forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
87 lines
3.8 KiB
Plaintext
87 lines
3.8 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; launcher.asm -- run tfetch.bin as a first-class proce
|
|
0002 ;
|
|
0003 ; The rdebug `jump` runs in the "remote debug" process.
|
|
0004 ; (dwt/notes/GUI_APPS.md section 10) showed that a serv
|
|
0005 ; from that context is accepted but never completed; a
|
|
0006 ; works. This launcher is the same shape as dwt/gui/xl
|
|
0007 ;
|
|
0008 ; create_process(entry, name, stack_size, 1, arg)
|
|
0009 ;
|
|
0010 ; create_process = bit 3F706A40h (Ghidra 07EE0D48)
|
|
0011 ;
|
|
0012 ; The child runs tfetch.bin, linked at bit 01870000h.
|
|
0013 ;
|
|
0014 ; Evidence cells (32-bit, bit addresses):
|
|
0015 ; 01872500 stage (1 entered, 2 create_process return
|
|
0016 ; 01872520 PCB returned by create_process (0 = failu
|
|
0017 ; 01872540 entry-point argument (poked by the host,
|
|
0018
|
|
0019 00000000 .text
|
|
0020 00000000 _start:
|
|
0021 00000000 0550 setf 16, 0, 0
|
|
0022 00000010 0740 setf 32, 0, 1
|
|
0023 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0024 00000040 078F move sp, @01872700h, 1 ; entry SP
|
|
00000050 01872700
|
|
0025 00000070 078E move a14, @01872720h, 1 ; entry A14
|
|
00000080 01872720
|
|
0026
|
|
0027 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0028 000000D0 0780 move a0, @01872500h, 1
|
|
000000E0 01872500
|
|
0029
|
|
0030 00000100 A3CF move a14, -*sp, 1
|
|
0031 00000110 09EE movi 01872800h, a14, L ; argument area
|
|
00000120 01872800
|
|
0032 00000140 09E0 movi 0, a0, L
|
|
00000150 00000000
|
|
0033 00000170 920E move a0, *a14+, 1 ; arg4 = 0
|
|
0034 00000180 09E0 movi 1, a0, L
|
|
00000190 00000001
|
|
0035 000001B0 920E move a0, *a14+, 1 ; arg3 = 1
|
|
0036 000001C0 09E0 movi 04000h, a0, L ; 16 KiB stack
|
|
000001D0 00004000
|
|
0037 000001F0 920E move a0, *a14+, 1 ; arg2 = stack size
|
|
0038 00000200 09E0 movi 3F30DC00h, a0, L ; ROM "0::0", any short name
|
|
00000210 3F30DC00
|
|
0039 00000230 920E move a0, *a14+, 1 ; arg1 = name
|
|
0040 00000240 07A0 move @01872540h, a0, 1 ; arg0 = entry, poked at run ti
|
|
00000250 01872540
|
|
0041 00000270 920E move a0, *a14+, 1 ; (little-endian bit address)
|
|
0042 00000280 0D5F calla 3F706A40h ; create_process
|
|
00000290 3F706A40
|
|
0043 000002B0 07AF move @01872700h, sp, 1
|
|
000002C0 01872700
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:13:38 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
0044 000002E0 07AE move @01872720h, a14, 1
|
|
000002F0 01872720
|
|
0045 00000310 0550 setf 16, 0, 0
|
|
0046 00000320 0740 setf 32, 0, 1
|
|
0047
|
|
0048 00000330 0788 move a8, @01872520h, 1 ; PCB marker
|
|
00000340 01872520
|
|
0049 00000360 09E0 movi 2, a0, L
|
|
00000370 00000002
|
|
0050 00000390 0780 move a0, @01872500h, 1 ; stage = 2
|
|
000003A0 01872500
|
|
0051
|
|
0052 000003C0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
000003D0 00FF
|
|
0053 000003E0 09E8 movi 0, a8, L
|
|
000003F0 00000000
|
|
0054 00000410 0960 rets
|
|
0055 .end
|
|
|
|
No Errors, No Warnings
|