forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
5 lines
227 B
Plaintext
5 lines
227 B
Plaintext
[+] challenge f6 fc e9 16 00 00 e7 d3 02 63 a8 c0 f6 f4 e9 17
|
|
[+] reply 53 f1 47 62 57 42 7b c4 4b 2a 56 c9 e7 30 fd f8
|
|
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
|
jump 0x01875000: NO RETURN within 8.0s
|