# H8/536 ROM Decompiler

This repo now includes a standalone Python helper for the H8/536 ROM image:

```powershell
python h8536_decompiler.py ROM\M27C512@DIP28_1.BIN --out build\rom_decompiled.asm --json build\rom_decompiled.json
```

If you are using the repo-local venv:

```powershell
.\.venv\Scripts\python.exe h8536_decompiler.py --out build\rom_decompiled.asm --json build\rom_decompiled.json --cycles --callgraph-dot build\callgraph.dot
```

## What It Does

- Decodes the H8/500 instruction set used by the H8/536.
- Reads the H8/536 minimum-mode vector table from the ROM.
- Recursively traces reachable code from reset, interrupt, and trap vectors.
- Emits labels for branch and call targets.
- Tracks `LDC.B #xx, BR` along traced control flow so later short absolute `@aa:8` operands can resolve automatically.
- Annotates H8/536 register accesses such as `P1DDR`, `SYSCR1`, `WCR`, watchdog, timer/SCI/A-D, and RAM-control registers.
- Decodes register bitfields and selected hardware semantics for setup writes.
- Emits memory-region metadata for vector, DTC, RAM, register-field, and mode-dependent program/external space.
- Parses the DTC vector table described by the manual.
- Scans unreached ROM ranges for ASCII strings and pointer-table candidates.
- Emits function summaries and a direct-call graph in JSON, with optional Graphviz DOT output.
- Adds Appendix A cycle estimates to JSON and can append them to ASM comments.
- Handles the E-clock transfer instructions `MOVFPE` and `MOVTPE`.

The generated listing is written to:

```text
build/rom_decompiled.asm
```

The optional JSON output is useful for scripts or later analysis:

```text
build/rom_decompiled.json
```

## Useful Options

```powershell
python h8536_decompiler.py --help
```

- `--mode min|max`: vector format. This ROM appears to be minimum mode; `min` is the default.
- `--entry H'1234`: add an extra entry point to recursive tracing.
- `--linear`: linear-sweep the selected range instead of tracing from vectors.
- `--start H'1000 --end H'D100`: constrain the decode range.
- `--br H'FE`: resolve short absolute `@aa:8` operands through a known base-register value.
- `--cycles`: append Appendix A cycle estimates to assembly comments.
- `--callgraph-dot build\callgraph.dot`: write a Graphviz DOT call graph.

## Code Layout

- `h8536_decompiler.py`: compatibility wrapper for the CLI.
- `h8536/cli.py`: argument parsing and end-to-end orchestration.
- `h8536/decoder.py`: instruction and effective-address decoding.
- `h8536/tables.py`: manual-derived opcode/vector/register tables.
- `h8536/vectors.py`: exception and DTC vector parsing.
- `h8536/analysis.py`: recursive tracing, linear sweep, labels, function grouping, and call graph analysis.
- `h8536/data_analysis.py`: unreached string and pointer-table candidate scans.
- `h8536/memory.py`: manual-derived memory-region tagging.
- `h8536/cycles.py`: Appendix A cycle estimate tables.
- `h8536/render.py`: assembly and JSON output.
- `h8536/model.py`, `h8536/rom.py`, `h8536/formatting.py`: shared data structures and helpers.