docs: Ghidra CALLA targets do not resolve (empty call graph); smart34010 is authoritative for call targets

This commit is contained in:
SDD committed 2026-10-16 10:38:16 +03:00
1 parent 9a2363a68f
commit 8a00cef556
3 files changed
+40 -4

No files matched your search

+9
View File
@@ -0,0 +1,9 @@
#Ghidra Lock File
#Fri Oct 16 10:37:43 EEST 2026
<META>\ Supports\ File\ Channel\ Locking=Channel Lock
Hostname=sid
OS\ Architecture=amd64
OS\ Name=Linux
OS\ Version=7.2.4-arch1-2
Timestamp=10/16/26, 10\:37\u202FAM
Username=arti
View File
Whitespace-only changes.
+31 -4
View File
@@ -899,11 +899,38 @@ instruction-for-instruction on every range checked, so the two disassemblers cro
**Next:** find where the test **sets** `*A13(0xffe0)` to the video-memory code — that
assignment is the actual failing comparison, and it is the thing to fix.
## Ghidra vs smart34010: which tool to trust for what (2026-10-16)
Both tools disassemble this ROM, and they **agree instruction-for-instruction on every range
checked**. But they differ in one way that matters, found while following the level-1 test:
| tool | the same `CALLA` instruction |
|---|---|
| `tools/smart34010/dis34` | `calla 0x3fde00c0` — full bit address, matches the ROM layout |
| Ghidra (MCP) | `CALLA 0x000bc018` — does not resolve to any function |
Ghidra's **absolute operands are correct** (`MOVI 0x3fdca990` is a genuine bit address), so
it is reliable for mnemonic structure, `MOVI` constants, xrefs on data, and decompilation.
Its **`CALLA` targets do not resolve**, so:
* Ghidra's **call graph is empty** for this ROM — `function_callers`/`function_callees`
return nothing for functions that clearly call others (`FUN_rom_07fbd000` reports 0 and 0);
* use **`smart34010` for call targets**, and Ghidra for structure and decompilation.
Do not build conclusions on Ghidra's call graph here until that is fixed; the earlier
"0 callers" results are artefacts of this, not evidence of unreachable code.
### Structural result from this pass
The level-1 error dispatcher is owned by `FUN_rom_07fbd000` (body `0x07FBD000`-`0x07FBE201`),
and it takes the failing **status code as its argument** (`*A13(0xffe0)` — there is exactly
one `0xffe0` reference in the routine, the read in the dispatcher, so the code is not set
locally). The failing code is therefore chosen by **whatever calls this routine** — and that
caller is what still needs finding.
---
## Next steps
1. Find where the test SETS *A13(0xffe0) to the video-memory code -- that assignment
is the failing comparison.
2. Everything else is in place: console capture (cap.lua), video memory located and
mapped, Ghidra project seeded and saved (25 functions).
1. Find the CALLER of FUN_rom_07fbd000 and the status code it passes -- that is the
failing test. Use smart34010 for call targets (Ghidra's CALLA does not resolve).
2. Optionally fix Ghidra's CALLA operand handling to get a usable call graph.