adsp219x-re/docs/ROM_ANALYSIS_WALKTHROUGH.md

# ROM Analysis Walkthrough

## 1. Determine the ROM Format

ADSP-2191 instructions are 24 bits (3 bytes). A raw dump can be:

- **Packed (3 bytes/word)**: Most common for SPI flash dumps.
  Load directly: `r2 -a adsp219x -b 24 dump.bin`
- **Padded (4 bytes/word)**: 32-bit aligned with a leading 0x00.
  Strip padding or use `r2 -s 1` to skip the first pad byte.
- **Boot stream**: Contains block headers (target address, byte
  count, flags) followed by data. Requires parsing the header
  format first.

### Quick Format Check

Look at the first few bytes. If you see `00 00 00` at offset 0
(a NOP), you likely have packed 3-byte format. If you see
`00 00 00 00` followed by meaningful data at offset 4, it is
probably 4-byte padded.

## 2. Find the Entry Point

The reset vector is at PM address 0x0000. Typical patterns:

    0x0000: JUMP main       (Type 10a, opcode starts with 0x1C)
    0x0000: NOP             (entry at next instruction)

The interrupt vector table occupies the first ~128 PM words,
with 4-word spacing per vector. Most vectors contain RTI (return
from interrupt) or JUMP to a handler.

## 3. Identify Code vs Data Regions

**Code regions** produce coherent disassembly: register loads,
compute instructions, jumps, and loops in logical sequence.

**Data regions** (coefficient tables, lookup tables) produce
nonsensical disassembly: random-looking mnemonics, impossible
register combinations, jumps to invalid addresses. Mark these
as data in r2:

    Cd 300 @ 0x1000    # Mark 300 bytes as data at offset 0x1000

## 4. Recognize DSP Patterns

### FIR Filter

    CNTR = N;
    DO loop_end UNTIL CE;
        MR = MR + MX0*MY0 (SS), MX0 = DM(I0,M0), MY0 = PM(I4,M4);
    loop_end: ...

Look for: Type 11 (DO UNTIL CE) followed by Type 1 multifunction
instructions with MAC operations.

### IIR Filter (Biquad)

Nested loops: outer loop over samples, inner loop over biquad
sections. Contains ASHIFT for scaling between stages.

### Initialization Sequence

Sequences of Type 6/7 instructions loading I/M/L registers.
This sets up circular buffers for the signal processing kernel.

## 5. Useful r2 Commands

    e asm.arch = adsp219x
    e asm.bits = 24
    pd 200                  # Disassemble 200 instructions
    pD 600                  # Disassemble 600 bytes (= 200 instructions)
    /x 1c00                 # Find unconditional JUMPs
    /x 16                   # Find DO UNTIL loops
    /x 0a                   # Find RTS/RTI instructions
    V                       # Enter visual mode