forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
106 lines
4.0 KiB
Plaintext
106 lines
4.0 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; restest.asm -- socket() then the resolver tftp_open u
|
|
0002 ;
|
|
0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd
|
|
0004 ; resolve = 3F5933D0h resolve("192.168.99.1") -> -
|
|
0005 ;
|
|
0006 ; Evidence cells (32-bit, bit addresses):
|
|
0007 ; 01875800 stage (1 entered, 2 socket returned, 3 re
|
|
0008 ; 01875820 socket() fd
|
|
0009 ; 01875840 resolver return
|
|
0010 ; 01875A00 entry SP
|
|
0011 ; 01875A20 entry A14
|
|
0012
|
|
0013 00000000 .text
|
|
0014 00000000 _start:
|
|
0015 00000000 0550 setf 16, 0, 0
|
|
0016 00000010 0740 setf 32, 0, 1
|
|
0017 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0018 00000040 078F move sp, @01875A00h, 1
|
|
00000050 01875A00
|
|
0019 00000070 078E move a14, @01875A20h, 1
|
|
00000080 01875A20
|
|
0020
|
|
0021 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0022 000000D0 0780 move a0, @01875800h, 1
|
|
000000E0 01875800
|
|
0023
|
|
0024 ; socket(2,2,0)
|
|
0025 00000100 09EE movi 01875900h, a14, L
|
|
00000110 01875900
|
|
0026 00000130 09E0 movi 0, a0, L
|
|
00000140 00000000
|
|
0027 00000160 920E move a0, *a14+, 1
|
|
0028 00000170 09E0 movi 2, a0, L
|
|
00000180 00000002
|
|
0029 000001A0 920E move a0, *a14+, 1
|
|
0030 000001B0 09E0 movi 2, a0, L
|
|
000001C0 00000002
|
|
0031 000001E0 920E move a0, *a14+, 1
|
|
0032 000001F0 0D5F calla 3F5C9A00h
|
|
00000200 3F5C9A00
|
|
0033 00000220 07AF move @01875A00h, sp, 1
|
|
00000230 01875A00
|
|
0034 00000250 07AE move @01875A20h, a14, 1
|
|
00000260 01875A20
|
|
0035 00000280 0550 setf 16, 0, 0
|
|
0036 00000290 0740 setf 32, 0, 1
|
|
0037 000002A0 0788 move a8, @01875820h, 1 ; fd
|
|
000002B0 01875820
|
|
0038 000002D0 4D09 move a8, a9
|
|
0039
|
|
0040 000002E0 09E0 movi 2, a0, L
|
|
000002F0 00000002
|
|
0041 00000310 0780 move a0, @01875800h, 1
|
|
00000320 01875800
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:36 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
0042
|
|
0043 ; resolve("192.168.99.1")
|
|
0044 00000340 09EE movi 01875900h, a14, L
|
|
00000350 01875900
|
|
0045 00000370 09E0 movi HOST, a0, L
|
|
00000380 00000550'
|
|
0046 000003A0 920E move a0, *a14+, 1
|
|
0047 000003B0 0D5F calla 3F5933D0h
|
|
000003C0 3F5933D0
|
|
0048 000003E0 07AF move @01875A00h, sp, 1
|
|
000003F0 01875A00
|
|
0049 00000410 07AE move @01875A20h, a14, 1
|
|
00000420 01875A20
|
|
0050 00000440 0550 setf 16, 0, 0
|
|
0051 00000450 0740 setf 32, 0, 1
|
|
0052 00000460 0788 move a8, @01875840h, 1
|
|
00000470 01875840
|
|
0053
|
|
0054 00000490 09E0 movi 3, a0, L
|
|
000004A0 00000003
|
|
0055 000004C0 0780 move a0, @01875800h, 1
|
|
000004D0 01875800
|
|
0056 000004F0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000500 00FF
|
|
0057 00000510 09E8 movi 0, a8, L
|
|
00000520 00000000
|
|
0058 00000540 0960 rets
|
|
0059
|
|
0060 00000550 HOST:
|
|
0061 00000550 3931 .word 03931h
|
|
0062 00000560 2E32 .word 02E32h
|
|
0063 00000570 3631 .word 03631h
|
|
0064 00000580 2E38 .word 02E38h
|
|
0065 00000590 3939 .word 03939h
|
|
0066 000005A0 312E .word 0312Eh
|
|
0067 000005B0 0000 .word 00000h
|
|
0068 .end
|
|
|
|
No Errors, No Warnings
|