forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
76 lines
3.1 KiB
Plaintext
76 lines
3.1 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; socktest.asm -- call the firmware's socket() wrapper
|
|
0002 ;
|
|
0003 ; Isolates the first call tftp_open makes. Run with rd
|
|
0004 ; remote-debug process (or from a create_process child)
|
|
0005 ; socket API is usable in that context.
|
|
0006 ;
|
|
0007 ; socket = bit 3F5C9A00h (Ghidra 07EB9340)
|
|
0008 ; socket(domain, type, protocol) = socket(2, 2, 0)
|
|
0009 ;
|
|
0010 ; Evidence cells (32-bit, bit addresses):
|
|
0011 ; 01874000 stage (1 entered, 2 socket returned)
|
|
0012 ; 01874020 socket() return (fd, or a negative errno)
|
|
0013 ; 01874200 entry SP
|
|
0014 ; 01874220 entry A14
|
|
0015
|
|
0016 00000000 .text
|
|
0017 00000000 _start:
|
|
0018 00000000 0550 setf 16, 0, 0
|
|
0019 00000010 0740 setf 32, 0, 1
|
|
0020 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0021 00000040 078F move sp, @01874200h, 1
|
|
00000050 01874200
|
|
0022 00000070 078E move a14, @01874220h, 1
|
|
00000080 01874220
|
|
0023
|
|
0024 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0025 000000D0 0780 move a0, @01874000h, 1
|
|
000000E0 01874000
|
|
0026
|
|
0027 00000100 09EE movi 01873800h, a14, L
|
|
00000110 01873800
|
|
0028 00000130 09E0 movi 0, a0, L
|
|
00000140 00000000
|
|
0029 00000160 920E move a0, *a14+, 1 ; arg2 = protocol
|
|
0030 00000170 09E0 movi 2, a0, L
|
|
00000180 00000002
|
|
0031 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
|
0032 000001B0 09E0 movi 2, a0, L
|
|
000001C0 00000002
|
|
0033 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET
|
|
0034 000001F0 0D5F calla 3F5C9A00h ; socket
|
|
00000200 3F5C9A00
|
|
0035 00000220 07AF move @01874200h, sp, 1
|
|
00000230 01874200
|
|
0036 00000250 07AE move @01874220h, a14, 1
|
|
00000260 01874220
|
|
0037 00000280 0550 setf 16, 0, 0
|
|
0038 00000290 0740 setf 32, 0, 1
|
|
0039 000002A0 0788 move a8, @01874020h, 1
|
|
000002B0 01874020
|
|
0040
|
|
0041 000002D0 09E0 movi 2, a0, L
|
|
000002E0 00000002
|
|
0042 00000300 0780 move a0, @01874000h, 1
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:12:14 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
00000310 01874000
|
|
0043 00000330 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000340 00FF
|
|
0044 00000350 09E8 movi 0, a8, L
|
|
00000360 00000000
|
|
0045 00000380 0960 rets
|
|
0046 .end
|
|
|
|
No Errors, No Warnings
|