move sp, @01890420h, 1 ; entry SP
00000050 01890420
0045 00000070 078E move a14, @01890400h, 1 ; entry A14
00000080 01890400
0046
0047 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0048 000000D0 0780 move a0, @01890140h, 1 ; stage = 1
000000E0 01890140
0049
0050 ; ---- convention check: strlen("0::0") == 4 ---------
0051 00000100 A3CF move a14, -*sp, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 2
0052 00000110 09EE movi 01892000h, a14, L
00000120 01892000
0053 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
00000150 3FACE948
0054 00000170 920E move a0, *a14+, 1 ; arg0
0055 00000180 0D5F calla 3FB458D0h ; strlen
00000190 3FB458D0
0050 000001B0 07AF move @01850420h, sp, 1
000001C0 01850420
0051 000001E0 07AE move @01850400h, a14, 1
000001F0 01850400
0052 00000210 0788 move a8, @01850160h, 1 ; MARK strlen
00000220 01850160
0053 00000240 09E0 movi 4, a0, L
00000250 00000004
0054 00000270 4808 cmp a0, a8
0055 00000280 CB00 jrne done
00000290 0093
0056
0057 000002A0 09E0 movi 2, a0, L
000002B0 00000002
0058 000002D0 0780 move a0, @01850140h, 1
000002E0 01850140
0059
0060 ; ---- display = XOpenDisplay("0::0") ----------------
0061 00000300 A3CF move a14, -*sp, 1
0062 00000310 09EE movi 01852000h, a14, L
00000320 01852000
0063 00000340 09E0 movi 3FACE948h, a0, L
00000350 3FACE948
0064 00000370 920E move a0, *a14+, 1 ; arg0 = name
0065 00000380 0D5F calla 3F9C2570h ; XOpenDisplay
00000390 3F9C2570
0066 000003B0 07AF move @01850420h, sp, 1
000003C0 01850420
0067 000003E0 07AE move @01850400h, a14, 1
000003F0 01850400
0068 00000410 0788 move a8, @01850100h, 1 ; MARK display
00000420 01850100
0069 00000440 4D08 move a8, a8
0070 00000450 CA77 jreq done
0071
0072 00000460 09E0 movi 3, a0, L
00000470 00000003
0073 00000490 0780 move a0, @01850140h, 1
000004A0 01850140
0074
0075 ; ---- root = *(*(display+0x480)+0x40) ---------------
0076 000004C0 07A6 move @01850100h, a6, 1
000004D0 01850100
0077 000004F0 B6C9 move *a6(0480h), a9, 1
00000500 0480
0078 00000510 B729 move *a9(040h), a9, 1
00000520 0040
0079 00000530 0789 move a9, @01850110h, 1 ; MARK root
00000540 01850110
0080
0081 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
0082 00000560 A3CF move a14, -*sp, 1
0083 00000570 09EE movi 01852000h, a14, L
00000580 01852000
0084 000005A0 09E0 movi 0, a0, L
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
0056 000001B0 07AF move @01890420h, sp, 1
000001C0 01890420
0057 000001E0 07AE move @01890400h, a14, 1
000001F0 01890400
0058 00000210 0550 setf 16, 0, 0 ; Xlib leaves the field sizes changed;
0059 00000220 0740 setf 32, 0, 1 ; re-establish the ABI's 32-bit field 1
0060 00000230 0788 move a8, @01890160h, 1 ; MARK strlen
00000240 01890160
0061 00000260 09E0 movi 4, a0, L
00000270 00000004
0062 00000290 4808 cmp a0, a8
0063 000002A0 CB00 jrne done
000002B0 0091
0064
0065 000002C0 09E0 movi 2, a0, L
000002D0 00000002
0066 000002F0 0780 move a0, @01890140h, 1
00000300 01890140
0067
0068 ; ---- display = XOpenDisplay("0::0") ----------------
0069 00000320 A3CF move a14, -*sp, 1
0070 00000330 09EE movi 01892000h, a14, L
00000340 01892000
0071 00000360 09E0 movi 3FACE948h, a0, L
00000370 3FACE948
0072 00000390 920E move a0, *a14+, 1 ; arg0 = name
0073 000003A0 0D5F calla 3F9C2570h ; XOpenDisplay
000003B0 3F9C2570
0074 000003D0 07AF move @01890420h, sp, 1
000003E0 01890420
0075 00000400 07AE move @01890400h, a14, 1
00000410 01890400
0076 00000430 0550 setf 16, 0, 0
0077 00000440 0740 setf 32, 0, 1
0078 00000450 4D0B move a8, a11 ; keep the Display in a callee-saved re
0079 00000460 078B move a11, @01890100h, 1 ; MARK display
00000470 01890100
0080 00000490 4D6B move a11, a11
0081 000004A0 CA72 jreq done
0082
0083 000004B0 09E0 movi 3, a0, L
000004C0 00000003
0084 000004E0 0780 move a0, @01890140h, 1
000004F0 01890140
0085
0086 ; ---- root = *(*(display+0x480)+0x40) ---------------
0087 00000510 B76A move *a11(0480h), a10, 1
00000520 0480
0088 00000530 B74A move *a10(040h), a10, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 3
000005B0 00000000
0085 000005D0 920E move a0, *a14+, 1 ; background = 0 (black)
0086 000005E0 920E move a0, *a14+, 1 ; border = 0
0087 000005F0 09E0 movi 2, a0, L
00000600 00000002
0088 00000620 920E move a0, *a14+, 1 ; border width
0089 00000630 09E0 movi 200, a0, L
00000640 000000C8
0090 00000660 920E move a0, *a14+, 1 ; height
0091 00000670 09E0 movi 400, a0, L
00000680 00000190
0092 000006A0 920E move a0, *a14+, 1 ; width
0093 000006B0 09E0 movi 100, a0, L
000006C0 00000064
0094 000006E0 920E move a0, *a14+, 1 ; y
0095 000006F0 920E move a0, *a14+, 1 ; x
0096 00000700 932E move a9, *a14+, 1 ; parent
0097 00000710 07A6 move @01850100h, a6, 1
00000720 01850100
0098 00000740 92CE move a6, *a14+, 1 ; display
0099 00000750 0D5F calla 3FD41B90h ; XCreateSimpleWindow
00000760 3FD41B90
0100 00000780 07AF move @01850420h, sp, 1
00000790 01850420
0101 000007B0 07AE move @01850400h, a14, 1
000007C0 01850400
0102 000007E0 0788 move a8, @01850120h, 1 ; MARK window
000007F0 01850120
0103
0104 00000810 09E0 movi 4, a0, L
00000820 00000004
0105 00000840 0780 move a0, @01850140h, 1
00000850 01850140
0106
0107 ; ---- XMapWindow(display, window) -------------------
0108 00000870 A3CF move a14, -*sp, 1
0109 00000880 09EE movi 01852000h, a14, L
00000890 01852000
0110 000008B0 930E move a8, *a14+, 1 ; window
0111 000008C0 07A6 move @01850100h, a6, 1
000008D0 01850100
0112 000008F0 92CE move a6, *a14+, 1 ; display
0113 00000900 0D5F calla 3FD645B0h ; XMapWindow
00000910 3FD645B0
0114 00000930 07AF move @01850420h, sp, 1
00000940 01850420
0115 00000960 07AE move @01850400h, a14, 1
00000970 01850400
0116
0117 00000990 09E0 movi 5, a0, L
000009A0 00000005
0118 000009C0 0780 move a0, @01850140h, 1
000009D0 01850140
0119
0120 ; ---- XSync(display, 0) -----------------------------
0121 000009F0 A3CF move a14, -*sp, 1
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
00000540 0040
0089 00000550 078A move a10, @01890110h, 1 ; MARK root
00000560 01890110
0090
0091 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
0092 00000580 A3CF move a14, -*sp, 1
0093 00000590 09EE movi 01892000h, a14, L
000005A0 01892000
0094 000005C0 09E0 movi 0, a0, L
000005D0 00000000
0095 000005F0 920E move a0, *a14+, 1 ; background = 0 (black)
0096 00000600 920E move a0, *a14+, 1 ; border = 0
0097 00000610 09E0 movi 2, a0, L
00000620 00000002
0098 00000640 920E move a0, *a14+, 1 ; border width
0099 00000650 09E0 movi 200, a0, L
00000660 000000C8
0100 00000680 920E move a0, *a14+, 1 ; height
0101 00000690 09E0 movi 400, a0, L
000006A0 00000190
0102 000006C0 920E move a0, *a14+, 1 ; width
0103 000006D0 09E0 movi 100, a0, L
000006E0 00000064
0104 00000700 920E move a0, *a14+, 1 ; y
0105 00000710 920E move a0, *a14+, 1 ; x
0106 00000720 934E move a10, *a14+, 1 ; parent = root
0107 00000730 936E move a11, *a14+, 1 ; display
0108 00000740 0D5F calla 3FD41B90h ; XCreateSimpleWindow
00000750 3FD41B90
0109 00000770 07AF move @01890420h, sp, 1
00000780 01890420
0110 000007A0 07AE move @01890400h, a14, 1
000007B0 01890400
0111 000007D0 0550 setf 16, 0, 0
0112 000007E0 0740 setf 32, 0, 1
0113 000007F0 4D0A move a8, a10 ; window id (root no longer needed)
0114 00000800 078A move a10, @01890120h, 1 ; MARK window
00000810 01890120
0115
0116 00000830 09E0 movi 4, a0, L
00000840 00000004
0117 00000860 0780 move a0, @01890140h, 1
00000870 01890140
0118
0119 ; ---- XMapWindow(display, window) -------------------
0120 00000890 A3CF move a14, -*sp, 1
0121 000008A0 09EE movi 01892000h, a14, L
000008B0 01892000
0122 000008D0 934E move a10, *a14+, 1 ; window
0123 000008E0 936E move a11, *a14+, 1 ; display
0124 000008F0 0D5F calla 3FD645B0h ; XMapWindow
00000900 3FD645B0
0125 00000920 07AF move @01890420h, sp, 1
00000930 01890420
0126 00000950 07AE move @01890400h, a14, 1
00000960 01890400
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:26:12 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 4
0122 00000A00 09EE movi 01852000h, a14, L
00000A10 01852000
0123 00000A30 09E0 movi 0, a0, L
00000A40 00000000
0124 00000A60 920E move a0, *a14+, 1 ; discard = 0
0125 00000A70 07A6 move @01850100h, a6, 1
00000A80 01850100
0126 00000AA0 92CE move a6, *a14+, 1 ; display
0127 00000AB0 0D5F calla 3FD9F6B0h ; XSync
00000AC0 3FD9F6B0
0128 00000AE0 07AF move @01850420h, sp, 1
00000AF0 01850420
0129 00000B10 07AE move @01850400h, a14, 1
00000B20 01850400
0130 00000B40 0788 move a8, @01850130h, 1 ; MARK sync
00000B50 01850130
0131
0132 00000B70 09E0 movi 6, a0, L
0127 00000980 0550 setf 16, 0, 0
0128 00000990 0740 setf 32, 0, 1
0129
0130 000009A0 09E0 movi 5, a0, L
000009B0 00000005
0131 000009D0 0780 move a0, @01890140h, 1
000009E0 01890140
0132
0133 ; ---- XSync(display, 0) -----------------------------
0134 00000A00 A3CF move a14, -*sp, 1
0135 00000A10 09EE movi 01892000h, a14, L
00000A20 01892000
0136 00000A40 09E0 movi 0, a0, L
00000A50 00000000
0137 00000A70 920E move a0, *a14+, 1 ; discard = 0
0138 00000A80 936E move a11, *a14+, 1 ; display
0139 00000A90 0D5F calla 3FD9F6B0h ; XSync
00000AA0 3FD9F6B0
0140 00000AC0 07AF move @01890420h, sp, 1
00000AD0 01890420
0141 00000AF0 07AE move @01890400h, a14, 1
00000B00 01890400
0142 00000B20 0550 setf 16, 0, 0
0143 00000B30 0740 setf 32, 0, 1
0144 00000B40 0788 move a8, @01890130h, 1 ; MARK sync
00000B50 01890130
0145
0146 00000B70 09E0 movi 6, a0, L
00000B80 00000006
0133 00000BA0 0780 move a0, @01850140h, 1
00000BB0 01850140
0134
0135 00000BD0 done:
0136 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
0147 00000BA0 0780 move a0, @01890140h, 1
00000BB0 01890140
0148
0149 00000BD0 done:
0150 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000BE0 00FF
0137 00000BF0 09E8 movi 0, a8, L
0151 00000BF0 09E8 movi 0, a8, L
00000C00 00000000
0138 00000C20 0960 rets
0139 .end
0152 00000C20 0960 rets
0153 .end
No Errors, No Warnings
dwt/gui/build/xhello.map
+1 -1
View File
@@ -1,7 +1,7 @@
*****************************************************
GSP COFF Linker, Version 2.00, 87.300
*****************************************************
Sun Oct 18 14:04:58 2026
Sun Oct 18 14:26:12 2026
OUTPUT FILE NAME: <XHELLO.out>
ENTRY POINT SYMBOL: 0
dwt/gui/build/xlaunch.bin
BIN
View File
Binary file not shown.
dwt/gui/build/xlaunch.lst
+91
View File
@@ -0,0 +1,91 @@
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:11:10 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 1
0001 ; xlaunch.asm -- create a *first-class* process whose e
0002 ;
0003 ; The rdebug `jump` payload runs inside the "remote deb
0004 ; H3 is that this process context is not a valid X clie
0005 ; therefore calls the OS's own create_process so xhello
0006 ; with its own PCB, user area (fd table) and 0x6000-byt
0007 ; Telnet handler does at ROM 07EDA7A0 (bits 3F6D4340..3
0008 ;
0009 ; create_process(entry="Telnet", name, 0x6000, 1, a
0010 ;
0011 ; create_process = bits 3F706A40 (Ghidra 07EE0D48).
0012 ;
0013 ; Markers (32-bit cells, bit addresses):
0014 ; 01860120 PCB returned by create_process (0 = failu
0015 ; 01860140 stage (1 = entered, 2 = create_process re
0016 ; 01860400 entry A14
0017 ; 01860420 entry SP
0018 ;
0019 ; The new process runs xhello.bin, linked at bit 018400
0020
0021 00000000 .text
0022 00000000 _start:
0023 00000000 0550 setf 16, 0, 0
0024 00000010 0740 setf 32, 0, 1
0025 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0026
0027 00000040 078F move sp, @01860420h, 1 ; entry SP
00000050 01860420
0028 00000070 078E move a14, @01860400h, 1 ; entry A14
00000080 01860400
0029
0030 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0031 000000D0 0780 move a0, @01860140h, 1 ; stage = 1
000000E0 01860140
0032
0033 ; ---- create_process(0x01840000, "0::0", 0x6000, 1, 0
0034 ; Arguments are pushed last-first, upward through A14,
0035 ; else in this firmware.
0036 00000100 A3CF move a14, -*sp, 1
0037 00000110 09EE movi 01862000h, a14, L
00000120 01862000
0038 00000140 09E0 movi 0, a0, L
00000150 00000000
0039 00000170 920E move a0, *a14+, 1 ; arg4 = 0 (process argument)
0040 00000180 09E0 movi 1, a0, L
00000190 00000001
0041 000001B0 920E move a0, *a14+, 1 ; arg3 = 1
0042 000001C0 09E0 movi 06000h, a0, L
000001D0 00006000
0043 000001F0 920E move a0, *a14+, 1 ; arg2 = stack size
0044 00000200 09E0 movi 3F30DC00h, a0, L ; ROM "0::0" (any short name wil
00000210 3F30DC00
0045 00000230 920E move a0, *a14+, 1 ; arg1 = name
0046 00000240 09E0 movi 01840000h, a0, L ; xhello entry
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:11:10 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 2
00000250 01840000
0047 00000270 920E move a0, *a14+, 1 ; arg0 = entry
0048 00000280 0D5F calla 3F706A40h ; create_process
00000290 3F706A40
0049 000002B0 07AF move @01860420h, sp, 1
000002C0 01860420
0050 000002E0 07AE move @01860400h, a14, 1
000002F0 01860400
0051
0052 00000310 0788 move a8, @01860120h, 1 ; MARK PCB
00000320 01860120
0053 00000340 09E0 movi 2, a0, L
00000350 00000002
0054 00000370 0780 move a0, @01860140h, 1 ; stage = 2
00000380 01860140
0055
0056 000003A0 done:
0057 000003A0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
000003B0 00FF
0058 000003C0 09E8 movi 0, a8, L
000003D0 00000000
0059 000003F0 0960 rets
0060 .end
No Errors, No Warnings
dwt/gui/build/xlaunch.map
+34
View File
@@ -0,0 +1,34 @@
*****************************************************
GSP COFF Linker, Version 2.00, 87.300
*****************************************************
Sun Oct 18 14:11:10 2026
OUTPUT FILE NAME: <XLAUNCH.out>
ENTRY POINT SYMBOL: 0
SECTION ALLOCATION MAP
output attributes/
section page origin length input sections
-------- ---- ---------- ---------- ----------------
.data 0 00000000 00000000
.bss 0 00000000 00000000 UNINITIALIZED
.text 0 01860000 00000400
01860000 00000400 XLAUNCH.obj (.text)
GLOBAL SYMBOLS
address name address name
-------- ---- -------- ----
00000000 .bss 00000000 edata
00000000 .data 00000000 .bss
01860000 .text 00000000 end
00000000 edata 00000000 .data
00000000 end 01860000 .text
01860400 etext 01860400 etext
[6 symbols]
dwt/gui/evidence/transport_evidence.txt
+101
View File
@@ -0,0 +1,101 @@
=== run12: xhello in a create_process child (successful) ===
TR OPEN entry pc=3F9C2570 a14=01892020 arg=48555555
TR DISP-ALLOC a8=007C7290
TR PARSE-ATTACH pc=3FD3B3E0 name=A001893D
TR ATTACH entry pc=3F70B060 nameptr=A001893D proc=003FFBD0
TR LOOKUP entry nameptr=A001892D
TR ATTACH ret a8=008D3050
TR SETUP-WRITE pre len=55555555
Data dumped successfully
TR XREAD entry conn=3FACE948 buf=007C7290 len=00000000
TR XREAD ret a8=00000000 expect=00000008
TR ACCEPT-CB entry proc=00414F90
TR REGISTER entry nameptr=C83F34EC proc=00414F90
TR REGISTER ret a8=007ADE70
TR READ12 call frame=00415680 conn=00000000 len=00010000
TR READ12 ret a8=0000000C
Data dumped successfully
TR READ12 complete
TR SRV-WRITE entry pc=3F70D150
TR SRV-WRITE ret a8=00000008
TR SRV-WRITE entry pc=3F70D150
=== run12: setup reply read, window calls ===
TR LOCAL-ACCEPT-WORKER entry conn=00415540
TR XREAD ret a8=00000008 expect=00000008
TR XREAD entry conn=3FACE948 buf=007C7290 len=00000000
TR XREAD ret a8=00000090 expect=00000090
TR DISP-INIT a10=007C7290
TR XREAD entry conn=007C7290 buf=01892E50 len=00000020
TR XREAD ret a8=00000000 expect=00000020
TR SRV-WRITE entry pc=3F70D150
TR SRV-WRITE ret a8=00000020
TR LOCAL-ACCEPT-WORKER entry conn=00415540
TR XREAD ret a8=00000020 expect=00000020
TR DISP-RET a10=007C7290 a8=00000000
TR DISP-RET2 a8=007C7290
TR XH STORE-DISP a8=007C7290
TR CreateSimpleWindow
TR MapWindow
TR XSync
=== run14: the same xhello called from the rdebug process (fails) ===
TR OPEN entry pc=3F9C2570 a14=01892020 arg=48555555
TR DISP-ALLOC a8=007C7290
TR PARSE-ATTACH pc=3FD3B3E0 name=A001893D
TR ATTACH entry pc=3F70B060 nameptr=A001893D proc=004043D0
TR LOOKUP entry nameptr=A001892D
TR ATTACH ret a8=008D3050
TR SETUP-WRITE pre len=55555555
Data dumped successfully
TR XREAD entry conn=3FACE948 buf=007C7290 len=01840000
TR XREAD ret a8=00000000 expect=00000008
TR ACCEPT-CB entry proc=00414F90
TR REGISTER entry nameptr=C83F34EC proc=00414F90
=== run14: nothing else -- no READ12, no SRV-WRITE, no MapWindow/XSync ===
dwt/gui/evidence/xhello_window_frame2838.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

dwt/gui/probe_win.lua
+49
View File
@@ -0,0 +1,49 @@
-- probe_win.lua -- final, breakpoint-free observation of the injected window.
--
-- No bpset/wpset at all: this script only reads RAM markers and takes PNG
-- snapshots on a trigger file ("<prefix> <count> <stride>"). The payload does
-- the work; the script just looks.
local machine = manager.machine
local dir = os.getenv("MSG_DIR") or "."
local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
local screen = nil
for _, s in pairs(machine.screens) do screen = s; break end
local cpu = machine.devices[':maincpu']
local space = cpu.spaces['program']
local f = 0
local job = nil
local function u32(a)
local ok, v = pcall(function() return space:read_u32(a) end)
if ok then return v end
return 0xdeadbeef
end
local function consume_trigger()
local fh = io.open(trigger, "r")
if not fh then return end
local text = fh:read("*a") or ""
fh:close(); os.remove(trigger)
local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
if not prefix then return end
job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = f }
print(string.format("probe_win: frame %d job %s x%d every %d",
f, prefix, job.left, job.stride))
end
emu.register_frame_done(function()
f = f + 1
consume_trigger()
if job and screen and f >= job.next then
local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, f)
local ok = pcall(function() return screen:snapshot(out) end)
print(string.format("probe_win: frame %d %s ok=%s", f, out, tostring(ok)))
job.left = job.left - 1
job.next = f + job.stride
if job.left <= 0 then job = nil end
end
if f % 100 == 0 then
print(string.format("probe_win: f=%d stage=%d strlen=%d win_low=%04X",
f, u32(0x01890140), u32(0x01890160), u32(0x01890120)))
end
end, "vt1200-gui-probe-win")
dwt/gui/run12/debug.log
+22582
View File
File diff suppressed because it is too large. Load diff
dwt/gui/run12/mame.log
+200
View File
@@ -0,0 +1,200 @@
Warning: -video none doesn't make much sense without -seconds_to_run
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
vt1200: scanline#1 line=1 enabled=1
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
trace: armed
vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
vt1200: scanline#2 line=0 enabled=1
vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
vt1200: scanline#3 line=1 enabled=1
vt1200: scanline#4 line=2 enabled=1
trace: f=100 PC=3FB44B00 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=00000000 strlen=1431655765
trace: f=200 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=300 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=400 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=500 PC=3F351010 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=500 procs 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd 00403650:WM 001B3860:.A@ 00414F90:SERVER 00404190:Inetd
trace: f=600 PC=3F798250 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=700 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=800 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=900 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1000 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=1000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=1100 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1200 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1300 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1400 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1500 PC=3F579870 st=1431655765 disp=55555555 root=55555555 win=55555555 pcb=55555555 tmdisp=004E65B0 strlen=1431655765
trace: f=1500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=1500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=1600 PC=3FB3FAC0 st=2 disp=55555555 root=55555555 win=55555555 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=1700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=1700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=1800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=1800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=1900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=1900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=2000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=2100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: frame 2297 snapshot job win x8 every 40
trace: frame 2297 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02297.png
trace: f=2300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: frame 2337 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02337.png
trace: frame 2377 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02377.png
trace: f=2400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: frame 2417 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02417.png
trace: frame 2457 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02457.png
trace: frame 2497 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02497.png
trace: f=2500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=2500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: frame 2537 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02537.png
trace: frame 2577 snapshot /home/arti/code/k-space/vt1200/dwt/gui/run12/win_frame02577.png
trace: f=2600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=2900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=2900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=3000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=3100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=3500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=3600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=3900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=3900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=4000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=4100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=4500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=4600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=4900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=4900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=5000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=5100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=5500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=5600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=5900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=5900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=6000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=6100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=6500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=6600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=6900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=6900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=7000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=7100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7300 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7300 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7400 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7400 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7500 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7500 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7500 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=7500 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=7600 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7600 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7700 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7700 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7800 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7800 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=7900 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=7900 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=8000 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=8000 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=8000 services [0]004FE5B0:xserver [1]008DB1B0:VTEMULATOR
trace: f=8000 procs 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0.. 001B3860:0..
trace: f=8100 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=8100 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
trace: f=8200 PC=3F579870 st=6 disp=006B7290 root=0001006B win=00010001 pcb=003FFBD0 tmdisp=004E65B0 strlen=4
trace: f=8200 disp=006B7290 screens=55555555 root=00000000 | tm disp=004E65B0 screens=0065FB90 root=0008006B
dwt/gui/run12/win_frame02537.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

dwt/gui/run13/mame.log
+197
View File
@@ -0,0 +1,197 @@
Warning: -video none doesn't make much sense without -seconds_to_run
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
vt1200: screen_update#3 frame=0 clip_y=0..900 screen=1280x901
vt1200: scanline#1 line=0 enabled=1
vt1200: guard#2 frame=0 dump_frame=-1 dump_ram=-1
vt1200: screen_update#4 frame=1 clip_y=0..0 screen=1280x901
vt1200: scanline#2 line=0 enabled=1
vt1200: scanline#3 line=1 enabled=1
vt1200: scanline#4 line=2 enabled=1
probe_win: f=100 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=200 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=300 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=400 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=500 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=600 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=700 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=800 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=900 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1000 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1100 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1200 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1300 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1400 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1500 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1600 stage=1431655765 strlen=1431655765 win_low=55555555
probe_win: f=1700 stage=6 strlen=4 win_low=10001
probe_win: f=1800 stage=6 strlen=4 win_low=10001
probe_win: f=1900 stage=6 strlen=4 win_low=10001
probe_win: f=2000 stage=6 strlen=4 win_low=10001
probe_win: f=2100 stage=6 strlen=4 win_low=10001
probe_win: f=2200 stage=6 strlen=4 win_low=10001
probe_win: f=2300 stage=6 strlen=4 win_low=10001
probe_win: f=2400 stage=6 strlen=4 win_low=10001
probe_win: f=2500 stage=6 strlen=4 win_low=10001
probe_win: frame 2598 job xhello x6 every 60
probe_win: frame 2598 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02598.png ok=true
probe_win: f=2600 stage=6 strlen=4 win_low=10001
probe_win: frame 2658 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02658.png ok=true
probe_win: f=2700 stage=6 strlen=4 win_low=10001
probe_win: frame 2718 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02718.png ok=true
probe_win: frame 2778 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02778.png ok=true
probe_win: f=2800 stage=6 strlen=4 win_low=10001
probe_win: frame 2838 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02838.png ok=true
probe_win: frame 2898 /home/arti/code/k-space/vt1200/dwt/gui/run13/xhello_frame02898.png ok=true
probe_win: f=2900 stage=6 strlen=4 win_low=10001
probe_win: f=3000 stage=6 strlen=4 win_low=10001
probe_win: f=3100 stage=6 strlen=4 win_low=10001
probe_win: f=3200 stage=6 strlen=4 win_low=10001
probe_win: f=3300 stage=6 strlen=4 win_low=10001
probe_win: f=3400 stage=6 strlen=4 win_low=10001
probe_win: f=3500 stage=6 strlen=4 win_low=10001
probe_win: f=3600 stage=6 strlen=4 win_low=10001
probe_win: f=3700 stage=6 strlen=4 win_low=10001
probe_win: f=3800 stage=6 strlen=4 win_low=10001
probe_win: f=3900 stage=6 strlen=4 win_low=10001
probe_win: f=4000 stage=6 strlen=4 win_low=10001
probe_win: f=4100 stage=6 strlen=4 win_low=10001
probe_win: f=4200 stage=6 strlen=4 win_low=10001
probe_win: f=4300 stage=6 strlen=4 win_low=10001
probe_win: f=4400 stage=6 strlen=4 win_low=10001
probe_win: f=4500 stage=6 strlen=4 win_low=10001
probe_win: f=4600 stage=6 strlen=4 win_low=10001
probe_win: f=4700 stage=6 strlen=4 win_low=10001
probe_win: f=4800 stage=6 strlen=4 win_low=10001
probe_win: f=4900 stage=6 strlen=4 win_low=10001
probe_win: f=5000 stage=6 strlen=4 win_low=10001
probe_win: f=5100 stage=6 strlen=4 win_low=10001
probe_win: f=5200 stage=6 strlen=4 win_low=10001
probe_win: f=5300 stage=6 strlen=4 win_low=10001
probe_win: f=5400 stage=6 strlen=4 win_low=10001
probe_win: f=5500 stage=6 strlen=4 win_low=10001
probe_win: f=5600 stage=6 strlen=4 win_low=10001
probe_win: f=5700 stage=6 strlen=4 win_low=10001
probe_win: f=5800 stage=6 strlen=4 win_low=10001
probe_win: f=5900 stage=6 strlen=4 win_low=10001
probe_win: f=6000 stage=6 strlen=4 win_low=10001
probe_win: f=6100 stage=6 strlen=4 win_low=10001
probe_win: f=6200 stage=6 strlen=4 win_low=10001
probe_win: f=6300 stage=6 strlen=4 win_low=10001
probe_win: f=6400 stage=6 strlen=4 win_low=10001
probe_win: f=6500 stage=6 strlen=4 win_low=10001
probe_win: f=6600 stage=6 strlen=4 win_low=10001
probe_win: f=6700 stage=6 strlen=4 win_low=10001
probe_win: f=6800 stage=6 strlen=4 win_low=10001
probe_win: f=6900 stage=6 strlen=4 win_low=10001
probe_win: f=7000 stage=6 strlen=4 win_low=10001
probe_win: f=7100 stage=6 strlen=4 win_low=10001
probe_win: f=7200 stage=6 strlen=4 win_low=10001
probe_win: f=7300 stage=6 strlen=4 win_low=10001
probe_win: f=7400 stage=6 strlen=4 win_low=10001
probe_win: f=7500 stage=6 strlen=4 win_low=10001
probe_win: f=7600 stage=6 strlen=4 win_low=10001
probe_win: f=7700 stage=6 strlen=4 win_low=10001
probe_win: f=7800 stage=6 strlen=4 win_low=10001
probe_win: f=7900 stage=6 strlen=4 win_low=10001
probe_win: f=8000 stage=6 strlen=4 win_low=10001
probe_win: f=8100 stage=6 strlen=4 win_low=10001
probe_win: f=8200 stage=6 strlen=4 win_low=10001
probe_win: f=8300 stage=6 strlen=4 win_low=10001
probe_win: f=8400 stage=6 strlen=4 win_low=10001
probe_win: f=8500 stage=6 strlen=4 win_low=10001
probe_win: f=8600 stage=6 strlen=4 win_low=10001
probe_win: f=8700 stage=6 strlen=4 win_low=10001
probe_win: f=8800 stage=6 strlen=4 win_low=10001
probe_win: f=8900 stage=6 strlen=4 win_low=10001
probe_win: f=9000 stage=6 strlen=4 win_low=10001
probe_win: f=9100 stage=6 strlen=4 win_low=10001
probe_win: f=9200 stage=6 strlen=4 win_low=10001
probe_win: f=9300 stage=6 strlen=4 win_low=10001
probe_win: f=9400 stage=6 strlen=4 win_low=10001
probe_win: f=9500 stage=6 strlen=4 win_low=10001
probe_win: f=9600 stage=6 strlen=4 win_low=10001
probe_win: f=9700 stage=6 strlen=4 win_low=10001
probe_win: f=9800 stage=6 strlen=4 win_low=10001
probe_win: f=9900 stage=6 strlen=4 win_low=10001
probe_win: f=10000 stage=6 strlen=4 win_low=10001
probe_win: f=10100 stage=6 strlen=4 win_low=10001
probe_win: f=10200 stage=6 strlen=4 win_low=10001
probe_win: f=10300 stage=6 strlen=4 win_low=10001
probe_win: f=10400 stage=6 strlen=4 win_low=10001
probe_win: f=10500 stage=6 strlen=4 win_low=10001
probe_win: f=10600 stage=6 strlen=4 win_low=10001
probe_win: f=10700 stage=6 strlen=4 win_low=10001
probe_win: f=10800 stage=6 strlen=4 win_low=10001
probe_win: f=10900 stage=6 strlen=4 win_low=10001
probe_win: f=11000 stage=6 strlen=4 win_low=10001
probe_win: f=11100 stage=6 strlen=4 win_low=10001
probe_win: f=11200 stage=6 strlen=4 win_low=10001
probe_win: f=11300 stage=6 strlen=4 win_low=10001
probe_win: f=11400 stage=6 strlen=4 win_low=10001
probe_win: f=11500 stage=6 strlen=4 win_low=10001
probe_win: f=11600 stage=6 strlen=4 win_low=10001
probe_win: f=11700 stage=6 strlen=4 win_low=10001
probe_win: f=11800 stage=6 strlen=4 win_low=10001
probe_win: f=11900 stage=6 strlen=4 win_low=10001
probe_win: f=12000 stage=6 strlen=4 win_low=10001
probe_win: f=12100 stage=6 strlen=4 win_low=10001
probe_win: f=12200 stage=6 strlen=4 win_low=10001
probe_win: f=12300 stage=6 strlen=4 win_low=10001
probe_win: f=12400 stage=6 strlen=4 win_low=10001
probe_win: f=12500 stage=6 strlen=4 win_low=10001
probe_win: f=12600 stage=6 strlen=4 win_low=10001
probe_win: f=12700 stage=6 strlen=4 win_low=10001
probe_win: f=12800 stage=6 strlen=4 win_low=10001
probe_win: f=12900 stage=6 strlen=4 win_low=10001
probe_win: f=13000 stage=6 strlen=4 win_low=10001
probe_win: f=13100 stage=6 strlen=4 win_low=10001
probe_win: f=13200 stage=6 strlen=4 win_low=10001
probe_win: f=13300 stage=6 strlen=4 win_low=10001
probe_win: f=13400 stage=6 strlen=4 win_low=10001
probe_win: f=13500 stage=6 strlen=4 win_low=10001
probe_win: f=13600 stage=6 strlen=4 win_low=10001
probe_win: f=13700 stage=6 strlen=4 win_low=10001
probe_win: f=13800 stage=6 strlen=4 win_low=10001
probe_win: f=13900 stage=6 strlen=4 win_low=10001
probe_win: f=14000 stage=6 strlen=4 win_low=10001
probe_win: f=14100 stage=6 strlen=4 win_low=10001
probe_win: f=14200 stage=6 strlen=4 win_low=10001
probe_win: f=14300 stage=6 strlen=4 win_low=10001
probe_win: f=14400 stage=6 strlen=4 win_low=10001
probe_win: f=14500 stage=6 strlen=4 win_low=10001
probe_win: f=14600 stage=6 strlen=4 win_low=10001
probe_win: f=14700 stage=6 strlen=4 win_low=10001
probe_win: f=14800 stage=6 strlen=4 win_low=10001
probe_win: f=14900 stage=6 strlen=4 win_low=10001
probe_win: f=15000 stage=6 strlen=4 win_low=10001
probe_win: f=15100 stage=6 strlen=4 win_low=10001
probe_win: f=15200 stage=6 strlen=4 win_low=10001
probe_win: f=15300 stage=6 strlen=4 win_low=10001
probe_win: f=15400 stage=6 strlen=4 win_low=10001
probe_win: f=15500 stage=6 strlen=4 win_low=10001
probe_win: f=15600 stage=6 strlen=4 win_low=10001
probe_win: f=15700 stage=6 strlen=4 win_low=10001
probe_win: f=15800 stage=6 strlen=4 win_low=10001
probe_win: f=15900 stage=6 strlen=4 win_low=10001
probe_win: f=16000 stage=6 strlen=4 win_low=10001
probe_win: f=16100 stage=6 strlen=4 win_low=10001
probe_win: f=16200 stage=6 strlen=4 win_low=10001
probe_win: f=16300 stage=6 strlen=4 win_low=10001
probe_win: f=16400 stage=6 strlen=4 win_low=10001
probe_win: f=16500 stage=6 strlen=4 win_low=10001
probe_win: f=16600 stage=6 strlen=4 win_low=10001
probe_win: f=16700 stage=6 strlen=4 win_low=10001
probe_win: f=16800 stage=6 strlen=4 win_low=10001
probe_win: f=16900 stage=6 strlen=4 win_low=10001
probe_win: f=17000 stage=6 strlen=4 win_low=10001
probe_win: f=17100 stage=6 strlen=4 win_low=10001
probe_win: f=17200 stage=6 strlen=4 win_low=10001
probe_win: f=17300 stage=6 strlen=4 win_low=10001
probe_win: f=17400 stage=6 strlen=4 win_low=10001
probe_win: f=17500 stage=6 strlen=4 win_low=10001
probe_win: f=17600 stage=6 strlen=4 win_low=10001
probe_win: f=17700 stage=6 strlen=4 win_low=10001
probe_win: f=17800 stage=6 strlen=4 win_low=10001
probe_win: f=17900 stage=6 strlen=4 win_low=10001
dwt/gui/run13/xhello_frame02838.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

dwt/gui/trace_accept.lua
+192
View File
@@ -0,0 +1,192 @@
-- trace_accept.lua -- H1/H2/H3 instrumentation for the X local-service connect.
--
-- Start with -debuglog: breakpoint printf output goes to ./debug.log (not
-- stdout). All addresses are bit addresses.
--
-- Probe points:
-- 3F9C2570 XOpenDisplay (Xlib client entry)
-- 3FD3B3E0 XParseDisplay: call of service attach by name
-- 3F70B060 service attach by name
-- 3F70DB80 service table lookup
-- 3F709840 service register (server side)
-- 3F34EC50 "xserver" registration callback = local accept/next-connection
-- 3F58B830 TCP connection accept (the real function, NOT 3F58B800)
-- 3F3F4680 authorisation check
-- 3F706A40 create_process
-- 3FD41B90 XCreateSimpleWindow
-- 3FD645B0 XMapWindow
-- 3FD9F6B0 XSync
--
-- Also snapshots frames on a trigger file: "<prefix> <count> <stride>".
local machine = manager.machine
local cpu = machine.devices[':maincpu']
local dbg = machine.debugger
local space = cpu.spaces['program']
if not dbg then print("trace: no debugger"); machine:exit(); return end
dbg.visible_cpu = cpu
local dir = os.getenv("MSG_DIR") or "."
local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
local screen = nil
for _, s in pairs(machine.screens) do screen = s; break end
local f = 0
local job = nil
local armed = false
local scanned = false
local function u32(a)
local ok, v = pcall(function() return space:read_u32(a) end)
if ok then return v end
return 0xdeadbeef
end
local function u8(a)
local ok, v = pcall(function() return space:read_u8(a) end)
if ok then return v end
return 0
end
local function name_at(p)
local t = {}
for k = 0, 15 do
local c = u8(p + k * 8)
if c == 0 then break end
if c >= 0x20 and c < 0x7f then
t[#t + 1] = string.char(c)
else
t[#t + 1] = "."
end
end
return table.concat(t)
end
local function cmd(s)
local ok, e = pcall(function() dbg:command(s) end)
if not ok then print("trace: command failed: " .. tostring(e)) end
end
local function consume_trigger()
local fh = io.open(trigger, "r")
if not fh then return end
local text = fh:read("*a") or ""
fh:close(); os.remove(trigger)
local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
if not prefix then return end
job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = f }
print(string.format("trace: frame %d snapshot job %s x%d every %d",
f, prefix, job.left, job.stride))
end
local function service_table()
local out = {}
for i = 0, 31 do
local p = u32(0x1e8d70 + i * 32)
if p ~= 0 and p ~= 0xdeadbeef then
out[#out + 1] = string.format("[%d]%08X:%s", i, p, name_at(p))
end
end
return table.concat(out, " ")
end
local function process_table()
local out = {}
local p = u32(0x1b3880)
local n = 0
while p ~= 0 and p ~= 0x1b3880 and p ~= 0xdeadbeef and n < 24 do
out[#out + 1] = string.format("%08X:%s", p, name_at(u32(p + 0xa0)))
p = u32(p)
n = n + 1
end
return table.concat(out, " ")
end
local function arm()
armed = true
-- client side
cmd('bpset 3F9C2570,,{ printf "TR OPEN entry pc=%08X a14=%08X arg=%08X\\n", pc, a14, d@(a14-32) ; g }')
cmd('bpset 3F9C27B0,,{ printf "TR DISP-ALLOC a8=%08X\\n", a8 ; g }')
cmd('bpset 3F9C3730,,{ printf "TR DISP-INIT a10=%08X\\n", a10 ; g }')
cmd('bpset 3F9C6870,,{ printf "TR DISP-RET a10=%08X a8=%08X\\n", a10, a8 ; g }')
cmd('bpset 3F9C6880,,{ printf "TR DISP-RET2 a8=%08X\\n", a8 ; g }')
cmd('bpset 01840450,,{ printf "TR XH STORE-DISP a8=%08X\\n", a8 ; g }')
cmd('bpset 01840570,,{ printf "TR XH STORE-ROOT a9=%08X\\n", a9 ; g }')
cmd('bpset 01840840,,{ printf "TR XH STORE-WIN a8=%08X\\n", a8 ; g }')
cmd('bpset 3FD3B3E0,,{ printf "TR PARSE-ATTACH pc=%08X name=%08X\\n", pc, d@(a14-32) ; g }')
cmd('bpset 3F70B060,,{ printf "TR ATTACH entry pc=%08X nameptr=%08X proc=%08X\\n", pc, d@(a14-32), d@0x1b3900 ; g }')
cmd('bpset 3F70BB40,,{ printf "TR ATTACH ret a8=%08X\\n", a8 ; g }')
cmd('bpset 3F70DB80,,{ printf "TR LOOKUP entry nameptr=%08X\\n", d@(a14-32) ; g }')
-- server side
cmd('bpset 3F709840,,{ printf "TR REGISTER entry nameptr=%08X proc=%08X\\n", d@(a14-32), d@0x1b3900 ; g }')
cmd('bpset 3F70AC20,,{ printf "TR REGISTER ret a8=%08X\\n", a8 ; g }')
cmd('bpset 3F34EC50,,{ printf "TR ACCEPT-CB entry proc=%08X\\n", d@0x1b3900 ; g }')
cmd('bpset 3F58B830,,{ printf "TR TCP-ACCEPT entry\\n" ; g }')
cmd('bpset 3F3F4680,,{ printf "TR AUTH entry\\n" ; g }')
-- local service: Xlib's setup write and the server's 12-byte setup read
cmd('bpset 3FD3D980,,{ printf "TR SETUP-WRITE pre len=%08X\\n", d@(a13+4288) ; dump ' .. dir .. '/setup_write.bin,a13+160,128 ; g }')
cmd('bpset 3F34F190,,{ printf "TR LOCAL-ACCEPT-WORKER entry conn=%08X\\n", a13 ; g }')
cmd('bpset 3F350170,,{ printf "TR READ12 call frame=%08X conn=%08X len=%08X\\n", a13, d@(a13), d@(a13+416) ; g }')
cmd('bpset 3F3501A0,,{ printf "TR READ12 ret a8=%08X\\n", a8 ; dump ' .. dir .. '/read12.bin,a13+96,64 ; g }')
cmd('bpset 3F350330,,{ printf "TR READ12 complete\\n" ; g }')
cmd('bpset 3F350BE0,,{ printf "TR SERVER-REPLY-WRITE call\\n" ; g }')
cmd('bpset 3F350C10,,{ printf "TR SERVER-REPLY-WRITE ret a8=%08X\\n", a8 ; g }')
cmd('bpset 3F9B2470,,{ printf "TR XREAD entry conn=%08X buf=%08X len=%08X\\n", a9, a10, a11 ; g }')
cmd('bpset 3F9B3020,,{ printf "TR XREAD ret a8=%08X expect=%08X\\n", a8, a11 ; g }')
cmd('bpset 3F70D150,d@0x1b3900==414F90,{ printf "TR SRV-WRITE entry pc=%08X\\n", pc ; g }')
cmd('bpset 3F70D990,d@0x1b3900==414F90,{ printf "TR SRV-WRITE ret a8=%08X\\n", a8 ; g }')
-- process creation
cmd('bpset 3F706A40,,{ printf "TR CREATE_PROC entry entryarg=%08X nameptr=%08X proc=%08X\\n", d@(a14-32), d@(a14-64), d@0x1b3900 ; g }')
-- window calls
cmd('bpset 3FD41B90,,{ printf "TR CreateSimpleWindow\\n" ; g }')
cmd('bpset 3FD645B0,,{ printf "TR MapWindow\\n" ; g }')
cmd('bpset 3FD9F6B0,,{ printf "TR XSync\\n" ; g }')
-- xhello progress is tracked through its relocated markers (0189xxxx);
-- the code offsets moved when the setf fix was inserted, so no bpsets here.
print("trace: armed")
end
emu.register_frame_done(function()
f = f + 1
if f == 1 and not armed then arm() end
consume_trigger()
if job and screen and f >= job.next then
local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, f)
pcall(function() return screen:snapshot(out) end)
print(string.format("trace: frame %d snapshot %s", f, out))
job.left = job.left - 1
job.next = f + job.stride
if job.left <= 0 then job = nil end
end
if f % 100 == 0 then
print(string.format("trace: f=%d PC=%08X st=%d disp=%08X root=%08X win=%08X pcb=%08X tmdisp=%08X strlen=%d",
f, cpu.state['PC'].value, u32(0x01890140), u32(0x01890100),
u32(0x01890110), u32(0x01890120), u32(0x01860120), u32(0xb78e0), u32(0x01890160)))
local d = u32(0x01890100)
if d ~= 0x55555555 and d ~= 0 and d ~= 0xdeadbeef then
local s = u32(d + 0x480)
local r = u32(s + 0x40)
local td = u32(0xb78e0)
local ts = u32(td + 0x480)
local tr = u32(ts + 0x40)
print(string.format("trace: f=%d disp=%08X screens=%08X root=%08X | tm disp=%08X screens=%08X root=%08X",
f, d, s, r, td, ts, tr))
if u32(0x01890140) == 3 and not scanned then
scanned = true
local hits = {}
for a = 0x00400000, 0x01000000, 0x20 do
if u32(a) == ts then
hits[#hits + 1] = string.format("%08X", a)
if #hits >= 8 then break end
end
end
print("trace: heap words equal to tm screens: " .. table.concat(hits, ","))
end
end
end
if f % 500 == 0 then
print(string.format("trace: f=%d services %s", f, service_table()))
print(string.format("trace: f=%d procs %s", f, process_table()))
end
end, "vt1200-gui-trace")
if machine.debugger then machine.debugger.execution_state = 'run' end
dwt/gui/xhello.asm
+66 -52
View File
@@ -1,5 +1,10 @@
; xhello.asm -- open a *new* X connection from an rdebug `jump` payload and
; create/map a window on the live DWT X server.
; xhello.asm -- open a *new* X connection and create/map a window on the live
; DWT X server.
;
; Run as a first-class process created by xlaunch.asm (create_process), NOT in
; the rdebug dispatcher's context: a connect made from the rdebug process is
; accepted at the service layer but the server never reads the X11 setup, so
; XOpenDisplay returns an unusable Display. A fresh process works.
;
; Calling convention (the one the firmware itself uses; see the WM at
; 07F57044 and the TM at 07E5D2B4):
@@ -10,9 +15,10 @@
; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last
; CALLA target
;
; We point A14 at a private argument buffer instead of the dispatcher frame, and
; we keep the entry SP/A14 in RAM so the payload returns even if a callee
; leaves the stack in an unexpected state.
; Xlib clobbers the CPU's SETF field state, so the ABI's 32-bit field 1 is
; re-established after every call. The Display pointer and root/window ids are
; kept in a11/a10 (both callee-saved by every Xlib entry point): a RAM cell can
; be overwritten by the new process's stack, a register cannot.
;
; Xlib entry points (Ghidra address -> bit address):
; 7F384AE XOpenDisplay(name) -> 3F9C2570
@@ -21,13 +27,13 @@
; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
; 7F68B1A strlen(s) -> 3FB458D0 (convention check)
;
; Markers (32-bit cells, bit addresses):
; 01850100 display pointer
; 01850110 root window
; 01850120 window id
; 01850130 XSync return
; 01850140 stage counter
; 01850150 strlen("0::0") -- must be 4; if not, we stop before touching Xlib
; Markers (32-bit cells, bit addresses; diagnostic only):
; 01890100 display pointer
; 01890110 root window
; 01890120 window id
; 01890130 XSync return
; 01890140 stage counter
; 01890160 strlen("0::0") -- must be 4; if not, we stop before touching Xlib
.text
_start:
@@ -35,52 +41,56 @@ _start:
setf 32, 0, 1
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
move sp, @01850420h, 1 ; entry SP
move a14, @01850400h, 1 ; entry A14
move sp, @01890420h, 1 ; entry SP
move a14, @01890400h, 1 ; entry A14
movi 1, a0, L
move a0, @01850140h, 1 ; stage = 1
move a0, @01890140h, 1 ; stage = 1
; ---- convention check: strlen("0::0") == 4 --------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 01892000h, a14, L
movi 3FACE948h, a0, L ; ROM "0::0"
move a0, *a14+, 1 ; arg0
calla 3FB458D0h ; strlen
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850160h, 1 ; MARK strlen
move @01890420h, sp, 1
move @01890400h, a14, 1
setf 16, 0, 0 ; Xlib leaves the field sizes changed;
setf 32, 0, 1 ; re-establish the ABI's 32-bit field 1
move a8, @01890160h, 1 ; MARK strlen
movi 4, a0, L
cmp a0, a8
jrne done
movi 2, a0, L
move a0, @01850140h, 1
move a0, @01890140h, 1
; ---- display = XOpenDisplay("0::0") ---------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 01892000h, a14, L
movi 3FACE948h, a0, L
move a0, *a14+, 1 ; arg0 = name
calla 3F9C2570h ; XOpenDisplay
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850100h, 1 ; MARK display
move a8, a8
move @01890420h, sp, 1
move @01890400h, a14, 1
setf 16, 0, 0
setf 32, 0, 1
move a8, a11 ; keep the Display in a callee-saved reg
move a11, @01890100h, 1 ; MARK display
move a11, a11
jreq done
movi 3, a0, L
move a0, @01850140h, 1
move a0, @01890140h, 1
; ---- root = *(*(display+0x480)+0x40) --------------------------
move @01850100h, a6, 1
move *a6(0480h), a9, 1
move *a9(040h), a9, 1
move a9, @01850110h, 1 ; MARK root
move *a11(0480h), a10, 1
move *a10(040h), a10, 1
move a10, @01890110h, 1 ; MARK root
; ---- XCreateSimpleWindow(display,root,100,100,400,200,2,0,0) --
move a14, -*sp, 1
movi 01852000h, a14, L
movi 01892000h, a14, L
movi 0, a0, L
move a0, *a14+, 1 ; background = 0 (black)
move a0, *a14+, 1 ; border = 0
@@ -93,44 +103,48 @@ _start:
movi 100, a0, L
move a0, *a14+, 1 ; y
move a0, *a14+, 1 ; x
move a9, *a14+, 1 ; parent
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
move a10, *a14+, 1 ; parent = root
move a11, *a14+, 1 ; display
calla 3FD41B90h ; XCreateSimpleWindow
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850120h, 1 ; MARK window
move @01890420h, sp, 1
move @01890400h, a14, 1
setf 16, 0, 0
setf 32, 0, 1
move a8, a10 ; window id (root no longer needed)
move a10, @01890120h, 1 ; MARK window
movi 4, a0, L
move a0, @01850140h, 1
move a0, @01890140h, 1
; ---- XMapWindow(display, window) ------------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
move a8, *a14+, 1 ; window
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
movi 01892000h, a14, L
move a10, *a14+, 1 ; window
move a11, *a14+, 1 ; display
calla 3FD645B0h ; XMapWindow
move @01850420h, sp, 1
move @01850400h, a14, 1
move @01890420h, sp, 1
move @01890400h, a14, 1
setf 16, 0, 0
setf 32, 0, 1
movi 5, a0, L
move a0, @01850140h, 1
move a0, @01890140h, 1
; ---- XSync(display, 0) ----------------------------------------
move a14, -*sp, 1
movi 01852000h, a14, L
movi 01892000h, a14, L
movi 0, a0, L
move a0, *a14+, 1 ; discard = 0
move @01850100h, a6, 1
move a6, *a14+, 1 ; display
move a11, *a14+, 1 ; display
calla 3FD9F6B0h ; XSync
move @01850420h, sp, 1
move @01850400h, a14, 1
move a8, @01850130h, 1 ; MARK sync
move @01890420h, sp, 1
move @01890400h, a14, 1
setf 16, 0, 0
setf 32, 0, 1
move a8, @01890130h, 1 ; MARK sync
movi 6, a0, L
move a0, @01850140h, 1
move a0, @01890140h, 1
done:
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
dwt/gui/xlaunch.asm
+60
View File
@@ -0,0 +1,60 @@
; xlaunch.asm -- create a *first-class* process whose entry is xhello.bin.
;
; The rdebug `jump` payload runs inside the "remote debug" process. Hypothesis
; H3 is that this process context is not a valid X client; this launcher
; therefore calls the OS's own create_process so xhello runs in a fresh process
; with its own PCB, user area (fd table) and 0x6000-byte stack, exactly like the
; Telnet handler does at ROM 07EDA7A0 (bits 3F6D4340..3F6D4440):
;
; create_process(entry="Telnet", name, 0x6000, 1, arg)
;
; create_process = bits 3F706A40 (Ghidra 07EE0D48).
;
; Markers (32-bit cells, bit addresses):
; 01860120 PCB returned by create_process (0 = failure)
; 01860140 stage (1 = entered, 2 = create_process returned)
; 01860400 entry A14
; 01860420 entry SP
;
; The new process runs xhello.bin, linked at bit 01840000 (built separately).
.text
_start:
setf 16, 0, 0
setf 32, 0, 1
mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
move sp, @01860420h, 1 ; entry SP
move a14, @01860400h, 1 ; entry A14
movi 1, a0, L
move a0, @01860140h, 1 ; stage = 1
; ---- create_process(0x01840000, "0::0", 0x6000, 1, 0) ----------
; Arguments are pushed last-first, upward through A14, as everywhere
; else in this firmware.
move a14, -*sp, 1
movi 01862000h, a14, L
movi 0, a0, L
move a0, *a14+, 1 ; arg4 = 0 (process argument)
movi 1, a0, L
move a0, *a14+, 1 ; arg3 = 1
movi 06000h, a0, L
move a0, *a14+, 1 ; arg2 = stack size
movi 3F30DC00h, a0, L ; ROM "0::0" (any short name will do)
move a0, *a14+, 1 ; arg1 = name
movi 01840000h, a0, L ; xhello entry
move a0, *a14+, 1 ; arg0 = entry
calla 3F706A40h ; create_process
move @01860420h, sp, 1
move @01860400h, a14, 1
move a8, @01860120h, 1 ; MARK PCB
movi 2, a0, L
move a0, @01860140h, 1 ; stage = 2
done:
mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
movi 0, a8, L
rets
.end
dwt/notes/GUI_APPS.md
+144
View File
@@ -326,3 +326,147 @@ live.
| `dwt/gui/probe.lua`, `probe2.lua`, `probe3.lua` | frame snapshots + marker/PC telemetry + accept breakpoint |
| `dwt/gui/run/mame.log` | boot, markers (`strlen=4`, `stage=2`, `disp=0`, `xclients=1`) |
| `dwt/gui/run/gui_frame15571.png` | post-injection frame: normal Terminal Manager, no new window |
## 10. Transport settled: a `create_process` child opens a window
**Verdict: H3 holds, with one payload bug on top.** A process created by the
firmware's own `create_process` connects to the `"xserver"` local service,
completes the X11 setup handshake, creates and maps a window. The final,
**breakpoint-free** run shows it at frame 2838:
`dwt/gui/evidence/xhello_window_frame2838.png` (black 400x200 window at 100,100
with the WM frame/title bar, over the Terminal Manager).
The ROM is untouched (`md5 b46a3e442ccb86134d2356bd70d22fd2`); no driver edits.
Run configuration is the documented `VT1200_SKIP_LEVEL1=1` divergence, private
`-cfg_directory`/`-nvram_directory`, BOOTP from `harness/serve.py --bootp`.
### 10.1 H1: the connect *does* reach the server accept — even from rdebug
The old probe address `0x3F58B800` was wrong: it is the **epilogue** of the
function that creates the "remote debug" process (`mmfm sp,a7,a9,a11,a13; rets`),
not the X accept. The local-service path is:
| stage | bit address |
|---|---|
| `XOpenDisplay` | `3F9C2570` |
| `XParseDisplay` → service attach by name | `3FD3B3E0` |
| service attach / lookup | `3F70B060` / `3F70DB80` |
| server-side accept callback (registration arg 1) | `3F34EC50` |
| local accept worker, 12-byte setup read | `3F34F190` / `3F350170` |
| setup read implementation | `3F70C5C0` |
| TCP accept (separate, auth-guarded) | `3F58B830` |
Instrumentation of the **old** experiment (xhello called in the rdebug process)
shows the connect is accepted, not rejected:
```
TR OPEN entry pc=3F9C2570 a14=01852020 ...
TR ATTACH entry pc=3F70B060 ... proc=003FFBD0
TR ATTACH ret a8=008D3050
TR SETUP-WRITE pre ...
TR ACCEPT-CB entry proc=00414F90 ; SERVER runs the service callback
TR REGISTER ret a8=007ADA30 ; re-registers for the next client
(no READ12)
```
`proc=00414F90` is `SERVER` (confirmed from the process list). So the service
table lookup, the attach and the accept callback all succeed; the failure is
downstream of accept.
### 10.2 H2: no auth check on the local path
`3F3F4680` (the "Client is not authorized" path) is **never hit** for a local
connect. The auth/user-node table belongs to the TCP listener (`3F58B830`,
`X Server's TCP Port`), not to the named service. Nothing rejects `"0::0"`.
### 10.3 What the rdebug process does *not* get
After the accept callback, the server's local accept worker must dequeue the
connection and read the 12-byte X11 setup. In the rdebug-process run it never
does — there is no `READ12` after the injected `ACCEPT-CB`; the client then sits
in Xlib's `select` (`3FD969F0`), which is the original observation. The server
side was alive (boot clients' own `READ12` calls occur earlier in the same log).
A fresh `create_process` child is dequeued normally. Why the rdebug context is
not dequeued was not reduced to a single ROM check; what is measured is the
difference in outcome: same payload, same service, same server, only the
calling process differs.
### 10.4 H3: `create_process` makes it work
`dwt/gui/xlaunch.asm` (128 B, bit `01860000`) is the launcher. Its call shape is
the Telnet handler's (`0x3F6D4340`–`0x3F6D4440`):
```
create_process(entry, name, stack, 1, arg) ; entry = 01840000, stack = 6000
```
It is invoked by the real rdebug `jump`; `create_process` returns PCB
`003FFBD0` and the child's `xhello` runs. The trace then shows the full
handshake:
```
TR CREATE_PROC entry entryarg=003F30DC ... proc=004043D0
TR OPEN entry ... (child) TR ATTACH ret a8=008D3050
TR ACCEPT-CB entry proc=00414F90
TR READ12 ret a8=0000000C ; server read the 12-byte setup
TR SRV-WRITE ret a8=00000008 ; setup reply header
TR SRV-WRITE ret a8=00000090 ; vendor + screen list
TR XREAD ret a8=00000008 expect=00000008 ; client read both
TR XREAD ret a8=00000090 expect=00000090
TR CreateSimpleWindow
TR MapWindow
TR XSync
```
Raw excerpt: `dwt/gui/evidence/transport_evidence.txt`; full trace:
`dwt/gui/run12/debug.log` (instrumented) and `dwt/gui/run13/mame.log`
(breakpoint-free).
### 10.5 The second bug: do not reload `Display *` from the marker cell
With H3 alone the child still crashed in `XCreateSimpleWindow`. The cause is in
`xhello`, not in the transport: `XOpenDisplay` really returns `0x7C7290`
(`DISP-RET2 a8=007C7290`), but the value read back from the old RAM marker cell
was `0x006B7290`. The root lookup then dereferenced the wrong block (all `0x5555`
fill) and produced garbage; the call went wild.
The fix, in `dwt/gui/xhello.asm`, is to keep the Display in **a11** and the
window in **a10** — both are callee-saved by every Xlib entry point
(`mmtm sp,a5,a7,a9,a10,a11,a13`) — instead of reloading it from RAM, and to
re-run `setf 16,0,0; setf 32,0,1` after every Xlib call because Xlib changes the
CPU's field state. The markers are diagnostic only now.
### 10.6 Reproduce
```sh
./dwt/gui/build.sh dwt/gui/xhello.asm 01840000 # 390 B
./dwt/gui/build.sh dwt/gui/xlaunch.asm 01860000 # 128 B
# boot with the private cfg/nvram and the breakpoint-free probe
VT1200_SKIP_LEVEL1=1 MSG_TRIGGER=$PWD/trigger MSG_DIR=$PWD \
/home/arti/code/k-space/mame0289/vt1200 vt1200 \
-rompath harness/mame/roms -sound none -skip_gameinfo \
-networkprovider taptun -video none -nothrottle \
-cfg_directory $PWD/cfg -nvram_directory $PWD/nvram \
-autoboot_script $PWD/probe_win.lua -autoboot_delay 0
# after 192.168.99.2:771 answers (one rdebug connection per poke/jump)
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01840000 --file dwt/gui/build/xhello.bin
python3 dwt/visual/inject.py --host 192.168.99.2 \
--poke-file 0x01860000 --file dwt/gui/build/xlaunch.bin \
--jump 0x01860000 --jump-wait 8
```
`probe_win.lua` contains no `bpset`/`wpset`; the final frame is produced by the
payload alone. Stage markers: `01890140` reaches 6, `01890160` = 4.
### 10.7 Limits
* The demonstration depends on the `VT1200_SKIP_LEVEL1=1` divergence (as did the
original experiment); it is evidence about the OS/X server, not a real POST.
* The window is an empty black `XCreateSimpleWindow` (400x200, border 2) on the
root window. The WM frames it; no text is drawn. Adding text needs
`XLoadFont`/`XCreateGC`/`XDrawString` on the same working connection.
* The rdebug process's own connect remains unusable; use `create_process`.