dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake

dwt/probe_ram.lua

@@ -0,0 +1,70 @@
+-- VT1200: dump RAM tables that the static analysis says hold the remote-debug
+-- command dispatcher and the DWT console command table.
+--
+--   VT1200_SKIP_LEVEL1=1 <mame> vt1200 -rompath harness/mame/roms -video none \
+--       -sound none -nothrottle -debug -debugger none \
+--       -autoboot_script dwt/probe_ram.lua -autoboot_delay 0
+--
+-- Addresses are TMS34010 *bit* addresses (the program space unit is 1 bit),
+-- so read_u32(0x1bb830) reads the 4 bytes at physical byte 0x37706.
+-- Diagnostic only: reads memory, writes nothing.
+
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local space = cpu.spaces['program']
+
+if not dbg then
+	print("ERROR: debugger not enabled; pass -debug")
+	machine:exit()
+	return
+end
+
+local FRAME = tonumber(os.getenv("PROBE_FRAME") or "2600")
+local frames = 0
+
+local function u32(a) return space:read_u32(a) end
+local function u16(a) return space:read_u16(a) end
+local function u8(a)  return space:read_u8(a) end
+
+local function dump32(label, base, n)
+	print(string.format("--- %s  bit=0x%08X byte=0x%06X", label, base, math.floor(base / 8)))
+	for i = 0, n - 1 do
+		local v = u32(base + i * 32)
+		print(string.format("  [%2d] bit=0x%08X = 0x%08X", i, base + i * 32, v))
+	end
+end
+
+local function dumpbytes(label, base, n)
+	print(string.format("--- %s  bit=0x%08X byte=0x%06X", label, base, math.floor(base / 8)))
+	local line = {}
+	for i = 0, n - 1 do
+		line[#line + 1] = string.format("%02X", u8(base + i * 8))
+		if (#line == 16) then
+			print("  " .. table.concat(line, " "))
+			line = {}
+		end
+	end
+	if #line > 0 then print("  " .. table.concat(line, " ")) end
+end
+
+emu.register_frame_done(function()
+	frames = frames + 1
+	if frames ~= FRAME then return end
+
+	print(string.format("=== frame %d", frames))
+	-- remote-debug dispatch table (dispatcher: ADDI 0x1bb830 + opcode*0x20 bits)
+	dump32("rdebug command table @ bit 0x1bb830", 0x1bb830, 12)
+	dump32("neighbouring globals @ bit 0x1bb7f0", 0x1bb7f0, 6)
+	-- DWT console command table (12-byte entries, dispatched at 0xa5c20)
+	dump32("DWT console table @ bit 0xa5c00", 0xa5c00, 12)
+	-- the 16-byte block dwt_prf renders/copies from
+	dumpbytes("dwt_prf source @ bit 0x1be810", 0x1be810, 64)
+	-- configuration words consulted by the debug/network accept paths
+	print(string.format("--- config @0xaecd0 = 0x%04X   @0xaecd2 = 0x%04X",
+		u16(0xaecd0), u16(0xaecd2)))
+	machine:exit()
+end, "vt1200-probe-ram")
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'