Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams
- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator - Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000 - Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11) - Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run) and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B' - Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead - Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy) - Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md Byte-identical ROM verified.
This commit is contained in:
tmerritt committed
1 parent
3ef16a6f99
commit
4c644d2a20
23 files changed
+17290
-507
No files matched your search
@@ -0,0 +1,700 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Recursive-trace NES PRG disassembler that emits ca65 source (Pass 1).
|
||||
|
||||
Classifies every PRG byte as reachable code or data by recursive descent from
|
||||
the RESET/NMI/IRQ vectors, then writes a byte-identical ca65 file where each
|
||||
instruction carries a trailing `; CPU:$xxxx PRG:xxxx AA BB` audit comment and
|
||||
every unreached byte stays as an explicit `.byte` line (never deleted).
|
||||
|
||||
Usage:
|
||||
nesdis.py --prg prg.bin --base 0x8000 --project "MUSCLE (U)" \
|
||||
--out prg.s --locals locals.inc [--pass2]
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
from collections import OrderedDict
|
||||
from pathlib import Path
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Official NMOS 6502 opcode table: opcode -> (mnemonic, addressing mode)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
IMP, ACC, IMM, ZP, ZPX, ZPY, ABS, ABSX, ABSY, IND, INDX, INDY, REL = range(13)
|
||||
|
||||
OPCODES = {
|
||||
0x00: ("brk", IMP), 0x01: ("ora", INDX), 0x05: ("ora", ZP), 0x06: ("asl", ZP),
|
||||
0x08: ("php", IMP), 0x09: ("ora", IMM), 0x0A: ("asl", ACC), 0x0D: ("ora", ABS),
|
||||
0x0E: ("asl", ABS), 0x10: ("bpl", REL), 0x11: ("ora", INDY), 0x15: ("ora", ZPX),
|
||||
0x16: ("asl", ZPX), 0x18: ("clc", IMP), 0x19: ("ora", ABSY), 0x1D: ("ora", ABSX),
|
||||
0x1E: ("asl", ABSX), 0x20: ("jsr", ABS), 0x21: ("and", INDX), 0x24: ("bit", ZP),
|
||||
0x25: ("and", ZP), 0x26: ("rol", ZP), 0x28: ("plp", IMP), 0x29: ("and", IMM),
|
||||
0x2A: ("rol", ACC), 0x2C: ("bit", ABS), 0x2D: ("and", ABS), 0x2E: ("rol", ABS),
|
||||
0x30: ("bmi", REL), 0x31: ("and", INDY), 0x35: ("and", ZPX), 0x36: ("rol", ZPX),
|
||||
0x38: ("sec", IMP), 0x39: ("and", ABSY), 0x3D: ("and", ABSX), 0x3E: ("rol", ABSX),
|
||||
0x40: ("rti", IMP), 0x41: ("eor", INDX), 0x45: ("eor", ZP), 0x46: ("lsr", ZP),
|
||||
0x48: ("pha", IMP), 0x49: ("eor", IMM), 0x4A: ("lsr", ACC), 0x4C: ("jmp", ABS),
|
||||
0x4D: ("eor", ABS), 0x4E: ("lsr", ABS), 0x50: ("bvc", REL), 0x51: ("eor", INDY),
|
||||
0x55: ("eor", ZPX), 0x56: ("lsr", ZPX), 0x58: ("cli", IMP), 0x59: ("eor", ABSY),
|
||||
0x5D: ("eor", ABSX), 0x5E: ("lsr", ABSX), 0x60: ("rts", IMP), 0x61: ("adc", INDX),
|
||||
0x65: ("adc", ZP), 0x66: ("ror", ZP), 0x68: ("pla", IMP), 0x69: ("adc", IMM),
|
||||
0x6A: ("ror", ACC), 0x6C: ("jmp", IND), 0x6D: ("adc", ABS), 0x6E: ("ror", ABS),
|
||||
0x70: ("bvs", REL), 0x71: ("adc", INDY), 0x75: ("adc", ZPX), 0x76: ("ror", ZPX),
|
||||
0x78: ("sei", IMP), 0x79: ("adc", ABSY), 0x7D: ("adc", ABSX), 0x7E: ("ror", ABSX),
|
||||
0x81: ("sta", INDX), 0x84: ("sty", ZP), 0x85: ("sta", ZP), 0x86: ("stx", ZP),
|
||||
0x88: ("dey", IMP), 0x8A: ("txa", IMP), 0x8C: ("sty", ABS), 0x8D: ("sta", ABS),
|
||||
0x8E: ("stx", ABS), 0x90: ("bcc", REL), 0x91: ("sta", INDY), 0x94: ("sty", ZPX),
|
||||
0x95: ("sta", ZPX), 0x96: ("stx", ZPY), 0x98: ("tya", IMP), 0x99: ("sta", ABSY),
|
||||
0x9A: ("txs", IMP), 0x9D: ("sta", ABSX), 0xA0: ("ldy", IMM), 0xA1: ("lda", INDX),
|
||||
0xA2: ("ldx", IMM), 0xA4: ("ldy", ZP), 0xA5: ("lda", ZP), 0xA6: ("ldx", ZP),
|
||||
0xA8: ("tay", IMP), 0xA9: ("lda", IMM), 0xAA: ("tax", IMP), 0xAC: ("ldy", ABS),
|
||||
0xAD: ("lda", ABS), 0xAE: ("ldx", ABS), 0xB0: ("bcs", REL), 0xB1: ("lda", INDY),
|
||||
0xB4: ("ldy", ZPX), 0xB5: ("lda", ZPX), 0xB6: ("ldx", ZPY), 0xB8: ("clv", IMP),
|
||||
0xB9: ("lda", ABSY), 0xBA: ("tsx", IMP), 0xBC: ("ldy", ABSX), 0xBD: ("lda", ABSX),
|
||||
0xBE: ("ldx", ABSY), 0xC0: ("cpy", IMM), 0xC1: ("cmp", INDX), 0xC4: ("cpy", ZP),
|
||||
0xC5: ("cmp", ZP), 0xC6: ("dec", ZP), 0xC8: ("iny", IMP), 0xC9: ("cmp", IMM),
|
||||
0xCA: ("dex", IMP), 0xCC: ("cpy", ABS), 0xCD: ("cmp", ABS), 0xCE: ("dec", ABS),
|
||||
0xD0: ("bne", REL), 0xD1: ("cmp", INDY), 0xD5: ("cmp", ZPX), 0xD6: ("dec", ZPX),
|
||||
0xD8: ("cld", IMP), 0xD9: ("cmp", ABSY), 0xDD: ("cmp", ABSX), 0xDE: ("dec", ABSX),
|
||||
0xE0: ("cpx", IMM), 0xE1: ("sbc", INDX), 0xE4: ("cpx", ZP), 0xE5: ("sbc", ZP),
|
||||
0xE6: ("inc", ZP), 0xE8: ("inx", IMP), 0xE9: ("sbc", IMM), 0xEA: ("nop", IMP),
|
||||
0xEC: ("cpx", ABS), 0xED: ("sbc", ABS), 0xEE: ("inc", ABS), 0xF0: ("beq", REL),
|
||||
0xF1: ("sbc", INDY), 0xF5: ("sbc", ZPX), 0xF6: ("inc", ZPX), 0xF8: ("sed", IMP),
|
||||
0xF9: ("sbc", ABSY), 0xFD: ("sbc", ABSX), 0xFE: ("inc", ABSX),
|
||||
}
|
||||
|
||||
MODE_LEN = {IMP: 1, ACC: 1, IMM: 2, ZP: 2, ZPX: 2, ZPY: 2, REL: 2,
|
||||
ABS: 3, ABSX: 3, ABSY: 3, IND: 3, INDX: 2, INDY: 2}
|
||||
|
||||
# Instructions after which control never falls through.
|
||||
TERMINATORS = {"jmp", "rts", "rti", "brk"}
|
||||
|
||||
BRANCHES = {"bpl", "bmi", "bvc", "bvs", "bcc", "bcs", "bne", "beq"}
|
||||
|
||||
|
||||
class Insn:
|
||||
"""One decoded 6502 instruction."""
|
||||
|
||||
def __init__(self, addr, length, text):
|
||||
self.addr = addr
|
||||
self.length = length
|
||||
self.text = text # rendered operand text (without mnemonic)
|
||||
self.opcode = None
|
||||
self.mnemonic = None
|
||||
self.mode = None
|
||||
self.target = None # branch/jump destination (CPU address)
|
||||
self.jsr_target = None # for jsr/jmp abs: subroutine/entry address
|
||||
|
||||
|
||||
def hex16(v):
|
||||
return f"${v:04X}"
|
||||
|
||||
|
||||
def render(prg, base, opcode, pc):
|
||||
"""Decode one instruction at pc. Returns an Insn or None when illegal."""
|
||||
if pc >= len(prg):
|
||||
return None
|
||||
entry = OPCODES.get(prg[pc])
|
||||
if entry is None:
|
||||
return None
|
||||
mnemonic, mode = entry
|
||||
length = MODE_LEN[mode]
|
||||
if pc + length > len(prg):
|
||||
return None
|
||||
|
||||
b1 = prg[pc + 1] if length > 1 else 0
|
||||
b2 = prg[pc + 2] if length > 2 else 0
|
||||
insn = Insn(pc + base, length, "")
|
||||
insn.opcode = prg[pc]
|
||||
insn.mnemonic = mnemonic
|
||||
insn.mode = mode
|
||||
|
||||
if mode == IMP:
|
||||
insn.text = ""
|
||||
elif mode == ACC:
|
||||
insn.text = "a"
|
||||
elif mode == IMM:
|
||||
insn.text = f"#${b1:02X}"
|
||||
elif mode == ZP:
|
||||
insn.text = f"Zp{b1:02X}"
|
||||
elif mode == ZPX:
|
||||
insn.text = f"Zp{b1:02X},x"
|
||||
elif mode == ZPY:
|
||||
insn.text = f"Zp{b1:02X},y"
|
||||
elif mode == ABS:
|
||||
insn.text = hex16(b1 | (b2 << 8))
|
||||
elif mode == ABSX:
|
||||
insn.text = f"{hex16(b1 | (b2 << 8))},x"
|
||||
elif mode == ABSY:
|
||||
insn.text = f"{hex16(b1 | (b2 << 8))},y"
|
||||
elif mode == IND:
|
||||
insn.text = f"({hex16(b1 | (b2 << 8))})"
|
||||
elif mode == INDX:
|
||||
insn.text = f"(Zp{b1:02X},x)"
|
||||
elif mode == INDY:
|
||||
insn.text = f"(Zp{b1:02X}),y"
|
||||
elif mode == REL:
|
||||
offset = b1 - 256 if b1 > 127 else b1
|
||||
insn.target = base + pc + 2 + offset
|
||||
insn.text = f"Label_{insn.target:04X}"
|
||||
return insn
|
||||
|
||||
|
||||
def trace(prg, base, seeds):
|
||||
"""Recursive descent from seeds. Returns (insns, invalid, indirect, targets, overlap)."""
|
||||
insns = {}
|
||||
targets = set(seeds)
|
||||
invalid = []
|
||||
indirect = []
|
||||
overlap = []
|
||||
queue = list(seeds)
|
||||
|
||||
while queue:
|
||||
addr = queue.pop(0)
|
||||
if addr in insns:
|
||||
continue
|
||||
off = addr - base
|
||||
if off < 0 or off >= len(prg):
|
||||
continue
|
||||
cur = off
|
||||
while True:
|
||||
if cur in insns:
|
||||
break
|
||||
if cur < 0 or cur >= len(prg):
|
||||
break
|
||||
insn = render(prg, base, prg[cur], cur)
|
||||
if insn is None:
|
||||
invalid.append(base + cur)
|
||||
break
|
||||
clash = [c for c in range(cur + 1, cur + insn.length) if c in insns]
|
||||
if clash:
|
||||
overlap.append((base + cur, insn.mnemonic, [base + c for c in clash]))
|
||||
insns[cur] = insn
|
||||
|
||||
# Follow control transfers.
|
||||
if insn.mnemonic in BRANCHES:
|
||||
t = insn.target
|
||||
if base <= t < base + len(prg):
|
||||
targets.add(t)
|
||||
queue.append(t)
|
||||
elif insn.mnemonic == "jsr":
|
||||
t = int(insn.text[1:], 16)
|
||||
insn.jsr_target = t
|
||||
if base <= t < base + len(prg):
|
||||
targets.add(t)
|
||||
queue.append(t)
|
||||
elif insn.mnemonic == "jmp":
|
||||
if insn.mode == ABS:
|
||||
t = int(insn.text[1:], 16)
|
||||
insn.jsr_target = t
|
||||
if base <= t < base + len(prg):
|
||||
targets.add(t)
|
||||
queue.append(t)
|
||||
break # unconditional: no fall-through
|
||||
else:
|
||||
ptr = int(insn.text.strip("()")[1:], 16)
|
||||
indirect.append((base + cur, ptr))
|
||||
if base <= ptr < base + len(prg) - 1:
|
||||
t = prg[ptr - base] | (prg[ptr - base + 1] << 8)
|
||||
if base <= t < base + len(prg):
|
||||
targets.add(t)
|
||||
queue.append(t)
|
||||
break
|
||||
elif insn.mnemonic in TERMINATORS:
|
||||
break
|
||||
|
||||
cur += insn.length
|
||||
|
||||
return insns, invalid, indirect, targets, overlap
|
||||
|
||||
|
||||
def scan_orphans(prg, base, insns, min_len=8):
|
||||
"""Contiguous untraced runs, used to hunt for code missed by static trace.
|
||||
|
||||
Coverage includes operand bytes, so only genuinely untouched ROM is reported.
|
||||
"""
|
||||
covered = set()
|
||||
for off, insn in insns.items():
|
||||
for k in range(off, off + insn.length):
|
||||
covered.add(k)
|
||||
out = []
|
||||
n = len(prg)
|
||||
i = 0
|
||||
while i < n:
|
||||
if i in covered:
|
||||
i += 1
|
||||
continue
|
||||
j = i
|
||||
while j < n and j not in covered:
|
||||
j += 1
|
||||
if j - i >= min_len:
|
||||
out.append((i, j - i))
|
||||
i = j
|
||||
return out
|
||||
|
||||
|
||||
def probe(prg, base, addr, max_insns=64):
|
||||
"""Decode linearly from addr without recording; used to judge candidate seeds."""
|
||||
cur = addr - base
|
||||
n = len(prg)
|
||||
seq = []
|
||||
term = None
|
||||
for _ in range(max_insns):
|
||||
if cur >= n:
|
||||
break
|
||||
insn = render(prg, base, prg[cur], cur)
|
||||
if insn is None:
|
||||
return seq, f"illegal ${base + cur:04X}"
|
||||
seq.append(insn)
|
||||
cur += insn.length
|
||||
if insn.mnemonic in TERMINATORS:
|
||||
term = insn.mnemonic
|
||||
break
|
||||
return seq, term
|
||||
|
||||
|
||||
# Bytes that may legally precede a routine entry point.
|
||||
ENTRY_PREDECESSORS = {0x60, 0x4C, 0x6C, 0x40, 0x00, 0xEA, 0x6A, 0x4A, 0x2A, 0x0A}
|
||||
|
||||
|
||||
def operand_value(insn):
|
||||
"""Absolute address of an ABS/ABSX/ABSY/IND operand, or None."""
|
||||
if insn.mode not in (ABS, ABSX, ABSY, IND):
|
||||
return None
|
||||
token = insn.text.strip("()").split(",")[0].lstrip("$")
|
||||
return int(token, 16)
|
||||
|
||||
|
||||
def operand_in_prg(insn, base, n):
|
||||
value = operand_value(insn)
|
||||
return value is None or (base <= value < base + n)
|
||||
|
||||
|
||||
# Mnemonics that only read, only write, or do both, for zero-page reference counting.
|
||||
ZP_READ_ONLY = {"lda", "ldx", "ldy", "cmp", "cpx", "cpy", "bit"}
|
||||
ZP_WRITE_ONLY = {"sta", "stx", "sty"}
|
||||
ZP_READ_WRITE = {"inc", "dec", "asl", "lsr", "rol", "ror"}
|
||||
|
||||
|
||||
def classify_zp(insn):
|
||||
"""Return (reads, writes) for a zero-page operand."""
|
||||
m = insn.mnemonic
|
||||
if m in ZP_READ_ONLY:
|
||||
return 1, 0
|
||||
if m in ZP_WRITE_ONLY:
|
||||
return 0, 1
|
||||
if m in ZP_READ_WRITE:
|
||||
return 1, 1
|
||||
if m in ("lda", "ldx", "ldy", "cmp", "cpx", "cpy", "bit", "sbc", "adc", "and",
|
||||
"ora", "eor"):
|
||||
return 1, 0
|
||||
return 1, 1
|
||||
|
||||
|
||||
def find_referenced_stubs(prg, base, insns, min_insns=4):
|
||||
"""Candidate routine entries that a data table elsewhere in the image points at.
|
||||
|
||||
This recovers code reached only through computed dispatch (jump tables feeding
|
||||
`jmp (zp)`, RTS tables), which a plain recursive trace from the vectors cannot see.
|
||||
A candidate must start right after a plausible terminator, decode linearly with no
|
||||
illegal opcode, run at least `min_insns` instructions, and end in rts/jmp.
|
||||
|
||||
Offsets that are operand bytes of already-decoded instructions are rejected first:
|
||||
that is what separates a real entry point from a decode that merely starts inside
|
||||
a neighbouring instruction's operand field.
|
||||
"""
|
||||
n = len(prg)
|
||||
# Every 16-bit little-endian window in the image, mapped to its host offsets.
|
||||
refs = {}
|
||||
for off in range(n - 1):
|
||||
refs.setdefault(prg[off] | (prg[off + 1] << 8), []).append(off)
|
||||
|
||||
# Operand bytes belong to an instruction already known to be reached code.
|
||||
operand_bytes = set()
|
||||
for off, insn in insns.items():
|
||||
for k in range(off + 1, off + insn.length):
|
||||
operand_bytes.add(k)
|
||||
|
||||
stubs = []
|
||||
for off in range(n):
|
||||
if off in insns or off in operand_bytes:
|
||||
continue
|
||||
if off > 0 and prg[off - 1] not in ENTRY_PREDECESSORS:
|
||||
continue
|
||||
addr = base + off
|
||||
seq, term = probe(prg, base, addr)
|
||||
if term not in ("rts", "jmp"):
|
||||
continue
|
||||
if len(seq) < min_insns:
|
||||
continue
|
||||
# Reject anything that runs into already-decoded code mid-stream.
|
||||
if any((i.addr - base) in insns for i in seq):
|
||||
continue
|
||||
# Reject clean decodes that no table anywhere in the image refers to.
|
||||
if not refs.get(addr):
|
||||
continue
|
||||
# Reject stubs whose operands point outside the PRG window (data decode).
|
||||
if any(not operand_in_prg(i, base, n) for i in seq):
|
||||
continue
|
||||
stubs.append(addr)
|
||||
return stubs
|
||||
|
||||
|
||||
def recover(prg, base, seeds, tables=(), max_rounds=12):
|
||||
"""Trace, iteratively seed table-referenced stubs, then drop seeds that collide.
|
||||
|
||||
A recovered stub that turns out to sit inside another instruction's operand field is
|
||||
a mis-aligned decode, not a routine: it is removed and the trace is redone.
|
||||
`tables` are explicitly declared 16-bit dispatch tables (addr, entry count) whose
|
||||
entries are routine entry points; they are seeded on every round.
|
||||
"""
|
||||
vector_seeds = list(seeds)
|
||||
table_seeds = []
|
||||
junk = []
|
||||
for addr, count in tables:
|
||||
off = addr - base
|
||||
for k in range(count):
|
||||
lo = prg[off + 2 * k]
|
||||
hi = prg[off + 2 * k + 1]
|
||||
entry = lo | (hi << 8)
|
||||
# Dispatch tables leave unused slots filled with whatever followed; only
|
||||
# keep slots that actually begin a decodable instruction.
|
||||
if render(prg, base, prg[entry - base], entry - base) is None:
|
||||
junk.append(entry)
|
||||
continue
|
||||
table_seeds.append(entry)
|
||||
stub_seeds = []
|
||||
rejected = []
|
||||
result = None
|
||||
|
||||
for _ in range(max_rounds):
|
||||
result = trace(prg, base, vector_seeds + table_seeds + stub_seeds)
|
||||
insns, invalid, indirect, targets, overlap = result
|
||||
|
||||
operand_bytes = set()
|
||||
for off, insn in insns.items():
|
||||
for k in range(off + 1, off + insn.length):
|
||||
operand_bytes.add(k)
|
||||
|
||||
keep, drop = [], []
|
||||
for addr in stub_seeds:
|
||||
(drop if (addr - base) in operand_bytes else keep).append(addr)
|
||||
stub_seeds = keep
|
||||
|
||||
stubs = find_referenced_stubs(prg, base, insns)
|
||||
fresh = [s for s in stubs if s not in targets and s not in stub_seeds]
|
||||
if not fresh and not drop:
|
||||
break
|
||||
stub_seeds.extend(fresh)
|
||||
rejected.extend(drop)
|
||||
|
||||
return result[0], result[1], result[2], result[3], result[4], stub_seeds, rejected, junk
|
||||
|
||||
|
||||
def parse_ranges(spec):
|
||||
"""Parse `ADDR:LEN` pairs into (address, length) tuples."""
|
||||
out = []
|
||||
for tok in spec.split(","):
|
||||
tok = tok.strip()
|
||||
if not tok:
|
||||
continue
|
||||
addr, length = tok.split(":")
|
||||
out.append((int(addr, 16), int(length, 10)))
|
||||
return out
|
||||
|
||||
|
||||
def parse_tables(spec):
|
||||
"""Parse `ADDR:COUNT` pairs into (address, entry_count) tuples."""
|
||||
return parse_ranges(spec)
|
||||
|
||||
|
||||
def build_refs(prg, base, insns, regions):
|
||||
"""Attribute each data region to the decoded instructions that reference it.
|
||||
|
||||
`regions` are (offset, length) pairs from scan_orphans; results are keyed by the
|
||||
region's start CPU address so the emitter can look them up directly.
|
||||
"""
|
||||
refs = {base + off: [] for off, _ in regions}
|
||||
if not regions:
|
||||
return refs
|
||||
for off in sorted(insns):
|
||||
insn = insns[off]
|
||||
value = operand_value(insn)
|
||||
if value is None:
|
||||
continue
|
||||
addr = base + off
|
||||
for start, length in regions:
|
||||
if base + start <= value < base + start + length:
|
||||
refs[base + start].append((addr, insn, value))
|
||||
break
|
||||
return refs
|
||||
|
||||
|
||||
def byte_columns(values):
|
||||
return ", ".join(f"${v:02X}" for v in values)
|
||||
|
||||
|
||||
def emit_code(prg, base, insns, targets, out, project, semantic, refs=None):
|
||||
"""Render the full PRG as ca65 text: code where traced, .byte elsewhere."""
|
||||
n = len(prg)
|
||||
refs = refs or {}
|
||||
name_of = {}
|
||||
|
||||
# Seed semantic entry-point names.
|
||||
for addr, name in semantic.items():
|
||||
name_of[addr] = name
|
||||
|
||||
i = 0
|
||||
routine_header = [
|
||||
"; -----------------------------------------------------------------------------",
|
||||
"; Routine: {name}",
|
||||
"; Global: Contextual control-flow entry identified from its parent routine and incoming branch usage.",
|
||||
"; Local: Continues its parent routine along the condition or operation encoded in this label,",
|
||||
"; then returns, branches again, or rejoins shared code as documented by the instructions.",
|
||||
"; Parameters: Undetermined in Pass 1 unless implied by the caller.",
|
||||
"; Returns: Undetermined in Pass 1; status flags and registers may carry results.",
|
||||
"; Clobbers: Undetermined in Pass 1.",
|
||||
"; -----------------------------------------------------------------------------",
|
||||
]
|
||||
|
||||
while i < n:
|
||||
cpu = base + i
|
||||
|
||||
if i in insns:
|
||||
insn = insns[i]
|
||||
if cpu in targets or cpu in name_of:
|
||||
name = name_of.get(cpu) or f"Label_{cpu:04X}"
|
||||
for line in routine_header:
|
||||
out.append(line.format(name=name))
|
||||
out.append(f"{name}:")
|
||||
text = f"{insn.mnemonic} {insn.text}".strip()
|
||||
raw = " ".join(f"{b:02X}" for b in prg[i:i + insn.length])
|
||||
line = f" {text}"
|
||||
out.append(f"{line:<31}; CPU:${cpu:04X} PRG:{i:04X} {raw}")
|
||||
i += insn.length
|
||||
continue
|
||||
|
||||
# Data run.
|
||||
j = i
|
||||
while j < n and j not in insns:
|
||||
j += 1
|
||||
cpu_end = base + j - 1
|
||||
out.append(f"; ---- data ${cpu:04X}-${cpu_end:04X} ({j - i} bytes) ----")
|
||||
for addr, insn, value in refs.get(cpu, [])[:6]:
|
||||
text = f"{insn.mnemonic} {insn.text}".strip()
|
||||
out.append(f"; referenced by `{text}` at ${addr:04X} "
|
||||
f"(operand ${value:04X} falls inside this region)")
|
||||
if len(refs.get(cpu, [])) > 6:
|
||||
out.append(f"; ... and {len(refs[cpu]) - 6} further references from decoded code")
|
||||
if cpu in name_of:
|
||||
out.append(f"{name_of[cpu]}:")
|
||||
k = i
|
||||
while k < j:
|
||||
chunk = prg[k:min(k + 16, j)]
|
||||
raw = " ".join(f"{b:02X}" for b in chunk)
|
||||
out.append(f" .byte {byte_columns(chunk)} ; CPU:${base + k:04X} PRG:{k:04X} {raw}")
|
||||
k += 16
|
||||
i = j
|
||||
|
||||
return name_of
|
||||
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--prg", required=True)
|
||||
ap.add_argument("--base", default="0x8000")
|
||||
ap.add_argument("--project", required=True)
|
||||
ap.add_argument("--out", required=True)
|
||||
ap.add_argument("--locals", default=None)
|
||||
ap.add_argument("--zp-aliases", default=None,
|
||||
help="comma list addr=name pairs for semantic zero-page names")
|
||||
ap.add_argument("--zp-strict", action="store_true",
|
||||
help="use ZpXX for every zero-page operand (default)")
|
||||
ap.add_argument("--extra-seed", default="",
|
||||
help="comma list of CPU addresses to seed in addition to the vectors")
|
||||
ap.add_argument("--report-orphans", type=int, default=0,
|
||||
help="print untraced runs of at least N bytes (missed-code hunting)")
|
||||
ap.add_argument("--auto-seed", action="store_true",
|
||||
help="iteratively seed table-referenced routine stubs to recover "
|
||||
"computed-dispatch code, then report every recovered entry")
|
||||
ap.add_argument("--table", default="",
|
||||
help="comma list of ADDR:COUNT declaring a 16-bit dispatch table whose "
|
||||
"entries are routine entry points (e.g. 0x9237:40)")
|
||||
ap.add_argument("--data", default="",
|
||||
help="comma list of ADDR:LEN forcing a region back to data even when "
|
||||
"static fall-through reached it (branch-over-data)")
|
||||
ap.add_argument("--probe", default="",
|
||||
help="comma list of CPU addresses to decode linearly for inspection")
|
||||
args = ap.parse_args()
|
||||
|
||||
base = int(args.base, 16)
|
||||
prg = Path(args.prg).read_bytes()
|
||||
if len(prg) < 6:
|
||||
sys.exit("PRG image too small for vectors")
|
||||
|
||||
nmi = prg[-6] | (prg[-5] << 8)
|
||||
rst = prg[-4] | (prg[-3] << 8)
|
||||
irq = prg[-2] | (prg[-1] << 8)
|
||||
|
||||
extra = [int(a, 16) for a in args.extra_seed.split(",") if a.strip()]
|
||||
|
||||
if args.probe:
|
||||
for tok in args.probe.split(","):
|
||||
tok = tok.strip()
|
||||
if not tok:
|
||||
continue
|
||||
addr = int(tok, 16)
|
||||
seq, term = probe(prg, base, addr)
|
||||
print(f"probe {tok}: {len(seq)} insns, terminator={term}")
|
||||
for insn in seq:
|
||||
raw = " ".join(f"{b:02X}" for b in prg[insn.addr - base:insn.addr - base + insn.length])
|
||||
text = f"{insn.mnemonic} {insn.text}".strip()
|
||||
print(f" ${insn.addr:04X} {raw:<9} {text}")
|
||||
return
|
||||
|
||||
seeds = [rst, nmi, irq] + extra
|
||||
tables = parse_tables(args.table)
|
||||
forced = parse_ranges(args.data)
|
||||
rejected = []
|
||||
junk = []
|
||||
if args.auto_seed or tables:
|
||||
insns, invalid, indirect, targets, overlap, recovered, rejected, junk = recover(
|
||||
prg, base, seeds, tables)
|
||||
else:
|
||||
insns, invalid, indirect, targets, overlap = trace(prg, base, seeds)
|
||||
recovered = []
|
||||
|
||||
# A branch that is always taken leaves its fall-through bytes as data; the trace
|
||||
# cannot tell, so the caller names those spans explicitly.
|
||||
overridden = []
|
||||
for addr, length in forced:
|
||||
for k in range(addr, addr + length):
|
||||
if k - base in insns:
|
||||
overridden.append(k)
|
||||
del insns[k - base]
|
||||
targets.discard(k)
|
||||
if forced:
|
||||
invalid = [a for a in invalid if not any(a0 <= a < a0 + n for a0, n in forced)]
|
||||
|
||||
semantic = OrderedDict()
|
||||
semantic[rst] = "Reset"
|
||||
semantic[nmi] = "NmiHandler"
|
||||
semantic[irq] = "IrqHandler"
|
||||
|
||||
regions = scan_orphans(prg, base, insns, 1)
|
||||
refs = build_refs(prg, base, insns, regions)
|
||||
|
||||
out = []
|
||||
out.append(f"; {args.project} NES disassembly - Pass 1")
|
||||
out.append("; Byte-oriented ca65 source generated from the supplied PRG image.")
|
||||
out.append("; Recursively reachable instructions are emitted explicitly with address/byte comments.")
|
||||
out.append("; Unreached bytes remain explicit .byte blocks; no ROM byte is deleted or reformatted.")
|
||||
out.append("; Pass 2 replaces address-derived labels, RAM aliases, and table names while")
|
||||
out.append("; preserving byte identity.")
|
||||
out.append(";")
|
||||
out.append(f"; Vectors: NMI=${nmi:04X} RESET=${rst:04X} IRQ=${irq:04X}")
|
||||
out.append(f"; PRG mapped at ${base:04X}-${base + len(prg) - 1:04X} (NROM, mirrored to the upper half)")
|
||||
out.append(";")
|
||||
out.append("; Pass 1 trace provenance (the audit trail behind every classification below):")
|
||||
if tables:
|
||||
for addr, count in tables:
|
||||
out.append(f"; dispatch table ${addr:04X}, {count} x 16-bit entries, seeded as routine entries")
|
||||
if recovered:
|
||||
out.append(f"; {len(set(recovered))} further routine entries recovered from table"
|
||||
" references elsewhere in the image:")
|
||||
out.append(f"; {', '.join(f'${a:04X}' for a in sorted(set(recovered)))}")
|
||||
if extra:
|
||||
out.append("; entries seeded by hand after inspecting code-shaped but unreferenced blocks:")
|
||||
out.append(f"; {', '.join(f'${a:04X}' for a in extra)}")
|
||||
if forced:
|
||||
for addr, length in forced:
|
||||
out.append(f"; ${addr:04X}-${addr + length - 1:04X} forced back to data:"
|
||||
" the only path into it is a branch that is always taken")
|
||||
if indirect:
|
||||
out.append("; indirect dispatch through zero page (not followed statically):")
|
||||
for addr, ptr in indirect:
|
||||
out.append(f"; jmp (${ptr:04X}) at ${addr:04X}")
|
||||
out.append(";")
|
||||
out.append('.setcpu "6502"')
|
||||
out.append("")
|
||||
out.append('.include "symbols.inc"')
|
||||
out.append('.include "locals.inc"')
|
||||
out.append("")
|
||||
out.append('.segment "PRG"')
|
||||
out.append("")
|
||||
|
||||
emit_code(prg, base, insns, targets, out, args.project, semantic, refs)
|
||||
|
||||
Path(args.out).write_text("\n".join(out) + "\n")
|
||||
|
||||
code_bytes = sum(i.length for i in insns.values())
|
||||
print(f"vectors : NMI=${nmi:04X} RESET=${rst:04X} IRQ=${irq:04X}")
|
||||
if extra:
|
||||
print(f"extra seed: {[hex(a) for a in extra]}")
|
||||
if tables:
|
||||
print(f"tables : {', '.join(f'${a:04X}x{c}' for a, c in tables)}")
|
||||
print(f"PRG : {len(prg)} bytes at ${base:04X}")
|
||||
print(f"code : {len(insns)} instructions / {code_bytes} bytes "
|
||||
f"({code_bytes * 100.0 / len(prg):.1f}%)")
|
||||
print(f"data : {len(prg) - code_bytes} bytes")
|
||||
print(f"labels : {len(targets | set(semantic))}")
|
||||
if invalid:
|
||||
print(f"INVALID : {[hex(a) for a in sorted(set(invalid))]}")
|
||||
if indirect:
|
||||
print(f"INDIRECT : {[(hex(a), hex(p)) for a, p in indirect]}")
|
||||
if overlap:
|
||||
print(f"OVERLAP : {[(hex(a), m, [hex(c) for c in clash]) for a, m, clash in overlap]}")
|
||||
if recovered:
|
||||
print(f"RECOVERED : {len(recovered)} table-referenced routine entries")
|
||||
print(f" {', '.join(hex(a) for a in sorted(set(recovered)))}")
|
||||
if rejected:
|
||||
print(f"REJECTED : {', '.join(hex(a) for a in sorted(set(rejected)))} "
|
||||
f"(mis-aligned stubs inside another instruction's operand)")
|
||||
if junk:
|
||||
print(f"JUNK SLOT : {', '.join(hex(a) for a in sorted(set(junk)))} "
|
||||
f"(unused dispatch-table slots, not decodable)")
|
||||
if forced:
|
||||
print(f"FORCED : {', '.join(f'${a:04X}+${n:02X}' for a, n in forced)} (branch-over-data)")
|
||||
if overridden:
|
||||
print(f" overrode {len(overridden)} fall-through bytes: "
|
||||
f"{', '.join(hex(a) for a in sorted(set(overridden)))}")
|
||||
if args.report_orphans:
|
||||
for off, length in scan_orphans(prg, base, insns, args.report_orphans):
|
||||
print(f"ORPHAN : ${base + off:04X}-${base + off + length - 1:04X} ({length} bytes)")
|
||||
|
||||
# Collect zero-page operands actually referenced so locals.inc can list them.
|
||||
if args.locals:
|
||||
zp = {}
|
||||
for off in sorted(insns):
|
||||
insn = insns[off]
|
||||
if insn.mode not in (ZP, ZPX, ZPY, INDX, INDY):
|
||||
continue
|
||||
addr = int(insn.text.replace("(", " ").replace(")", " ").replace(",", " ").split()[0][2:], 16)
|
||||
reads, writes = classify_zp(insn)
|
||||
rec = zp.setdefault(addr, {"reads": 0, "writes": 0, "where": []})
|
||||
rec["reads"] += reads
|
||||
rec["writes"] += writes
|
||||
if base + off not in rec["where"]:
|
||||
rec["where"].append(base + off)
|
||||
|
||||
lines = [f"; {args.project} application-specific RAM aliases - Pass 1",
|
||||
"; Generated from every direct zero-page operand in reachable code:",
|
||||
"; ref counts are reads/writes, `where` lists the referencing addresses.",
|
||||
"; ZpXX names indicate storage with a role not yet unique enough for a behavioral name;",
|
||||
"; Pass 2 replaces them with names derived from observed usage.",
|
||||
""]
|
||||
for addr in sorted(zp):
|
||||
rec = zp[addr]
|
||||
total = rec["reads"] + rec["writes"]
|
||||
name = f"Zp{addr:02X}"
|
||||
where = ", ".join(f"{w:04X}" for w in rec["where"][:4])
|
||||
if len(rec["where"]) > 4:
|
||||
where += f", +{len(rec['where']) - 4} more"
|
||||
lines.append(f"{name:<24}= ${addr:02X} ; {total} refs; "
|
||||
f"reads={rec['reads']} writes={rec['writes']}; used at ${where}")
|
||||
Path(args.locals).write_text("\n".join(lines) + "\n")
|
||||
print(f"locals : {len(zp)} zero-page aliases written to {args.locals}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in new issue
Block a user