sgi-indy

Research workspace for the Silicon Graphics Indy (IP24) workstation, focused on its boot PROM.

The repository contains:

• a reproducible fetcher and checksum manifest for the four MAME indy_4610 PROM dumps;
• a tool that wraps a raw PROM dump in a minimal ELF32 big-endian MIPS image so it can be opened by Ghidra/REA at its real address;
• a structural map of the newest PROM, ip24prom.070-9101-011.bin (SGI Version 5.3 Rev B10, 12 Feb 1996);
• the full 1,074-entry function index produced by Ghidra auto-analysis;
• notes for reproducing the REA + Ghidra setup.

Result at a glance

Item	Value
Newest Indy PROM	ip24prom.070-9101-011.bin, 524,288 bytes
Version string	SGI Version 5.3 Rev B10 R4X00/R5000 IP24 Feb 12, 1996
SHA-1	ac663a4db68528e400487e98cbf901f620fb30ce (matches MAME)
SHA-256	333a0b2e39bb828a28a758b6f633ae7290030129dc747297a1be68dc317b86ae
Load address	0x1FC00000 (BIOS window)
Analyzed code span	0x1FC00000 - 0x1FC4A8A0, 1,074 functions
Defined strings	1,418, from 0x1FC01B7C to 0x1FC7C16B
Used bytes	0x00000 - 0x7F9FF; remainder is 0xFF padding

See docs/rom-map.md for the memory map, exception-vector table, boot flow and function anchors. See docs/rom-map.json for the machine-readable layout and docs/procedure-index.csv for every function start.

ROM files are not committed

The PROM dumps are copyrighted SGI firmware. roms/*.bin, the MAME zip and the generated ELF wrapper are ignored by git. Fetch and verify them with:

./tools/fetch-roms.sh

The fetch script downloads the MAME 0.236 indy_4610 set and checks every SHA-1 against MAME's src/mame/sgi/indy_indigo2.cpp.

Reproduce the analysis

Prerequisites: Node.js 22.23.4+, REA (npm install -g rea-agents), Ghidra 12.1.x and JDK 21. This workspace used REA 6.8.0, Ghidra 12.1.2 and OpenJDK 21.

export GHIDRA_INSTALL_DIR=/opt/ghidra
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64

./tools/fetch-roms.sh
./tools/make-elf-wrapper.py \
  roms/ip24prom.070-9101-011.bin -o roms/indy-ip24-5.3-b10.elf

rea analyze roms/indy-ip24-5.3-b10.elf --provider ghidra --json

REA's headerless raw-binary lane does not include MIPS. The wrapper declares ELF32, big-endian, ET_EXEC, e_flags = EF_MIPS_ARCH_32 and no ABI-flags record, which selects REA's recordless MIPS admission and pins Ghidra to MIPS:BE:32:default. The ROM bytes are copied unchanged at file offset 0x1000 and mapped at 0x1FC00000.

To regenerate the checked-in map and function index, open the wrapper in a REA session, export its evidence bundle, then run:

./tools/rom-map.py roms/ip24prom.070-9101-011.bin \
  --evidence evidence/rea-bundle.json \
  --output docs/rom-map.json \
  --procedures-csv docs/procedure-index.csv

Repository layout

docs/       map, setup notes, generated map JSON and function index
roms/       fetched ROMs (ignored) and the SHA-1 manifest
tools/      fetch, ELF wrapper, map generator
evidence/   local REA bundle (ignored)

Setup notes

The Gitea remote is https://git.wut.ee/opencode.energia.arti.ee/sgi-indy. See docs/rea-setup.md for the exact REA/OpenCode configuration used here.

Sources and attribution

• MAME indy_indigo2.cpp for the IP22/IP24 memory map and ROM identities: https://github.com/mamedev/mame/blob/master/src/mame/sgi/indy_indigo2.cpp
• MAME 0.236 ROM set archive used for the dumps.
• MiSTer SGIIndy_MiSTer ROM directory used as a cross-check.
• REA: https://github.com/morluto/rea