Update all docs and test generator to match verified assembler opcodes
- README.md: Complete project overview with plugin status - ARCHITECTURE.md: Fixed register tables (CNTR in REG1, not REG2) - GETTING_STARTED.md: r2-native workflow, removed Python disasm refs - PRACTICAL_EXAMPLE.md: Uses verified open21xx opcodes with bit layouts - ROM_ANALYSIS_WALKTHROUGH.md: Updated format detection and r2 commands - r2plugin/README.md: Simplified, points to assembler test ROM - gen_isa_test.py: All opcodes from open21xx assembler with labels
This commit is contained in:
@@ -1,26 +1,59 @@
|
||||
# ADSP-219x Analysis Workflow (Air-Gapped 🛡️)
|
||||
# Getting Started (Air-Gapped Deployment)
|
||||
|
||||
## Phase 1: Preparation (Online)
|
||||
1. **Download and Copy**: Ensure the entire `adsp219x-re/` folder is on the air-gapped machine.
|
||||
2. **Setup Dependencies**: Ensure Python 3.8+ is installed. Radare2 must be on $PATH.
|
||||
3. **Verify Python**: `python3 -m pip install r2pipe` (if not already part of your r2 install).
|
||||
## Prerequisites
|
||||
|
||||
## Phase 2: Loading ROMs
|
||||
Use raw loading for ADSP-2191 ROMs:
|
||||
`r2 -a adsp2 -b 24 -m 0x0 my_rom.bin`
|
||||
(Note: `-a` and `-b` are placeholders until a native plugin exists. We use raw mode.)
|
||||
- Radare2 5.8.0+ (built from source on the target machine)
|
||||
- GCC (to compile the plugin)
|
||||
- Python 3 (optional, for test ROM generation)
|
||||
|
||||
## Phase 3: Automated Disassembly
|
||||
Run the standalone disassembler first to get a quick overview:
|
||||
`python3 disassembler/adsp219x_disasm.py my_rom.bin 3 > disassembly.txt`
|
||||
## Setup
|
||||
|
||||
## Phase 4: Radare2 + Iaito Integration
|
||||
To use our custom Python disassembly inside radare2:
|
||||
1. Open the ROM in radare2.
|
||||
2. Run the analysis script via r2pipe:
|
||||
`#!python analysis/analyze_rom.py` (Inside r2: `#!pipe python3 ...`)
|
||||
3. Use `iaito` to browse the memory with the comments generated by the script.
|
||||
1. Copy the entire `adsp219x-re/` directory to the air-gapped machine.
|
||||
|
||||
## Phase 5: Debugging/Validation
|
||||
Compare your proprietary ROM against our test ROMs in `testrom/test_roms/`.
|
||||
If you find a new instruction type, add it to `disassembler/adsp219x_disasm.py` and submit!
|
||||
2. Build and install the radare2 plugin:
|
||||
|
||||
cd r2plugin
|
||||
make
|
||||
make install
|
||||
|
||||
3. Verify installation:
|
||||
|
||||
r2 -a adsp219x -b 24 -q -c "pd 10" examples/isa_test.bin
|
||||
|
||||
You should see decoded instructions (NOP, AX0 = 0x1234, etc.).
|
||||
|
||||
## Loading a ROM Dump
|
||||
|
||||
For a raw 24-bit packed binary (3 bytes per instruction, big-endian):
|
||||
|
||||
r2 -a adsp219x -b 24 firmware.bin
|
||||
|
||||
For a padded 32-bit dump (4 bytes per instruction with leading 0x00),
|
||||
strip the padding first or adjust the base offset manually.
|
||||
|
||||
## Useful r2 Commands
|
||||
|
||||
pd 100 # Disassemble 100 instructions
|
||||
s 0x200 # Seek to PM address 0x200 (byte offset 0x600)
|
||||
/x 1c # Search for JUMP opcodes (Type 10a prefix)
|
||||
axt @@ sym.* # Cross-references (after analysis)
|
||||
|
||||
## Validation
|
||||
|
||||
Compare your disassembly against the reference examples in
|
||||
`examples/`. The `isa_test.bin` was assembled with the open21xx
|
||||
toolchain and contains verified opcodes for all major instruction
|
||||
types.
|
||||
|
||||
## Reference Documentation
|
||||
|
||||
The `docs/` directory contains the original Analog Devices
|
||||
instruction set reference chapters (PDF and text extracts):
|
||||
|
||||
- `9x_opcodes.*` - Opcode definitions and mnemonics
|
||||
- `9x_ALUops.*` - ALU operations
|
||||
- `9x_mltops.*` - Multiplier/MAC operations
|
||||
- `9x_shftops.*` - Shifter operations
|
||||
- `9x_flowops.*` - Flow control (jumps, loops, returns)
|
||||
- `9x_moveops.*` - Data move operations
|
||||
- `9x_multiops.*` - Multifunction operations
|
||||
|
||||
Reference in New Issue
Block a user