# sgi-indy

Research workspace for the Silicon Graphics Indy (IP24) workstation, focused on
its boot PROM.

The repository contains:

- a reproducible fetcher and checksum manifest for the four MAME `indy_4610`
  PROM dumps;
- a tool that wraps a raw PROM dump in a minimal ELF32 big-endian MIPS image so
  it can be opened by Ghidra/REA at its real address;
- a structural map of the newest PROM, `ip24prom.070-9101-011.bin`
  (SGI Version 5.3 Rev B10, 12 Feb 1996);
- the full 1,074-entry function index produced by Ghidra auto-analysis;
- notes for reproducing the REA + Ghidra setup.

## Result at a glance

| Item | Value |
| --- | --- |
| Newest Indy PROM | `ip24prom.070-9101-011.bin`, 524,288 bytes |
| Version string | `SGI Version 5.3 Rev B10 R4X00/R5000 IP24 Feb 12, 1996` |
| SHA-1 | `ac663a4db68528e400487e98cbf901f620fb30ce` (matches MAME) |
| SHA-256 | `333a0b2e39bb828a28a758b6f633ae7290030129dc747297a1be68dc317b86ae` |
| Load address | `0x1FC00000` (BIOS window) |
| Analyzed code span | `0x1FC00000` - `0x1FC4A8A0`, 1,074 functions |
| Defined strings | 1,418, from `0x1FC01B7C` to `0x1FC7C16B` |
| Used bytes | `0x00000` - `0x7F9FF`; remainder is `0xFF` padding |

See [docs/rom-map.md](docs/rom-map.md) for the memory map, exception-vector
table, boot flow and function anchors.
See [docs/rom-map.json](docs/rom-map.json) for the machine-readable layout and
[docs/procedure-index.csv](docs/procedure-index.csv) for every function start.

## ROM files

The four PROM dumps from the MAME 0.236 `indy_4610` set are committed under
`roms/` for preservation, together with `roms/SHA1SUMS`. The MAME zip and the
generated ELF wrapper stay ignored.

The dumps can be re-fetched and verified with:

```bash
./tools/fetch-roms.sh
```

The fetch script downloads the `indy_4610` set and checks every SHA-1 against
MAME's `src/mame/sgi/indy_indigo2.cpp`.

## Reproduce the analysis

Prerequisites: Node.js 22.23.4+, REA (`npm install -g rea-agents`), Ghidra 12.1.x
and JDK 21. This workspace used REA 6.8.0, Ghidra 12.1.2 and OpenJDK 21.

```bash
export GHIDRA_INSTALL_DIR=/opt/ghidra
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64

./tools/fetch-roms.sh
./tools/make-elf-wrapper.py \
  roms/ip24prom.070-9101-011.bin -o roms/indy-ip24-5.3-b10.elf

rea analyze roms/indy-ip24-5.3-b10.elf --provider ghidra --json
```

REA's headerless `raw-binary` lane does not include MIPS. The wrapper declares
ELF32, big-endian, `ET_EXEC`, `e_flags = EF_MIPS_ARCH_32` and no ABI-flags
record, which selects REA's recordless MIPS admission and pins Ghidra to
`MIPS:BE:32:default`. The ROM bytes are copied unchanged at file offset `0x1000`
and mapped at `0x1FC00000`.

To regenerate the checked-in map and function index, open the wrapper in a REA
session, export its evidence bundle, then run:

```bash
./tools/rom-map.py roms/ip24prom.070-9101-011.bin \
  --evidence evidence/rea-bundle.json \
  --output docs/rom-map.json \
  --procedures-csv docs/procedure-index.csv
```

## IRIX network install server

`tools/irix_netinstall.py` is an all-in-one BOOTP + TFTP + rsh server for
netbooting the PROM and running the IRIX `inst` installer over the network.

It maps the `exec /bin/sh` session that `inst` opens to **mksh** (falling back
to **dash**), never to bash or csh, and runs it in a read-only bubblewrap
sandbox. It also serves TFTP from the install tree, including the SGI boot-tape
`file(member)` syntax.

```sh
sudo ./tools/irix_netinstall.py \
    --root /srv/irix --server-ip 10.0.0.1 \
    --client-ip 10.0.0.2 --client-mac 08:00:69:07:dc:e0 \
    --bootfile /6.5.30/stand/fx.ARCS
```

See [docs/netinstall.md](docs/netinstall.md) for the install tree layout, PROM
and `inst` steps, and the protocol details.

## Repository layout

```
docs/       map, network-install guide, setup notes, generated JSON/CSV
roms/       ROM dumps and the SHA-1 manifest
tools/      fetch, ELF wrapper, map generator, install server, tests
evidence/   local REA bundle (ignored)
```

## Setup notes

The Gitea remote is
<https://git.wut.ee/opencode.energia.arti.ee/sgi-indy>.
See [docs/rea-setup.md](docs/rea-setup.md) for the exact REA/OpenCode
configuration used here.

## Sources and attribution

- MAME `indy_indigo2.cpp` for the IP22/IP24 memory map and ROM identities:
  <https://github.com/mamedev/mame/blob/master/src/mame/sgi/indy_indigo2.cpp>
- MAME 0.236 ROM set archive used for the dumps.
- MiSTer `SGIIndy_MiSTer` ROM directory used as a cross-check.
- REA: <https://github.com/morluto/rea>