sigurasg / GhidraTek2465

A Ghidra loader and analyzer for the Tek2465 series oscilloscope firmware.
Apache License 2.0
4 stars 1 forks source link

Figure out how MC6800 CPX is supposed to affect flags. #8

Open sigurasg opened 6 days ago

sigurasg commented 6 days ago

The description of how CPX is supposed to affect flags is somewhat ambiguous in the reference manual. The MAME m6800 implementation certainly does weird things. This isn't very important for disassembly or decompilation, but it wants to be right for emulation.

sigurasg commented 6 days ago

After pondering this a bit, it seems reasonable for the language spec to produce the same results as the MAME m6800 implementation, as presumably it has accurate (enough) emulation for running actual firmware/software. Perhaps it's e.g. possible to write some (lengthy) assembly code that validates register and flags handling, and to make it run equally well under Ghidra emulation.

jombo23 commented 5 days ago

Have you confirmed that mame will actually run the software? I have had really really hit and miss experience with mames accuracy in the past. Writing test cases for certain condition registers shouldnt be a very big deal, and would be easy enough to run on real hardware.

If you write me a set of conditions, such as X > M X < M X > M > 256 X > M < 256 X < M > 256 X < M < 256 etc,

I will write a routine (eventually!) to test the outcomes.

sigurasg commented 4 days ago

I wrote the beginnings of an emulator for one of my targets, and it runs the firmware just fine. This doesn't say much of course, as perhaps the firmware doesn't rely on anything but the Z flag from CPX, although presumably the rest of the m6800 emulation is good enough. I'm not set up to e.g. burn EPROMs or otherwise to run on this hardware (oscilloscopes), and they have pretty lousy IO for the purpose :).

From the reference manuals the 6801 has a "sane" CPX implementation that affects all of NZVC in the expected manner.

The Compare Index Register (CPX) instruction can also be used effectively with the conditional
branch instructions. Readers familiar with the M6800 will recall that this instruction can be used
with only a few of the branches. In the MC6801, however, internal processing has been modified
such that it can be used for branching similar to the single byte comparisons. A typical use of the
CPX instruction is shown in the following example. 
sigurasg commented 4 days ago

There's a handy table on page 101 detailing the differences between mc6000 and mc6801. PSHX/PULX are nice additions, making it possible to do reentrant programming. I wrote this gripe about that issue in the 6800. The other improvements are nice as well - which reminds me I wanted to make sure the 6800 language spec doesn't accidentally disassemble any of the undefined opcodes.