29dc1f1bd2
- README.md: Complete project overview with plugin status - ARCHITECTURE.md: Fixed register tables (CNTR in REG1, not REG2) - GETTING_STARTED.md: r2-native workflow, removed Python disasm refs - PRACTICAL_EXAMPLE.md: Uses verified open21xx opcodes with bit layouts - ROM_ANALYSIS_WALKTHROUGH.md: Updated format detection and r2 commands - r2plugin/README.md: Simplified, points to assembler test ROM - gen_isa_test.py: All opcodes from open21xx assembler with labels
79 lines
2.4 KiB
Markdown
79 lines
2.4 KiB
Markdown
# Practical Example: Disassembling a Boot Sequence
|
|
|
|
This walkthrough uses verified opcodes from the open21xx assembler
|
|
to demonstrate analysis of a typical ADSP-2191 initialization.
|
|
|
|
## Hex Dump (from examples/isa_test.bin)
|
|
|
|
0x000 000000 NOP
|
|
0x003 412340 AX0 = 0x1234
|
|
0x006 456781 AX1 = 0x5678
|
|
0x009 4AAAA4 AY0 = 0xAAAA
|
|
0x00C 440002 MX0 = 0x4000
|
|
0x00F 420006 MY0 = 0x2000
|
|
0x012 501000 I0 = 0x0100
|
|
0x015 502001 I1 = 0x0200
|
|
0x018 303000 I4 = 0x0300
|
|
|
|
## Step-by-Step Analysis
|
|
|
|
### 1. NOP at Reset Vector (0x000000)
|
|
|
|
The processor starts at PM address 0x0000. A NOP here means the
|
|
real entry point follows immediately, or there is a JUMP to the
|
|
main code further ahead.
|
|
|
|
### 2. Register Initialization (Type 6: Dreg = Imm16)
|
|
|
|
0x412340 -> AX0 = 0x1234
|
|
Bit layout: 01.00.0001.00100.011.0100.0000
|
|
Bits 23-20 = 0100 (Type 6), bits 3-0 = 0000 (AX0)
|
|
Immediate value in bits 19-4 = 0x1234
|
|
|
|
### 3. DAG Setup (Type 7: Reg1/Reg2 = Imm16)
|
|
|
|
0x501000 -> I0 = 0x0100
|
|
Bits 23-20 = 0101 (Type 7, REG1), bits 3-0 = 0000 (I0)
|
|
|
|
0x303000 -> I4 = 0x0300
|
|
Bits 23-20 = 0011 (Type 7, REG2), bits 3-0 = 0000 (I4)
|
|
|
|
This is the classic DAG initialization pattern: set index registers
|
|
to buffer start addresses, then set modifier and length registers.
|
|
|
|
### 4. Compute Instructions (Type 9: ALU/MAC)
|
|
|
|
0x22600F -> AR = AX0 + AY0
|
|
Bits 23-21 = 001, 20-19 = 00 (Type 9)
|
|
AMF = bits 17-13 = 10011 = X+Y
|
|
XOP = bits 10-8 = 000 (AX0), YOP = bits 12-11 = 00 (AY0)
|
|
COND = bits 3-0 = 1111 (TRUE = unconditional)
|
|
|
|
0x20800F -> MR = MX0 * MY0 (SS)
|
|
AMF = bits 17-13 = 00100 = X*Y (SS)
|
|
|
|
### 5. Jumps (Type 10 vs 10a)
|
|
|
|
Type 10 (conditional, 13-bit address):
|
|
|
|
0x180010 -> IF EQ JUMP 0x0001
|
|
Bits 23-20 = 0001, 19 = 1, 18 = 0 (Type 10)
|
|
B = bit 17 = 0 (no delay slot)
|
|
Address = bits 16-4, COND = bits 3-0 = 0000 (EQ)
|
|
|
|
Type 10a (unconditional, 16-bit address):
|
|
|
|
0x1C0010 -> JUMP 0x0001
|
|
Bits 23-18 = 000111 (Type 10a)
|
|
Address = bits 17-4 + bits 1-0 as MSBs
|
|
S = bit 2 (0=JUMP, 1=CALL), B = bit 3 (delayed branch)
|
|
|
|
## Patterns to Look For
|
|
|
|
- **FIR/IIR kernels**: Tight DO...UNTIL CE loops containing
|
|
Type 1 multifunction instructions (MAC + dual memory read).
|
|
- **Initialization**: Sequences of Type 6/7 loads setting up
|
|
DAG registers (I/M/L) before entering a processing loop.
|
|
- **Data tables in PM**: Regions that disassemble as nonsense
|
|
are likely coefficient tables (24-bit PM data words).
|