Files

Siggi 29dc1f1bd2 Update all docs and test generator to match verified assembler opcodes

- README.md: Complete project overview with plugin status
- ARCHITECTURE.md: Fixed register tables (CNTR in REG1, not REG2)
- GETTING_STARTED.md: r2-native workflow, removed Python disasm refs
- PRACTICAL_EXAMPLE.md: Uses verified open21xx opcodes with bit layouts
- ROM_ANALYSIS_WALKTHROUGH.md: Updated format detection and r2 commands
- r2plugin/README.md: Simplified, points to assembler test ROM
- gen_isa_test.py: All opcodes from open21xx assembler with labels

2026-04-22 18:46:54 +00:00

2.4 KiB

Raw Blame History

Practical Example: Disassembling a Boot Sequence

This walkthrough uses verified opcodes from the open21xx assembler to demonstrate analysis of a typical ADSP-2191 initialization.

Hex Dump (from examples/isa_test.bin)

0x000 000000   NOP
0x003 412340   AX0 = 0x1234
0x006 456781   AX1 = 0x5678
0x009 4AAAA4   AY0 = 0xAAAA
0x00C 440002   MX0 = 0x4000
0x00F 420006   MY0 = 0x2000
0x012 501000   I0 = 0x0100
0x015 502001   I1 = 0x0200
0x018 303000   I4 = 0x0300

Step-by-Step Analysis

1. NOP at Reset Vector (0x000000)

The processor starts at PM address 0x0000. A NOP here means the real entry point follows immediately, or there is a JUMP to the main code further ahead.

2. Register Initialization (Type 6: Dreg = Imm16)

0x412340 -> AX0 = 0x1234
Bit layout: 01.00.0001.00100.011.0100.0000
Bits 23-20 = 0100 (Type 6), bits 3-0 = 0000 (AX0)
Immediate value in bits 19-4 = 0x1234

3. DAG Setup (Type 7: Reg1/Reg2 = Imm16)

0x501000 -> I0 = 0x0100
Bits 23-20 = 0101 (Type 7, REG1), bits 3-0 = 0000 (I0)

0x303000 -> I4 = 0x0300
Bits 23-20 = 0011 (Type 7, REG2), bits 3-0 = 0000 (I4)

This is the classic DAG initialization pattern: set index registers to buffer start addresses, then set modifier and length registers.

4. Compute Instructions (Type 9: ALU/MAC)

0x22600F -> AR = AX0 + AY0
Bits 23-21 = 001, 20-19 = 00 (Type 9)
AMF = bits 17-13 = 10011 = X+Y
XOP = bits 10-8 = 000 (AX0), YOP = bits 12-11 = 00 (AY0)
COND = bits 3-0 = 1111 (TRUE = unconditional)

0x20800F -> MR = MX0 * MY0 (SS)
AMF = bits 17-13 = 00100 = X*Y (SS)

5. Jumps (Type 10 vs 10a)

Type 10 (conditional, 13-bit address):

0x180010 -> IF EQ JUMP 0x0001
Bits 23-20 = 0001, 19 = 1, 18 = 0 (Type 10)
B = bit 17 = 0 (no delay slot)
Address = bits 16-4, COND = bits 3-0 = 0000 (EQ)

Type 10a (unconditional, 16-bit address):

0x1C0010 -> JUMP 0x0001
Bits 23-18 = 000111 (Type 10a)
Address = bits 17-4 + bits 1-0 as MSBs
S = bit 2 (0=JUMP, 1=CALL), B = bit 3 (delayed branch)

Patterns to Look For

FIR/IIR kernels: Tight DO...UNTIL CE loops containing Type 1 multifunction instructions (MAC + dual memory read).
Initialization: Sequences of Type 6/7 loads setting up DAG registers (I/M/L) before entering a processing loop.
Data tables in PM: Regions that disassemble as nonsense are likely coefficient tables (24-bit PM data words).

2.4 KiB Raw Blame History