Holm Tiffe wrote:
Mouse wrote:
[W]hen we
had problems like this we had to code up small runtime
routines to scan the memory space for what were JMP and JMP indirect
instructions in our Microdata 1621 object code to find out who was
connected to what.
Maybe if holme had such a routine he could run it
and find the
runtime setup ones.
Or throw grep at the text version of the disassaembly.
My disassembler was originally written specifically to pick apart a
captured malware binary, and it is most usable for jobs similar to
that. It's not "this is the only tool you'll need", but in my
experience it is a major help with such things - I used it for a Y2K
consulting gig back when Y2K was an issue (someone had an x86 binary
whose vendor no longer existed and found it had bugs).
Or maybe if one is lucky, the code you have at
0x04c8 is a table and
could just be dumped to continue the hunt.
Looking at what's at 4c8, I think more likely r8 is a pointer to some
kind of large state struct, with 4c8 an offset within that struct.
I probably will not have the leisure to look at this all that much more
anytime soon. There is a version of my disassembler up for anonymous
FTP (probably at least a little out of date) and the current source is
available for git clone; anyone who cares to is welcome to fetch it and
take over. I really should update the FTPable copy....
ftp.rodents-montreal.org:/mouse/disas/src/ is the FTPable copy; the git
repo is
git://git.rodents-montreal.org/Mouse/disas.
/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML mouse at
rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
I'm qouting from Roger Ivie (comp.sys.dec):
I am currently holding the following documents in my grubby little
fingers:
- Two copies of a rather hefty document titled "rtVAX 300 Hardware
Information Kit: Hardware User's Guide" (EK-382AB-UG-002).
- One copy of the depressingly slim "rtVAX 300 Hardware Information Kit:
Programmer's Guide" (EK-383AA-PG-001), which seems to be all about
writing VAXeln device drivers.
- One copy of the even slimmer "rtVAX 300 Release Notes" (EK-417AA-RN-001)
According to Chapter 6 (Console and Boot ROM Interface):
"The rtVAX 300 processor module does not contain an internal console
serial-line unit (SLU); however, 16 console registers are reserved in
the rtVAX 300 processor reserved space to select and program an external
Signetics 2681 console dual universal asynchronous receive/transmitter
(SCN 2681 DUART). These regosters occupy physical locations 201000000 to
2010003F. The built-in firmware of the rtVAX 300 programs and
communicates with the external SCN 2681 DUART, which implements these
console registers."
It then refers to table 3-13 for a list of the registers. That table
says:
20100000 Channel A mode registers (MRA1, MRA2) (R/W)
20100004 Channel A status register (R)
Channel A clock select register (CSRA) (W)
20100008 Reserved (R)
Channel A command register (CRA)
2010000C Channel A receive holding register (RHRA) (R)
Channel A transmit holding register (THRA) (W)
20100010 Input port change register (IPCR) (R)
Auxiliary control register (ACR) (W)
20100014 Channel A/B interrupt status register (ISR) (R)
Channel A/B interrupt mask register (IMR) (W)
20100018 Counter/timer interval register upper (CTU) (R)
Counter/timer interval register upper (CTUR) (W)
2010001C Counter/timer interval register lower (CTL) (R)
Counter/timer interval register lower (CTLR) (W)
20100020 Channel B mode register (MRB1, MRB2) (R/W)
20100024 Channel B status register (SRB) (R)
Channel B clock select register (CSRB) (W)
20100028 Reserved (R)
Channel B command register (CRB) (W)
2010002C Channel B receive holding register (RHRB) (R)
Channel B transmit holding register (THRB) (W)
20100030 Reserved (R/W)
20100034 Input port register (R)
Output port configuration register (OPCR) (W)
20100038 Start counter command register (R)
Set output port bits command register (W)
2010003c Stop counter command register (R)
Reset output port bits commnad register (W)
-- roger ivie rivie at
ridgenet.net
...so the SCN2681 seems to be the normal way to get some SLU's on a
rtVAX300 System and Dave should have one of them somwhere on his board
also.
Test:
>> d/b 2010000C 41
A
>> d/b 2010000C 42
B
>> d/b 2010000C 43
C
>>
:-)
Don't have much time the next days (mother in law is getting 60 today),
will test further after jan 1.
I wish you a happy new year...
Regards,
Holm
--
For those that are still interested, I've put threee images on
my website that show what is insife the VAX Brick.
http://www.tiffe.de/robotron/VAX/rtVAX300-internal-1.jpg
http://www.tiffe.de/robotron/VAX/rtVAX300-internal-2.jpg
http://www.tiffe.de/robotron/VAX/rtVAX300-outside.jpg
It is clear now, that the processor itself is containing some rom code,
there are 4 pcs. of I28F512 EEPROMs which may contain the system startup-
and console code, so the code of the EPROMs that I previously read out is
pretty much useless, since it contains only the "End User Application" in
this case VAXELN with the user programs. The serial Console drivers for
sure are in the EEPROMs in that brick...
Mouse, I've build your disass but since I know nothing about VAX Assembly
lanuage (huh? What's that cmp3 and cmp5 ... what powerful machine instructions)
im struggeling pretty much in the dark here..
Regards,
Holm
--
Technik Service u. Handel Tiffe,
www.tsht.de, Holm Tiffe,
Freiberger Stra?e 42, 09600 Obersch?na, USt-Id: DE253710583
www.tsht.de, info at tsht.de, Fax +49 3731 74200, Mobil: 0172 8790 741