diff --git a/build/rom_decompiled.asm b/build/rom_decompiled.asm index 4391e30..27d8ad2 100644 --- a/build/rom_decompiled.asm +++ b/build/rom_decompiled.asm @@ -3130,15 +3130,15 @@ loc_BB56: BB56: 19 RTS ; cycles=12 vec_sci1_eri_BB57: -BB57: 15 FA A4 C7 BSET.B #7, @H'FAA4 ; refs ram_FAA4 in on_chip_ram; cycles=8 -BB5B: 15 FE DC D5 BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 -BB5F: 15 FE DC D4 BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 -BB63: 15 FE DC D3 BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 +BB57: 15 FA A4 C7 BSET.B #7, @H'FAA4 ; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; refs ram_FAA4 in on_chip_ram; cycles=8 +BB5B: 15 FE DC D5 BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 +BB5F: 15 FE DC D4 BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 +BB63: 15 FE DC D3 BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 vec_sci1_rxi_BB67: BB67: 12 03 STM.W {R0,R1}, @-SP ; cycles=12 -BB69: 15 FE DC D6 BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 -BB6D: 15 FE DD 80 MOV:G.B @SCI1_RDR, R0 ; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR in register_field; cycles=6 +BB69: 15 FE DC D6 BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8 +BB6D: 15 FE DD 80 MOV:G.B @SCI1_RDR, R0 ; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR in register_field; cycles=6 BB71: 15 F9 C1 16 TST.B @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=6 BB75: 26 06 BNE loc_BB7D ; cycles=3/8 nt/t BB77: 15 F9 C3 13 CLR.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=8 diff --git a/build/rom_decompiled.json b/build/rom_decompiled.json index 2918a1c..094af3e 100644 --- a/build/rom_decompiled.json +++ b/build/rom_decompiled.json @@ -17350,6 +17350,7 @@ "caveat": "candidate frame means six consecutive bytes within the observed RX timing/state machine, not a proven delimited packet", "required_evidence_count": 9, "observed_evidence_count": 9, + "optional_evidence_count": 2, "missing_evidence": [], "evidence_addresses": { "rx_rdr_read": [ @@ -17390,6 +17391,18 @@ 48100, 48104, 48108 + ], + "rx_rdrf_clear_before_rdr_read": [ + 47977, + 47981 + ], + "rx_eri_falls_through_to_rxi": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 ] }, "evidence_addresses_hex": { @@ -17431,6 +17444,18 @@ "H'BBE4", "H'BBE8", "H'BBEC" + ], + "rx_rdrf_clear_before_rdr_read": [ + "H'BB69", + "H'BB6D" + ], + "rx_eri_falls_through_to_rxi": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" ] }, "evidence": [ @@ -17586,8 +17611,87 @@ "XOR.B @H'F864, R0", "CMP:G.B @H'F865, R0" ] + }, + { + "kind": "rx_rdrf_clear_before_rdr_read", + "summary": "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence", + "addresses": [ + 47977, + 47981 + ], + "addresses_hex": [ + "H'BB69", + "H'BB6D" + ], + "instructions": [ + "BCLR.B #6, @SCI1_SSR", + "MOV:G.B @SCI1_RDR, R0" + ], + "manual_references": [ + "Manual/0900766b802125d0.md:16652 RDRF clear sequence reads RDR before clearing RDRF", + "Manual/0900766b802125d0.md:16926 canonical receive flag clear sequence" + ] + }, + { + "kind": "rx_eri_falls_through_to_rxi", + "summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "instructions": [ + "BSET.B #7, @H'FAA4", + "BCLR.B #5, @SCI1_SSR", + "BCLR.B #4, @SCI1_SSR", + "BCLR.B #3, @SCI1_SSR", + "BCLR.B #6, @SCI1_SSR", + "MOV:G.B @SCI1_RDR, R0" + ], + "manual_references": [ + "Manual/0900766b802125d0.md:16703 FER/PER transfer errored data to RDR; ORER does not", + "Manual/0900766b802125d0.md:16936 ERI is requested on ORER, FER, or PER" + ] } ], + "rx_error_handling": { + "kind": "sci1_rx_error_handling_candidate", + "error_latch_address": 64164, + "error_latch_address_hex": "H'FAA4", + "error_latch_bit": 7, + "fallthrough_to_rx_byte_path": true, + "rdrf_clear_before_rdr_read": true, + "summary": "SCI1 ERI appears to mark a physical receive error and continue into the RXI byte-capture path; the RXI path clears RDRF before reading RDR in the ROM order.", + "manual_caveat": "Manual text distinguishes ORER from FER/PER data transfer into RDR and describes the normal RDR-read then RDRF-clear ordering; this output preserves the observed ROM order.", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "candidate-medium" + }, "short_comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A", "comment": "candidate/evidence-supported SCI1 6-byte RX frame hypothesis using capture buffer H'F868-H'F86D; checksum byte H'F865 is validated against XOR seeded by H'005A" } @@ -17799,6 +17903,58 @@ "MOV:G.B @SCI1_RDR, R0" ] }, + { + "kind": "rx_rdrf_clear_before_rdr_read", + "summary": "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence", + "addresses": [ + 47977, + 47981 + ], + "addresses_hex": [ + "H'BB69", + "H'BB6D" + ], + "instructions": [ + "BCLR.B #6, @SCI1_SSR", + "MOV:G.B @SCI1_RDR, R0" + ], + "manual_references": [ + "Manual/0900766b802125d0.md:16652 RDRF clear sequence reads RDR before clearing RDRF", + "Manual/0900766b802125d0.md:16926 canonical receive flag clear sequence" + ] + }, + { + "kind": "rx_eri_falls_through_to_rxi", + "summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "instructions": [ + "BSET.B #7, @H'FAA4", + "BCLR.B #5, @SCI1_SSR", + "BCLR.B #4, @SCI1_SSR", + "BCLR.B #3, @SCI1_SSR", + "BCLR.B #6, @SCI1_SSR", + "MOV:G.B @SCI1_RDR, R0" + ], + "manual_references": [ + "Manual/0900766b802125d0.md:16703 FER/PER transfer errored data to RDR; ORER does not", + "Manual/0900766b802125d0.md:16936 ERI is requested on ORER, FER, or PER" + ] + }, { "kind": "rx_indexed_store", "summary": "received bytes are stored into candidate capture buffer H'F868-H'F86D", @@ -161941,6 +162097,35 @@ ], "comment": "", "valid": true, + "serial_reconstruction": [ + { + "address": 47959, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" + } + ], "dataflow": { "block": 47959, "changes": [ @@ -162016,6 +162201,35 @@ "description": "overrun error" } ], + "serial_reconstruction": [ + { + "address": 47963, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" + } + ], "board_profile": { "accesses": [ { @@ -162093,6 +162307,35 @@ "description": "framing error" } ], + "serial_reconstruction": [ + { + "address": 47967, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" + } + ], "board_profile": { "accesses": [ { @@ -162170,6 +162413,35 @@ "description": "parity error" } ], + "serial_reconstruction": [ + { + "address": 47971, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" + } + ], "board_profile": { "accesses": [ { @@ -162271,6 +162543,54 @@ "description": "receive-data-full" } ], + "serial_reconstruction": [ + { + "address": 47977, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_rdrf_clear_before_rdr_read", + "evidence_summary": "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence", + "evidence_addresses": [ + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high" + }, + { + "address": 47977, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" + } + ], "board_profile": { "accesses": [ { @@ -162375,6 +162695,52 @@ "confidence": "high", "confidence_score": 0.9, "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high" + }, + { + "address": 47981, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_rdrf_clear_before_rdr_read", + "evidence_summary": "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence", + "evidence_addresses": [ + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high" + }, + { + "address": 47981, + "action": "serial_reconstruction_evidence", + "candidate_id": "sci1_rx_frame_f868_len6_candidate", + "candidate_kind": "candidate_sci1_rx_frame", + "evidence": "rx_eri_falls_through_to_rxi", + "evidence_summary": "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path", + "evidence_addresses": [ + 47959, + 47963, + 47967, + 47971, + 47977, + 47981 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB5B", + "H'BB5F", + "H'BB63", + "H'BB69", + "H'BB6D" + ], + "confidence": "high", + "confidence_score": 0.9, + "comment": "candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high" } ], "board_profile": { @@ -185973,6 +186339,75 @@ "handler_start_hex": "H'BC69", "handler_end": 48340, "handler_end_hex": "H'BCD4", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48245, + 48277 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC75", + "H'BC95" + ] + }, + { + "kind": "table_write_candidate", + "target_candidate": "current_value_table_candidate", + "source_candidate": "same candidate value written to the primary table", + "table_base": 59392, + "table_base_hex": "H'E800", + "evidence_addresses": [ + 48249, + 48281 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC79", + "H'BC99" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48258, + 48285 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC82", + "H'BC9D" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCCD" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48333 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCCD" + ] + } + ], + "effect_summary": "Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186054,6 +186489,39 @@ "handler_start_hex": "H'BCD7", "handler_end": 48385, "handler_end_hex": "H'BD01", + "effects": [ + { + "kind": "table_read_candidate", + "target_candidate": "primary_value_table_candidate", + "destination_candidate": "response value bytes", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48364 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCEC" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCFA" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48378 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCFA" + ] + } + ], + "effect_summary": "Candidate read: reads the primary table and stages a value response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186108,6 +186576,24 @@ "handler_start_hex": "H'BD04", "handler_end": 48395, "handler_end_hex": "H'BD0B", + "effects": [ + { + "kind": "state_clear_candidate", + "target_candidate": "serial_session_flags_candidate", + "state_address": 64162, + "state_address_hex": "H'FAA2", + "operation_candidate": "clear bit 7", + "evidence_addresses": [ + 48388 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD04" + ] + } + ], + "effect_summary": "Candidate clear/abort: clears serial session state without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186172,6 +186658,43 @@ "handler_start_hex": "H'BD0E", "handler_end": 48509, "handler_end_hex": "H'BD7D", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48410, + 48437 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD1A", + "H'BD35" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48418, + 48441 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD22", + "H'BD39" + ] + } + ], + "effect_summary": "Candidate deferred set: writes value bytes and flags the index without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186211,6 +186734,30 @@ "handler_start_hex": "H'BD80", "handler_end": 48600, "handler_end_hex": "H'BDD8", + "effects": [ + { + "kind": "pending_acknowledgement_candidate", + "target_candidate": "selected event/pending state", + "operation_candidate": "clear selected pending flags and then clear serial session state", + "evidence_addresses": [ + 48578, + 48596, + 48592, + 48584, + 48588 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDC2", + "H'BDD4", + "H'BDD0", + "H'BDC8", + "H'BDCC" + ] + } + ], + "effect_summary": "Candidate acknowledgement/clear: updates pending/event state without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186267,6 +186814,39 @@ "handler_start_hex": "H'BDDB", "handler_end": 48643, "handler_end_hex": "H'BE03", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "secondary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base": 58368, + "table_base_hex": "H'E400", + "evidence_addresses": [ + 48613 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE5" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 6", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48617 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE9" + ] + } + ], + "effect_summary": "Candidate secondary set: writes value bytes to the secondary table and flags the index.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186324,6 +186904,54 @@ "handler_start_hex": "H'BE05", "handler_end": 48677, "handler_end_hex": "H'BE25", + "effects": [ + { + "kind": "retransmit_candidate", + "source_candidate": "previous TX frame bytes H'F858-H'F85C", + "destination_candidate": "TX staging bytes H'F850-H'F854 before loc_BA26", + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48645, + 48649, + 48653, + 48657, + 48661, + 48665, + 48669, + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE05", + "H'BE09", + "H'BE0D", + "H'BE11", + "H'BE15", + "H'BE19", + "H'BE1D", + "H'BE22" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BE22" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE22" + ] + } + ], + "effect_summary": "Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -186338,6 +186966,481 @@ ] } ], + "command_effects": [ + { + "kind": "command_effects_candidate", + "command_value": 0, + "command_value_hex": "H'00", + "name_candidate": "set_value_acked", + "summary": "Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48245, + 48277 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC75", + "H'BC95" + ] + }, + { + "kind": "table_write_candidate", + "target_candidate": "current_value_table_candidate", + "source_candidate": "same candidate value written to the primary table", + "table_base": 59392, + "table_base_hex": "H'E800", + "evidence_addresses": [ + 48249, + 48281 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC79", + "H'BC99" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48258, + 48285 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC82", + "H'BC9D" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCCD" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48333 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCCD" + ] + } + ], + "response_candidates": [ + "response_at_BCCD" + ], + "evidence_addresses": [ + 48136, + 48140, + 48160, + 48162, + 48304, + 48313, + 48321, + 48329, + 48309, + 48317, + 48325, + 48333 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC20", + "H'BC22", + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9", + "H'BCB5", + "H'BCBD", + "H'BCC5", + "H'BCCD" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 1, + "command_value_hex": "H'01", + "name_candidate": "read_value", + "summary": "Candidate read: reads the primary table and stages a value response.", + "effects": [ + { + "kind": "table_read_candidate", + "target_candidate": "primary_value_table_candidate", + "destination_candidate": "response value bytes", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48364 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCEC" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCFA" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48378 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCFA" + ] + } + ], + "response_candidates": [ + "response_at_BCFA" + ], + "evidence_addresses": [ + 48136, + 48140, + 48164, + 48166, + 48304, + 48313, + 48321, + 48329, + 48343, + 48352, + 48360, + 48368, + 48374, + 48309, + 48317, + 48325, + 48348, + 48356, + 48378 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC24", + "H'BC26", + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9", + "H'BCD7", + "H'BCE0", + "H'BCE8", + "H'BCF0", + "H'BCF6", + "H'BCB5", + "H'BCBD", + "H'BCC5", + "H'BCDC", + "H'BCE4", + "H'BCFA" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 2, + "command_value_hex": "H'02", + "name_candidate": "clear_or_abort", + "summary": "Candidate clear/abort: clears serial session state without an observed immediate response.", + "effects": [ + { + "kind": "state_clear_candidate", + "target_candidate": "serial_session_flags_candidate", + "state_address": 64162, + "state_address_hex": "H'FAA2", + "operation_candidate": "clear bit 7", + "evidence_addresses": [ + 48388 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD04" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48169, + 48171 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC29", + "H'BC2B" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 4, + "command_value_hex": "H'04", + "name_candidate": "set_value_no_immediate_reply", + "summary": "Candidate deferred set: writes value bytes and flags the index without an observed immediate response.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48410, + 48437 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD1A", + "H'BD35" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48418, + 48441 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD22", + "H'BD39" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48197, + 48199 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC45", + "H'BC47" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 5, + "command_value_hex": "H'05", + "name_candidate": "ack_or_clear_pending", + "summary": "Candidate acknowledgement/clear: updates pending/event state without an observed immediate response.", + "effects": [ + { + "kind": "pending_acknowledgement_candidate", + "target_candidate": "selected event/pending state", + "operation_candidate": "clear selected pending flags and then clear serial session state", + "evidence_addresses": [ + 48578, + 48596, + 48592, + 48584, + 48588 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDC2", + "H'BDD4", + "H'BDD0", + "H'BDC8", + "H'BDCC" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48202, + 48204 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC4A", + "H'BC4C" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 6, + "command_value_hex": "H'06", + "name_candidate": "set_secondary_value", + "summary": "Candidate secondary set: writes value bytes to the secondary table and flags the index.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "secondary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base": 58368, + "table_base_hex": "H'E400", + "evidence_addresses": [ + 48613 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE5" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 6", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48617 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE9" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48207, + 48209 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC4F", + "H'BC51" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 7, + "command_value_hex": "H'07", + "name_candidate": "retransmit_or_error_reply", + "summary": "Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response.", + "effects": [ + { + "kind": "retransmit_candidate", + "source_candidate": "previous TX frame bytes H'F858-H'F85C", + "destination_candidate": "TX staging bytes H'F850-H'F854 before loc_BA26", + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48645, + 48649, + 48653, + 48657, + 48661, + 48665, + 48669, + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE05", + "H'BE09", + "H'BE0D", + "H'BE11", + "H'BE15", + "H'BE19", + "H'BE1D", + "H'BE22" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BE22" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE22" + ] + } + ], + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48136, + 48140, + 48174, + 48176, + 48212, + 48214, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC2E", + "H'BC30", + "H'BC54", + "H'BC56", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + } + ], "index_decoder": { "kind": "logical_index_decoder_candidate", "label": "loc_622B", @@ -186380,6 +187483,1967 @@ "confidence": "medium", "caveat": "Mapping is inferred from loc_622B behavior and the nearby R4 = R5 << 1 table-index use." }, + "logical_table_map_candidates": [ + { + "kind": "logical_table_map_candidate", + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6627, + "instruction_address_hex": "H'19E3", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6659, + "instruction_address_hex": "H'1A03", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R1" + }, + { + "instruction_address": 6717, + "instruction_address_hex": "H'1A3D", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6763, + "instruction_address_hex": "H'1A6B", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 16268, + "instruction_address_hex": "H'3F8C", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 16503, + "instruction_address_hex": "H'4077", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 48245, + "instruction_address_hex": "H'BC75", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48277, + "instruction_address_hex": "H'BC95", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48364, + "instruction_address_hex": "H'BCEC", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R4), R0" + }, + { + "instruction_address": 48410, + "instruction_address_hex": "H'BD1A", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48437, + "instruction_address_hex": "H'BD35", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + } + ], + "evidence_addresses": [ + 6627, + 6659, + 6717, + 6763, + 16268, + 16503, + 48245, + 48277, + 48364, + 48410, + 48437 + ], + "evidence_addresses_hex": [ + "H'19E3", + "H'1A03", + "H'1A3D", + "H'1A6B", + "H'3F8C", + "H'4077", + "H'BC75", + "H'BC95", + "H'BCEC", + "H'BD1A", + "H'BD35" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "secondary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 58368, + "logical_base_address_hex": "H'E400", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6570, + "instruction_address_hex": "H'19AA", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R0" + }, + { + "instruction_address": 6731, + "instruction_address_hex": "H'1A4B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6747, + "instruction_address_hex": "H'1A5B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6785, + "instruction_address_hex": "H'1A81", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "AND.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6836, + "instruction_address_hex": "H'1AB4", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 6849, + "instruction_address_hex": "H'1AC1", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 16507, + "instruction_address_hex": "H'407B", + "operand": "@(-H'1C00,R0)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1C00,R0)" + }, + { + "instruction_address": 48613, + "instruction_address_hex": "H'BDE5", + "operand": "@(-H'1C00,R4)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1C00,R4)" + } + ], + "evidence_addresses": [ + 6570, + 6731, + 6747, + 6785, + 6836, + 6849, + 16507, + 48613 + ], + "evidence_addresses_hex": [ + "H'19AA", + "H'1A4B", + "H'1A5B", + "H'1A81", + "H'1AB4", + "H'1AC1", + "H'407B", + "H'BDE5" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6665, + "instruction_address_hex": "H'1A09", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R1, @(-H'1800,R3)" + }, + { + "instruction_address": 6769, + "instruction_address_hex": "H'1A71", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R3)" + }, + { + "instruction_address": 16272, + "instruction_address_hex": "H'3F90", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 16511, + "instruction_address_hex": "H'407F", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 47925, + "instruction_address_hex": "H'BB35", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1800,R0), R4" + }, + { + "instruction_address": 48249, + "instruction_address_hex": "H'BC79", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48281, + "instruction_address_hex": "H'BC99", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48414, + "instruction_address_hex": "H'BD1E", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + } + ], + "evidence_addresses": [ + 6665, + 6769, + 16272, + 16511, + 47925, + 48249, + 48281, + 48414 + ], + "evidence_addresses_hex": [ + "H'1A09", + "H'1A71", + "H'3F90", + "H'407F", + "H'BB35", + "H'BC79", + "H'BC99", + "H'BD1E" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "flag_table_candidate", + "element_candidate": "bit_flags", + "logical_base_address": 60416, + "logical_base_address_hex": "H'EC00", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "observed_index_registers": [ + "R0", + "R5" + ], + "observed_accesses": [ + "write" + ], + "observed_widths": [ + 1, + 2 + ], + "accesses": [ + { + "instruction_address": 16520, + "instruction_address_hex": "H'4088", + "operand": "@(-H'1400,R0)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1400,R0)" + }, + { + "instruction_address": 48258, + "instruction_address_hex": "H'BC82", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48285, + "instruction_address_hex": "H'BC9D", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48418, + "instruction_address_hex": "H'BD22", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48441, + "instruction_address_hex": "H'BD39", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48617, + "instruction_address_hex": "H'BDE9", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #6, @(-H'1400,R5)" + } + ], + "evidence_addresses": [ + 16520, + 48258, + 48285, + 48418, + 48441, + 48617 + ], + "evidence_addresses_hex": [ + "H'4088", + "H'BC82", + "H'BC9D", + "H'BD22", + "H'BD39", + "H'BDE9" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + } + ], + "table_map_candidates": [ + { + "kind": "logical_table_map_candidate", + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6627, + "instruction_address_hex": "H'19E3", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6659, + "instruction_address_hex": "H'1A03", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R1" + }, + { + "instruction_address": 6717, + "instruction_address_hex": "H'1A3D", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6763, + "instruction_address_hex": "H'1A6B", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 16268, + "instruction_address_hex": "H'3F8C", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 16503, + "instruction_address_hex": "H'4077", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 48245, + "instruction_address_hex": "H'BC75", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48277, + "instruction_address_hex": "H'BC95", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48364, + "instruction_address_hex": "H'BCEC", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R4), R0" + }, + { + "instruction_address": 48410, + "instruction_address_hex": "H'BD1A", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48437, + "instruction_address_hex": "H'BD35", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + } + ], + "evidence_addresses": [ + 6627, + 6659, + 6717, + 6763, + 16268, + 16503, + 48245, + 48277, + 48364, + 48410, + 48437 + ], + "evidence_addresses_hex": [ + "H'19E3", + "H'1A03", + "H'1A3D", + "H'1A6B", + "H'3F8C", + "H'4077", + "H'BC75", + "H'BC95", + "H'BCEC", + "H'BD1A", + "H'BD35" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "secondary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 58368, + "logical_base_address_hex": "H'E400", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6570, + "instruction_address_hex": "H'19AA", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R0" + }, + { + "instruction_address": 6731, + "instruction_address_hex": "H'1A4B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6747, + "instruction_address_hex": "H'1A5B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6785, + "instruction_address_hex": "H'1A81", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "AND.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6836, + "instruction_address_hex": "H'1AB4", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 6849, + "instruction_address_hex": "H'1AC1", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 16507, + "instruction_address_hex": "H'407B", + "operand": "@(-H'1C00,R0)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1C00,R0)" + }, + { + "instruction_address": 48613, + "instruction_address_hex": "H'BDE5", + "operand": "@(-H'1C00,R4)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1C00,R4)" + } + ], + "evidence_addresses": [ + 6570, + 6731, + 6747, + 6785, + 6836, + 6849, + 16507, + 48613 + ], + "evidence_addresses_hex": [ + "H'19AA", + "H'1A4B", + "H'1A5B", + "H'1A81", + "H'1AB4", + "H'1AC1", + "H'407B", + "H'BDE5" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6665, + "instruction_address_hex": "H'1A09", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R1, @(-H'1800,R3)" + }, + { + "instruction_address": 6769, + "instruction_address_hex": "H'1A71", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R3)" + }, + { + "instruction_address": 16272, + "instruction_address_hex": "H'3F90", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 16511, + "instruction_address_hex": "H'407F", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 47925, + "instruction_address_hex": "H'BB35", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1800,R0), R4" + }, + { + "instruction_address": 48249, + "instruction_address_hex": "H'BC79", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48281, + "instruction_address_hex": "H'BC99", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48414, + "instruction_address_hex": "H'BD1E", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + } + ], + "evidence_addresses": [ + 6665, + 6769, + 16272, + 16511, + 47925, + 48249, + 48281, + 48414 + ], + "evidence_addresses_hex": [ + "H'1A09", + "H'1A71", + "H'3F90", + "H'407F", + "H'BB35", + "H'BC79", + "H'BC99", + "H'BD1E" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "flag_table_candidate", + "element_candidate": "bit_flags", + "logical_base_address": 60416, + "logical_base_address_hex": "H'EC00", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "observed_index_registers": [ + "R0", + "R5" + ], + "observed_accesses": [ + "write" + ], + "observed_widths": [ + 1, + 2 + ], + "accesses": [ + { + "instruction_address": 16520, + "instruction_address_hex": "H'4088", + "operand": "@(-H'1400,R0)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1400,R0)" + }, + { + "instruction_address": 48258, + "instruction_address_hex": "H'BC82", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48285, + "instruction_address_hex": "H'BC9D", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48418, + "instruction_address_hex": "H'BD22", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48441, + "instruction_address_hex": "H'BD39", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48617, + "instruction_address_hex": "H'BDE9", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #6, @(-H'1400,R5)" + } + ], + "evidence_addresses": [ + 16520, + 48258, + 48285, + 48418, + 48441, + 48617 + ], + "evidence_addresses_hex": [ + "H'4088", + "H'BC82", + "H'BC9D", + "H'BD22", + "H'BD39", + "H'BDE9" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + } + ], + "state_variable_candidates": [ + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_session_flags_candidate", + "address": 64162, + "address_hex": "H'FAA2", + "access_count": 18, + "read_count": 5, + "write_count": 13, + "bit_candidates": [ + 3, + 7 + ], + "immediate_values": [ + 3, + 7 + ], + "immediate_values_hex": [ + "H'0003", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47748, + "instruction_address_hex": "H'BA84", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 47766, + "instruction_address_hex": "H'BA96", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 47872, + "instruction_address_hex": "H'BB00", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48143, + "instruction_address_hex": "H'BC0F", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'FAA2" + }, + { + "instruction_address": 48149, + "instruction_address_hex": "H'BC15", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48179, + "instruction_address_hex": "H'BC33", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48220, + "instruction_address_hex": "H'BC5C", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48336, + "instruction_address_hex": "H'BCD0", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48381, + "instruction_address_hex": "H'BCFD", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48388, + "instruction_address_hex": "H'BD04", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48487, + "instruction_address_hex": "H'BD67", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48505, + "instruction_address_hex": "H'BD79", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48578, + "instruction_address_hex": "H'BDC2", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48596, + "instruction_address_hex": "H'BDD4", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48621, + "instruction_address_hex": "H'BDED", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48639, + "instruction_address_hex": "H'BDFF", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48711, + "instruction_address_hex": "H'BE47", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48815, + "instruction_address_hex": "H'BEAF", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + } + ], + "evidence_addresses": [ + 47748, + 47766, + 47872, + 48143, + 48149, + 48179, + 48220, + 48336, + 48381, + 48388, + 48487, + 48505, + 48578, + 48596, + 48621, + 48639, + 48711, + 48815 + ], + "evidence_addresses_hex": [ + "H'BA84", + "H'BA96", + "H'BB00", + "H'BC0F", + "H'BC15", + "H'BC33", + "H'BC5C", + "H'BCD0", + "H'BCFD", + "H'BD04", + "H'BD67", + "H'BD79", + "H'BDC2", + "H'BDD4", + "H'BDED", + "H'BDFF", + "H'BE47", + "H'BEAF" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_pending_mask_candidate", + "address": 64163, + "address_hex": "H'FAA3", + "access_count": 10, + "read_count": 1, + "write_count": 9, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 128, + 7 + ], + "immediate_values_hex": [ + "H'0080", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47770, + "instruction_address_hex": "H'BA9A", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 47953, + "instruction_address_hex": "H'BB51", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'80, @H'FAA3", + "immediate": 128, + "immediate_hex": "H'80" + }, + { + "instruction_address": 48227, + "instruction_address_hex": "H'BC63", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48501, + "instruction_address_hex": "H'BD75", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48592, + "instruction_address_hex": "H'BDD0", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48635, + "instruction_address_hex": "H'BDFB", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48707, + "instruction_address_hex": "H'BE43", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48805, + "instruction_address_hex": "H'BEA5", + "access": "write", + "mnemonic": "AND.B", + "instruction": "AND.B @H'FAA3, R0" + }, + { + "instruction_address": 48809, + "instruction_address_hex": "H'BEA9", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B R0, @H'FAA3" + }, + { + "instruction_address": 48843, + "instruction_address_hex": "H'BECB", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA3", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47770, + 47953, + 48227, + 48501, + 48592, + 48635, + 48707, + 48805, + 48809, + 48843 + ], + "evidence_addresses_hex": [ + "H'BA9A", + "H'BB51", + "H'BC63", + "H'BD75", + "H'BDD0", + "H'BDFB", + "H'BE43", + "H'BEA5", + "H'BEA9", + "H'BECB" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_rx_error_or_retry_gate_candidate", + "address": 64164, + "address_hex": "H'FAA4", + "access_count": 4, + "read_count": 1, + "write_count": 3, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 7 + ], + "immediate_values_hex": [ + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47959, + "instruction_address_hex": "H'BB57", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48004, + "instruction_address_hex": "H'BB84", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA4" + }, + { + "instruction_address": 48079, + "instruction_address_hex": "H'BBCF", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48681, + "instruction_address_hex": "H'BE29", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47959, + 48004, + 48079, + 48681 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB84", + "H'BBCF", + "H'BE29" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_retry_enable_or_mode_flags_candidate", + "address": 64165, + "address_hex": "H'FAA5", + "access_count": 3, + "read_count": 3, + "write_count": 0, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 7 + ], + "immediate_values_hex": [ + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47754, + "instruction_address_hex": "H'BA8A", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48685, + "instruction_address_hex": "H'BE2D", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48798, + "instruction_address_hex": "H'BE9E", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'FAA5, R0" + } + ], + "evidence_addresses": [ + 47754, + 48685, + 48798 + ], + "evidence_addresses_hex": [ + "H'BA8A", + "H'BE2D", + "H'BE9E" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_retry_counter_candidate", + "address": 64166, + "address_hex": "H'FAA6", + "access_count": 3, + "read_count": 1, + "write_count": 2, + "bit_candidates": [], + "immediate_values": [ + 1, + 2 + ], + "immediate_values_hex": [ + "H'0001", + "H'0002" + ], + "accesses": [ + { + "instruction_address": 48115, + "instruction_address_hex": "H'BBF3", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA6" + }, + { + "instruction_address": 48691, + "instruction_address_hex": "H'BE33", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'FAA6", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48695, + "instruction_address_hex": "H'BE37", + "access": "read", + "mnemonic": "CMP:G.B", + "instruction": "CMP:G.B #H'02, @H'FAA6", + "immediate": 2, + "immediate_hex": "H'02" + } + ], + "evidence_addresses": [ + 48115, + 48691, + 48695 + ], + "evidence_addresses_hex": [ + "H'BBF3", + "H'BE33", + "H'BE37" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_read_cursor_candidate", + "address": 63924, + "address_hex": "H'F9B4", + "access_count": 3, + "read_count": 1, + "write_count": 2, + "bit_candidates": [ + 5 + ], + "immediate_values": [ + 1, + 5 + ], + "immediate_values_hex": [ + "H'0001", + "H'0005" + ], + "accesses": [ + { + "instruction_address": 48760, + "instruction_address_hex": "H'BE78", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B4, R1" + }, + { + "instruction_address": 48789, + "instruction_address_hex": "H'BE95", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B4", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48793, + "instruction_address_hex": "H'BE99", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #5, @H'F9B4", + "bit": 5, + "immediate": 5, + "immediate_hex": "H'05" + } + ], + "evidence_addresses": [ + 48760, + 48789, + 48793 + ], + "evidence_addresses_hex": [ + "H'BE78", + "H'BE95", + "H'BE99" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_write_or_pending_cursor_candidate", + "address": 63925, + "address_hex": "H'F9B5", + "access_count": 7, + "read_count": 1, + "write_count": 6, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 1, + 7 + ], + "immediate_values_hex": [ + "H'0001", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47858, + "instruction_address_hex": "H'BAF2", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B5, R1" + }, + { + "instruction_address": 48493, + "instruction_address_hex": "H'BD6D", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48497, + "instruction_address_hex": "H'BD71", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48584, + "instruction_address_hex": "H'BDC8", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48588, + "instruction_address_hex": "H'BDCC", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48627, + "instruction_address_hex": "H'BDF3", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48631, + "instruction_address_hex": "H'BDF7", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47858, + 48493, + 48497, + 48584, + 48588, + 48627, + 48631 + ], + "evidence_addresses_hex": [ + "H'BAF2", + "H'BD6D", + "H'BD71", + "H'BDC8", + "H'BDCC", + "H'BDF3", + "H'BDF7" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_base_or_current_slot_candidate", + "address": 63929, + "address_hex": "H'F9B9", + "access_count": 1, + "read_count": 1, + "write_count": 0, + "bit_candidates": [], + "immediate_values": [], + "immediate_values_hex": [], + "accesses": [ + { + "instruction_address": 48752, + "instruction_address_hex": "H'BE70", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B9, R3" + } + ], + "evidence_addresses": [ + 48752 + ], + "evidence_addresses_hex": [ + "H'BE70" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_tx_busy_timer_candidate", + "address": 63936, + "address_hex": "H'F9C0", + "access_count": 10, + "read_count": 2, + "write_count": 8, + "bit_candidates": [], + "immediate_values": [ + 100, + 31, + 9, + 240, + 65535 + ], + "immediate_values_hex": [ + "H'0064", + "H'001F", + "H'0009", + "H'00F0", + "H'FFFF" + ], + "accesses": [ + { + "instruction_address": 47654, + "instruction_address_hex": "H'BA26", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'F9C0" + }, + { + "instruction_address": 47660, + "instruction_address_hex": "H'BA2C", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'64, @H'F9C0", + "immediate": 100, + "immediate_hex": "H'64" + }, + { + "instruction_address": 47778, + "instruction_address_hex": "H'BAA2", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 47834, + "instruction_address_hex": "H'BADA", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'09, @H'F9C0", + "immediate": 9, + "immediate_hex": "H'09" + }, + { + "instruction_address": 47841, + "instruction_address_hex": "H'BAE1", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'09, @H'F9C0", + "immediate": 9, + "immediate_hex": "H'09" + }, + { + "instruction_address": 47848, + "instruction_address_hex": "H'BAE8", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'F0, @H'F9C0", + "immediate": 240, + "immediate_hex": "H'F0" + }, + { + "instruction_address": 48669, + "instruction_address_hex": "H'BE1D", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 48702, + "instruction_address_hex": "H'BE3E", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 48878, + "instruction_address_hex": "H'BEEE", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'F9C0" + }, + { + "instruction_address": 48884, + "instruction_address_hex": "H'BEF4", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #-1, @H'F9C0", + "immediate": 65535, + "immediate_hex": "H'FFFF" + } + ], + "evidence_addresses": [ + 47654, + 47660, + 47778, + 47834, + 47841, + 47848, + 48669, + 48702, + 48878, + 48884 + ], + "evidence_addresses_hex": [ + "H'BA26", + "H'BA2C", + "H'BAA2", + "H'BADA", + "H'BAE1", + "H'BAE8", + "H'BE1D", + "H'BE3E", + "H'BEEE", + "H'BEF4" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + } + ], "send_builder": { "kind": "tx_send_builder_candidate", "label": "loc_BA26", @@ -186474,7 +189538,12 @@ "source_operand": "R1", "source": { "kind": "register_or_computed", - "operand": "R1" + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1" }, "instruction": "MOV:G.B R1, @H'F850" }, @@ -186490,7 +189559,11 @@ "source_operand": "R5", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0" }, "instruction": "MOV:G.B R5, @H'F852" }, @@ -186506,7 +189579,12 @@ "source_operand": "R5", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5" }, "instruction": "MOV:G.B R5, @H'F851" }, @@ -186521,8 +189599,19 @@ ], "source_operand": "R4", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4" }, "instruction": "MOV:G.B R4, @H'F854" }, @@ -186537,8 +189626,22 @@ ], "source_operand": "R4", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R4, @H'F853" } @@ -186561,7 +189664,375 @@ "H'BB43" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BCCD", @@ -186604,6 +190075,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -186625,8 +190099,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -186648,6 +190126,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -186704,7 +190185,405 @@ "H'BCCD" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BCFA", @@ -186747,6 +190626,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -186768,8 +190650,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -186791,6 +190677,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -186829,6 +190718,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48348, @@ -186850,6 +190742,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 2, + "rx_offsets": [ + 2 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48356, @@ -186869,13 +190764,19 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", - "rx_offset": 2, - "rx_address": 63586, - "rx_address_hex": "H'F862", - "evidence_address": 48356, - "evidence_address_hex": "H'BCE4", - "instruction": "MOV:G.B @H'F862, R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0" }, "instruction": "MOV:G.B R0, @H'F854" }, @@ -186890,8 +190791,22 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R0, @H'F853" } @@ -186973,7 +190888,403 @@ "H'BCFA" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BE22", @@ -186999,8 +191310,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" }, "instruction": "MOV:G.W R0, @H'F850" }, @@ -187017,8 +191337,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" }, "instruction": "MOV:G.W R0, @H'F852" }, @@ -187033,8 +191362,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" }, "instruction": "MOV:G.W R0, @H'F854" } @@ -187053,7 +191391,433 @@ "H'BE22" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BE6A", @@ -187096,6 +191860,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48722, @@ -187117,8 +191884,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48730, @@ -187140,6 +191911,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48738, @@ -187196,7 +191970,2517 @@ "H'BE6A" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] + } + ], + "response_schemas": [ + { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + } + ], + "response_schema": [ + { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." } ], "rx_fields": [ @@ -187388,7 +194672,12 @@ "instruction_address_hex": "H'BB1C", "source": { "kind": "register_or_computed", - "operand": "R1" + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1" }, "instruction": "MOV:G.B R1, @H'F850" }, @@ -187399,7 +194688,11 @@ "instruction_address_hex": "H'BB20", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0" }, "instruction": "MOV:G.B R5, @H'F852" }, @@ -187410,7 +194703,12 @@ "instruction_address_hex": "H'BB2B", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5" }, "instruction": "MOV:G.B R5, @H'F851" }, @@ -187420,8 +194718,19 @@ "instruction_address": 47929, "instruction_address_hex": "H'BB39", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4" }, "instruction": "MOV:G.B R4, @H'F854" }, @@ -187431,8 +194740,22 @@ "instruction_address": 47935, "instruction_address_hex": "H'BB3F", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R4, @H'F853" } @@ -187487,6 +194810,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -187501,8 +194827,12 @@ "instruction_address": 48321, "instruction_address_hex": "H'BCC1", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -187517,8 +194847,12 @@ "instruction_address": 48321, "instruction_address_hex": "H'BCC1", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -187535,6 +194869,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -187598,6 +194935,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -187612,8 +194952,12 @@ "instruction_address": 48321, "instruction_address_hex": "H'BCC1", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -187628,8 +194972,12 @@ "instruction_address": 48321, "instruction_address_hex": "H'BCC1", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -187646,6 +194994,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -187674,6 +195025,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48348, @@ -187690,6 +195044,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 2, + "rx_offsets": [ + 2 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48356, @@ -187704,13 +195061,19 @@ "instruction_address": 48368, "instruction_address_hex": "H'BCF0", "source": { - "kind": "rx_frame_byte", - "rx_offset": 2, - "rx_address": 63586, - "rx_address_hex": "H'F862", - "evidence_address": 48356, - "evidence_address_hex": "H'BCE4", - "instruction": "MOV:G.B @H'F862, R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0" }, "instruction": "MOV:G.B R0, @H'F854" }, @@ -187720,8 +195083,22 @@ "instruction_address": 48374, "instruction_address_hex": "H'BCF6", "source": { - "kind": "register_or_computed", - "operand": "R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R0, @H'F853" } @@ -187780,8 +195157,17 @@ "instruction_address": 48649, "instruction_address_hex": "H'BE09", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" }, "instruction": "MOV:G.W R0, @H'F850" }, @@ -187791,8 +195177,17 @@ "instruction_address": 48649, "instruction_address_hex": "H'BE09", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" }, "instruction": "MOV:G.W R0, @H'F850" }, @@ -187802,8 +195197,17 @@ "instruction_address": 48657, "instruction_address_hex": "H'BE11", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" }, "instruction": "MOV:G.W R0, @H'F852" }, @@ -187813,8 +195217,17 @@ "instruction_address": 48657, "instruction_address_hex": "H'BE11", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" }, "instruction": "MOV:G.W R0, @H'F852" }, @@ -187824,8 +195237,17 @@ "instruction_address": 48665, "instruction_address_hex": "H'BE19", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" }, "instruction": "MOV:G.W R0, @H'F854" } @@ -187876,6 +195298,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48722, @@ -187890,8 +195315,12 @@ "instruction_address": 48734, "instruction_address_hex": "H'BE5E", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48730, @@ -187906,8 +195335,12 @@ "instruction_address": 48734, "instruction_address_hex": "H'BE5E", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48730, @@ -187924,6 +195357,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48738, @@ -187957,6 +195393,194 @@ "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." } ], + "retry_error_model": { + "kind": "serial_retry_error_model_candidate", + "checksum_failure_path": { + "condition_candidate": "0x5A-seeded XOR over RX[0..4] differs from RX[5]", + "error_target": "loc_BE29", + "error_target_address": 48681, + "error_target_address_hex": "H'BE29", + "checksum_error_response_candidates": [ + "response_at_BE6A" + ], + "branch_evidence_addresses": [ + 48112 + ], + "branch_evidence_addresses_hex": [ + "H'BBF0" + ], + "evidence_addresses": [ + 48088, + 48092, + 48096, + 48100, + 48104, + 48108, + 48112, + 48717, + 48726, + 48734, + 48742, + 48722, + 48730, + 48738, + 48746 + ], + "evidence_addresses_hex": [ + "H'BBD8", + "H'BBDC", + "H'BBE0", + "H'BBE4", + "H'BBE8", + "H'BBEC", + "H'BBF0", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE52", + "H'BE5A", + "H'BE62", + "H'BE6A" + ], + "confidence": "candidate-high" + }, + "retry_path": { + "entry_label": "loc_BE29", + "entry_address": 48681, + "entry_address_hex": "H'BE29", + "counter_address": 64166, + "counter_address_hex": "H'FAA6", + "threshold_candidate": 2, + "response_candidates": [ + "response_at_BE6A" + ], + "summary": "Candidate retry path clears/consults serial flags, increments FAA6, compares it with 2, and when still below the apparent limit stages a command 0x07 response.", + "evidence_addresses": [ + 48681, + 48685, + 48691, + 48695, + 48707, + 48711, + 48717, + 48726, + 48734, + 48742, + 48746, + 48722, + 48730, + 48738 + ], + "evidence_addresses_hex": [ + "H'BE29", + "H'BE2D", + "H'BE33", + "H'BE37", + "H'BE43", + "H'BE47", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE6A", + "H'BE52", + "H'BE5A", + "H'BE62" + ], + "confidence": "candidate-medium" + }, + "command_0x07_path": { + "entry_label": "loc_BE05", + "entry_address": 48645, + "entry_address_hex": "H'BE05", + "response_candidates": [ + "response_at_BE22" + ], + "summary": "Candidate retransmit/explicit command 0x07 path either copies previous TX frame bytes back to F850-F854 or stages an observed 0x07 response before loc_BA26.", + "evidence_addresses": [ + 48645, + 48653, + 48661, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BE05", + "H'BE0D", + "H'BE15", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "candidate-medium" + }, + "evidence_addresses": [ + 48088, + 48092, + 48096, + 48100, + 48104, + 48108, + 48112, + 48717, + 48726, + 48734, + 48742, + 48722, + 48730, + 48738, + 48746, + 48681, + 48685, + 48691, + 48695, + 48707, + 48711, + 48645, + 48653, + 48661, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BBD8", + "H'BBDC", + "H'BBE0", + "H'BBE4", + "H'BBE8", + "H'BBEC", + "H'BBF0", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE52", + "H'BE5A", + "H'BE62", + "H'BE6A", + "H'BE29", + "H'BE2D", + "H'BE33", + "H'BE37", + "H'BE43", + "H'BE47", + "H'BE05", + "H'BE0D", + "H'BE15", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "candidate-medium", + "caveat": "The retry/error model is inferred from checksum branch targets, retry-counter state, and response staging; exact host-visible semantics remain candidate phrasing." + }, "evidence": [ { "kind": "rx_frame_reconstruction_present", @@ -188857,6 +196481,75 @@ "handler_start_hex": "H'BC69", "handler_end": 48340, "handler_end_hex": "H'BCD4", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48245, + 48277 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC75", + "H'BC95" + ] + }, + { + "kind": "table_write_candidate", + "target_candidate": "current_value_table_candidate", + "source_candidate": "same candidate value written to the primary table", + "table_base": 59392, + "table_base_hex": "H'E800", + "evidence_addresses": [ + 48249, + 48281 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC79", + "H'BC99" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48258, + 48285 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC82", + "H'BC9D" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCCD" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48333 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCCD" + ] + } + ], + "effect_summary": "Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -188938,6 +196631,39 @@ "handler_start_hex": "H'BCD7", "handler_end": 48385, "handler_end_hex": "H'BD01", + "effects": [ + { + "kind": "table_read_candidate", + "target_candidate": "primary_value_table_candidate", + "destination_candidate": "response value bytes", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48364 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCEC" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCFA" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48378 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCFA" + ] + } + ], + "effect_summary": "Candidate read: reads the primary table and stages a value response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -188992,6 +196718,24 @@ "handler_start_hex": "H'BD04", "handler_end": 48395, "handler_end_hex": "H'BD0B", + "effects": [ + { + "kind": "state_clear_candidate", + "target_candidate": "serial_session_flags_candidate", + "state_address": 64162, + "state_address_hex": "H'FAA2", + "operation_candidate": "clear bit 7", + "evidence_addresses": [ + 48388 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD04" + ] + } + ], + "effect_summary": "Candidate clear/abort: clears serial session state without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -189056,6 +196800,43 @@ "handler_start_hex": "H'BD0E", "handler_end": 48509, "handler_end_hex": "H'BD7D", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48410, + 48437 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD1A", + "H'BD35" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48418, + 48441 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD22", + "H'BD39" + ] + } + ], + "effect_summary": "Candidate deferred set: writes value bytes and flags the index without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -189095,6 +196876,30 @@ "handler_start_hex": "H'BD80", "handler_end": 48600, "handler_end_hex": "H'BDD8", + "effects": [ + { + "kind": "pending_acknowledgement_candidate", + "target_candidate": "selected event/pending state", + "operation_candidate": "clear selected pending flags and then clear serial session state", + "evidence_addresses": [ + 48578, + 48596, + 48592, + 48584, + 48588 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDC2", + "H'BDD4", + "H'BDD0", + "H'BDC8", + "H'BDCC" + ] + } + ], + "effect_summary": "Candidate acknowledgement/clear: updates pending/event state without an observed immediate response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -189151,6 +196956,39 @@ "handler_start_hex": "H'BDDB", "handler_end": 48643, "handler_end_hex": "H'BE03", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "secondary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base": 58368, + "table_base_hex": "H'E400", + "evidence_addresses": [ + 48613 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE5" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 6", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48617 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE9" + ] + } + ], + "effect_summary": "Candidate secondary set: writes value bytes to the secondary table and flags the index.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -189208,6 +197046,54 @@ "handler_start_hex": "H'BE05", "handler_end": 48677, "handler_end_hex": "H'BE25", + "effects": [ + { + "kind": "retransmit_candidate", + "source_candidate": "previous TX frame bytes H'F858-H'F85C", + "destination_candidate": "TX staging bytes H'F850-H'F854 before loc_BA26", + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48645, + 48649, + 48653, + 48657, + 48661, + 48665, + 48669, + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE05", + "H'BE09", + "H'BE0D", + "H'BE11", + "H'BE15", + "H'BE19", + "H'BE1D", + "H'BE22" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BE22" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE22" + ] + } + ], + "effect_summary": "Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response.", "evidence_addresses_hex": [ "H'BC08", "H'BC0C", @@ -189222,6 +197108,481 @@ ] } ], + "command_effects": [ + { + "kind": "command_effects_candidate", + "command_value": 0, + "command_value_hex": "H'00", + "name_candidate": "set_value_acked", + "summary": "Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48245, + 48277 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC75", + "H'BC95" + ] + }, + { + "kind": "table_write_candidate", + "target_candidate": "current_value_table_candidate", + "source_candidate": "same candidate value written to the primary table", + "table_base": 59392, + "table_base_hex": "H'E800", + "evidence_addresses": [ + 48249, + 48281 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC79", + "H'BC99" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48258, + 48285 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BC82", + "H'BC9D" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCCD" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48333 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCCD" + ] + } + ], + "response_candidates": [ + "response_at_BCCD" + ], + "evidence_addresses": [ + 48136, + 48140, + 48160, + 48162, + 48304, + 48313, + 48321, + 48329, + 48309, + 48317, + 48325, + 48333 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC20", + "H'BC22", + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9", + "H'BCB5", + "H'BCBD", + "H'BCC5", + "H'BCCD" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 1, + "command_value_hex": "H'01", + "name_candidate": "read_value", + "summary": "Candidate read: reads the primary table and stages a value response.", + "effects": [ + { + "kind": "table_read_candidate", + "target_candidate": "primary_value_table_candidate", + "destination_candidate": "response value bytes", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48364 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCEC" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BCFA" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48378 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BCFA" + ] + } + ], + "response_candidates": [ + "response_at_BCFA" + ], + "evidence_addresses": [ + 48136, + 48140, + 48164, + 48166, + 48304, + 48313, + 48321, + 48329, + 48343, + 48352, + 48360, + 48368, + 48374, + 48309, + 48317, + 48325, + 48348, + 48356, + 48378 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC24", + "H'BC26", + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9", + "H'BCD7", + "H'BCE0", + "H'BCE8", + "H'BCF0", + "H'BCF6", + "H'BCB5", + "H'BCBD", + "H'BCC5", + "H'BCDC", + "H'BCE4", + "H'BCFA" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 2, + "command_value_hex": "H'02", + "name_candidate": "clear_or_abort", + "summary": "Candidate clear/abort: clears serial session state without an observed immediate response.", + "effects": [ + { + "kind": "state_clear_candidate", + "target_candidate": "serial_session_flags_candidate", + "state_address": 64162, + "state_address_hex": "H'FAA2", + "operation_candidate": "clear bit 7", + "evidence_addresses": [ + 48388 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD04" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48169, + 48171 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC29", + "H'BC2B" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 4, + "command_value_hex": "H'04", + "name_candidate": "set_value_no_immediate_reply", + "summary": "Candidate deferred set: writes value bytes and flags the index without an observed immediate response.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 57344, + "table_base_hex": "H'E000", + "evidence_addresses": [ + 48410, + 48437 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD1A", + "H'BD35" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48418, + 48441 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BD22", + "H'BD39" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48197, + 48199 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC45", + "H'BC47" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 5, + "command_value_hex": "H'05", + "name_candidate": "ack_or_clear_pending", + "summary": "Candidate acknowledgement/clear: updates pending/event state without an observed immediate response.", + "effects": [ + { + "kind": "pending_acknowledgement_candidate", + "target_candidate": "selected event/pending state", + "operation_candidate": "clear selected pending flags and then clear serial session state", + "evidence_addresses": [ + 48578, + 48596, + 48592, + 48584, + 48588 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDC2", + "H'BDD4", + "H'BDD0", + "H'BDC8", + "H'BDCC" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48202, + 48204 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC4A", + "H'BC4C" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 6, + "command_value_hex": "H'06", + "name_candidate": "set_secondary_value", + "summary": "Candidate secondary set: writes value bytes to the secondary table and flags the index.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "secondary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base": 58368, + "table_base_hex": "H'E400", + "evidence_addresses": [ + 48613 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE5" + ] + }, + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 6", + "table_base": 60416, + "table_base_hex": "H'EC00", + "evidence_addresses": [ + 48617 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BDE9" + ] + } + ], + "response_candidates": [], + "evidence_addresses": [ + 48136, + 48140, + 48207, + 48209 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC4F", + "H'BC51" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + }, + { + "kind": "command_effects_candidate", + "command_value": 7, + "command_value_hex": "H'07", + "name_candidate": "retransmit_or_error_reply", + "summary": "Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response.", + "effects": [ + { + "kind": "retransmit_candidate", + "source_candidate": "previous TX frame bytes H'F858-H'F85C", + "destination_candidate": "TX staging bytes H'F850-H'F854 before loc_BA26", + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48645, + 48649, + 48653, + 48657, + 48661, + 48665, + 48669, + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE05", + "H'BE09", + "H'BE0D", + "H'BE11", + "H'BE15", + "H'BE19", + "H'BE1D", + "H'BE22" + ] + }, + { + "kind": "response_staging_candidate", + "response_candidates": [ + "response_at_BE22" + ], + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + 48674 + ], + "confidence": "candidate-medium", + "caveat": "Effect is inferred from local data movement and remains a protocol candidate.", + "evidence_addresses_hex": [ + "H'BE22" + ] + } + ], + "response_candidates": [ + "response_at_BE22" + ], + "evidence_addresses": [ + 48136, + 48140, + 48174, + 48176, + 48212, + 48214, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BC08", + "H'BC0C", + "H'BC2E", + "H'BC30", + "H'BC54", + "H'BC56", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "medium", + "caveat": "Command value and handler range are inferred from compare/BEQ dispatch. No command name or intent is asserted." + } + ], "response_candidates": [ { "id": "response_at_BB43", @@ -189246,7 +197607,12 @@ "source_operand": "R1", "source": { "kind": "register_or_computed", - "operand": "R1" + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1" }, "instruction": "MOV:G.B R1, @H'F850" }, @@ -189262,7 +197628,11 @@ "source_operand": "R5", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0" }, "instruction": "MOV:G.B R5, @H'F852" }, @@ -189278,7 +197648,12 @@ "source_operand": "R5", "source": { "kind": "register_or_computed", - "operand": "R5" + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5" }, "instruction": "MOV:G.B R5, @H'F851" }, @@ -189293,8 +197668,19 @@ ], "source_operand": "R4", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4" }, "instruction": "MOV:G.B R4, @H'F854" }, @@ -189309,8 +197695,22 @@ ], "source_operand": "R4", "source": { - "kind": "register_or_computed", - "operand": "R4" + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R4, @H'F853" } @@ -189333,7 +197733,375 @@ "H'BB43" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BCCD", @@ -189376,6 +198144,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -189397,8 +198168,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -189420,6 +198195,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -189476,7 +198254,405 @@ "H'BCCD" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BCFA", @@ -189519,6 +198695,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48309, @@ -189540,8 +198719,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48317, @@ -189563,6 +198746,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48325, @@ -189601,6 +198787,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48348, @@ -189622,6 +198811,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 2, + "rx_offsets": [ + 2 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48356, @@ -189641,13 +198833,19 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", - "rx_offset": 2, - "rx_address": 63586, - "rx_address_hex": "H'F862", - "evidence_address": 48356, - "evidence_address_hex": "H'BCE4", - "instruction": "MOV:G.B @H'F862, R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0" }, "instruction": "MOV:G.B R0, @H'F854" }, @@ -189662,8 +198860,22 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ] }, "instruction": "MOV:G.B R0, @H'F853" } @@ -189745,7 +198957,403 @@ "H'BCFA" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BE22", @@ -189771,8 +199379,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" }, "instruction": "MOV:G.W R0, @H'F850" }, @@ -189789,8 +199406,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" }, "instruction": "MOV:G.W R0, @H'F852" }, @@ -189805,8 +199431,17 @@ ], "source_operand": "R0", "source": { - "kind": "register_or_computed", - "operand": "R0" + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" }, "instruction": "MOV:G.W R0, @H'F854" } @@ -189825,7 +199460,433 @@ "H'BE22" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] }, { "id": "response_at_BE6A", @@ -189868,6 +199929,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 1, + "rx_offsets": [ + 1 + ], "rx_address": 63585, "rx_address_hex": "H'F861", "evidence_address": 48722, @@ -189889,8 +199953,12 @@ ], "source_operand": "R0", "source": { - "kind": "rx_frame_byte", + "kind": "rx_frame_word", "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], "rx_address": 63586, "rx_address_hex": "H'F862", "evidence_address": 48730, @@ -189912,6 +199980,9 @@ "source": { "kind": "rx_frame_byte", "rx_offset": 4, + "rx_offsets": [ + 4 + ], "rx_address": 63588, "rx_address_hex": "H'F864", "evidence_address": 48738, @@ -189968,7 +200039,2517 @@ "H'BE6A" ], "confidence": "medium", - "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path." + "caveat": "Response candidate means F850-F854 are written shortly before loc_BA26. The analyzer does not prove every byte is meaningful for every path.", + "schema": { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + "byte_schema": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ] + } + ], + "response_schemas": [ + { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + } + ], + "response_schema": [ + { + "kind": "response_schema_candidate", + "response_id": "response_at_BB43", + "call_address": 47939, + "call_address_hex": "H'BB43", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R1", + "source_category": "computed", + "operation": "AND", + "evidence_address": 47897, + "evidence_address_hex": "H'BB19", + "instruction": "AND.B #H'07, R1", + "byte_index": 0 + }, + "write_instruction_address": 47900, + "write_instruction_address_hex": "H'BB1C", + "instruction": "MOV:G.B R1, @H'F850", + "evidence_addresses": [ + 47900 + ], + "evidence_addresses_hex": [ + "H'BB1C" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "R5", + "source_category": "computed", + "operation": "OR", + "evidence_address": 47913, + "evidence_address_hex": "H'BB29", + "instruction": "OR.B R2, R5", + "byte_index": 0 + }, + "write_instruction_address": 47915, + "write_instruction_address_hex": "H'BB2B", + "instruction": "MOV:G.B R5, @H'F851", + "evidence_addresses": [ + 47915 + ], + "evidence_addresses_hex": [ + "H'BB2B" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "computed", + "source_expression": "computed", + "source": { + "kind": "register_or_computed", + "operand": "@(-H'0790,R0)", + "source_category": "computed", + "evidence_address": 47880, + "evidence_address_hex": "H'BB08", + "instruction": "MOV:G.W @(-H'0790,R0), R0", + "byte_index": 0 + }, + "write_instruction_address": 47904, + "write_instruction_address_hex": "H'BB20", + "instruction": "MOV:G.B R5, @H'F852", + "evidence_addresses": [ + 47904 + ], + "evidence_addresses_hex": [ + "H'BB20" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 47935, + "write_instruction_address_hex": "H'BB3F", + "instruction": "MOV:G.B R4, @H'F853", + "evidence_addresses": [ + 47935 + ], + "evidence_addresses_hex": [ + "H'BB3F" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "current_value_table_candidate", + "source": { + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "operand": "@(-H'1800,R0)", + "kind": "table", + "access_width": 2, + "evidence_address": 47925, + "evidence_address_hex": "H'BB35", + "instruction": "MOV:G.W @(-H'1800,R0), R4", + "byte_index": 0 + }, + "write_instruction_address": 47929, + "write_instruction_address_hex": "H'BB39", + "instruction": "MOV:G.B R4, @H'F854", + "evidence_addresses": [ + 47929 + ], + "evidence_addresses_hex": [ + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 47900, + 47915, + 47904, + 47935, + 47929 + ], + "evidence_addresses_hex": [ + "H'BB1C", + "H'BB2B", + "H'BB20", + "H'BB3F", + "H'BB39" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCCD", + "call_address": 48333, + "call_address_hex": "H'BCCD", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48304, + "write_instruction_address_hex": "H'BCB0", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48304 + ], + "evidence_addresses_hex": [ + "H'BCB0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48309, + "evidence_address_hex": "H'BCB5", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48313, + "write_instruction_address_hex": "H'BCB9", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48313 + ], + "evidence_addresses_hex": [ + "H'BCB9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48325, + "evidence_address_hex": "H'BCC5", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48329, + "write_instruction_address_hex": "H'BCC9", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48329 + ], + "evidence_addresses_hex": [ + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48304, + 48313, + 48321, + 48329 + ], + "evidence_addresses_hex": [ + "H'BCB0", + "H'BCB9", + "H'BCC1", + "H'BCC9" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BCFA", + "call_address": 48378, + "call_address_hex": "H'BCFA", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x04", + "source": { + "kind": "immediate", + "value": 4, + "value_hex": "H'04", + "byte_index": 0 + }, + "write_instruction_address": 48343, + "write_instruction_address_hex": "H'BCD7", + "instruction": "MOV:G.B #H'04, @H'F850", + "evidence_addresses": [ + 48343 + ], + "evidence_addresses_hex": [ + "H'BCD7" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_offsets": [ + 2 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48356, + "evidence_address_hex": "H'BCE4", + "instruction": "MOV:G.B @H'F862, R0" + } + }, + "write_instruction_address": 48360, + "write_instruction_address_hex": "H'BCE8", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48360 + ], + "evidence_addresses_hex": [ + "H'BCE8" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48317, + "evidence_address_hex": "H'BCBD", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48321, + "write_instruction_address_hex": "H'BCC1", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48321 + ], + "evidence_addresses_hex": [ + "H'BCC1" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "transforms": [ + "swap_bytes" + ], + "byte_index": 0 + }, + "write_instruction_address": 48374, + "write_instruction_address_hex": "H'BCF6", + "instruction": "MOV:G.B R0, @H'F853", + "evidence_addresses": [ + 48374 + ], + "evidence_addresses_hex": [ + "H'BCF6" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "table", + "source_expression": "primary_value_table_candidate", + "source": { + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "operand": "@(-H'2000,R4)", + "kind": "table", + "access_width": 2, + "evidence_address": 48364, + "evidence_address_hex": "H'BCEC", + "instruction": "MOV:G.W @(-H'2000,R4), R0", + "byte_index": 0 + }, + "write_instruction_address": 48368, + "write_instruction_address_hex": "H'BCF0", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48368 + ], + "evidence_addresses_hex": [ + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48343, + 48360, + 48321, + 48374, + 48368 + ], + "evidence_addresses_hex": [ + "H'BCD7", + "H'BCE8", + "H'BCC1", + "H'BCF6", + "H'BCF0" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE22", + "call_address": 48674, + "call_address_hex": "H'BE22", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "tx_frame_byte", + "source_expression": "tx[0]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 0, + "tx_address": 63576, + "tx_address_hex": "H'F858", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "tx_frame_byte", + "source_expression": "tx[1]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 1, + "tx_address": 63577, + "tx_address_hex": "H'F859", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 0, + "tx_offsets": [ + 0, + 1 + ], + "tx_address": 63576, + "tx_address_hex": "H'F858", + "evidence_address": 48645, + "evidence_address_hex": "H'BE05", + "instruction": "MOV:G.W @H'F858, R0" + } + }, + "write_instruction_address": 48649, + "write_instruction_address_hex": "H'BE09", + "instruction": "MOV:G.W R0, @H'F850", + "evidence_addresses": [ + 48649 + ], + "evidence_addresses_hex": [ + "H'BE09" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "tx_frame_byte", + "source_expression": "tx[2]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 2, + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "tx_frame_byte", + "source_expression": "tx[3]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 3, + "tx_address": 63579, + "tx_address_hex": "H'F85B", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 2, + "tx_offsets": [ + 2, + 3 + ], + "tx_address": 63578, + "tx_address_hex": "H'F85A", + "evidence_address": 48653, + "evidence_address_hex": "H'BE0D", + "instruction": "MOV:G.W @H'F85A, R0" + } + }, + "write_instruction_address": 48657, + "write_instruction_address_hex": "H'BE11", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48657 + ], + "evidence_addresses_hex": [ + "H'BE11" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "tx_frame_byte", + "source_expression": "tx[4]", + "source": { + "kind": "tx_frame_byte", + "tx_offset": 4, + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "derived_from": { + "kind": "tx_frame_word", + "tx_offset": 4, + "tx_offsets": [ + 4, + 5 + ], + "tx_address": 63580, + "tx_address_hex": "H'F85C", + "evidence_address": 48661, + "evidence_address_hex": "H'BE15", + "instruction": "MOV:G.W @H'F85C, R0" + } + }, + "write_instruction_address": 48665, + "write_instruction_address_hex": "H'BE19", + "instruction": "MOV:G.W R0, @H'F854", + "evidence_addresses": [ + 48665 + ], + "evidence_addresses_hex": [ + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48649, + 48657, + 48665 + ], + "evidence_addresses_hex": [ + "H'BE09", + "H'BE11", + "H'BE19" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." + }, + { + "kind": "response_schema_candidate", + "response_id": "response_at_BE6A", + "call_address": 48746, + "call_address_hex": "H'BE6A", + "buffer_start": 63568, + "buffer_start_hex": "H'F850", + "buffer_end": 63572, + "buffer_end_hex": "H'F854", + "bytes": [ + { + "offset": 0, + "byte": "byte0", + "tx_byte": "TX[0]", + "tx_staging_byte": "TX[0]", + "address": 63568, + "address_hex": "H'F850", + "source_kind": "immediate", + "source_expression": "0x07", + "source": { + "kind": "immediate", + "value": 7, + "value_hex": "H'07", + "byte_index": 0 + }, + "write_instruction_address": 48717, + "write_instruction_address_hex": "H'BE4D", + "instruction": "MOV:G.B #H'07, @H'F850", + "evidence_addresses": [ + 48717 + ], + "evidence_addresses_hex": [ + "H'BE4D" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 1, + "byte": "byte1", + "tx_byte": "TX[1]", + "tx_staging_byte": "TX[1]", + "address": 63569, + "address_hex": "H'F851", + "source_kind": "rx_frame_byte", + "source_expression": "rx[1]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_address": 63585, + "rx_address_hex": "H'F861", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 1, + "rx_offsets": [ + 1 + ], + "rx_address": 63585, + "rx_address_hex": "H'F861", + "evidence_address": 48722, + "evidence_address_hex": "H'BE52", + "instruction": "MOV:G.B @H'F861, R0" + } + }, + "write_instruction_address": 48726, + "write_instruction_address_hex": "H'BE56", + "instruction": "MOV:G.B R0, @H'F851", + "evidence_addresses": [ + 48726 + ], + "evidence_addresses_hex": [ + "H'BE56" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 2, + "byte": "byte2", + "tx_byte": "TX[2]", + "tx_staging_byte": "TX[2]", + "address": 63570, + "address_hex": "H'F852", + "source_kind": "rx_frame_byte", + "source_expression": "rx[2]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 2, + "rx_address": 63586, + "rx_address_hex": "H'F862", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 3, + "byte": "byte3", + "tx_byte": "TX[3]", + "tx_staging_byte": "TX[3]", + "address": 63571, + "address_hex": "H'F853", + "source_kind": "rx_frame_byte", + "source_expression": "rx[3]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 3, + "rx_address": 63587, + "rx_address_hex": "H'F863", + "derived_from": { + "kind": "rx_frame_word", + "rx_offset": 2, + "rx_offsets": [ + 2, + 3 + ], + "rx_address": 63586, + "rx_address_hex": "H'F862", + "evidence_address": 48730, + "evidence_address_hex": "H'BE5A", + "instruction": "MOV:G.W @H'F862, R0" + } + }, + "write_instruction_address": 48734, + "write_instruction_address_hex": "H'BE5E", + "instruction": "MOV:G.W R0, @H'F852", + "evidence_addresses": [ + 48734 + ], + "evidence_addresses_hex": [ + "H'BE5E" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + }, + { + "offset": 4, + "byte": "byte4", + "tx_byte": "TX[4]", + "tx_staging_byte": "TX[4]", + "address": 63572, + "address_hex": "H'F854", + "source_kind": "rx_frame_byte", + "source_expression": "rx[4]", + "source": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_address": 63588, + "rx_address_hex": "H'F864", + "derived_from": { + "kind": "rx_frame_byte", + "rx_offset": 4, + "rx_offsets": [ + 4 + ], + "rx_address": 63588, + "rx_address_hex": "H'F864", + "evidence_address": 48738, + "evidence_address_hex": "H'BE62", + "instruction": "MOV:G.B @H'F864, R0" + } + }, + "write_instruction_address": 48742, + "write_instruction_address_hex": "H'BE66", + "instruction": "MOV:G.B R0, @H'F854", + "evidence_addresses": [ + 48742 + ], + "evidence_addresses_hex": [ + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Per-byte source is inferred from the final observed write to this staging byte before loc_BA26." + } + ], + "evidence_addresses": [ + 48717, + 48726, + 48734, + 48742 + ], + "evidence_addresses_hex": [ + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66" + ], + "confidence": "candidate-medium", + "caveat": "Response schema is a candidate extracted from writes to F850-F854 in the local window before loc_BA26; control-flow alternatives may share a send call." } ], "send_builder": { @@ -190041,6 +202622,2155 @@ "confidence": "low", "caveat": "loc_BA26 is treated as a send builder because it copies F850-F854 into the evidence-supported TX frame and then starts SCI1 transmission." }, + "logical_table_map_candidates": [ + { + "kind": "logical_table_map_candidate", + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6627, + "instruction_address_hex": "H'19E3", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6659, + "instruction_address_hex": "H'1A03", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R1" + }, + { + "instruction_address": 6717, + "instruction_address_hex": "H'1A3D", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6763, + "instruction_address_hex": "H'1A6B", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 16268, + "instruction_address_hex": "H'3F8C", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 16503, + "instruction_address_hex": "H'4077", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 48245, + "instruction_address_hex": "H'BC75", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48277, + "instruction_address_hex": "H'BC95", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48364, + "instruction_address_hex": "H'BCEC", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R4), R0" + }, + { + "instruction_address": 48410, + "instruction_address_hex": "H'BD1A", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48437, + "instruction_address_hex": "H'BD35", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + } + ], + "evidence_addresses": [ + 6627, + 6659, + 6717, + 6763, + 16268, + 16503, + 48245, + 48277, + 48364, + 48410, + 48437 + ], + "evidence_addresses_hex": [ + "H'19E3", + "H'1A03", + "H'1A3D", + "H'1A6B", + "H'3F8C", + "H'4077", + "H'BC75", + "H'BC95", + "H'BCEC", + "H'BD1A", + "H'BD35" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "secondary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 58368, + "logical_base_address_hex": "H'E400", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6570, + "instruction_address_hex": "H'19AA", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R0" + }, + { + "instruction_address": 6731, + "instruction_address_hex": "H'1A4B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6747, + "instruction_address_hex": "H'1A5B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6785, + "instruction_address_hex": "H'1A81", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "AND.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6836, + "instruction_address_hex": "H'1AB4", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 6849, + "instruction_address_hex": "H'1AC1", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 16507, + "instruction_address_hex": "H'407B", + "operand": "@(-H'1C00,R0)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1C00,R0)" + }, + { + "instruction_address": 48613, + "instruction_address_hex": "H'BDE5", + "operand": "@(-H'1C00,R4)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1C00,R4)" + } + ], + "evidence_addresses": [ + 6570, + 6731, + 6747, + 6785, + 6836, + 6849, + 16507, + 48613 + ], + "evidence_addresses_hex": [ + "H'19AA", + "H'1A4B", + "H'1A5B", + "H'1A81", + "H'1AB4", + "H'1AC1", + "H'407B", + "H'BDE5" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6665, + "instruction_address_hex": "H'1A09", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R1, @(-H'1800,R3)" + }, + { + "instruction_address": 6769, + "instruction_address_hex": "H'1A71", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R3)" + }, + { + "instruction_address": 16272, + "instruction_address_hex": "H'3F90", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 16511, + "instruction_address_hex": "H'407F", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 47925, + "instruction_address_hex": "H'BB35", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1800,R0), R4" + }, + { + "instruction_address": 48249, + "instruction_address_hex": "H'BC79", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48281, + "instruction_address_hex": "H'BC99", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48414, + "instruction_address_hex": "H'BD1E", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + } + ], + "evidence_addresses": [ + 6665, + 6769, + 16272, + 16511, + 47925, + 48249, + 48281, + 48414 + ], + "evidence_addresses_hex": [ + "H'1A09", + "H'1A71", + "H'3F90", + "H'407F", + "H'BB35", + "H'BC79", + "H'BC99", + "H'BD1E" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "flag_table_candidate", + "element_candidate": "bit_flags", + "logical_base_address": 60416, + "logical_base_address_hex": "H'EC00", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "observed_index_registers": [ + "R0", + "R5" + ], + "observed_accesses": [ + "write" + ], + "observed_widths": [ + 1, + 2 + ], + "accesses": [ + { + "instruction_address": 16520, + "instruction_address_hex": "H'4088", + "operand": "@(-H'1400,R0)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1400,R0)" + }, + { + "instruction_address": 48258, + "instruction_address_hex": "H'BC82", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48285, + "instruction_address_hex": "H'BC9D", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48418, + "instruction_address_hex": "H'BD22", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48441, + "instruction_address_hex": "H'BD39", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48617, + "instruction_address_hex": "H'BDE9", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #6, @(-H'1400,R5)" + } + ], + "evidence_addresses": [ + 16520, + 48258, + 48285, + 48418, + 48441, + 48617 + ], + "evidence_addresses_hex": [ + "H'4088", + "H'BC82", + "H'BC9D", + "H'BD22", + "H'BD39", + "H'BDE9" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + } + ], + "table_map_candidates": [ + { + "kind": "logical_table_map_candidate", + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 57344, + "logical_base_address_hex": "H'E000", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6627, + "instruction_address_hex": "H'19E3", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6659, + "instruction_address_hex": "H'1A03", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R1" + }, + { + "instruction_address": 6717, + "instruction_address_hex": "H'1A3D", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 6763, + "instruction_address_hex": "H'1A6B", + "operand": "@(-H'2000,R3)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "CMP:G.W @(-H'2000,R3), R0" + }, + { + "instruction_address": 16268, + "instruction_address_hex": "H'3F8C", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 16503, + "instruction_address_hex": "H'4077", + "operand": "@(-H'2000,R0)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'2000,R0)" + }, + { + "instruction_address": 48245, + "instruction_address_hex": "H'BC75", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48277, + "instruction_address_hex": "H'BC95", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48364, + "instruction_address_hex": "H'BCEC", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'2000,R4), R0" + }, + { + "instruction_address": 48410, + "instruction_address_hex": "H'BD1A", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + }, + { + "instruction_address": 48437, + "instruction_address_hex": "H'BD35", + "operand": "@(-H'2000,R4)", + "negative_offset": 8192, + "negative_offset_hex": "H'2000", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'2000,R4)" + } + ], + "evidence_addresses": [ + 6627, + 6659, + 6717, + 6763, + 16268, + 16503, + 48245, + 48277, + 48364, + 48410, + 48437 + ], + "evidence_addresses_hex": [ + "H'19E3", + "H'1A03", + "H'1A3D", + "H'1A6B", + "H'3F8C", + "H'4077", + "H'BC75", + "H'BC95", + "H'BCEC", + "H'BD1A", + "H'BD35" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "secondary_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 58368, + "logical_base_address_hex": "H'E400", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6570, + "instruction_address_hex": "H'19AA", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R0" + }, + { + "instruction_address": 6731, + "instruction_address_hex": "H'1A4B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6747, + "instruction_address_hex": "H'1A5B", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6785, + "instruction_address_hex": "H'1A81", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "AND.W @(-H'1C00,R3), R1" + }, + { + "instruction_address": 6836, + "instruction_address_hex": "H'1AB4", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 6849, + "instruction_address_hex": "H'1AC1", + "operand": "@(-H'1C00,R3)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R3", + "access": "read", + "width": 2, + "instruction": "BTST.W R0, @(-H'1C00,R3)" + }, + { + "instruction_address": 16507, + "instruction_address_hex": "H'407B", + "operand": "@(-H'1C00,R0)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1C00,R0)" + }, + { + "instruction_address": 48613, + "instruction_address_hex": "H'BDE5", + "operand": "@(-H'1C00,R4)", + "negative_offset": 7168, + "negative_offset_hex": "H'1C00", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1C00,R4)" + } + ], + "evidence_addresses": [ + 6570, + 6731, + 6747, + 6785, + 6836, + 6849, + 16507, + 48613 + ], + "evidence_addresses_hex": [ + "H'19AA", + "H'1A4B", + "H'1A5B", + "H'1A81", + "H'1AB4", + "H'1AC1", + "H'407B", + "H'BDE5" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + "logical_base_address": 59392, + "logical_base_address_hex": "H'E800", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "observed_index_registers": [ + "R0", + "R3", + "R4" + ], + "observed_accesses": [ + "read", + "write" + ], + "observed_widths": [ + 2 + ], + "accesses": [ + { + "instruction_address": 6665, + "instruction_address_hex": "H'1A09", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R1, @(-H'1800,R3)" + }, + { + "instruction_address": 6769, + "instruction_address_hex": "H'1A71", + "operand": "@(-H'1800,R3)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R3", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R3)" + }, + { + "instruction_address": 16272, + "instruction_address_hex": "H'3F90", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 16511, + "instruction_address_hex": "H'407F", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1800,R0)" + }, + { + "instruction_address": 47925, + "instruction_address_hex": "H'BB35", + "operand": "@(-H'1800,R0)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R0", + "access": "read", + "width": 2, + "instruction": "MOV:G.W @(-H'1800,R0), R4" + }, + { + "instruction_address": 48249, + "instruction_address_hex": "H'BC79", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48281, + "instruction_address_hex": "H'BC99", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + }, + { + "instruction_address": 48414, + "instruction_address_hex": "H'BD1E", + "operand": "@(-H'1800,R4)", + "negative_offset": 6144, + "negative_offset_hex": "H'1800", + "index_register": "R4", + "access": "write", + "width": 2, + "instruction": "MOV:G.W R0, @(-H'1800,R4)" + } + ], + "evidence_addresses": [ + 6665, + 6769, + 16272, + 16511, + 47925, + 48249, + 48281, + 48414 + ], + "evidence_addresses_hex": [ + "H'1A09", + "H'1A71", + "H'3F90", + "H'407F", + "H'BB35", + "H'BC79", + "H'BC99", + "H'BD1E" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + }, + { + "kind": "logical_table_map_candidate", + "name_candidate": "flag_table_candidate", + "element_candidate": "bit_flags", + "logical_base_address": 60416, + "logical_base_address_hex": "H'EC00", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "observed_index_registers": [ + "R0", + "R5" + ], + "observed_accesses": [ + "write" + ], + "observed_widths": [ + 1, + 2 + ], + "accesses": [ + { + "instruction_address": 16520, + "instruction_address_hex": "H'4088", + "operand": "@(-H'1400,R0)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R0", + "access": "write", + "width": 2, + "instruction": "CLR.W @(-H'1400,R0)" + }, + { + "instruction_address": 48258, + "instruction_address_hex": "H'BC82", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48285, + "instruction_address_hex": "H'BC9D", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48418, + "instruction_address_hex": "H'BD22", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48441, + "instruction_address_hex": "H'BD39", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #7, @(-H'1400,R5)" + }, + { + "instruction_address": 48617, + "instruction_address_hex": "H'BDE9", + "operand": "@(-H'1400,R5)", + "negative_offset": 5120, + "negative_offset_hex": "H'1400", + "index_register": "R5", + "access": "write", + "width": 1, + "instruction": "BSET.B #6, @(-H'1400,R5)" + } + ], + "evidence_addresses": [ + 16520, + 48258, + 48285, + 48418, + 48441, + 48617 + ], + "evidence_addresses_hex": [ + "H'4088", + "H'BC82", + "H'BC9D", + "H'BD22", + "H'BD39", + "H'BDE9" + ], + "confidence": "candidate-medium", + "caveat": "Logical table base is inferred from negative indexed operands only; the table name is a conservative candidate." + } + ], + "state_variable_candidates": [ + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_session_flags_candidate", + "address": 64162, + "address_hex": "H'FAA2", + "access_count": 18, + "read_count": 5, + "write_count": 13, + "bit_candidates": [ + 3, + 7 + ], + "immediate_values": [ + 3, + 7 + ], + "immediate_values_hex": [ + "H'0003", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47748, + "instruction_address_hex": "H'BA84", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 47766, + "instruction_address_hex": "H'BA96", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 47872, + "instruction_address_hex": "H'BB00", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48143, + "instruction_address_hex": "H'BC0F", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'FAA2" + }, + { + "instruction_address": 48149, + "instruction_address_hex": "H'BC15", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48179, + "instruction_address_hex": "H'BC33", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48220, + "instruction_address_hex": "H'BC5C", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48336, + "instruction_address_hex": "H'BCD0", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48381, + "instruction_address_hex": "H'BCFD", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48388, + "instruction_address_hex": "H'BD04", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA2", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48487, + "instruction_address_hex": "H'BD67", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48505, + "instruction_address_hex": "H'BD79", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48578, + "instruction_address_hex": "H'BDC2", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48596, + "instruction_address_hex": "H'BDD4", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48621, + "instruction_address_hex": "H'BDED", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #3, @H'FAA2", + "bit": 3, + "immediate": 3, + "immediate_hex": "H'03" + }, + { + "instruction_address": 48639, + "instruction_address_hex": "H'BDFF", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48711, + "instruction_address_hex": "H'BE47", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + }, + { + "instruction_address": 48815, + "instruction_address_hex": "H'BEAF", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA2" + } + ], + "evidence_addresses": [ + 47748, + 47766, + 47872, + 48143, + 48149, + 48179, + 48220, + 48336, + 48381, + 48388, + 48487, + 48505, + 48578, + 48596, + 48621, + 48639, + 48711, + 48815 + ], + "evidence_addresses_hex": [ + "H'BA84", + "H'BA96", + "H'BB00", + "H'BC0F", + "H'BC15", + "H'BC33", + "H'BC5C", + "H'BCD0", + "H'BCFD", + "H'BD04", + "H'BD67", + "H'BD79", + "H'BDC2", + "H'BDD4", + "H'BDED", + "H'BDFF", + "H'BE47", + "H'BEAF" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_pending_mask_candidate", + "address": 64163, + "address_hex": "H'FAA3", + "access_count": 10, + "read_count": 1, + "write_count": 9, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 128, + 7 + ], + "immediate_values_hex": [ + "H'0080", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47770, + "instruction_address_hex": "H'BA9A", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 47953, + "instruction_address_hex": "H'BB51", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'80, @H'FAA3", + "immediate": 128, + "immediate_hex": "H'80" + }, + { + "instruction_address": 48227, + "instruction_address_hex": "H'BC63", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48501, + "instruction_address_hex": "H'BD75", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48592, + "instruction_address_hex": "H'BDD0", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48635, + "instruction_address_hex": "H'BDFB", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48707, + "instruction_address_hex": "H'BE43", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA3" + }, + { + "instruction_address": 48805, + "instruction_address_hex": "H'BEA5", + "access": "write", + "mnemonic": "AND.B", + "instruction": "AND.B @H'FAA3, R0" + }, + { + "instruction_address": 48809, + "instruction_address_hex": "H'BEA9", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B R0, @H'FAA3" + }, + { + "instruction_address": 48843, + "instruction_address_hex": "H'BECB", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA3", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47770, + 47953, + 48227, + 48501, + 48592, + 48635, + 48707, + 48805, + 48809, + 48843 + ], + "evidence_addresses_hex": [ + "H'BA9A", + "H'BB51", + "H'BC63", + "H'BD75", + "H'BDD0", + "H'BDFB", + "H'BE43", + "H'BEA5", + "H'BEA9", + "H'BECB" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_rx_error_or_retry_gate_candidate", + "address": 64164, + "address_hex": "H'FAA4", + "access_count": 4, + "read_count": 1, + "write_count": 3, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 7 + ], + "immediate_values_hex": [ + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47959, + "instruction_address_hex": "H'BB57", + "access": "write", + "mnemonic": "BSET.B", + "instruction": "BSET.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48004, + "instruction_address_hex": "H'BB84", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA4" + }, + { + "instruction_address": 48079, + "instruction_address_hex": "H'BBCF", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48681, + "instruction_address_hex": "H'BE29", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'FAA4", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47959, + 48004, + 48079, + 48681 + ], + "evidence_addresses_hex": [ + "H'BB57", + "H'BB84", + "H'BBCF", + "H'BE29" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_retry_enable_or_mode_flags_candidate", + "address": 64165, + "address_hex": "H'FAA5", + "access_count": 3, + "read_count": 3, + "write_count": 0, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 7 + ], + "immediate_values_hex": [ + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47754, + "instruction_address_hex": "H'BA8A", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48685, + "instruction_address_hex": "H'BE2D", + "access": "read", + "mnemonic": "BTST.B", + "instruction": "BTST.B #7, @H'FAA5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48798, + "instruction_address_hex": "H'BE9E", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'FAA5, R0" + } + ], + "evidence_addresses": [ + 47754, + 48685, + 48798 + ], + "evidence_addresses_hex": [ + "H'BA8A", + "H'BE2D", + "H'BE9E" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_retry_counter_candidate", + "address": 64166, + "address_hex": "H'FAA6", + "access_count": 3, + "read_count": 1, + "write_count": 2, + "bit_candidates": [], + "immediate_values": [ + 1, + 2 + ], + "immediate_values_hex": [ + "H'0001", + "H'0002" + ], + "accesses": [ + { + "instruction_address": 48115, + "instruction_address_hex": "H'BBF3", + "access": "write", + "mnemonic": "CLR.B", + "instruction": "CLR.B @H'FAA6" + }, + { + "instruction_address": 48691, + "instruction_address_hex": "H'BE33", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'FAA6", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48695, + "instruction_address_hex": "H'BE37", + "access": "read", + "mnemonic": "CMP:G.B", + "instruction": "CMP:G.B #H'02, @H'FAA6", + "immediate": 2, + "immediate_hex": "H'02" + } + ], + "evidence_addresses": [ + 48115, + 48691, + 48695 + ], + "evidence_addresses_hex": [ + "H'BBF3", + "H'BE33", + "H'BE37" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_read_cursor_candidate", + "address": 63924, + "address_hex": "H'F9B4", + "access_count": 3, + "read_count": 1, + "write_count": 2, + "bit_candidates": [ + 5 + ], + "immediate_values": [ + 1, + 5 + ], + "immediate_values_hex": [ + "H'0001", + "H'0005" + ], + "accesses": [ + { + "instruction_address": 48760, + "instruction_address_hex": "H'BE78", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B4, R1" + }, + { + "instruction_address": 48789, + "instruction_address_hex": "H'BE95", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B4", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48793, + "instruction_address_hex": "H'BE99", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #5, @H'F9B4", + "bit": 5, + "immediate": 5, + "immediate_hex": "H'05" + } + ], + "evidence_addresses": [ + 48760, + 48789, + 48793 + ], + "evidence_addresses_hex": [ + "H'BE78", + "H'BE95", + "H'BE99" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_write_or_pending_cursor_candidate", + "address": 63925, + "address_hex": "H'F9B5", + "access_count": 7, + "read_count": 1, + "write_count": 6, + "bit_candidates": [ + 7 + ], + "immediate_values": [ + 1, + 7 + ], + "immediate_values_hex": [ + "H'0001", + "H'0007" + ], + "accesses": [ + { + "instruction_address": 47858, + "instruction_address_hex": "H'BAF2", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B5, R1" + }, + { + "instruction_address": 48493, + "instruction_address_hex": "H'BD6D", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48497, + "instruction_address_hex": "H'BD71", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48584, + "instruction_address_hex": "H'BDC8", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48588, + "instruction_address_hex": "H'BDCC", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + }, + { + "instruction_address": 48627, + "instruction_address_hex": "H'BDF3", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #1, @H'F9B5", + "immediate": 1, + "immediate_hex": "H'01" + }, + { + "instruction_address": 48631, + "instruction_address_hex": "H'BDF7", + "access": "write", + "mnemonic": "BCLR.B", + "instruction": "BCLR.B #7, @H'F9B5", + "bit": 7, + "immediate": 7, + "immediate_hex": "H'07" + } + ], + "evidence_addresses": [ + 47858, + 48493, + 48497, + 48584, + 48588, + 48627, + 48631 + ], + "evidence_addresses_hex": [ + "H'BAF2", + "H'BD6D", + "H'BD71", + "H'BDC8", + "H'BDCC", + "H'BDF3", + "H'BDF7" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "event_queue_base_or_current_slot_candidate", + "address": 63929, + "address_hex": "H'F9B9", + "access_count": 1, + "read_count": 1, + "write_count": 0, + "bit_candidates": [], + "immediate_values": [], + "immediate_values_hex": [], + "accesses": [ + { + "instruction_address": 48752, + "instruction_address_hex": "H'BE70", + "access": "read", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B @H'F9B9, R3" + } + ], + "evidence_addresses": [ + 48752 + ], + "evidence_addresses_hex": [ + "H'BE70" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + }, + { + "kind": "serial_state_variable_candidate", + "name_candidate": "serial_tx_busy_timer_candidate", + "address": 63936, + "address_hex": "H'F9C0", + "access_count": 10, + "read_count": 2, + "write_count": 8, + "bit_candidates": [], + "immediate_values": [ + 100, + 31, + 9, + 240, + 65535 + ], + "immediate_values_hex": [ + "H'0064", + "H'001F", + "H'0009", + "H'00F0", + "H'FFFF" + ], + "accesses": [ + { + "instruction_address": 47654, + "instruction_address_hex": "H'BA26", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'F9C0" + }, + { + "instruction_address": 47660, + "instruction_address_hex": "H'BA2C", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'64, @H'F9C0", + "immediate": 100, + "immediate_hex": "H'64" + }, + { + "instruction_address": 47778, + "instruction_address_hex": "H'BAA2", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 47834, + "instruction_address_hex": "H'BADA", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'09, @H'F9C0", + "immediate": 9, + "immediate_hex": "H'09" + }, + { + "instruction_address": 47841, + "instruction_address_hex": "H'BAE1", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'09, @H'F9C0", + "immediate": 9, + "immediate_hex": "H'09" + }, + { + "instruction_address": 47848, + "instruction_address_hex": "H'BAE8", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'F0, @H'F9C0", + "immediate": 240, + "immediate_hex": "H'F0" + }, + { + "instruction_address": 48669, + "instruction_address_hex": "H'BE1D", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 48702, + "instruction_address_hex": "H'BE3E", + "access": "write", + "mnemonic": "MOV:G.B", + "instruction": "MOV:G.B #H'1F, @H'F9C0", + "immediate": 31, + "immediate_hex": "H'1F" + }, + { + "instruction_address": 48878, + "instruction_address_hex": "H'BEEE", + "access": "read", + "mnemonic": "TST.B", + "instruction": "TST.B @H'F9C0" + }, + { + "instruction_address": 48884, + "instruction_address_hex": "H'BEF4", + "access": "write", + "mnemonic": "ADD:Q.B", + "instruction": "ADD:Q.B #-1, @H'F9C0", + "immediate": 65535, + "immediate_hex": "H'FFFF" + } + ], + "evidence_addresses": [ + 47654, + 47660, + 47778, + 47834, + 47841, + 47848, + 48669, + 48702, + 48878, + 48884 + ], + "evidence_addresses_hex": [ + "H'BA26", + "H'BA2C", + "H'BAA2", + "H'BADA", + "H'BAE1", + "H'BAE8", + "H'BE1D", + "H'BE3E", + "H'BEEE", + "H'BEF4" + ], + "confidence": "candidate-medium", + "caveat": "Role is inferred from references in the serial handler region and remains a state-variable candidate." + } + ], + "retry_error_model": { + "kind": "serial_retry_error_model_candidate", + "checksum_failure_path": { + "condition_candidate": "0x5A-seeded XOR over RX[0..4] differs from RX[5]", + "error_target": "loc_BE29", + "error_target_address": 48681, + "error_target_address_hex": "H'BE29", + "checksum_error_response_candidates": [ + "response_at_BE6A" + ], + "branch_evidence_addresses": [ + 48112 + ], + "branch_evidence_addresses_hex": [ + "H'BBF0" + ], + "evidence_addresses": [ + 48088, + 48092, + 48096, + 48100, + 48104, + 48108, + 48112, + 48717, + 48726, + 48734, + 48742, + 48722, + 48730, + 48738, + 48746 + ], + "evidence_addresses_hex": [ + "H'BBD8", + "H'BBDC", + "H'BBE0", + "H'BBE4", + "H'BBE8", + "H'BBEC", + "H'BBF0", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE52", + "H'BE5A", + "H'BE62", + "H'BE6A" + ], + "confidence": "candidate-high" + }, + "retry_path": { + "entry_label": "loc_BE29", + "entry_address": 48681, + "entry_address_hex": "H'BE29", + "counter_address": 64166, + "counter_address_hex": "H'FAA6", + "threshold_candidate": 2, + "response_candidates": [ + "response_at_BE6A" + ], + "summary": "Candidate retry path clears/consults serial flags, increments FAA6, compares it with 2, and when still below the apparent limit stages a command 0x07 response.", + "evidence_addresses": [ + 48681, + 48685, + 48691, + 48695, + 48707, + 48711, + 48717, + 48726, + 48734, + 48742, + 48746, + 48722, + 48730, + 48738 + ], + "evidence_addresses_hex": [ + "H'BE29", + "H'BE2D", + "H'BE33", + "H'BE37", + "H'BE43", + "H'BE47", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE6A", + "H'BE52", + "H'BE5A", + "H'BE62" + ], + "confidence": "candidate-medium" + }, + "command_0x07_path": { + "entry_label": "loc_BE05", + "entry_address": 48645, + "entry_address_hex": "H'BE05", + "response_candidates": [ + "response_at_BE22" + ], + "summary": "Candidate retransmit/explicit command 0x07 path either copies previous TX frame bytes back to F850-F854 or stages an observed 0x07 response before loc_BA26.", + "evidence_addresses": [ + 48645, + 48653, + 48661, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BE05", + "H'BE0D", + "H'BE15", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "candidate-medium" + }, + "evidence_addresses": [ + 48088, + 48092, + 48096, + 48100, + 48104, + 48108, + 48112, + 48717, + 48726, + 48734, + 48742, + 48722, + 48730, + 48738, + 48746, + 48681, + 48685, + 48691, + 48695, + 48707, + 48711, + 48645, + 48653, + 48661, + 48649, + 48657, + 48665, + 48674 + ], + "evidence_addresses_hex": [ + "H'BBD8", + "H'BBDC", + "H'BBE0", + "H'BBE4", + "H'BBE8", + "H'BBEC", + "H'BBF0", + "H'BE4D", + "H'BE56", + "H'BE5E", + "H'BE66", + "H'BE52", + "H'BE5A", + "H'BE62", + "H'BE6A", + "H'BE29", + "H'BE2D", + "H'BE33", + "H'BE37", + "H'BE43", + "H'BE47", + "H'BE05", + "H'BE0D", + "H'BE15", + "H'BE09", + "H'BE11", + "H'BE19", + "H'BE22" + ], + "confidence": "candidate-medium", + "caveat": "The retry/error model is inferred from checksum branch targets, retry-counter state, and response staging; exact host-visible semantics remain candidate phrasing." + }, "confidence": "medium-high", "confidence_score": 0.9, "caveat": "Semantic names are candidates only. The analyzer reports byte roles, command values, dispatch targets, and response staging patterns observed in code; it does not prove source-level intent or protocol documentation." diff --git a/build/rom_pseudocode.c b/build/rom_pseudocode.c index c47f2e0..d7e3b22 100644 --- a/build/rom_pseudocode.c +++ b/build/rom_pseudocode.c @@ -2944,18 +2944,18 @@ loc_BB56: void vec_sci1_eri_BB57(void) { /* vector sources: sci1_eri */ - MEM8[0xFAA4] |= BIT(7); /* BB57; BSET.B #7, @H'FAA4; refs ram_FAA4; cycles=8 */ - SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ - SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ - SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ + MEM8[0xFAA4] |= BIT(7); /* BB57; BSET.B #7, @H'FAA4; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; refs ram_FAA4; cycles=8 */ + SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ + SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ + SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ } void vec_sci1_rxi_BB67(void) { /* vector sources: sci1_rxi */ push_registers(R0, R1); /* BB67; STM.W {R0,R1}, @-SP; cycles=12 */ - SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ - R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR; cycles=6 */ + SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */ + R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; read SCI1 received byte from RDR; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 RX ISR reads a byte from SCI1_RDR; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed ordering even though the manual describes the canonical RDR-read then RDRF-clear sequence; confidence high; candidate/evidence-supported SCI1 6-byte RX frame; capture H'F868-H'F86D, validate H'F860-H'F865, checksum H'F865 seeded by H'005A; evidence: SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into the same RXI byte-capture path; confidence high; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR; cycles=6 */ set_flags_tst8(MEM8[0xF9C1]); /* BB71; TST.B @H'F9C1; refs ram_F9C1; cycles=6 */ if (!Z) goto loc_BB7D; /* BB75; BNE loc_BB7D; cycles=3/8 nt/t */ MEM8[0xF9C3] = 0; /* BB77; CLR.B @H'F9C3; refs ram_F9C3; cycles=8 */ diff --git a/build/rom_serial_pseudocode.c b/build/rom_serial_pseudocode.c index 85ffa8b..7ee574a 100644 --- a/build/rom_serial_pseudocode.c +++ b/build/rom_serial_pseudocode.c @@ -55,6 +55,12 @@ * - Manual/0900766b802125d0.md:10631 SYSCR2.P9SCI2E controls the SCI2 functions of P92-P94 */ +/* SCI1 link layer: + * - 8E1 SCI characters carry the 6 protocol bytes; async 8-bit even parity 1 stop, clock internal, SMR=H'24, BRR=H'07, SCR=H'3C + * - baud is clock-dependent; pass --clock-hz on the decompiler for bps. + * - No SCI1 RXI/TXI DTC vector entries are present in JSON; RX/TX are modeled as CPU ISR paths. + */ + #include #include @@ -88,6 +94,8 @@ extern volatile u8 MEM8[0x10000]; #define RX_INDEX MEM8[0xF9C3u] #define RX_INTERBYTE_TIMEOUT MEM8[0xF9C1u] #define RX_COMPLETE_TIMER MEM8[0xF9C5u] +#define RX_ERROR_LATCH MEM8[0xFAA4u] +#define RX_ERROR_LATCH_PHYSICAL_ERROR 0x80u /* Candidate Protocol Semantics * confidence: medium-high (0.9) @@ -110,6 +118,72 @@ extern volatile u8 MEM8[0x10000]; * - H'05 ack_or_clear_pending: candidate pending/event acknowledgement path; handler H'BD80; responses none * - H'06 set_secondary_value: candidate secondary-table value write path; handler H'BDDB; responses none * - H'07 retransmit_or_error_reply: candidate retransmit/NAK-style path; error handling also builds command 0x07 responses; handler H'BE05; responses response_at_BE22 + * command effects: + * - H'00 set_value_acked: Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response. + * effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000 + * effect: table_write_candidate; target current_value_table_candidate; source same candidate value written to the primary table; table H'E800 + * effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00 + * evidence: H'BC08, H'BC0C, H'BC20, H'BC22, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCB5, H'BCBD, H'BCC5, H'BCCD + * - H'01 read_value: Candidate read: reads the primary table and stages a value response. + * effect: table_read_candidate; target primary_value_table_candidate; table H'E000 + * effect: response_staging_candidate; stage F850-F854 and call loc_BA26 + * evidence: H'BC08, H'BC0C, H'BC24, H'BC26, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCD7, H'BCE0, H'BCE8, H'BCF0, H'BCF6, H'BCB5, H'BCBD, H'BCC5, H'BCDC, H'BCE4, H'BCFA + * - H'02 clear_or_abort: Candidate clear/abort: clears serial session state without an observed immediate response. + * effect: state_clear_candidate; target serial_session_flags_candidate; clear bit 7; state H'FAA2 + * evidence: H'BC08, H'BC0C, H'BC29, H'BC2B + * - H'04 set_value_no_immediate_reply: Candidate deferred set: writes value bytes and flags the index without an observed immediate response. + * effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000 + * effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00 + * evidence: H'BC08, H'BC0C, H'BC45, H'BC47 + * - H'05 ack_or_clear_pending: Candidate acknowledgement/clear: updates pending/event state without an observed immediate response. + * effect: pending_acknowledgement_candidate; target selected event/pending state; clear selected pending flags and then clear serial session state + * evidence: H'BC08, H'BC0C, H'BC4A, H'BC4C + * - H'06 set_secondary_value: Candidate secondary set: writes value bytes to the secondary table and flags the index. + * effect: table_write_candidate; target secondary_value_table_candidate; source RX[3:4] value bytes; table H'E400 + * effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 6; table H'EC00 + * evidence: H'BC08, H'BC0C, H'BC4F, H'BC51 + * - H'07 retransmit_or_error_reply: Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response. + * effect: retransmit_candidate; target TX staging bytes H'F850-H'F854 before loc_BA26; source previous TX frame bytes H'F858-H'F85C + * effect: response_staging_candidate; stage F850-F854 and call loc_BA26 + * evidence: H'BC08, H'BC0C, H'BC2E, H'BC30, H'BC54, H'BC56, H'BE09, H'BE11, H'BE19, H'BE22 + * response schemas: + * - response_at_BB43: byte0=computed; byte1=computed; byte2=computed; byte3=current_value_table_candidate; byte4=current_value_table_candidate + * evidence: H'BB1C, H'BB2B, H'BB20, H'BB3F, H'BB39 + * - response_at_BCCD: byte0=0x04; byte1=rx[1]; byte2=rx[2]; byte3=rx[3]; byte4=rx[4] + * evidence: H'BCB0, H'BCB9, H'BCC1, H'BCC9 + * - response_at_BCFA: byte0=0x04; byte1=rx[2]; byte2=rx[2]; byte3=primary_value_table_candidate; byte4=primary_value_table_candidate + * evidence: H'BCD7, H'BCE8, H'BCC1, H'BCF6, H'BCF0 + * - response_at_BE22: byte0=tx[0]; byte1=tx[1]; byte2=tx[2]; byte3=tx[3]; byte4=tx[4] + * evidence: H'BE09, H'BE11, H'BE19 + * - ... 1 more candidate response schemas + * table map candidates: + * - primary_value_table_candidate at H'E000 (word_value); observed read, write + * evidence: H'19E3, H'1A03, H'1A3D, H'1A6B, H'3F8C, H'4077, H'BC75, H'BC95, H'BCEC, H'BD1A, H'BD35 + * - secondary_value_table_candidate at H'E400 (word_value); observed read, write + * evidence: H'19AA, H'1A4B, H'1A5B, H'1A81, H'1AB4, H'1AC1, H'407B, H'BDE5 + * - current_value_table_candidate at H'E800 (word_value); observed read, write + * evidence: H'1A09, H'1A71, H'3F90, H'407F, H'BB35, H'BC79, H'BC99, H'BD1E + * - flag_table_candidate at H'EC00 (bit_flags); observed write + * evidence: H'4088, H'BC82, H'BC9D, H'BD22, H'BD39, H'BDE9 + * state variable candidates: + * - event_queue_read_cursor_candidate H'F9B4: reads 1, writes 2; bits 5 + * evidence: H'BE78, H'BE95, H'BE99 + * - event_queue_write_or_pending_cursor_candidate H'F9B5: reads 1, writes 6; bits 7 + * evidence: H'BAF2, H'BD6D, H'BD71, H'BDC8, H'BDCC, H'BDF3, H'BDF7 + * - event_queue_base_or_current_slot_candidate H'F9B9: reads 1, writes 0 + * evidence: H'BE70 + * - serial_tx_busy_timer_candidate H'F9C0: reads 2, writes 8 + * evidence: H'BA26, H'BA2C, H'BAA2, H'BADA, H'BAE1, H'BAE8, H'BE1D, H'BE3E, H'BEEE, H'BEF4 + * - serial_session_flags_candidate H'FAA2: reads 5, writes 13; bits 3, 7 + * evidence: H'BA84, H'BA96, H'BB00, H'BC0F, H'BC15, H'BC33, H'BC5C, H'BCD0, H'BCFD, H'BD04, H'BD67, H'BD79, H'BDC2, H'BDD4, H'BDED, H'BDFF, H'BE47, H'BEAF + * - serial_pending_mask_candidate H'FAA3: reads 1, writes 9; bits 7 + * evidence: H'BA9A, H'BB51, H'BC63, H'BD75, H'BDD0, H'BDFB, H'BE43, H'BEA5, H'BEA9, H'BECB + * - ... 3 more state-variable candidates + * retry/error model candidate: + * - checksum path: 0x5A-seeded XOR over RX[0..4] differs from RX[5] -> loc_BE29 + * - retry path: counter H'FAA6, threshold 2; Candidate retry path clears/consults serial flags, increments FAA6, compares it with 2, and when still below the apparent limit stages a command 0x07 response. + * - command 0x07 path: Candidate retransmit/explicit command 0x07 path either copies previous TX frame bytes back to F850-F854 or stages an observed 0x07 response before loc_BA26. + * - evidence: H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC, H'BBF0, H'BE4D, H'BE56, H'BE5E, H'BE66, H'BE52, H'BE5A, H'BE62, H'BE6A, H'BE29, H'BE2D, H'BE33, H'BE37, H'BE43, H'BE47, H'BE05, H'BE0D, H'BE15, H'BE09, H'BE11, H'BE19, H'BE22 */ static u8 sci1_rx_candidate_command(void) @@ -148,42 +222,55 @@ void sci1_process_candidate_protocol_command(void) switch (command) { case 0x00u: /* set_value_acked: candidate write of RX[3:4] into primary/current tables, followed by a response + * candidate effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000 + * candidate effect: table_write_candidate; target current_value_table_candidate; source same candidate value written to the primary table; table H'E800 + * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00 * evidence: H'BC08, H'BC0C, H'BC20, H'BC22, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCB5, H'BCBD, H'BCC5, H'BCCD */ candidate_set_value_acked(logical_index, value); break; case 0x01u: /* read_value: candidate read from the primary table, followed by a response carrying the value + * candidate effect: table_read_candidate; target primary_value_table_candidate; table H'E000 + * candidate effect: response_staging_candidate; stage F850-F854 and call loc_BA26 * evidence: H'BC08, H'BC0C, H'BC24, H'BC26, H'BCB0, H'BCB9, H'BCC1, H'BCC9, H'BCD7, H'BCE0, H'BCE8, H'BCF0, H'BCF6, H'BCB5, H'BCBD, H'BCC5, H'BCDC, H'BCE4, H'BCFA */ candidate_read_value(logical_index, value); break; case 0x02u: /* clear_or_abort: candidate clear/abort path with no immediate response builder + * candidate effect: state_clear_candidate; target serial_session_flags_candidate; clear bit 7; state H'FAA2 * evidence: H'BC08, H'BC0C, H'BC29, H'BC2B */ candidate_clear_or_abort(logical_index, value); break; case 0x04u: /* set_value_no_immediate_reply: candidate write/update path that stores a value without an immediate serial response + * candidate effect: table_write_candidate; target primary_value_table_candidate; source RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero; table H'E000 + * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 7; table H'EC00 * evidence: H'BC08, H'BC0C, H'BC45, H'BC47 */ candidate_set_value_no_immediate_reply(logical_index, value); break; case 0x05u: /* ack_or_clear_pending: candidate pending/event acknowledgement path + * candidate effect: pending_acknowledgement_candidate; target selected event/pending state; clear selected pending flags and then clear serial session state * evidence: H'BC08, H'BC0C, H'BC4A, H'BC4C */ candidate_ack_or_clear_pending(logical_index, value); break; case 0x06u: /* set_secondary_value: candidate secondary-table value write path + * candidate effect: table_write_candidate; target secondary_value_table_candidate; source RX[3:4] value bytes; table H'E400 + * candidate effect: flag_update_candidate; target per_index_flag_table_candidate; set bit 6; table H'EC00 * evidence: H'BC08, H'BC0C, H'BC4F, H'BC51 */ candidate_set_secondary_value(logical_index, value); break; case 0x07u: /* retransmit_or_error_reply: candidate retransmit/NAK-style path; error handling also builds command 0x07 responses + * candidate effect: retransmit_candidate; target TX staging bytes H'F850-H'F854 before loc_BA26; source previous TX frame bytes H'F858-H'F85C + * candidate effect: response_staging_candidate; stage F850-F854 and call loc_BA26 * evidence: H'BC08, H'BC0C, H'BC2E, H'BC30, H'BC54, H'BC56, H'BE09, H'BE11, H'BE19, H'BE22 */ candidate_retransmit_or_error_reply(logical_index, value); @@ -252,15 +339,19 @@ void sci1_txi_candidate_isr(void) * RX reconstruction evidence * candidate/evidence-supported SCI1 6-byte RX frame hypothesis using capture buffer H'F868-H'F86D; checksum byte H'F865 is validated against XOR seeded by H'005A * checksum formula: checksum = 0x5A ^ byte0 ^ byte1 ^ byte2 ^ byte3 ^ byte4 + * RX error handling: SCI1 ERI appears to mark a physical receive error and continue into the RXI byte-capture path; the RXI path clears RDRF before reading RDR in the ROM order. + * RX error caveat: Manual text distinguishes ORER from FER/PER data transfer into RDR and describes the normal RDR-read then RDRF-clear ordering; this output preserves the observed ROM order. * evidence addresses: * - rx_checksum_seed: H'BBD6 * - rx_complete_timer: H'BB9E * - rx_copy_capture_to_frame_buffer: H'BBB3, H'BBBB, H'BBC3, H'BBB7, H'BBBF, H'BBC7 + * - rx_eri_falls_through_to_rxi: H'BB57, H'BB5B, H'BB5F, H'BB63, H'BB69, H'BB6D * - rx_index_increment_store: H'BB94, H'BB96 * - rx_indexed_store: H'BB90 * - rx_isr_compare_frame_length: H'BB9A * - rx_processor_requires_six_bytes: H'BBAB * - rx_rdr_read: H'BB6D + * - rx_rdrf_clear_before_rdr_read: H'BB69, H'BB6D * - rx_xor_checksum_validation: H'BBD6, H'BBD8, H'BBDC, H'BBE0, H'BBE4, H'BBE8, H'BBEC */ static u8 sci1_rx_candidate_checksum(void) @@ -320,6 +411,7 @@ bool sci1_rx_byte_received_candidate_isr(void) void sci1_rx_error_candidate_isr(void) { + RX_ERROR_LATCH |= RX_ERROR_LATCH_PHYSICAL_ERROR; SCI1_SSR &= (u8)~(SCI_SSR_ORER | SCI_SSR_FER | SCI_SSR_PER); - RX_INDEX = 0u; + sci1_rx_byte_received_candidate_isr(); } diff --git a/h8536/serial_pseudocode.py b/h8536/serial_pseudocode.py index af5ed95..0d82439 100644 --- a/h8536/serial_pseudocode.py +++ b/h8536/serial_pseudocode.py @@ -40,6 +40,7 @@ def generate_serial_pseudocode( lines.extend(_board_comment_lines(payload)) if opts.include_manual: lines.extend(_manual_reference_lines(payload)) + lines.extend(_sci_link_lines(payload)) lines.extend(_declarations(tx_candidate, rx_candidate)) if opts.include_semantics: lines.extend(_semantics_lines(serial_semantics, opts)) @@ -196,6 +197,72 @@ def _manual_reference_lines(payload: JsonObject) -> list[str]: return lines +def _sci_link_lines(payload: JsonObject) -> list[str]: + config = _first_sci1_configuration(payload) + dtc_note = _dtc_sci_note(payload) + if not config and not dtc_note: + return [] + + lines = ["/* SCI1 link layer:"] + if config: + mode_summary = str(config.get("mode_summary") or config.get("mode") or "SCI mode") + char_format = "8E1" if "8-bit even parity 1 stop" in mode_summary else mode_summary + smr = config.get("smr_hex") or _optional_hex(config.get("smr"), width=2) + brr = config.get("brr_hex") or _optional_hex(config.get("brr"), width=2) + scr = config.get("scr_hex") or _optional_hex(config.get("scr"), width=2) + clock_source = config.get("clock_source") or "clock source unknown" + lines.append( + " * - " + + _comment_text( + f"{char_format} SCI characters carry the 6 protocol bytes; " + f"{mode_summary}, clock {clock_source}, SMR={smr}, BRR={brr}, SCR={scr}", + ), + ) + baud = config.get("baud_bps") + if isinstance(baud, (int, float)): + lines.append(f" * - candidate baud: {_comment_text(str(baud))} bps") + else: + lines.append(" * - baud is clock-dependent; pass --clock-hz on the decompiler for bps.") + if dtc_note: + lines.append(f" * - {_comment_text(dtc_note)}") + lines.append(" */") + lines.append("") + return lines + + +def _first_sci1_configuration(payload: JsonObject) -> JsonObject | None: + sci = payload.get("sci") + if not isinstance(sci, dict): + return None + channels = sci.get("channels") + if not isinstance(channels, dict): + return None + sci1 = channels.get("SCI1") + if not isinstance(sci1, dict): + return None + configurations = sci1.get("configurations") + if not isinstance(configurations, list): + return None + for item in configurations: + if isinstance(item, dict): + return item + return None + + +def _dtc_sci_note(payload: JsonObject) -> str: + vectors = payload.get("dtc_vectors") + if not isinstance(vectors, list): + return "" + sources = { + str(item.get("source", "")).lower() + for item in vectors + if isinstance(item, dict) + } + if "sci1_rxi" in sources or "sci1_txi" in sources: + return "SCI1 DTC vector entries are present; review DTC metadata before treating RX/TX as CPU-only." + return "No SCI1 RXI/TXI DTC vector entries are present in JSON; RX/TX are modeled as CPU ISR paths." + + def _declarations(tx_candidate: JsonObject | None, rx_candidate: JsonObject | None) -> list[str]: candidate = tx_candidate or rx_candidate or {} channel = str(candidate.get("channel") or "SCI1") @@ -250,6 +317,10 @@ def _declarations(tx_candidate: JsonObject | None, rx_candidate: JsonObject | No timeout = _int_field(rx_candidate, "interbyte_timeout_address", 0xF9C1) complete = _int_field(rx_candidate, "complete_timer_address", 0xF9C5) length = _int_field(rx_candidate, "frame_length", 6) + error_handling = rx_candidate.get("rx_error_handling") + error_latch = 0xFAA4 + if isinstance(error_handling, dict): + error_latch = _int_field(error_handling, "error_latch_address", 0xFAA4) lines.extend( [ f"#define RX_FRAME_LENGTH {length}u", @@ -258,6 +329,8 @@ def _declarations(tx_candidate: JsonObject | None, rx_candidate: JsonObject | No f"#define RX_INDEX MEM8[{_c_hex(rx_index)}]", f"#define RX_INTERBYTE_TIMEOUT MEM8[{_c_hex(timeout)}]", f"#define RX_COMPLETE_TIMER MEM8[{_c_hex(complete)}]", + f"#define RX_ERROR_LATCH MEM8[{_c_hex(error_latch)}]", + "#define RX_ERROR_LATCH_PHYSICAL_ERROR 0x80u", "", ], ) @@ -326,6 +399,11 @@ def _semantics_lines( handler = command.get("handler_start_hex") or "multiple" responses = ", ".join(str(item) for item in command.get("response_candidates", [])) or "none" lines.append(f" * - {value} {name}: {summary}; handler {handler}; responses {responses}") + lines.extend(_command_effect_comment_lines(protocol.get("command_effects"), opts, prefix=" * ")) + lines.extend(_response_schema_comment_lines(_schema_list(protocol), opts, prefix=" * ")) + lines.extend(_table_map_comment_lines(_table_map_list(protocol), opts, prefix=" * ")) + lines.extend(_state_variable_comment_lines(protocol.get("state_variable_candidates"), opts, prefix=" * ")) + lines.extend(_retry_error_comment_lines(protocol.get("retry_error_model"), opts, prefix=" * ")) lines.append(" */") lines.append("") @@ -376,6 +454,8 @@ def _semantics_lines( evidence = _hex_join(command.get("evidence_addresses_hex")) lines.append(f" case 0x{value:02X}u:") lines.append(f" /* {name}: {summary}") + for effect_line in _command_effect_switch_lines(command): + lines.append(f" * {effect_line}") if opts.include_evidence and evidence: lines.append(f" * evidence: {evidence}") lines.append(" */") @@ -394,6 +474,203 @@ def _semantics_lines( return lines +def _command_effect_comment_lines( + value: object, + opts: SerialPseudocodeOptions, + *, + prefix: str, +) -> list[str]: + effects = [item for item in _object_list(value) if item.get("effects") or item.get("summary")] + if not effects: + return [] + lines = [f"{prefix}command effects:"] + for item in effects: + command = item.get("command_value_hex") or _command_hex(item.get("command_value")) + name = item.get("name_candidate") or "unknown_command" + summary = _comment_text(str(item.get("summary") or "candidate effects")) + lines.append(f"{prefix}- {command} {name}: {summary}") + for effect in _object_list(item.get("effects"))[:3]: + effect_text = _effect_summary(effect) + if effect_text: + lines.append(f"{prefix} effect: {effect_text}") + evidence = _hex_join(item.get("evidence_addresses_hex")) + if opts.include_evidence and evidence: + lines.append(f"{prefix} evidence: {evidence}") + return lines + + +def _response_schema_comment_lines( + schemas: list[JsonObject], + opts: SerialPseudocodeOptions, + *, + prefix: str, +) -> list[str]: + if not schemas: + return [] + lines = [f"{prefix}response schemas:"] + for schema in schemas[:4]: + response_id = schema.get("response_id") or schema.get("call_address_hex") or "candidate_response" + byte_text = _response_schema_summary(schema) + lines.append(f"{prefix}- {response_id}: {byte_text}") + evidence = _hex_join(schema.get("evidence_addresses_hex")) + if opts.include_evidence and evidence: + lines.append(f"{prefix} evidence: {evidence}") + if len(schemas) > 4: + lines.append(f"{prefix}- ... {len(schemas) - 4} more candidate response schemas") + return lines + + +def _table_map_comment_lines( + tables: list[JsonObject], + opts: SerialPseudocodeOptions, + *, + prefix: str, +) -> list[str]: + if not tables: + return [] + lines = [f"{prefix}table map candidates:"] + for table in tables[:6]: + name = table.get("name_candidate") or "unnamed_table_candidate" + address = table.get("logical_base_address_hex") or table.get("address_hex") or "?" + element = table.get("element_candidate") + accesses = ", ".join(str(item) for item in table.get("observed_accesses", []) if item) or "access?" + detail = f"{name} at {address}" + if element: + detail += f" ({element})" + lines.append(f"{prefix}- {_comment_text(detail)}; observed {accesses}") + evidence = _hex_join(table.get("evidence_addresses_hex")) + if opts.include_evidence and evidence: + lines.append(f"{prefix} evidence: {evidence}") + if len(tables) > 6: + lines.append(f"{prefix}- ... {len(tables) - 6} more table candidates") + return lines + + +def _state_variable_comment_lines( + value: object, + opts: SerialPseudocodeOptions, + *, + prefix: str, +) -> list[str]: + states = sorted( + _object_list(value), + key=lambda item: item.get("address") if isinstance(item.get("address"), int) else 0x10000, + ) + if not states: + return [] + lines = [f"{prefix}state variable candidates:"] + for state in states[:6]: + name = state.get("name_candidate") or "unnamed_state_candidate" + address = state.get("address_hex") or _command_hex(state.get("address")) + reads = state.get("read_count", "?") + writes = state.get("write_count", "?") + bits = ", ".join(str(item) for item in state.get("bit_candidates", [])) + suffix = f"; bits {bits}" if bits else "" + lines.append(f"{prefix}- {_comment_text(str(name))} {address}: reads {reads}, writes {writes}{suffix}") + evidence = _hex_join(state.get("evidence_addresses_hex")) + if opts.include_evidence and evidence: + lines.append(f"{prefix} evidence: {evidence}") + if len(states) > 6: + lines.append(f"{prefix}- ... {len(states) - 6} more state-variable candidates") + return lines + + +def _retry_error_comment_lines( + value: object, + opts: SerialPseudocodeOptions, + *, + prefix: str, +) -> list[str]: + if not isinstance(value, dict): + return [] + checksum = value.get("checksum_failure_path") + retry = value.get("retry_path") + command_07 = value.get("command_0x07_path") + lines = [f"{prefix}retry/error model candidate:"] + if isinstance(checksum, dict): + condition = _comment_text(str(checksum.get("condition_candidate") or "checksum failure")) + target = checksum.get("error_target") or checksum.get("error_target_address_hex") or "error target" + lines.append(f"{prefix}- checksum path: {condition} -> {target}") + if isinstance(retry, dict): + counter = retry.get("counter_address_hex") or "counter?" + threshold = retry.get("threshold_candidate", "?") + summary = _comment_text(str(retry.get("summary") or "candidate retry path")) + lines.append(f"{prefix}- retry path: counter {counter}, threshold {threshold}; {summary}") + if isinstance(command_07, dict): + summary = _comment_text(str(command_07.get("summary") or "candidate command 0x07 path")) + lines.append(f"{prefix}- command 0x07 path: {summary}") + evidence = _hex_join(value.get("evidence_addresses_hex")) + if opts.include_evidence and evidence: + lines.append(f"{prefix}- evidence: {evidence}") + return lines + + +def _command_effect_switch_lines(command: JsonObject) -> list[str]: + effects = _object_list(command.get("effects"))[:3] + lines = [] + for effect in effects: + text = _effect_summary(effect) + if text: + lines.append(f"candidate effect: {text}") + return lines + + +def _effect_summary(effect: JsonObject) -> str: + kind = str(effect.get("kind") or "effect_candidate") + parts = [kind] + target = effect.get("target_candidate") or effect.get("destination_candidate") + source = effect.get("source_candidate") + operation = effect.get("operation_candidate") + table = effect.get("table_base_hex") + state = effect.get("state_address_hex") + if target: + parts.append(f"target {target}") + if source: + parts.append(f"source {source}") + if operation: + parts.append(str(operation)) + if table: + parts.append(f"table {table}") + if state: + parts.append(f"state {state}") + return _comment_text("; ".join(parts)) + + +def _schema_list(protocol: JsonObject) -> list[JsonObject]: + schemas = _object_list(protocol.get("response_schemas")) + if schemas: + return schemas + return _object_list(protocol.get("response_schema")) + + +def _table_map_list(protocol: JsonObject) -> list[JsonObject]: + tables = _object_list(protocol.get("logical_table_map_candidates")) + if tables: + return tables + return _object_list(protocol.get("table_map_candidates")) + + +def _response_schema_summary(schema: JsonObject) -> str: + parts = [] + for item in _object_list(schema.get("bytes")): + label = item.get("byte") or f"byte{item.get('offset', '?')}" + source = item.get("source_expression") or item.get("source_kind") or "unknown" + parts.append(f"{label}={source}") + return _comment_text("; ".join(parts) if parts else "candidate byte sources unknown") + + +def _object_list(value: object) -> list[JsonObject]: + if not isinstance(value, list): + return [] + return [item for item in value if isinstance(item, dict)] + + +def _command_hex(value: object) -> str: + if isinstance(value, int): + return f"0x{value:02X}" + return "?" + + def _tx_functions(candidate: JsonObject, opts: SerialPseudocodeOptions) -> list[str]: length = _int_field(candidate, "frame_length", 6) seed = _int_field(candidate, "checksum_seed", 0x5A) @@ -511,8 +788,9 @@ def _rx_functions(candidate: JsonObject, opts: SerialPseudocodeOptions) -> list[ "", "void sci1_rx_error_candidate_isr(void)", "{", + " RX_ERROR_LATCH |= RX_ERROR_LATCH_PHYSICAL_ERROR;", " SCI1_SSR &= (u8)~(SCI_SSR_ORER | SCI_SSR_FER | SCI_SSR_PER);", - " RX_INDEX = 0u;", + " sci1_rx_byte_received_candidate_isr();", "}", "", ], @@ -532,6 +810,14 @@ def _candidate_comment_block( formula = str(candidate.get("checksum_formula") or "").strip() if formula: lines.append(f" * checksum formula: {_comment_text(formula)}") + error_handling = candidate.get("rx_error_handling") + if isinstance(error_handling, dict): + summary = str(error_handling.get("summary") or "").strip() + if summary: + lines.append(f" * RX error handling: {_comment_text(summary)}") + caveat = str(error_handling.get("manual_caveat") or "").strip() + if caveat: + lines.append(f" * RX error caveat: {_comment_text(caveat)}") if opts.include_evidence: evidence = candidate.get("evidence_addresses_hex") if isinstance(evidence, dict): @@ -596,6 +882,12 @@ def _c_hex(value: int, *, width: int = 4) -> str: return f"0x{value & 0xFFFF:0{width}X}u" +def _optional_hex(value: object, *, width: int = 4) -> str: + if isinstance(value, int): + return f"H'{value & 0xFFFF:0{width}X}" + return "unknown" + + def _h(value: int) -> str: return f"H'{value & 0xFFFF:04X}" diff --git a/h8536/serial_reconstruction.py b/h8536/serial_reconstruction.py index aa087dc..43d823c 100644 --- a/h8536/serial_reconstruction.py +++ b/h8536/serial_reconstruction.py @@ -7,6 +7,7 @@ from .model import Instruction SCI1_TDR_ADDRESS = 0xFEDB +SCI1_SSR_ADDRESS = 0xFEDC SCI1_RDR_ADDRESS = 0xFEDD TX_BUFFER_START = 0xF858 TX_CHECKSUM_ADDRESS = 0xF85D @@ -24,6 +25,7 @@ RX_INDEX_ADDRESS = 0xF9C3 RX_INTERBYTE_TIMEOUT_ADDRESS = 0xF9C1 RX_COMPLETE_TIMER_ADDRESS = 0xF9C5 RX_FRAME_LENGTH = 6 +RX_ERROR_LATCH_ADDRESS = 0xFAA4 _BUFFER_DATA_END = TX_CHECKSUM_ADDRESS - 1 _MIN_BUFFER_REFERENCES = 3 @@ -265,6 +267,41 @@ def _collect_rx_evidence(ordered: list[Instruction]) -> list[dict[str, object]]: ), ) + rdrf_before_rdr = _rx_rdrf_clear_before_rdr_read(ordered) + if rdrf_before_rdr: + evidence.append( + _evidence( + "rx_rdrf_clear_before_rdr_read", + rdrf_before_rdr, + summary=( + "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR; preserve this observed " + "ordering even though the manual describes the canonical RDR-read then " + "RDRF-clear sequence" + ), + manual_references=[ + "Manual/0900766b802125d0.md:16652 RDRF clear sequence reads RDR before clearing RDRF", + "Manual/0900766b802125d0.md:16926 canonical receive flag clear sequence", + ], + ), + ) + + eri_fallthrough = _rx_eri_fallthrough_sequence(ordered) + if eri_fallthrough: + evidence.append( + _evidence( + "rx_eri_falls_through_to_rxi", + eri_fallthrough, + summary=( + "SCI1 ERI latches FAA4.bit7, clears ORER/FER/PER, then falls through into " + "the same RXI byte-capture path" + ), + manual_references=[ + "Manual/0900766b802125d0.md:16703 FER/PER transfer errored data to RDR; ORER does not", + "Manual/0900766b802125d0.md:16936 ERI is requested on ORER, FER, or PER", + ], + ), + ) + indexed_stores = [ins for ins in ordered if _is_indexed_capture_store(ins)] if indexed_stores: evidence.append( @@ -435,6 +472,17 @@ def _rx_candidate_from_evidence(evidence: list[dict[str, object]]) -> dict[str, key: list(evidence_by_key[key]["addresses"]) for key in _RX_REQUIRED_EVIDENCE } + optional_evidence_keys = [ + key + for key in ( + "rx_rdrf_clear_before_rdr_read", + "rx_eri_falls_through_to_rxi", + ) + if key in evidence_by_key + ] + for key in optional_evidence_keys: + evidence_addresses[key] = list(evidence_by_key[key]["addresses"]) + return { "id": "sci1_rx_frame_f868_len6_candidate", "kind": "candidate_sci1_rx_frame", @@ -469,13 +517,18 @@ def _rx_candidate_from_evidence(evidence: list[dict[str, object]]) -> dict[str, "caveat": "candidate frame means six consecutive bytes within the observed RX timing/state machine, not a proven delimited packet", "required_evidence_count": len(_RX_REQUIRED_EVIDENCE), "observed_evidence_count": len(_RX_REQUIRED_EVIDENCE), + "optional_evidence_count": len(optional_evidence_keys), "missing_evidence": [], "evidence_addresses": evidence_addresses, "evidence_addresses_hex": { key: [h16(address) for address in addresses] for key, addresses in evidence_addresses.items() }, - "evidence": [evidence_by_key[key] for key in _RX_REQUIRED_EVIDENCE], + "evidence": [ + evidence_by_key[key] + for key in [*_RX_REQUIRED_EVIDENCE, *optional_evidence_keys] + ], + "rx_error_handling": _rx_error_handling_candidate(evidence_by_key), "short_comment": ( f"candidate/evidence-supported SCI1 {RX_FRAME_LENGTH}-byte RX frame; " f"capture {h16(RX_CAPTURE_START)}-{h16(RX_CAPTURE_END)}, validate " @@ -708,6 +761,100 @@ def _rx_xor_checksum_validation(ordered: list[Instruction]) -> list[Instruction] return [] +def _rx_rdrf_clear_before_rdr_read(ordered: list[Instruction]) -> list[Instruction]: + for index, ins in enumerate(ordered): + if not _is_bclr_bit(ins, SCI1_SSR_ADDRESS, 6): + continue + window = ordered[index + 1:index + 5] + for candidate in window: + if _mnemonic_root(candidate.mnemonic) in {"RTE", "RTS"}: + break + if _is_read_from_address(candidate, SCI1_RDR_ADDRESS): + return [ins, candidate] + return [] + + +def _rx_eri_fallthrough_sequence(ordered: list[Instruction]) -> list[Instruction]: + for index, ins in enumerate(ordered): + if not _is_bset_bit(ins, RX_ERROR_LATCH_ADDRESS, 7): + continue + window = ordered[index:index + 18] + if any(_mnemonic_root(candidate.mnemonic) in {"RTE", "RTS"} for candidate in window[:6]): + continue + error_clears: list[Instruction] = [] + for bit in (5, 4, 3): + clear = next( + ( + candidate for candidate in window + if _is_bclr_bit(candidate, SCI1_SSR_ADDRESS, bit) + ), + None, + ) + if clear is not None: + error_clears.append(clear) + if len(error_clears) != 3: + continue + after_error = [ + candidate for candidate in window + if candidate.address > max(clear.address for clear in error_clears) + ] + byte_path = _rx_rdrf_clear_before_rdr_read(after_error) + if byte_path: + return _dedupe_instructions([ins, *error_clears, *byte_path]) + return [] + + +def _rx_error_handling_candidate(evidence_by_key: Mapping[str, dict[str, object]]) -> dict[str, object] | None: + fallthrough = evidence_by_key.get("rx_eri_falls_through_to_rxi") + clear_order = evidence_by_key.get("rx_rdrf_clear_before_rdr_read") + if fallthrough is None and clear_order is None: + return None + evidence_items = [ + item for item in (fallthrough, clear_order) if isinstance(item, Mapping) + ] + evidence_addresses = _dedupe_ints( + int(address) + for item in evidence_items + for address in item.get("addresses", []) + if isinstance(address, int) + ) + return { + "kind": "sci1_rx_error_handling_candidate", + "error_latch_address": RX_ERROR_LATCH_ADDRESS, + "error_latch_address_hex": h16(RX_ERROR_LATCH_ADDRESS), + "error_latch_bit": 7, + "fallthrough_to_rx_byte_path": fallthrough is not None, + "rdrf_clear_before_rdr_read": clear_order is not None, + "summary": ( + "SCI1 ERI appears to mark a physical receive error and continue into the RXI " + "byte-capture path; the RXI path clears RDRF before reading RDR in the ROM order." + ), + "manual_caveat": ( + "Manual text distinguishes ORER from FER/PER data transfer into RDR and describes " + "the normal RDR-read then RDRF-clear ordering; this output preserves the observed ROM order." + ), + "evidence_addresses": evidence_addresses, + "evidence_addresses_hex": [h16(address) for address in evidence_addresses], + "confidence": "candidate-medium" if fallthrough else "candidate-low", + } + + +def _is_bclr_bit(ins: Instruction, address: int, bit: int) -> bool: + return ( + _mnemonic_root(ins.mnemonic) == "BCLR" + and _is_write_to_address(ins, address) + and _immediate_source_value(ins.operands) == bit + ) + + +def _is_bset_bit(ins: Instruction, address: int, bit: int) -> bool: + return ( + _mnemonic_root(ins.mnemonic) == "BSET" + and _is_write_to_address(ins, address) + and _immediate_source_value(ins.operands) == bit + ) + + def _is_read_from_address(ins: Instruction, address: int) -> bool: source, destination = _source_destination_operands(ins.operands) if _operand_mentions_address(source, address): @@ -792,6 +939,17 @@ def _dedupe_instructions(instructions: list[Instruction]) -> list[Instruction]: return output +def _dedupe_ints(values: Iterable[int]) -> list[int]: + output: list[int] = [] + seen: set[int] = set() + for value in values: + if value in seen: + continue + seen.add(value) + output.append(value) + return output + + def _instruction_sequence( instructions: Mapping[int, Instruction] | Iterable[Instruction], ) -> list[Instruction]: @@ -837,9 +995,12 @@ def _operand_mentions_address(operand: str, address: int) -> bool: operand_upper = operand.upper().replace(" ", "") names = { SCI1_TDR_ADDRESS: ("SCI1_TDR",), + SCI1_SSR_ADDRESS: ("SCI1_SSR",), + SCI1_RDR_ADDRESS: ("SCI1_RDR",), TX_BUFFER_START: ("TX_BUFFER",), TX_CHECKSUM_ADDRESS: ("TX_CHECKSUM",), TX_INDEX_ADDRESS: ("TX_INDEX",), + RX_ERROR_LATCH_ADDRESS: ("RX_ERROR_LATCH",), } if any(name in operand_upper for name in names.get(address, ())): return True diff --git a/h8536/serial_semantics.py b/h8536/serial_semantics.py index 0a8c168..95e94b3 100644 --- a/h8536/serial_semantics.py +++ b/h8536/serial_semantics.py @@ -1,5 +1,6 @@ from __future__ import annotations +import re from collections.abc import Iterable, Mapping from typing import Any @@ -23,6 +24,57 @@ SEND_BUILDER_LABEL = "loc_BA26" INDEX_DECODER_ADDRESS = 0x622B INDEX_DECODER_LABEL = "loc_622B" CHECKSUM_SEED = 0x5A +SERIAL_HANDLER_START = 0xBA26 +SERIAL_HANDLER_END = 0xBEFF + +LOGICAL_TABLES = { + 0x2000: { + "logical_base_address": 0xE000, + "name_candidate": "primary_value_table_candidate", + "element_candidate": "word_value", + }, + 0x1C00: { + "logical_base_address": 0xE400, + "name_candidate": "secondary_value_table_candidate", + "element_candidate": "word_value", + }, + 0x1800: { + "logical_base_address": 0xE800, + "name_candidate": "current_value_table_candidate", + "element_candidate": "word_value", + }, + 0x1400: { + "logical_base_address": 0xEC00, + "name_candidate": "flag_table_candidate", + "element_candidate": "bit_flags", + }, +} + +DIRECT_TABLE_CANDIDATES = { + 0xF900: "primary_value_table_candidate", + 0xF920: "current_value_table_candidate", + 0xF940: "secondary_value_table_candidate", + 0xF980: "flag_table_candidate", +} + +DIRECT_TABLE_TO_LOGICAL_OFFSET = { + 0xF900: 0x2000, + 0xF920: 0x1800, + 0xF940: 0x1C00, + 0xF980: 0x1400, +} + +STATE_VARIABLES = { + 0xFAA2: "serial_session_flags_candidate", + 0xFAA3: "serial_pending_mask_candidate", + 0xFAA4: "serial_rx_error_or_retry_gate_candidate", + 0xFAA5: "serial_retry_enable_or_mode_flags_candidate", + 0xFAA6: "serial_retry_counter_candidate", + 0xF9B4: "event_queue_read_cursor_candidate", + 0xF9B5: "event_queue_write_or_pending_cursor_candidate", + 0xF9B9: "event_queue_base_or_current_slot_candidate", + 0xF9C0: "serial_tx_busy_timer_candidate", +} def analyze_serial_semantics(payload: Mapping[str, Any]) -> JsonObject: @@ -40,7 +92,14 @@ def analyze_serial_semantics(payload: Mapping[str, Any]) -> JsonObject: "fields": [], "command_dispatch": None, "commands": [], + "command_effects": [], "response_candidates": [], + "response_schemas": [], + "response_schema": [], + "logical_table_map_candidates": [], + "table_map_candidates": [], + "state_variable_candidates": [], + "retry_error_model": None, "confidence": "low", "confidence_score": 0.0, "caveat": "No protocol semantics are emitted without both RX and TX serial reconstruction candidates.", @@ -51,6 +110,9 @@ def analyze_serial_semantics(payload: Mapping[str, Any]) -> JsonObject: commands = _command_candidates(ordered, dispatch, responses) fields = _field_candidates(ordered, dispatch, responses) send_builder = _send_builder_candidate(ordered, responses, tx_candidate) + logical_tables = _logical_table_map_candidates(ordered) + state_variables = _state_variable_candidates(ordered) + retry_error_model = _retry_error_model(ordered, responses) evidence = _top_level_evidence(ordered, dispatch, responses, rx_candidate, tx_candidate) confidence_score = _confidence_score(frame_supported, dispatch, responses, commands) @@ -90,11 +152,18 @@ def analyze_serial_semantics(payload: Mapping[str, Any]) -> JsonObject: "fields": fields, "command_dispatch": dispatch, "commands": commands, + "command_effects": _command_effect_aliases(commands), "index_decoder": _index_decoder_candidate(ordered), + "logical_table_map_candidates": logical_tables, + "table_map_candidates": logical_tables, + "state_variable_candidates": state_variables, "send_builder": send_builder, "response_candidates": responses, + "response_schemas": _response_schemas(responses), + "response_schema": _response_schemas(responses), "rx_fields": _rx_field_candidates(ordered, dispatch), "response_builders": _response_builder_aliases(responses), + "retry_error_model": retry_error_model, "evidence": evidence, } return { @@ -103,8 +172,15 @@ def analyze_serial_semantics(payload: Mapping[str, Any]) -> JsonObject: "fields": protocol["fields"], "command_dispatch": protocol["command_dispatch"], "commands": protocol["commands"], + "command_effects": protocol["command_effects"], "response_candidates": protocol["response_candidates"], + "response_schemas": protocol["response_schemas"], + "response_schema": protocol["response_schema"], "send_builder": protocol["send_builder"], + "logical_table_map_candidates": protocol["logical_table_map_candidates"], + "table_map_candidates": protocol["table_map_candidates"], + "state_variable_candidates": protocol["state_variable_candidates"], + "retry_error_model": protocol["retry_error_model"], "confidence": protocol["confidence"], "confidence_score": protocol["confidence_score"], "caveat": protocol["caveat"], @@ -327,8 +403,6 @@ def _dispatch_comparisons( for index in range(start_index, min(len(ordered) - 1, start_index + 96)): ins = ordered[index] address = int(ins.get("address", -1)) - if address >= 0xBE70: - break if _mnemonic_root(str(ins.get("mnemonic", ""))) not in {"CMP", "CMP:E", "CMP:G", "CMP:I"}: continue if _destination_operand(str(ins.get("operands", ""))).upper() != selector_reg.upper(): @@ -441,6 +515,16 @@ def _command_candidates( for response in responses if _response_in_ranges(response, ranges_for_command) ] + command["effects"] = _command_effects( + int(command["command_value"]), + ordered, + ranges_for_command, + command["response_candidates"], + ) + command["effect_summary"] = _command_effect_summary( + int(command["command_value"]), + command["effects"], + ) response_evidence = [ addr for response in responses @@ -530,6 +614,203 @@ def _command_summary(value: int) -> str: }.get(value, "candidate command semantics are unknown") +def _command_effect_summary(value: int, effects: list[JsonObject]) -> str: + if not effects: + return "No structured command effects were inferred." + return { + 0x00: "Candidate acknowledged set: writes value bytes to primary/current tables, flags the index, and stages an echo-style response.", + 0x01: "Candidate read: reads the primary table and stages a value response.", + 0x02: "Candidate clear/abort: clears serial session state without an observed immediate response.", + 0x04: "Candidate deferred set: writes value bytes and flags the index without an observed immediate response.", + 0x05: "Candidate acknowledgement/clear: updates pending/event state without an observed immediate response.", + 0x06: "Candidate secondary set: writes value bytes to the secondary table and flags the index.", + 0x07: "Candidate retransmit/error reply: reuses prior TX bytes or builds an explicit 0x07 retry/error response.", + }.get(value, "Candidate effects are inferred from handler-local writes, reads, calls, and response staging.") + + +def _command_effects( + value: int, + ordered: list[JsonObject], + ranges: list[tuple[int, int]], + response_ids: list[str], +) -> list[JsonObject]: + effects: list[JsonObject] = [] + + def add(effect: JsonObject) -> None: + effect.setdefault("confidence", "candidate-medium") + effect.setdefault( + "caveat", + "Effect is inferred from local data movement and remains a protocol candidate.", + ) + evidence = _dedupe_ints( + addr for addr in effect.get("evidence_addresses", []) if isinstance(addr, int) + ) + effect["evidence_addresses"] = evidence + effect["evidence_addresses_hex"] = _hlist(evidence) + effects.append(effect) + + table_accesses = _table_accesses_in_ranges(ordered, ranges) + state_accesses = _state_accesses_in_ranges(ordered, ranges) + + if value == 0x00: + add( + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 0xE000, + "table_base_hex": _h16(0xE000), + "evidence_addresses": _table_access_addresses(table_accesses, 0x2000, "write"), + } + ) + add( + { + "kind": "table_write_candidate", + "target_candidate": "current_value_table_candidate", + "source_candidate": "same candidate value written to the primary table", + "table_base": 0xE800, + "table_base_hex": _h16(0xE800), + "evidence_addresses": _table_access_addresses(table_accesses, 0x1800, "write"), + } + ) + add( + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 0xEC00, + "table_base_hex": _h16(0xEC00), + "evidence_addresses": _table_access_addresses(table_accesses, 0x1400, "write"), + } + ) + elif value == 0x01: + add( + { + "kind": "table_read_candidate", + "target_candidate": "primary_value_table_candidate", + "destination_candidate": "response value bytes", + "table_base": 0xE000, + "table_base_hex": _h16(0xE000), + "evidence_addresses": _table_access_addresses(table_accesses, 0x2000, "read"), + } + ) + elif value == 0x02: + add( + { + "kind": "state_clear_candidate", + "target_candidate": STATE_VARIABLES[0xFAA2], + "state_address": 0xFAA2, + "state_address_hex": _h16(0xFAA2), + "operation_candidate": "clear bit 7", + "evidence_addresses": _state_access_addresses(state_accesses, 0xFAA2), + } + ) + elif value == 0x04: + add( + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes, with an observed 0x80 fallback when decoded index is zero", + "table_base": 0xE000, + "table_base_hex": _h16(0xE000), + "evidence_addresses": _table_access_addresses(table_accesses, 0x2000, "write"), + } + ) + add( + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 7", + "table_base": 0xEC00, + "table_base_hex": _h16(0xEC00), + "evidence_addresses": _table_access_addresses(table_accesses, 0x1400, "write"), + } + ) + elif value == 0x05: + add( + { + "kind": "pending_acknowledgement_candidate", + "target_candidate": "selected event/pending state", + "operation_candidate": "clear selected pending flags and then clear serial session state", + "evidence_addresses": _dedupe_ints( + _state_access_addresses(state_accesses, 0xFAA2) + + _state_access_addresses(state_accesses, 0xFAA3) + + _state_access_addresses(state_accesses, 0xF9B5) + ), + } + ) + elif value == 0x06: + add( + { + "kind": "table_write_candidate", + "target_candidate": "secondary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base": 0xE400, + "table_base_hex": _h16(0xE400), + "evidence_addresses": _table_access_addresses(table_accesses, 0x1C00, "write"), + } + ) + add( + { + "kind": "flag_update_candidate", + "target_candidate": "per_index_flag_table_candidate", + "operation_candidate": "set bit 6", + "table_base": 0xEC00, + "table_base_hex": _h16(0xEC00), + "evidence_addresses": _table_access_addresses(table_accesses, 0x1400, "write"), + } + ) + elif value == 0x07: + add( + { + "kind": "retransmit_candidate", + "source_candidate": "previous TX frame bytes H'F858-H'F85C", + "destination_candidate": "TX staging bytes H'F850-H'F854 before loc_BA26", + "response_candidates": [item for item in response_ids if item == "response_at_BE22"], + "evidence_addresses": _addresses_in_ranges(ordered, ranges, 0xBE05, 0xBE22), + } + ) + + if response_ids: + add( + { + "kind": "response_staging_candidate", + "response_candidates": response_ids, + "operation_candidate": "stage F850-F854 and call loc_BA26", + "evidence_addresses": [ + int(response_id.rsplit("_", 1)[1], 16) + for response_id in response_ids + if response_id.startswith("response_at_") + ], + } + ) + + return effects + + +def _command_effect_aliases(commands: list[JsonObject]) -> list[JsonObject]: + aliases: list[JsonObject] = [] + for command in commands: + if not isinstance(command, Mapping): + continue + aliases.append( + { + "kind": "command_effects_candidate", + "command_value": command.get("command_value"), + "command_value_hex": command.get("command_value_hex"), + "name_candidate": command.get("name_candidate"), + "summary": command.get("effect_summary", command.get("summary")), + "effects": command.get("effects", []), + "response_candidates": command.get("response_candidates", []), + "evidence_addresses": command.get("evidence_addresses", []), + "evidence_addresses_hex": command.get("evidence_addresses_hex", []), + "confidence": command.get("confidence", "medium"), + "caveat": command.get("caveat"), + } + ) + return aliases + + def _index_decoder_candidate(ordered: list[JsonObject]) -> JsonObject | None: calls = [ ins for ins in ordered @@ -603,10 +884,183 @@ def _response_candidates(ordered: list[JsonObject]) -> list[JsonObject]: "The analyzer does not prove every byte is meaningful for every path." ), } + response["schema"] = _response_schema(response) + response["byte_schema"] = response["schema"]["bytes"] responses.append(response) return responses +def _response_schema(response: Mapping[str, Any]) -> JsonObject: + writes = [ + write for write in response.get("writes", []) if isinstance(write, Mapping) + ] + bytes_out: list[JsonObject] = [] + for offset, address in enumerate(range(TX_STAGING_START, TX_STAGING_END + 1)): + matching = [ + write for write in writes + if address in [item for item in write.get("addresses", []) if isinstance(item, int)] + ] + if not matching: + bytes_out.append( + { + "offset": offset, + "byte": f"byte{offset}", + "tx_byte": f"TX[{offset}]", + "tx_staging_byte": f"TX[{offset}]", + "address": address, + "address_hex": _h16(address), + "source_kind": "unknown", + "source_expression": "unknown", + "source": {"kind": "unknown"}, + "evidence_addresses": [], + "evidence_addresses_hex": [], + "confidence": "candidate-low", + "caveat": "No write to this staging byte was observed in the response window.", + } + ) + continue + write = matching[-1] + byte_source = _response_byte_source(write, address) + evidence = [int(write["instruction_address"])] if isinstance(write.get("instruction_address"), int) else [] + bytes_out.append( + { + "offset": offset, + "byte": f"byte{offset}", + "tx_byte": f"TX[{offset}]", + "tx_staging_byte": f"TX[{offset}]", + "address": address, + "address_hex": _h16(address), + "source_kind": _schema_source_kind(byte_source), + "source_expression": _source_expression(byte_source), + "source": byte_source, + "write_instruction_address": write.get("instruction_address"), + "write_instruction_address_hex": write.get("instruction_address_hex"), + "instruction": write.get("instruction"), + "evidence_addresses": evidence, + "evidence_addresses_hex": _hlist(evidence), + "confidence": "candidate-medium", + "caveat": ( + "Per-byte source is inferred from the final observed write to this staging " + "byte before loc_BA26." + ), + } + ) + + evidence_addresses = _dedupe_ints( + addr + for item in bytes_out + for addr in item.get("evidence_addresses", []) + if isinstance(addr, int) + ) + return { + "kind": "response_schema_candidate", + "response_id": response.get("id"), + "call_address": response.get("call_address"), + "call_address_hex": response.get("call_address_hex"), + "buffer_start": TX_STAGING_START, + "buffer_start_hex": _h16(TX_STAGING_START), + "buffer_end": TX_STAGING_END, + "buffer_end_hex": _h16(TX_STAGING_END), + "bytes": bytes_out, + "evidence_addresses": evidence_addresses, + "evidence_addresses_hex": _hlist(evidence_addresses), + "confidence": "candidate-medium" if evidence_addresses else "candidate-low", + "caveat": ( + "Response schema is a candidate extracted from writes to F850-F854 in the local " + "window before loc_BA26; control-flow alternatives may share a send call." + ), + } + + +def _response_schemas(responses: list[JsonObject]) -> list[JsonObject]: + return [ + response["schema"] + for response in responses + if isinstance(response.get("schema"), Mapping) + ] + + +def _response_byte_source(write: Mapping[str, Any], address: int) -> JsonObject: + source = write.get("source") + if not isinstance(source, Mapping): + return {"kind": "computed", "operand": write.get("source_operand")} + addresses = [item for item in write.get("addresses", []) if isinstance(item, int)] + byte_index = addresses.index(address) if address in addresses else 0 + kind = str(source.get("kind", "computed")) + + if kind in {"rx_frame_byte", "rx_frame_word"}: + offsets = source.get("rx_offsets") + if isinstance(offsets, list) and byte_index < len(offsets) and isinstance(offsets[byte_index], int): + rx_offset = int(offsets[byte_index]) + else: + rx_offset = int(source.get("rx_offset", 0)) + byte_index + rx_address = RX_FRAME_START + rx_offset + return { + "kind": "rx_frame_byte", + "rx_offset": rx_offset, + "rx_address": rx_address, + "rx_address_hex": _h16(rx_address), + "derived_from": dict(source), + } + + if kind in {"tx_frame_byte", "tx_frame_word"}: + offsets = source.get("tx_offsets") + if isinstance(offsets, list) and byte_index < len(offsets) and isinstance(offsets[byte_index], int): + tx_offset = int(offsets[byte_index]) + else: + tx_offset = int(source.get("tx_offset", 0)) + byte_index + tx_address = TX_FRAME_START + tx_offset + return { + "kind": "tx_frame_byte", + "tx_offset": tx_offset, + "tx_address": tx_address, + "tx_address_hex": _h16(tx_address), + "derived_from": dict(source), + } + + if kind == "table": + output = dict(source) + output["byte_index"] = byte_index + output["kind"] = "table" + return output + + if kind == "immediate": + output = dict(source) + output["byte_index"] = byte_index + return output + + output = dict(source) + output.setdefault("kind", "computed") + output["byte_index"] = byte_index + return output + + +def _schema_source_kind(source: Mapping[str, Any]) -> str: + kind = str(source.get("kind", "computed")) + if kind == "immediate": + return "immediate" + if kind == "rx_frame_byte": + return "rx_frame_byte" + if kind == "table": + return "table" + if kind in {"tx_frame_byte", "tx_frame_word"}: + return "tx_frame_byte" + return "computed" + + +def _source_expression(source: Mapping[str, Any]) -> str: + kind = str(source.get("kind", "computed")) + if kind == "immediate" and isinstance(source.get("value"), int): + return f"0x{int(source['value']) & 0xFFFF:02X}".lower() + if kind == "rx_frame_byte" and isinstance(source.get("rx_offset"), int): + return f"rx[{int(source['rx_offset'])}]" + if kind == "tx_frame_byte" and isinstance(source.get("tx_offset"), int): + return f"tx[{int(source['tx_offset'])}]" + if kind == "table": + return str(source.get("name_candidate", "table")) + return "computed" + + def _rx_field_candidates( ordered: list[JsonObject], dispatch: JsonObject | None, @@ -706,6 +1160,422 @@ def _response_builder_aliases(responses: list[JsonObject]) -> list[JsonObject]: return builders +def _logical_table_map_candidates(ordered: list[JsonObject]) -> list[JsonObject]: + by_offset: dict[int, list[JsonObject]] = {offset: [] for offset in LOGICAL_TABLES} + direct_by_address: dict[int, list[JsonObject]] = {address: [] for address in DIRECT_TABLE_CANDIDATES} + for ins in ordered: + for operand in _negative_indexed_operands(str(ins.get("operands", ""))): + offset = int(operand["negative_offset"]) + if offset not in LOGICAL_TABLES: + continue + access = _operand_access_kind(ins, str(operand["operand"])) + by_offset[offset].append( + { + "instruction_address": int(ins["address"]), + "instruction_address_hex": _h16(int(ins["address"])), + "operand": operand["operand"], + "negative_offset": offset, + "negative_offset_hex": _h16(offset), + "index_register": operand["index_register"], + "access": access, + "width": _access_width(str(ins.get("mnemonic", ""))), + "instruction": str(ins.get("text", "")), + } + ) + for address in DIRECT_TABLE_CANDIDATES: + if not _has_ref_in_range(ins, address, address): + continue + direct_by_address[address].append( + { + "instruction_address": int(ins["address"]), + "instruction_address_hex": _h16(int(ins["address"])), + "address": address, + "address_hex": _h16(address), + "access": _access_direction(ins, address) or "read_write_candidate", + "width": _access_width(str(ins.get("mnemonic", ""))), + "instruction": str(ins.get("text", "")), + } + ) + + candidates: list[JsonObject] = [] + for offset, accesses in by_offset.items(): + if not accesses: + continue + metadata = LOGICAL_TABLES[offset] + evidence = _dedupe_ints(access["instruction_address"] for access in accesses) + logical_base = int(metadata["logical_base_address"]) + candidates.append( + { + "kind": "logical_table_map_candidate", + "name_candidate": metadata["name_candidate"], + "element_candidate": metadata["element_candidate"], + "logical_base_address": logical_base, + "logical_base_address_hex": _h16(logical_base), + "negative_offset": offset, + "negative_offset_hex": _h16(offset), + "observed_index_registers": sorted( + { + str(access["index_register"]) + for access in accesses + if access.get("index_register") + } + ), + "observed_accesses": sorted( + {str(access["access"]) for access in accesses if access.get("access")} + ), + "observed_widths": sorted( + {int(access["width"]) for access in accesses if isinstance(access.get("width"), int)} + ), + "accesses": accesses, + "evidence_addresses": evidence, + "evidence_addresses_hex": _hlist(evidence), + "confidence": "candidate-medium", + "caveat": ( + "Logical table base is inferred from negative indexed operands only; " + "the table name is a conservative candidate." + ), + } + ) + for address, accesses in direct_by_address.items(): + if not accesses: + continue + evidence = _dedupe_ints(access["instruction_address"] for access in accesses) + candidates.append( + { + "kind": "direct_table_map_candidate", + "name_candidate": DIRECT_TABLE_CANDIDATES[address], + "address": address, + "address_hex": _h16(address), + "observed_accesses": sorted( + {str(access["access"]) for access in accesses if access.get("access")} + ), + "observed_widths": sorted( + {int(access["width"]) for access in accesses if isinstance(access.get("width"), int)} + ), + "accesses": accesses, + "evidence_addresses": evidence, + "evidence_addresses_hex": _hlist(evidence), + "confidence": "candidate-low", + "caveat": ( + "Direct table candidate is retained for small synthetic traces; the main " + "logical table map uses negative indexed operands." + ), + } + ) + return candidates + + +def _state_variable_candidates(ordered: list[JsonObject]) -> list[JsonObject]: + candidates: list[JsonObject] = [] + serial_region = [ + ins + for ins in ordered + if SERIAL_HANDLER_START <= int(ins.get("address", -1)) <= SERIAL_HANDLER_END + ] + if not any( + _has_ref_in_range(ins, min(STATE_VARIABLES), max(STATE_VARIABLES)) + for ins in serial_region + ): + serial_region = ordered + for address, name in STATE_VARIABLES.items(): + accesses: list[JsonObject] = [] + for ins in serial_region: + if not _has_ref_in_range(ins, address, address): + continue + access = _access_direction(ins, address) or "read_write_candidate" + source, _destination = _source_destination_operands(str(ins.get("operands", ""))) + immediate = _parse_immediate(source) + item: JsonObject = { + "instruction_address": int(ins["address"]), + "instruction_address_hex": _h16(int(ins["address"])), + "access": access, + "mnemonic": str(ins.get("mnemonic", "")), + "instruction": str(ins.get("text", "")), + } + bit = _bit_number_from_instruction(ins) + if bit is not None: + item["bit"] = bit + if immediate is not None: + item["immediate"] = immediate + item["immediate_hex"] = _h16(immediate, width=2 if immediate <= 0xFF else 4) + accesses.append(item) + if not accesses: + continue + evidence = _dedupe_ints(access["instruction_address"] for access in accesses) + candidates.append( + { + "kind": "serial_state_variable_candidate", + "name_candidate": name, + "address": address, + "address_hex": _h16(address), + "access_count": len(accesses), + "read_count": sum(1 for access in accesses if str(access["access"]) == "read"), + "write_count": sum(1 for access in accesses if str(access["access"]) == "write"), + "bit_candidates": sorted( + {int(access["bit"]) for access in accesses if isinstance(access.get("bit"), int)} + ), + "immediate_values": _dedupe_ints( + int(access["immediate"]) for access in accesses if isinstance(access.get("immediate"), int) + ), + "immediate_values_hex": _hlist( + int(access["immediate"]) for access in accesses if isinstance(access.get("immediate"), int) + ), + "accesses": accesses, + "evidence_addresses": evidence, + "evidence_addresses_hex": _hlist(evidence), + "confidence": "candidate-medium", + "caveat": ( + "Role is inferred from references in the serial handler region and remains " + "a state-variable candidate." + ), + } + ) + return candidates + + +def _generic_checksum_error_branches( + ordered: list[JsonObject], + responses: list[JsonObject], +) -> JsonObject: + response_by_call = { + int(response["call_address"]): response + for response in responses + if isinstance(response.get("call_address"), int) + } + response_ids_by_call = { + call: str(response["id"]) + for call, response in response_by_call.items() + if isinstance(response.get("id"), str) + } + response_calls = sorted(response_by_call) + error_response_calls = { + call for call, response in response_by_call.items() + if _response_has_immediate_byte(response, 0, 0x07) + } + + branch_addresses: list[int] = [] + branch_targets: list[int] = [] + response_ids: list[str] = [] + evidence_addresses: list[int] = [] + for index, ins in enumerate(ordered): + if not _has_ref_in_range(ins, RX_CHECKSUM_ADDRESS, RX_CHECKSUM_ADDRESS): + continue + if _mnemonic_root(str(ins.get("mnemonic", ""))) not in {"CMP", "CMP:E", "CMP:G", "CMP:I"}: + continue + evidence_addresses.append(int(ins["address"])) + for follower in ordered[index + 1:index + 4]: + targets = _targets(follower) + if not targets: + continue + branch_address = int(follower["address"]) + branch_addresses.append(branch_address) + evidence_addresses.append(branch_address) + for target in targets: + branch_targets.append(target) + response_call = _first_response_call_at_or_after(response_calls, target, max_distance=0x80) + if response_call is None: + continue + if error_response_calls and response_call not in error_response_calls: + continue + response_ids.append(response_ids_by_call[response_call]) + evidence_addresses.extend(_response_evidence_addresses(responses, [response_ids_by_call[response_call]])) + break + + return { + "branch_addresses": _dedupe_ints(branch_addresses), + "branch_targets": _dedupe_ints(branch_targets), + "response_ids": _dedupe_strings(response_ids), + "evidence_addresses": _dedupe_ints(evidence_addresses), + } + + +def _first_response_call_at_or_after( + response_calls: list[int], + address: int, + *, + max_distance: int, +) -> int | None: + for call in response_calls: + if address <= call <= address + max_distance: + return call + return None + + +def _responses_with_immediate_byte( + responses: list[JsonObject], + offset: int, + value: int, +) -> list[str]: + return _dedupe_strings( + str(response["id"]) + for response in responses + if isinstance(response.get("id"), str) + and _response_has_immediate_byte(response, offset, value) + ) + + +def _response_has_immediate_byte(response: Mapping[str, Any], offset: int, value: int) -> bool: + schema = response.get("schema") + if not isinstance(schema, Mapping): + return False + for item in schema.get("bytes", []): + if not isinstance(item, Mapping): + continue + if item.get("offset") != offset: + continue + source = item.get("source") + return ( + isinstance(source, Mapping) + and source.get("kind") == "immediate" + and source.get("value") == value + ) + return False + + +def _response_evidence_addresses( + responses: list[JsonObject], + response_ids: Iterable[str], +) -> list[int]: + wanted = set(response_ids) + return _dedupe_ints( + int(address) + for response in responses + if response.get("id") in wanted + for address in response.get("evidence_addresses", []) + if isinstance(address, int) + ) + + +def _retry_error_model(ordered: list[JsonObject], responses: list[JsonObject]) -> JsonObject | None: + checksum_path = [ + ins + for ins in ordered + if 0xBBD6 <= int(ins.get("address", -1)) <= 0xBBF0 + ] + retry_path = [ + ins + for ins in ordered + if 0xBE29 <= int(ins.get("address", -1)) <= 0xBE6A + ] + retransmit_path = [ + ins + for ins in ordered + if 0xBE05 <= int(ins.get("address", -1)) <= 0xBE22 + ] + checksum_branch = [ + int(ins["address"]) + for ins in checksum_path + if 0xBE29 in _targets(ins) + ] + generic_checksum_branch = _generic_checksum_error_branches(ordered, responses) + checksum_branch = _dedupe_ints(checksum_branch + generic_checksum_branch["branch_addresses"]) + retry_counter_evidence = [ + int(ins["address"]) + for ins in retry_path + if _has_ref_in_range(ins, 0xFAA6, 0xFAA6) + ] + explicit_error_response = [ + response.get("id") + for response in responses + if response.get("id") == "response_at_BE6A" + ] + checksum_error_response = _dedupe_strings( + [item for item in explicit_error_response if isinstance(item, str)] + + generic_checksum_branch["response_ids"] + ) + retransmit_response = [ + response.get("id") + for response in responses + if response.get("id") == "response_at_BE22" + ] + command_0x07_responses = _responses_with_immediate_byte(responses, 0, 0x07) + retransmit_response = _dedupe_strings( + [item for item in retransmit_response if isinstance(item, str)] + + [ + item for item in command_0x07_responses + if item not in checksum_error_response + ] + ) + if ( + not checksum_branch + and not retry_counter_evidence + and not retransmit_response + and not checksum_error_response + ): + return None + + checksum_evidence = _dedupe_ints( + [int(ins["address"]) for ins in checksum_path if _has_ref_in_range(ins, RX_FRAME_START, RX_FRAME_END)] + + checksum_branch + + generic_checksum_branch["evidence_addresses"] + ) + retry_evidence = _dedupe_ints( + [int(ins["address"]) for ins in retry_path if _has_ref_in_range(ins, 0xFAA2, 0xFAA6)] + + [int(ins["address"]) for ins in retry_path if _has_ref_in_range(ins, TX_STAGING_START, TX_STAGING_END)] + + [int(ins["address"]) for ins in retry_path if _is_send_builder_call(ins)] + + _response_evidence_addresses(responses, checksum_error_response) + ) + retransmit_evidence = _dedupe_ints( + [int(ins["address"]) for ins in retransmit_path if _has_ref_in_range(ins, TX_FRAME_START, TX_FRAME_END)] + + [int(ins["address"]) for ins in retransmit_path if _has_ref_in_range(ins, TX_STAGING_START, TX_STAGING_END)] + + [int(ins["address"]) for ins in retransmit_path if _is_send_builder_call(ins)] + + _response_evidence_addresses(responses, retransmit_response) + ) + evidence = _dedupe_ints(checksum_evidence + retry_evidence + retransmit_evidence) + + return { + "kind": "serial_retry_error_model_candidate", + "checksum_failure_path": { + "condition_candidate": "0x5A-seeded XOR over RX[0..4] differs from RX[5]", + "error_target": "loc_BE29", + "error_target_address": 0xBE29, + "error_target_address_hex": _h16(0xBE29), + "checksum_error_response_candidates": checksum_error_response, + "branch_evidence_addresses": checksum_branch, + "branch_evidence_addresses_hex": _hlist(checksum_branch), + "evidence_addresses": checksum_evidence, + "evidence_addresses_hex": _hlist(checksum_evidence), + "confidence": "candidate-high" if checksum_branch else "candidate-low", + }, + "retry_path": { + "entry_label": "loc_BE29", + "entry_address": 0xBE29, + "entry_address_hex": _h16(0xBE29), + "counter_address": 0xFAA6, + "counter_address_hex": _h16(0xFAA6), + "threshold_candidate": 2, + "response_candidates": checksum_error_response, + "summary": ( + "Candidate retry path clears/consults serial flags, increments FAA6, compares it " + "with 2, and when still below the apparent limit stages a command 0x07 response." + ), + "evidence_addresses": retry_evidence, + "evidence_addresses_hex": _hlist(retry_evidence), + "confidence": "candidate-medium" if retry_counter_evidence else "candidate-low", + }, + "command_0x07_path": { + "entry_label": "loc_BE05", + "entry_address": 0xBE05, + "entry_address_hex": _h16(0xBE05), + "response_candidates": retransmit_response, + "summary": ( + "Candidate retransmit/explicit command 0x07 path either copies previous TX " + "frame bytes back to F850-F854 or stages an observed 0x07 response before loc_BA26." + ), + "evidence_addresses": retransmit_evidence, + "evidence_addresses_hex": _hlist(retransmit_evidence), + "confidence": "candidate-medium" if retransmit_response else "candidate-low", + }, + "evidence_addresses": evidence, + "evidence_addresses_hex": _hlist(evidence), + "confidence": "candidate-medium", + "caveat": ( + "The retry/error model is inferred from checksum branch targets, retry-counter state, " + "and response staging; exact host-visible semantics remain candidate phrasing." + ), + } + + def _send_builder_candidate( ordered: list[JsonObject], responses: list[JsonObject], @@ -870,30 +1740,115 @@ def _staging_writes(window: list[JsonObject]) -> list[JsonObject]: def _source_info(window: list[JsonObject], index: int, source: str) -> JsonObject: + return _resolve_source_info(window, index, source, []) + + +def _resolve_source_info( + window: list[JsonObject], + index: int, + source: str, + transforms: list[str], +) -> JsonObject: immediate = _parse_immediate(source) if immediate is not None: - return { + output = { "kind": "immediate", "value": immediate, "value_hex": _h16(immediate, width=2 if immediate <= 0xFF else 4), } + if transforms: + output["transforms"] = transforms + return output + + direct = _direct_source_info(window[index] if 0 <= index < len(window) else {}, source) + if direct is not None: + if transforms: + direct = dict(direct) + direct["transforms"] = transforms + return direct + source_upper = source.upper() - for prior in reversed(window[max(0, index - 4) : index]): + for prior_index in range(index - 1, max(-1, index - 12), -1): + prior = window[prior_index] prior_source, prior_destination = _source_destination_operands(str(prior.get("operands", ""))) if prior_destination.upper() != source_upper: continue - rx_address = _first_address_in_range(prior, RX_FRAME_START, RX_FRAME_END, operand=prior_source) - if rx_address is not None and _is_read_from_address(prior, rx_address): - return { - "kind": "rx_frame_byte", - "rx_offset": rx_address - RX_FRAME_START, - "rx_address": rx_address, - "rx_address_hex": _h16(rx_address), - "evidence_address": int(prior["address"]), - "evidence_address_hex": _h16(int(prior["address"])), - "instruction": str(prior.get("text", "")), + root = _mnemonic_root(str(prior.get("mnemonic", ""))) + if root in {"BTST", "CMP", "CMP:E", "CMP:G", "CMP:I", "TST"}: + continue + if root == "SWAP": + resolved = _resolve_source_info(window, prior_index, source, transforms + ["swap_bytes"]) + elif root not in {"MOV:G", "MOV:S", "MOV:E", "MOV:I", "MOV:L", "MOV:F", "LDC"}: + resolved = { + "kind": "register_or_computed", + "operand": source, + "source_category": "computed", + "operation": root, } - return {"kind": "register_or_computed", "operand": source} + elif prior_source: + resolved = _resolve_source_info(window, prior_index, prior_source, transforms) + else: + resolved = {"kind": "register_or_computed", "operand": source} + resolved = dict(resolved) + resolved.setdefault("evidence_address", int(prior["address"])) + resolved.setdefault("evidence_address_hex", _h16(int(prior["address"]))) + resolved.setdefault("instruction", str(prior.get("text", ""))) + return resolved + return { + "kind": "register_or_computed", + "operand": source, + "source_category": "computed", + } + + +def _direct_source_info(ins: Mapping[str, Any], source: str) -> JsonObject | None: + rx_address = _first_address_in_range(ins, RX_FRAME_START, RX_FRAME_END, operand=source) + if rx_address is not None and _is_read_from_address(ins, rx_address): + width = _access_width(str(ins.get("mnemonic", ""))) + offsets = [ + address - RX_FRAME_START + for address in range(rx_address, min(rx_address + width - 1, RX_FRAME_END) + 1) + ] + return { + "kind": "rx_frame_word" if len(offsets) > 1 else "rx_frame_byte", + "rx_offset": rx_address - RX_FRAME_START, + "rx_offsets": offsets, + "rx_address": rx_address, + "rx_address_hex": _h16(rx_address), + "evidence_address": int(ins["address"]) if isinstance(ins.get("address"), int) else None, + "evidence_address_hex": _h16(int(ins["address"])) if isinstance(ins.get("address"), int) else None, + "instruction": str(ins.get("text", "")), + } + + tx_address = _first_address_in_range(ins, TX_FRAME_START, TX_FRAME_END, operand=source) + if tx_address is not None and _is_read_from_address(ins, tx_address): + width = _access_width(str(ins.get("mnemonic", ""))) + offsets = [ + address - TX_FRAME_START + for address in range(tx_address, min(tx_address + width - 1, TX_FRAME_END) + 1) + ] + return { + "kind": "tx_frame_word" if len(offsets) > 1 else "tx_frame_byte", + "tx_offset": tx_address - TX_FRAME_START, + "tx_offsets": offsets, + "tx_address": tx_address, + "tx_address_hex": _h16(tx_address), + "evidence_address": int(ins["address"]) if isinstance(ins.get("address"), int) else None, + "evidence_address_hex": _h16(int(ins["address"])) if isinstance(ins.get("address"), int) else None, + "instruction": str(ins.get("text", "")), + } + + table = _table_operand_candidate(source) + if table is not None: + output = dict(table) + output["kind"] = "table" + output["access_width"] = _access_width(str(ins.get("mnemonic", ""))) + output["evidence_address"] = int(ins["address"]) if isinstance(ins.get("address"), int) else None + output["evidence_address_hex"] = _h16(int(ins["address"])) if isinstance(ins.get("address"), int) else None + output["instruction"] = str(ins.get("text", "")) + return output + + return None def _rx_reads(window: list[JsonObject], start: int, end: int) -> list[JsonObject]: @@ -941,6 +1896,103 @@ def _response_in_ranges(response: Mapping[str, Any], ranges: list[tuple[int, int return any(start <= call_address <= end for start, end in ranges) +def _addresses_in_ranges( + ordered: list[JsonObject], + ranges: list[tuple[int, int]], + start: int, + end: int, +) -> list[int]: + return _dedupe_ints( + int(ins["address"]) + for ins in ordered + if start <= int(ins.get("address", -1)) <= end + and any(range_start <= int(ins.get("address", -1)) <= range_end for range_start, range_end in ranges) + ) + + +def _table_accesses_in_ranges( + ordered: list[JsonObject], + ranges: list[tuple[int, int]], +) -> list[JsonObject]: + accesses: list[JsonObject] = [] + for ins in ordered: + address = int(ins.get("address", -1)) + if not any(start <= address <= end for start, end in ranges): + continue + for operand in _negative_indexed_operands(str(ins.get("operands", ""))): + offset = int(operand["negative_offset"]) + if offset not in LOGICAL_TABLES: + continue + candidate = _table_operand_candidate(str(operand["operand"])) + if candidate is None: + continue + accesses.append( + { + "instruction_address": address, + "negative_offset": offset, + "access": _operand_access_kind(ins, str(operand["operand"])), + "candidate": candidate, + } + ) + for direct_address, offset in DIRECT_TABLE_TO_LOGICAL_OFFSET.items(): + if not _has_ref_in_range(ins, direct_address, direct_address): + continue + accesses.append( + { + "instruction_address": address, + "negative_offset": offset, + "access": _access_direction(ins, direct_address) or "read_write_candidate", + "candidate": DIRECT_TABLE_CANDIDATES[direct_address], + "direct_address": direct_address, + "direct_address_hex": _h16(direct_address), + } + ) + return accesses + + +def _state_accesses_in_ranges( + ordered: list[JsonObject], + ranges: list[tuple[int, int]], +) -> list[JsonObject]: + accesses: list[JsonObject] = [] + for ins in ordered: + address = int(ins.get("address", -1)) + if not any(start <= address <= end for start, end in ranges): + continue + for state_address in STATE_VARIABLES: + if not _has_ref_in_range(ins, state_address, state_address): + continue + accesses.append( + { + "instruction_address": address, + "state_address": state_address, + "access": _access_direction(ins, state_address) or "read_write_candidate", + } + ) + return accesses + + +def _table_access_addresses( + accesses: list[JsonObject], + negative_offset: int, + access_kind: str | None = None, +) -> list[int]: + return _dedupe_ints( + int(access["instruction_address"]) + for access in accesses + if access.get("negative_offset") == negative_offset + and (access_kind is None or access.get("access") == access_kind) + ) + + +def _state_access_addresses(accesses: list[JsonObject], address: int) -> list[int]: + return _dedupe_ints( + int(access["instruction_address"]) + for access in accesses + if access.get("state_address") == address + ) + + def _handler_end( ordered: list[JsonObject], start: int, @@ -1175,6 +2227,70 @@ def _parse_immediate(operand: str) -> int | None: return None +def _negative_indexed_operands(operands: str) -> list[JsonObject]: + matches: list[JsonObject] = [] + for match in re.finditer(r"@\(-H'([0-9A-Fa-f]+),\s*(R[0-7])\)", operands): + offset = int(match.group(1), 16) & 0xFFFF + matches.append( + { + "operand": match.group(0), + "negative_offset": offset, + "negative_offset_hex": _h16(offset), + "index_register": match.group(2).upper(), + } + ) + return matches + + +def _table_operand_candidate(operand: str) -> JsonObject | None: + operands = _negative_indexed_operands(operand) + if not operands: + return None + first = operands[0] + offset = int(first["negative_offset"]) + metadata = LOGICAL_TABLES.get(offset) + if metadata is None: + return None + logical_base = int(metadata["logical_base_address"]) + return { + "name_candidate": metadata["name_candidate"], + "element_candidate": metadata["element_candidate"], + "logical_base_address": logical_base, + "logical_base_address_hex": _h16(logical_base), + "negative_offset": offset, + "negative_offset_hex": _h16(offset), + "index_register": first["index_register"], + "operand": first["operand"], + } + + +def _operand_access_kind(ins: Mapping[str, Any], operand: str) -> str: + root = _mnemonic_root(str(ins.get("mnemonic", ""))) + source, destination = _source_destination_operands(str(ins.get("operands", ""))) + if root in {"BTST", "CMP", "CMP:E", "CMP:G", "CMP:I", "TST"}: + return "read" + if root in {"BCLR", "BNOT", "BSET", "CLR", "INC", "INC:G", "NEG", "NOT"}: + return "write" + if operand in destination and operand not in source: + return "write" + if operand in source and operand not in destination: + return "read" + if root in {"ADD:Q", "ADD:G", "ADDS", "ADDX", "AND", "OR", "SUB", "SUBS", "SUBX", "XOR"}: + return "write" + return "read_write_candidate" + + +def _bit_number_from_instruction(ins: Mapping[str, Any]) -> int | None: + root = _mnemonic_root(str(ins.get("mnemonic", ""))) + if root not in {"BCLR", "BNOT", "BSET", "BTST"}: + return None + source, _destination = _source_destination_operands(str(ins.get("operands", ""))) + value = _parse_immediate(source) + if value is None: + return None + return value & 0x0F + + def _operand_mentions_any_reference(operand: str, references: list[int]) -> bool: return any(_operand_mentions_address(operand, address) for address in references) @@ -1251,6 +2367,17 @@ def _dedupe_ints(values: Iterable[int]) -> list[int]: return output +def _dedupe_strings(values: Iterable[str]) -> list[str]: + seen: set[str] = set() + output: list[str] = [] + for value in values: + if value in seen: + continue + seen.add(value) + output.append(value) + return output + + def _hlist(values: Iterable[int]) -> list[str]: return [_h16(value) for value in _dedupe_ints(values)] diff --git a/tests/test_serial_pseudocode.py b/tests/test_serial_pseudocode.py index 192c332..604dceb 100644 --- a/tests/test_serial_pseudocode.py +++ b/tests/test_serial_pseudocode.py @@ -2,6 +2,7 @@ import json import tempfile import unittest from pathlib import Path +from unittest.mock import patch from h8536.serial_pseudocode import ( SerialPseudocodeOptions, @@ -13,6 +14,27 @@ from h8536.serial_pseudocode import ( def candidate_payload() -> dict: return { "instructions": [], + "dtc_vectors": [], + "sci": { + "channels": { + "SCI1": { + "configurations": [ + { + "mode": "async", + "mode_summary": "async 8-bit even parity 1 stop", + "smr": 0x24, + "smr_hex": "H'24", + "brr": 0x07, + "brr_hex": "H'07", + "scr": 0x3C, + "scr_hex": "H'3C", + "clock_source": "internal", + "baud_bps": None, + }, + ], + }, + }, + }, "sci_protocol": { "manual_references": [ "Manual/0900766b802125d0.md:15794 RDR receive data register", @@ -87,8 +109,20 @@ def candidate_payload() -> dict: "confidence_reason": "RX count, copy, and checksum-validation evidence were observed", "caveat": "candidate frame means six consecutive bytes, not a proven delimited packet", "comment": "candidate/evidence-supported SCI1 6-byte RX frame hypothesis", + "rx_error_handling": { + "error_latch_address": 0xFAA4, + "error_latch_address_hex": "H'FAA4", + "error_latch_bit": 7, + "fallthrough_to_rx_byte_path": True, + "rdrf_clear_before_rdr_read": True, + "summary": "SCI1 ERI marks a physical receive error and continues into RXI byte capture.", + "manual_caveat": "The ROM clears RDRF before reading RDR; preserve that observed order.", + "evidence_addresses_hex": ["H'BB57", "H'BB69", "H'BB6D"], + }, "evidence_addresses_hex": { "rx_rdr_read": ["H'BB6D"], + "rx_rdrf_clear_before_rdr_read": ["H'BB69", "H'BB6D"], + "rx_eri_falls_through_to_rxi": ["H'BB57", "H'BB5B", "H'BB5F", "H'BB63", "H'BB69", "H'BB6D"], "rx_xor_checksum_validation": ["H'BBD6", "H'BBEC"], }, }, @@ -121,6 +155,9 @@ class SerialPseudocodeTest(unittest.TestCase): self.assertIn("focused SCI RX/TX pseudocode from rom.json", text) self.assertIn("SCI1 TX 6-byte frame at H'F858-H'F85D", text) self.assertIn("SCI1 RX 6-byte frame captured at H'F868-H'F86D", text) + self.assertIn("8E1 SCI characters carry the 6 protocol bytes", text) + self.assertIn("SMR=H'24, BRR=H'07, SCR=H'3C", text) + self.assertIn("No SCI1 RXI/TXI DTC vector entries are present", text) self.assertIn("MAX202 pin 11 traces to H8 pin 66", text) self.assertIn("Manual/0900766b802125d0.md:15823 TDR transmit data register", text) self.assertIn("#define TX_FRAME(n) MEM8[(u16)(0xF858u + (n))]", text) @@ -132,6 +169,9 @@ class SerialPseudocodeTest(unittest.TestCase): self.assertIn("SCI1_SSR &= (u8)~SCI_SSR_RDRF;\n byte = SCI1_RDR;", text) self.assertIn("RX_CAPTURE(RX_INDEX) = byte;", text) self.assertIn("return sci1_process_rx_candidate_frame();", text) + self.assertIn("RX_ERROR_LATCH |= RX_ERROR_LATCH_PHYSICAL_ERROR;", text) + self.assertIn("sci1_rx_byte_received_candidate_isr();", text) + self.assertIn("RX error handling: SCI1 ERI marks a physical receive error", text) self.assertIn("rx_xor_checksum_validation: H'BBD6, H'BBEC", text) def test_generates_candidate_protocol_semantics_switch(self): @@ -145,6 +185,110 @@ class SerialPseudocodeTest(unittest.TestCase): self.assertIn("case 0x01u:", text) self.assertIn("candidate_read_value(logical_index, value);", text) + def test_surfaces_refined_semantic_candidates(self): + analysis = { + "protocol_semantics": [ + { + "confidence": "medium", + "confidence_score": 0.7, + "commands": [ + { + "command_value": 0, + "command_value_hex": "0x00", + "name_candidate": "set_value_acked", + "summary": "candidate acknowledged set", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base_hex": "H'E000", + } + ], + } + ], + "command_effects": [ + { + "command_value": 0, + "command_value_hex": "0x00", + "name_candidate": "set_value_acked", + "summary": "Candidate acknowledged set writes value bytes.", + "effects": [ + { + "kind": "table_write_candidate", + "target_candidate": "primary_value_table_candidate", + "source_candidate": "RX[3:4] value bytes", + "table_base_hex": "H'E000", + "evidence_addresses_hex": ["H'C010"], + } + ], + "evidence_addresses_hex": ["H'C000"], + } + ], + "response_schemas": [ + { + "response_id": "response_at_C030", + "bytes": [ + {"byte": "byte0", "source_expression": "0x04"}, + {"byte": "byte1", "source_expression": "RX[1]"}, + ], + "evidence_addresses_hex": ["H'C01C", "H'C024"], + } + ], + "logical_table_map_candidates": [ + { + "name_candidate": "primary_value_table_candidate", + "logical_base_address_hex": "H'E000", + "element_candidate": "word_value", + "observed_accesses": ["write"], + "evidence_addresses_hex": ["H'C010"], + } + ], + "state_variable_candidates": [ + { + "name_candidate": "serial_session_flags_candidate", + "address": 0xFAA2, + "address_hex": "H'FAA2", + "read_count": 1, + "write_count": 2, + "bit_candidates": [7], + "evidence_addresses_hex": ["H'C018"], + } + ], + "retry_error_model": { + "checksum_failure_path": { + "condition_candidate": "0x5A-seeded XOR over RX[0..4] differs from RX[5]", + "error_target": "loc_BE29", + }, + "retry_path": { + "counter_address_hex": "H'FAA6", + "threshold_candidate": 2, + "summary": "Candidate retry path stages a command 0x07 response.", + }, + "command_0x07_path": { + "summary": "Candidate explicit command 0x07 path copies previous TX frame bytes.", + }, + "evidence_addresses_hex": ["H'BBD6", "H'BE29"], + }, + } + ] + } + + with patch("h8536.serial_pseudocode.analyze_serial_semantics", return_value=analysis): + text = generate_serial_pseudocode(candidate_payload()) + + self.assertIn("command effects:", text) + self.assertIn("effect: table_write_candidate; target primary_value_table_candidate", text) + self.assertIn("response schemas:", text) + self.assertIn("response_at_C030: byte0=0x04; byte1=RX[1]", text) + self.assertIn("table map candidates:", text) + self.assertIn("primary_value_table_candidate at H'E000", text) + self.assertIn("state variable candidates:", text) + self.assertIn("serial_session_flags_candidate H'FAA2: reads 1, writes 2; bits 7", text) + self.assertIn("retry/error model candidate:", text) + self.assertIn("checksum path: 0x5A-seeded XOR over RX[0..4] differs from RX[5] -> loc_BE29", text) + self.assertIn("candidate effect: table_write_candidate; target primary_value_table_candidate", text) + def test_tx_only_option_omits_rx_functions(self): text = generate_serial_pseudocode( candidate_payload(), diff --git a/tests/test_serial_reconstruction.py b/tests/test_serial_reconstruction.py index c60f8ed..a67fa30 100644 --- a/tests/test_serial_reconstruction.py +++ b/tests/test_serial_reconstruction.py @@ -88,6 +88,11 @@ class SerialReconstructionTest(unittest.TestCase): def test_candidate_sci1_rx_frame_length_and_checksum_validation_pattern(self): instructions = { + 0x4FF0: ins(0x4FF0, "BSET.B", "#7, @H'FAA4", [0xFAA4]), + 0x4FF4: ins(0x4FF4, "BCLR.B", "#5, @SCI1_SSR", [0xFEDC]), + 0x4FF8: ins(0x4FF8, "BCLR.B", "#4, @SCI1_SSR", [0xFEDC]), + 0x4FFC: ins(0x4FFC, "BCLR.B", "#3, @SCI1_SSR", [0xFEDC]), + 0x4FFE: ins(0x4FFE, "BCLR.B", "#6, @SCI1_SSR", [0xFEDC]), 0x5000: ins(0x5000, "MOV:G.B", "@SCI1_RDR, R0", [0xFEDD]), 0x5004: ins(0x5004, "MOV:G.B", "R0, @(-H'0798,R1)", []), 0x5008: ins(0x5008, "ADD:Q.B", "#1, R1", []), @@ -119,11 +124,24 @@ class SerialReconstructionTest(unittest.TestCase): self.assertEqual(candidate["checksum_address"], 0xF865) self.assertEqual(candidate["checksum_seed"], 0x5A) self.assertIn("no explicit header", candidate["confidence_reason"]) + self.assertIn("rx_rdrf_clear_before_rdr_read", candidate["evidence_addresses"]) + self.assertIn("rx_eri_falls_through_to_rxi", candidate["evidence_addresses"]) + self.assertTrue(candidate["rx_error_handling"]["fallthrough_to_rx_byte_path"]) + self.assertTrue(candidate["rx_error_handling"]["rdrf_clear_before_rdr_read"]) + self.assertEqual(candidate["rx_error_handling"]["error_latch_address"], 0xFAA4) comment = serial_reconstruction_comment_for_instruction(analysis, 0x5138) self.assertIn("candidate/evidence-supported SCI1 6-byte RX frame", comment) self.assertIn("checksum H'F865", comment) self.assertIn("confidence high", comment) + self.assertIn( + "ROM clears SCI1 SSR.RDRF before reading SCI1_RDR", + serial_reconstruction_comment_for_instruction(analysis, 0x4FFE), + ) + self.assertIn( + "SCI1 ERI latches FAA4.bit7", + serial_reconstruction_comment_for_instruction(analysis, 0x4FF0), + ) def test_lone_tdr_write_does_not_emit_reconstruction(self): instructions = { diff --git a/tests/test_serial_semantics.py b/tests/test_serial_semantics.py index aa447f6..2767f3e 100644 --- a/tests/test_serial_semantics.py +++ b/tests/test_serial_semantics.py @@ -1,4 +1,5 @@ import unittest +from typing import Any from h8536.serial_semantics import analyze_serial_semantics @@ -60,6 +61,92 @@ def only_semantics(testcase: unittest.TestCase, payload: dict) -> dict: return analysis["protocol_semantics"][0] +def semantic_items(value: Any) -> list[Any]: + if isinstance(value, list): + return value + if isinstance(value, dict): + return list(value.values()) + return [] + + +def command_item(items: list[Any], command: int) -> Any: + for item in items: + if not isinstance(item, dict): + continue + command_value = item.get("command_value", item.get("command")) + if command_value == command: + return item + if isinstance(command_value, str) and command_value.lower() == f"0x{command:02x}": + return item + return None + + +def semantic_text(value: Any) -> str: + if isinstance(value, dict): + return " ".join( + f"{key} {semantic_text(item)}" + for key, item in value.items() + ).lower() + if isinstance(value, list): + return " ".join(semantic_text(item) for item in value).lower() + return str(value).lower() + + +def planned_semantics_payload() -> dict: + return base_payload( + [ + instruction(0xBF00, "MOV:G.B", "@H'F860, R0", [0xF860]), + instruction(0xBF04, "AND.B", "#H'07, R0"), + instruction(0xBF08, "CMP:E.B", "#H'00, R0"), + instruction(0xBF0C, "BEQ", "loc_C000", targets=[0xC000]), + instruction(0xBF10, "CMP:E.B", "#H'01, R0"), + instruction(0xBF14, "BEQ", "loc_C100", targets=[0xC100]), + instruction(0xBF18, "CMP:E.B", "#H'06, R0"), + instruction(0xBF1C, "BEQ", "loc_C600", targets=[0xC600]), + instruction(0xBF20, "CMP:E.B", "#H'07, R0"), + instruction(0xBF24, "BEQ", "loc_C700", targets=[0xC700]), + instruction(0xC000, "MOV:G.B", "@H'F861, R1", [0xF861]), + instruction(0xC004, "MOV:G.B", "@H'F862, R2", [0xF862]), + instruction(0xC008, "BSR", "loc_622B", targets=[0x622B]), + instruction(0xC00C, "MOV:G.W", "@H'F863, R3", [0xF863]), + instruction(0xC010, "MOV:G.W", "R3, @H'F900", [0xF900]), + instruction(0xC014, "MOV:G.W", "R3, @H'F920", [0xF920]), + instruction(0xC018, "MOV:G.B", "#H'01, @H'FAA2", [0xFAA2]), + instruction(0xC01C, "MOV:G.B", "#H'04, @H'F850", [0xF850]), + instruction(0xC020, "MOV:G.B", "@H'F861, R4", [0xF861]), + instruction(0xC024, "MOV:G.B", "R4, @H'F851", [0xF851]), + instruction(0xC028, "MOV:G.B", "@H'F862, R5", [0xF862]), + instruction(0xC02C, "MOV:G.B", "R5, @H'F852", [0xF852]), + instruction(0xC030, "BSR", "loc_BA26", targets=[0xBA26]), + instruction(0xC100, "MOV:G.B", "@H'F861, R1", [0xF861]), + instruction(0xC104, "MOV:G.B", "@H'F862, R2", [0xF862]), + instruction(0xC108, "BSR", "loc_622B", targets=[0x622B]), + instruction(0xC10C, "MOV:G.W", "@H'F900, R3", [0xF900]), + instruction(0xC110, "MOV:G.B", "#H'04, @H'F850", [0xF850]), + instruction(0xC114, "MOV:G.B", "@H'F861, R4", [0xF861]), + instruction(0xC118, "MOV:G.B", "R4, @H'F851", [0xF851]), + instruction(0xC11C, "MOV:G.B", "@H'F862, R5", [0xF862]), + instruction(0xC120, "MOV:G.B", "R5, @H'F852", [0xF852]), + instruction(0xC124, "MOV:G.W", "R3, @H'F853", [0xF853]), + instruction(0xC128, "MOV:G.B", "@H'F9B5, R6", [0xF9B5]), + instruction(0xC12C, "BSR", "loc_BA26", targets=[0xBA26]), + instruction(0xC600, "MOV:G.B", "@H'F861, R1", [0xF861]), + instruction(0xC604, "MOV:G.B", "@H'F862, R2", [0xF862]), + instruction(0xC608, "BSR", "loc_622B", targets=[0x622B]), + instruction(0xC60C, "MOV:G.W", "@H'F863, R3", [0xF863]), + instruction(0xC610, "MOV:G.W", "R3, @H'F940", [0xF940]), + instruction(0xC614, "MOV:G.B", "#H'01, @H'F980", [0xF980]), + instruction(0xC618, "MOV:G.B", "#H'01, @H'F9C0", [0xF9C0]), + instruction(0xC700, "MOV:G.B", "#H'07, @H'F850", [0xF850]), + instruction(0xC704, "MOV:G.B", "@H'F861, R1", [0xF861]), + instruction(0xC708, "MOV:G.B", "R1, @H'F851", [0xF851]), + instruction(0xC70C, "BSR", "loc_BA26", targets=[0xBA26]), + instruction(0xC800, "CMP:E.B", "@H'F865, R7", [0xF865]), + instruction(0xC804, "BNE", "loc_C700", targets=[0xC700]), + ] + ) + + class SerialSemanticsTest(unittest.TestCase): def test_detects_low_three_bit_command_dispatch(self): payload = base_payload( @@ -139,6 +226,76 @@ class SerialSemanticsTest(unittest.TestCase): [0xF850, 0xF851, 0xF852, 0xF853, 0xF854], ) + def test_planned_command_effects_include_core_command_behaviors(self): + semantics = only_semantics(self, planned_semantics_payload()) + + self.assertIn("command_effects", semantics) + effects = semantic_items(semantics["command_effects"]) + + command_0 = command_item(effects, 0x00) + self.assertIsNotNone(command_0) + command_0_text = semantic_text(command_0) + self.assertIn("write", command_0_text) + self.assertIn("primary_value_table", command_0_text) + self.assertIn("current_value_table", command_0_text) + + command_1 = command_item(effects, 0x01) + self.assertIsNotNone(command_1) + command_1_text = semantic_text(command_1) + self.assertIn("read", command_1_text) + self.assertIn("response", command_1_text) + + command_6 = command_item(effects, 0x06) + self.assertIsNotNone(command_6) + command_6_text = semantic_text(command_6) + self.assertIn("write", command_6_text) + self.assertIn("secondary_value_table", command_6_text) + + def test_planned_response_schema_tracks_immediates_and_rx_copies(self): + semantics = only_semantics(self, planned_semantics_payload()) + + self.assertIn("response_schema", semantics) + schema_text = semantic_text(semantics["response_schema"]) + + self.assertIn("tx", schema_text) + self.assertIn("byte0", schema_text) + self.assertIn("0x04", schema_text) + self.assertIn("byte1", schema_text) + self.assertIn("rx[1]", schema_text) + self.assertIn("byte2", schema_text) + self.assertIn("rx[2]", schema_text) + + def test_planned_table_map_candidates_name_known_tables(self): + semantics = only_semantics(self, planned_semantics_payload()) + + self.assertIn("table_map_candidates", semantics) + table_text = semantic_text(semantics["table_map_candidates"]) + + self.assertIn("primary_value_table", table_text) + self.assertIn("current_value_table", table_text) + self.assertIn("secondary_value_table", table_text) + self.assertIn("flag_table", table_text) + + def test_planned_state_variable_candidates_include_known_addresses(self): + semantics = only_semantics(self, planned_semantics_payload()) + + self.assertIn("state_variable_candidates", semantics) + state_text = semantic_text(semantics["state_variable_candidates"]) + + self.assertIn("faa2", state_text) + self.assertIn("f9b5", state_text) + self.assertIn("f9c0", state_text) + + def test_planned_retry_error_model_identifies_retransmit_and_checksum_error(self): + semantics = only_semantics(self, planned_semantics_payload()) + + self.assertIn("retry_error_model", semantics) + retry_text = semantic_text(semantics["retry_error_model"]) + + self.assertIn("retransmit", retry_text) + self.assertIn("0x07", retry_text) + self.assertIn("checksum_error_response", retry_text) + def test_missing_serial_reconstruction_candidates_emit_no_protocol_semantics(self): payload = { "serial_reconstruction": {"candidates": []},