forked from arti/vt1200
SDD
a5769d3d2e
Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients (SERVER, SESSIONMGR/Terminal Manager, WM, VTE). Internal clients use the local service "xserver" via the display string "0::0"; TCP 6000 is a separate authorised listener. Function table and the 4-call hello-window sequence are in dwt/notes/GUI_APPS.md. Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then called XOpenDisplay; it never returns (stage 2, display 0, X-server client watermark unchanged) and the rdebug service dies. Verdict: hard for a self-contained window; shared-RAM UI mutation (opcode 8) is the working route.
220 lines
9.2 KiB
Plaintext
220 lines
9.2 KiB
Plaintext
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 1
|
|
|
|
0001 ; xhello.asm -- open a *new* X connection from an rdebu
|
|
0002 ; create/map a window on the live DWT X server.
|
|
0003 ;
|
|
0004 ; Calling convention (the one the firmware itself uses;
|
|
0005 ; 07F57044 and the TM at 07E5D2B4):
|
|
0006 ;
|
|
0007 ; MOVE A14,-*SP,1 ; reserve the slot the ca
|
|
0008 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
|
|
0009 ; ...
|
|
0010 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
|
|
0011 ; CALLA target
|
|
0012 ;
|
|
0013 ; We point A14 at a private argument buffer instead of
|
|
0014 ; we keep the entry SP/A14 in RAM so the payload return
|
|
0015 ; leaves the stack in an unexpected state.
|
|
0016 ;
|
|
0017 ; Xlib entry points (Ghidra address -> bit address):
|
|
0018 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
|
|
0019 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
|
|
0020 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
|
|
0021 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
|
|
0022 ; 7F68B1A strlen(s) -> 3FB458D0
|
|
0023 ;
|
|
0024 ; Markers (32-bit cells, bit addresses):
|
|
0025 ; 01850100 display pointer
|
|
0026 ; 01850110 root window
|
|
0027 ; 01850120 window id
|
|
0028 ; 01850130 XSync return
|
|
0029 ; 01850140 stage counter
|
|
0030 ; 01850150 strlen("0::0") -- must be 4; if not, we s
|
|
0031
|
|
0032 00000000 .text
|
|
0033 00000000 _start:
|
|
0034 00000000 0550 setf 16, 0, 0
|
|
0035 00000010 0740 setf 32, 0, 1
|
|
0036 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000030 FF00
|
|
0037
|
|
0038 00000040 078F move sp, @01850420h, 1 ; entry SP
|
|
00000050 01850420
|
|
0039 00000070 078E move a14, @01850400h, 1 ; entry A14
|
|
00000080 01850400
|
|
0040
|
|
0041 000000A0 09E0 movi 1, a0, L
|
|
000000B0 00000001
|
|
0042 000000D0 0780 move a0, @01850140h, 1 ; stage = 1
|
|
000000E0 01850140
|
|
0043
|
|
0044 ; ---- convention check: strlen("0::0") == 4 ---------
|
|
0045 00000100 A3CF move a14, -*sp, 1
|
|
0046 00000110 09EE movi 01852000h, a14, L
|
|
00000120 01852000
|
|
0047 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
|
|
00000150 3FACE948
|
|
0048 00000170 920E move a0, *a14+, 1 ; arg0
|
|
0049 00000180 0D5F calla 3FB458D0h ; strlen
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 2
|
|
|
|
00000190 3FB458D0
|
|
0050 000001B0 07AF move @01850420h, sp, 1
|
|
000001C0 01850420
|
|
0051 000001E0 07AE move @01850400h, a14, 1
|
|
000001F0 01850400
|
|
0052 00000210 0788 move a8, @01850160h, 1 ; MARK strlen
|
|
00000220 01850160
|
|
0053 00000240 09E0 movi 4, a0, L
|
|
00000250 00000004
|
|
0054 00000270 4808 cmp a0, a8
|
|
0055 00000280 CB00 jrne done
|
|
00000290 0093
|
|
0056
|
|
0057 000002A0 09E0 movi 2, a0, L
|
|
000002B0 00000002
|
|
0058 000002D0 0780 move a0, @01850140h, 1
|
|
000002E0 01850140
|
|
0059
|
|
0060 ; ---- display = XOpenDisplay("0::0") ----------------
|
|
0061 00000300 A3CF move a14, -*sp, 1
|
|
0062 00000310 09EE movi 01852000h, a14, L
|
|
00000320 01852000
|
|
0063 00000340 09E0 movi 3FACE948h, a0, L
|
|
00000350 3FACE948
|
|
0064 00000370 920E move a0, *a14+, 1 ; arg0 = name
|
|
0065 00000380 0D5F calla 3F9C2570h ; XOpenDisplay
|
|
00000390 3F9C2570
|
|
0066 000003B0 07AF move @01850420h, sp, 1
|
|
000003C0 01850420
|
|
0067 000003E0 07AE move @01850400h, a14, 1
|
|
000003F0 01850400
|
|
0068 00000410 0788 move a8, @01850100h, 1 ; MARK display
|
|
00000420 01850100
|
|
0069 00000440 4D08 move a8, a8
|
|
0070 00000450 CA77 jreq done
|
|
0071
|
|
0072 00000460 09E0 movi 3, a0, L
|
|
00000470 00000003
|
|
0073 00000490 0780 move a0, @01850140h, 1
|
|
000004A0 01850140
|
|
0074
|
|
0075 ; ---- root = *(*(display+0x480)+0x40) ---------------
|
|
0076 000004C0 07A6 move @01850100h, a6, 1
|
|
000004D0 01850100
|
|
0077 000004F0 B6C9 move *a6(0480h), a9, 1
|
|
00000500 0480
|
|
0078 00000510 B729 move *a9(040h), a9, 1
|
|
00000520 0040
|
|
0079 00000530 0789 move a9, @01850110h, 1 ; MARK root
|
|
00000540 01850110
|
|
0080
|
|
0081 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
|
|
0082 00000560 A3CF move a14, -*sp, 1
|
|
0083 00000570 09EE movi 01852000h, a14, L
|
|
00000580 01852000
|
|
0084 000005A0 09E0 movi 0, a0, L
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 3
|
|
|
|
000005B0 00000000
|
|
0085 000005D0 920E move a0, *a14+, 1 ; background = 0 (black)
|
|
0086 000005E0 920E move a0, *a14+, 1 ; border = 0
|
|
0087 000005F0 09E0 movi 2, a0, L
|
|
00000600 00000002
|
|
0088 00000620 920E move a0, *a14+, 1 ; border width
|
|
0089 00000630 09E0 movi 200, a0, L
|
|
00000640 000000C8
|
|
0090 00000660 920E move a0, *a14+, 1 ; height
|
|
0091 00000670 09E0 movi 400, a0, L
|
|
00000680 00000190
|
|
0092 000006A0 920E move a0, *a14+, 1 ; width
|
|
0093 000006B0 09E0 movi 100, a0, L
|
|
000006C0 00000064
|
|
0094 000006E0 920E move a0, *a14+, 1 ; y
|
|
0095 000006F0 920E move a0, *a14+, 1 ; x
|
|
0096 00000700 932E move a9, *a14+, 1 ; parent
|
|
0097 00000710 07A6 move @01850100h, a6, 1
|
|
00000720 01850100
|
|
0098 00000740 92CE move a6, *a14+, 1 ; display
|
|
0099 00000750 0D5F calla 3FD41B90h ; XCreateSimpleWindow
|
|
00000760 3FD41B90
|
|
0100 00000780 07AF move @01850420h, sp, 1
|
|
00000790 01850420
|
|
0101 000007B0 07AE move @01850400h, a14, 1
|
|
000007C0 01850400
|
|
0102 000007E0 0788 move a8, @01850120h, 1 ; MARK window
|
|
000007F0 01850120
|
|
0103
|
|
0104 00000810 09E0 movi 4, a0, L
|
|
00000820 00000004
|
|
0105 00000840 0780 move a0, @01850140h, 1
|
|
00000850 01850140
|
|
0106
|
|
0107 ; ---- XMapWindow(display, window) -------------------
|
|
0108 00000870 A3CF move a14, -*sp, 1
|
|
0109 00000880 09EE movi 01852000h, a14, L
|
|
00000890 01852000
|
|
0110 000008B0 930E move a8, *a14+, 1 ; window
|
|
0111 000008C0 07A6 move @01850100h, a6, 1
|
|
000008D0 01850100
|
|
0112 000008F0 92CE move a6, *a14+, 1 ; display
|
|
0113 00000900 0D5F calla 3FD645B0h ; XMapWindow
|
|
00000910 3FD645B0
|
|
0114 00000930 07AF move @01850420h, sp, 1
|
|
00000940 01850420
|
|
0115 00000960 07AE move @01850400h, a14, 1
|
|
00000970 01850400
|
|
0116
|
|
0117 00000990 09E0 movi 5, a0, L
|
|
000009A0 00000005
|
|
0118 000009C0 0780 move a0, @01850140h, 1
|
|
000009D0 01850140
|
|
0119
|
|
0120 ; ---- XSync(display, 0) -----------------------------
|
|
0121 000009F0 A3CF move a14, -*sp, 1
|
|
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
|
|
(c) Copyright 1985, 1987, Texas Instruments Inc.
|
|
|
|
PAGE 4
|
|
|
|
0122 00000A00 09EE movi 01852000h, a14, L
|
|
00000A10 01852000
|
|
0123 00000A30 09E0 movi 0, a0, L
|
|
00000A40 00000000
|
|
0124 00000A60 920E move a0, *a14+, 1 ; discard = 0
|
|
0125 00000A70 07A6 move @01850100h, a6, 1
|
|
00000A80 01850100
|
|
0126 00000AA0 92CE move a6, *a14+, 1 ; display
|
|
0127 00000AB0 0D5F calla 3FD9F6B0h ; XSync
|
|
00000AC0 3FD9F6B0
|
|
0128 00000AE0 07AF move @01850420h, sp, 1
|
|
00000AF0 01850420
|
|
0129 00000B10 07AE move @01850400h, a14, 1
|
|
00000B20 01850400
|
|
0130 00000B40 0788 move a8, @01850130h, 1 ; MARK sync
|
|
00000B50 01850130
|
|
0131
|
|
0132 00000B70 09E0 movi 6, a0, L
|
|
00000B80 00000006
|
|
0133 00000BA0 0780 move a0, @01850140h, 1
|
|
00000BB0 01850140
|
|
0134
|
|
0135 00000BD0 done:
|
|
0136 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
|
|
00000BE0 00FF
|
|
0137 00000BF0 09E8 movi 0, a8, L
|
|
00000C00 00000000
|
|
0138 00000C20 0960 rets
|
|
0139 .end
|
|
|
|
No Errors, No Warnings
|