forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
143 lines
5.8 KiB
Plaintext
143 lines
5.8 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; udptest.asm -- socket() + sendto() a real TFTP RRQ.
|
|
0002 ;
|
|
0003 ; socket = 3F5C9A00h socket(2,2,0) -> fd
|
|
0004 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, to
|
|
0005 ;
|
|
0006 ; The RRQ is the packet the firmware itself would send
|
|
0007 ; "dwt/tcpip/probe.bin" in octet mode. A server log li
|
|
0008 ; proof that UDP transmit works from the calling proces
|
|
0009 ;
|
|
0010 ; Evidence cells (32-bit, bit addresses):
|
|
0011 ; 01876800 stage (1 entered, 2 sendto returned)
|
|
0012 ; 01876820 socket fd
|
|
0013 ; 01876840 sendto return
|
|
0014 ; 01876A00 entry SP
|
|
0015 ; 01876A20 entry A14
|
|
0016
|
|
0017 00000000 .text
|
|
0018 00000000 _start:
|
|
0019 00000000 0550 setf 16, 0, 0
|
|
0020 00000010 0740 setf 32, 0, 1
|
|
0021 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0022 00000040 078F move sp, @01876A00h, 1
|
|
00000050 01876A00
|
|
0023 00000070 078E move a14, @01876A20h, 1
|
|
00000080 01876A20
|
|
0024
|
|
0025 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0026 000000D0 0780 move a0, @01876800h, 1
|
|
000000E0 01876800
|
|
0027
|
|
0028 00000100 09EE movi 01877000h, a14, L
|
|
00000110 01877000
|
|
0029 00000130 09E0 movi 0, a0, L
|
|
00000140 00000000
|
|
0030 00000160 920E move a0, *a14+, 1 ; arg2 = protocol
|
|
0031 00000170 09E0 movi 2, a0, L
|
|
00000180 00000002
|
|
0032 000001A0 920E move a0, *a14+, 1 ; arg1 = SOCK_DGRAM
|
|
0033 000001B0 09E0 movi 2, a0, L
|
|
000001C0 00000002
|
|
0034 000001E0 920E move a0, *a14+, 1 ; arg0 = AF_INET
|
|
0035 000001F0 0D5F calla 3F5C9A00h
|
|
00000200 3F5C9A00
|
|
0036 00000220 07AF move @01876A00h, sp, 1
|
|
00000230 01876A00
|
|
0037 00000250 07AE move @01876A20h, a14, 1
|
|
00000260 01876A20
|
|
0038 00000280 0550 setf 16, 0, 0
|
|
0039 00000290 0740 setf 32, 0, 1
|
|
0040 000002A0 0788 move a8, @01876820h, 1
|
|
000002B0 01876820
|
|
0041 000002D0 4D09 move a8, a9
|
|
0042
|
|
0043 000002E0 09E0 movi 2, a0, L
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
000002F0 00000002
|
|
0044 00000310 0780 move a0, @01876800h, 1
|
|
00000320 01876800
|
|
0045
|
|
0046 ; sendto(fd, RRQ, RRQLEN, 0, SADDR, 16)
|
|
0047 00000340 09EE movi 01877000h, a14, L
|
|
00000350 01877000
|
|
0048 00000370 09E0 movi 16, a0, L
|
|
00000380 00000010
|
|
0049 000003A0 920E move a0, *a14+, 1 ; arg5 = 16
|
|
0050 000003B0 09E0 movi SADDR, a0, L
|
|
000003C0 00000740'
|
|
0051 000003E0 920E move a0, *a14+, 1 ; arg4 = &sockaddr
|
|
0052 000003F0 09E0 movi 0, a0, L
|
|
00000400 00000000
|
|
0053 00000420 920E move a0, *a14+, 1 ; arg3 = flags
|
|
0054 00000430 09E0 movi 28, a0, L
|
|
00000440 0000001C
|
|
0055 00000460 920E move a0, *a14+, 1 ; arg2 = length
|
|
0056 00000470 09E0 movi RRQ, a0, L
|
|
00000480 00000660'
|
|
0057 000004A0 920E move a0, *a14+, 1 ; arg1 = packet
|
|
0058 000004B0 932E move a9, *a14+, 1 ; arg0 = fd
|
|
0059 000004C0 0D5F calla 3F5D3D70h
|
|
000004D0 3F5D3D70
|
|
0060 000004F0 07AF move @01876A00h, sp, 1
|
|
00000500 01876A00
|
|
0061 00000520 07AE move @01876A20h, a14, 1
|
|
00000530 01876A20
|
|
0062 00000550 0550 setf 16, 0, 0
|
|
0063 00000560 0740 setf 32, 0, 1
|
|
0064 00000570 0788 move a8, @01876840h, 1
|
|
00000580 01876840
|
|
0065
|
|
0066 000005A0 09E0 movi 3, a0, L
|
|
000005B0 00000003
|
|
0067 000005D0 0780 move a0, @01876800h, 1
|
|
000005E0 01876800
|
|
0068 00000600 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000610 00FF
|
|
0069 00000620 09E8 movi 0, a8, L
|
|
00000630 00000000
|
|
0070 00000650 0960 rets
|
|
0071
|
|
0072 00000660 RRQ:
|
|
0073 00000660 0100 .word 00100h ; opcode 1 (00 01)
|
|
0074 00000670 7764 .word 07764h ; "dw"
|
|
0075 00000680 2F74 .word 02F74h ; "t/"
|
|
0076 00000690 6374 .word 06374h ; "tc"
|
|
0077 000006A0 6970 .word 06970h ; "pi"
|
|
0078 000006B0 2F70 .word 02F70h ; "p/"
|
|
0079 000006C0 7270 .word 07270h ; "pr"
|
|
0080 000006D0 626F .word 0626Fh ; "ob"
|
|
0081 000006E0 2E65 .word 02E65h ; "e."
|
|
0082 000006F0 6962 .word 06962h ; "bi"
|
|
0083 00000700 006E .word 0006Eh ; "n\0"
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:14:27 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 3
|
|
|
|
0084 00000710 636F .word 0636Fh ; "oc"
|
|
0085 00000720 6574 .word 06574h ; "te"
|
|
0086 00000730 0074 .word 00074h ; "t\0"
|
|
0087 00000740 SADDR:
|
|
0088 00000740 0002 .word 00002h ; sin_family = AF_INET
|
|
0089 00000750 4500 .word 04500h ; sin_port = htons(69)
|
|
0090 00000760 A8C0 .word 0A8C0h ; 192.168
|
|
0091 00000770 0163 .word 00163h ; .99.1
|
|
0092 00000780 0000 .word 0
|
|
0093 00000790 0000 .word 0
|
|
0094 000007A0 0000 .word 0
|
|
0095 000007B0 0000 .word 0
|
|
0096 .end
|
|
|
|
No Errors, No Warnings
|