forked from arti/vt1200
SDD
1e5c095b72
The firmware transforms the reply (16-round Feistel per 8-byte record) and compares it with the host-order copy of the challenge, so the answer is swap4(inverse_transform(swap4(challenge))). The font stages are memcpy in this path because dwt_prf initialises only mode 1. challenge.py implements the transform and its inverse using the firmware's fixed key/SP table; solve.py answers the challenge over TCP using the unmodified exploit client. 320 forward vectors, the firmware's own inverse and three live sessions validate it. A live run with no breakpoints poked the 82-byte hello-world payload and ran it: MAGIC DEAD/BEEF/0400, VRAM 1024/1024. Notes and evidence under dwt/notes and dwt/evidence.
18 lines
861 B
Plaintext
18 lines
861 B
Plaintext
Warning: -video none doesn't make much sense without -seconds_to_run
|
|
vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
|
|
vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
|
|
vt1200: scanline#1 line=1 enabled=1
|
|
vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
|
|
vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
|
|
vt1200: scanline#2 line=0 enabled=1
|
|
vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
|
|
vt1200: scanline#3 line=1 enabled=1
|
|
vt1200: scanline#4 line=2 enabled=1
|
|
CHECK frame 500 MAGIC1=5555 MAGIC2=5555 COUNT=5555
|
|
CHECK frame 1000 MAGIC1=5555 MAGIC2=5555 COUNT=5555
|
|
CHECK frame 1500 MAGIC1=5555 MAGIC2=5555 COUNT=5555
|
|
CHECK payload-ran: MAGIC1=DEAD MAGIC2=BEEF COUNT=0400
|
|
CHECK payload-ran: VRAM block 1024/1024 words FFFF, 0 holes
|
|
CHECK exiting at frame 1850 (payload seen at 1730)
|
|
Average speed: 328.16% (25 seconds)
|