3.3 KiB
3.3 KiB
PT2 Known Button ROM Trace
This report follows the panel button edge path from the serial-visible reports back into the ROM input scanner.
The key table is the indirect handler table at H'2706, used by loc_1C0E after byte-level panel input changes are detected.
Known Anchors
CAM POWER
- Emitted selector:
0x0007 - Handler:
H'1F40 - Edge source:
F105 -> F6D4viaF6F2.4 - Trigger bit:
F6D4.3 - Table slot:
H'274C->H'1F40 - Current-level tests: F6D4.3
- State writes: E80E
IRIS/M.BLACK LINK
- Emitted selector:
0x0013 - Handler:
H'200E - Edge source:
F006 -> F6DBviaF6F3.3 - Trigger bit:
F6DB.7 - Table slot:
H'27C4->H'200E - Current-level tests: F6DB.7
- State writes: E826
CALL
- Emitted selector:
0x0015 - Handler:
H'20A1 - Edge source:
F006 -> F6DBviaF6F3.3 - Trigger bit:
F6DB.5 - Table slot:
H'27C0->H'20A1 - Current-level tests: F6DB.5
- State writes: E82A
Button Matrix Entries With Serial Reports
| Source | Shadow bit | Dirty | Handler | Selector(s) | State writes |
|---|---|---|---|---|---|
F105 |
F6D4.6 |
F6F2.4 |
H'2048 |
0x006B |
E8D6 |
F105 |
F6D4.3 |
F6F2.4 |
H'1F40 |
0x0007 |
E80E |
F105 |
F6D4.2 |
F6F2.4 |
H'1EDE |
0x0017, 0x0018 |
E82E, E830 |
F105 |
F6D4.1 |
F6F2.4 |
H'1EA9 |
0x00F8 |
E9F0 |
F105 |
F6D4.0 |
F6F2.4 |
H'1E20 |
0x00B7, 0x00C4, 0x00C6, 0x0097 |
E96E, E988, E98C, E92E |
F106 |
F6D3.7 |
F6F2.3 |
H'1DCE |
0x0096 |
E92C |
F106 |
F6D3.6 |
F6F2.3 |
H'1D87 |
0x0097 |
E92E |
F106 |
F6D3.5 |
F6F2.3 |
H'1D56 |
0x001A |
E834 |
F106 |
F6D3.4 |
F6F2.3 |
H'1D25 |
0x001A |
E834 |
F106 |
F6D3.3 |
F6F2.3 |
H'1CF4 |
0x001A |
E834 |
F106 |
F6D3.2 |
F6F2.3 |
H'1CCE |
0x001A |
E834 |
F106 |
F6D3.1 |
F6F2.3 |
H'1CB2 |
0x001A |
E834 |
F109 |
F6D0.7 |
F6F2.0 |
H'24E8 |
0x008F |
E91E |
F109 |
F6D0.6 |
F6F2.0 |
H'252E |
0x008F |
E91E |
F109 |
F6D0.3 |
F6F2.0 |
H'24A9 |
0x0083 |
E906 |
F109 |
F6D0.2 |
F6F2.0 |
H'2408 |
0x0083 |
E906 |
F109 |
F6D0.1 |
F6F2.0 |
H'2390 |
0x0083 |
E906 |
F005 |
F6DC.7 |
F6F3.4 |
H'20F1 |
0x00B9 |
E972 |
F005 |
F6DC.5 |
F6F3.4 |
H'2204 |
0x0093 |
E926 |
F005 |
F6DC.4 |
F6F3.4 |
H'226D |
0x0093 |
E926 |
F005 |
F6DC.3 |
F6F3.4 |
H'22A6 |
0x0093 |
E926 |
F005 |
F6DC.1 |
F6F3.4 |
H'22FC |
0x0093 |
E926 |
F005 |
F6DC.0 |
F6F3.4 |
H'2326 |
0x0093 |
E926 |
F006 |
F6DB.7 |
F6F3.3 |
H'200E |
0x0013 |
E826 |
F006 |
F6DB.5 |
F6F3.3 |
H'20A1 |
0x0015 |
E82A |
F006 |
F6DB.3 |
F6F3.3 |
H'20BE |
0x009A |
E934 |
Practical Read
- CALL and CAM POWER do share the general panel edge path with many other buttons.
- The shared path is: panel byte snapshot -> shadow byte -> dirty bit ->
loc_1C0Ejump table -> handler ->loc_3E54report. - Other buttons diverge in their handlers: many require
F731/F730/F791session/menu gates, mutate page state, or emit different selectors. - Some table entries are
H'1C25, an immediateRTS, so those physical matrix positions are intentionally ignored in this firmware context.