forked from arti/vt1200
SDD
01923ecb69
The firmware's tftp_open hangs in its resolver from the rdebug process, so the payload speaks RFC 783 over the firmware socket API: socket(2,2,0), sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ logged, and rdebug peek matches probe.bin byte-for-byte. Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
6 lines
282 B
Plaintext
6 lines
282 B
Plaintext
[+] challenge ef 8c 60 17 00 00 5d e6 02 63 a8 c0 ef 84 60 18
|
|
[+] reply 23 5f ff 91 64 74 93 f9 f1 f4 da 11 38 c1 1d 15
|
|
opcode 7 -> flag=0x00 payload=44 6f 6e 65 0a 00 (b'Done\n\x00')
|
|
[.] jump returned 0x00000000 (0)
|
|
jump 0x01876000: returned 0x00000000 (0) payload=00 00 00 00
|