Files

Siggi 29dc1f1bd2 Update all docs and test generator to match verified assembler opcodes

- README.md: Complete project overview with plugin status
- ARCHITECTURE.md: Fixed register tables (CNTR in REG1, not REG2)
- GETTING_STARTED.md: r2-native workflow, removed Python disasm refs
- PRACTICAL_EXAMPLE.md: Uses verified open21xx opcodes with bit layouts
- ROM_ANALYSIS_WALKTHROUGH.md: Updated format detection and r2 commands
- r2plugin/README.md: Simplified, points to assembler test ROM
- gen_isa_test.py: All opcodes from open21xx assembler with labels

2026-04-22 18:46:54 +00:00

2.5 KiB

Raw Blame History

ROM Analysis Walkthrough

1. Determine the ROM Format

ADSP-2191 instructions are 24 bits (3 bytes). A raw dump can be:

Packed (3 bytes/word): Most common for SPI flash dumps. Load directly: r2 -a adsp219x -b 24 dump.bin
Padded (4 bytes/word): 32-bit aligned with a leading 0x00. Strip padding or use r2 -s 1 to skip the first pad byte.
Boot stream: Contains block headers (target address, byte count, flags) followed by data. Requires parsing the header format first.

Quick Format Check

Look at the first few bytes. If you see 00 00 00 at offset 0 (a NOP), you likely have packed 3-byte format. If you see 00 00 00 00 followed by meaningful data at offset 4, it is probably 4-byte padded.

2. Find the Entry Point

The reset vector is at PM address 0x0000. Typical patterns:

0x0000: JUMP main       (Type 10a, opcode starts with 0x1C)
0x0000: NOP             (entry at next instruction)

The interrupt vector table occupies the first ~128 PM words, with 4-word spacing per vector. Most vectors contain RTI (return from interrupt) or JUMP to a handler.

3. Identify Code vs Data Regions

Code regions produce coherent disassembly: register loads, compute instructions, jumps, and loops in logical sequence.

Data regions (coefficient tables, lookup tables) produce nonsensical disassembly: random-looking mnemonics, impossible register combinations, jumps to invalid addresses. Mark these as data in r2:

Cd 300 @ 0x1000    # Mark 300 bytes as data at offset 0x1000

4. Recognize DSP Patterns

FIR Filter

CNTR = N;
DO loop_end UNTIL CE;
    MR = MR + MX0*MY0 (SS), MX0 = DM(I0,M0), MY0 = PM(I4,M4);
loop_end: ...

Look for: Type 11 (DO UNTIL CE) followed by Type 1 multifunction instructions with MAC operations.

IIR Filter (Biquad)

Nested loops: outer loop over samples, inner loop over biquad sections. Contains ASHIFT for scaling between stages.

Initialization Sequence

Sequences of Type 6/7 instructions loading I/M/L registers. This sets up circular buffers for the signal processing kernel.

5. Useful r2 Commands

e asm.arch = adsp219x
e asm.bits = 24
pd 200                  # Disassemble 200 instructions
pD 600                  # Disassemble 600 bytes (= 200 instructions)
/x 1c00                 # Find unconditional JUMPs
/x 16                   # Find DO UNTIL loops
/x 0a                   # Find RTS/RTI instructions
V                       # Enter visual mode

2.5 KiB Raw Blame History