TC800汇编资料（反汇编了内核）！

yan · 发表于 2007-12-31 23:14:13

呵呵，180元又买了个TC800，根据leesoft的提示，TC800是凌阳16位单片机，于是就借了凌阳16位单片机相关的书，下载了unSP IDE 2.0.0，了解了汇编指令集，在无意中发现TC800.bin用的是这种指令集，于是就匆忙写了个反汇编器，反了TC800.bin，找了找，终于找到了虚拟机的入口,可以在TC800中弄个汇编接口，废话就不说了，以下是各种资料。

首先，你得了解凌阳16位单片机的相关资料，http://www.sunplusmcu.com/里可以找到16位单片机的编程资料和数据手册，了解汇编指令的芯片结构。
以下是我的一些发现：
0x0: 数据堆栈指针
0xbc: 数据堆栈
0x210: 屏幕缓冲区
0xf1a: _TEXT
0x8000: _GRAPH
0x210: _GBUF
0x236: 图形模式
0x237: 前景色
0x238: 背景色
0xc06: 屏幕亮度
0x12: 临时字符串缓冲区指针
0xfe2: 临时字符串缓冲区
内存在0x13页

CALL 8:8fce //从数据堆栈中弹出1个数据放入地址0x3,0x4中
CALL 8:8fe6 //从数据堆栈中弹出1个数据放入地址0x5,0x6中
CALL 8:8ff2 //从数据堆栈中弹出2个数据放入地址0x3,0x4,0x5,0x6中

//==================================================
// 虚拟指令跳转表
//==================================================
// 基本指令
// 00 01 02 03 04 05 06 07
8:91ba:    .DW 0x8bbd, 0x8bbe, 0x8bcb, 0x8be2, 0x8bfc, 0x8c07, 0x8c16, 0x8c2a,
// 08 09 0a 0b 0c 0d 0e 0f
   .DW 0x8c34, 0x8c46, 0x8c62, 0x8c6c, 0x8c76, 0x901f, 0x8c80, 0x8c85,
// 10 11 12 13 14 15 16 17
   .DW 0x8c8e, 0x8c2f, 0x8c3d, 0x8c54, 0x8c67, 0x8c71, 0x8c7b, 0x8c9c,
// 18 19 1a 1b 1c 1d 1e 1f
   .DW 0x8ca1, 0x8ca6, 0x9035, 0x903c, 0x8cba, 0x8cc0, 0x8cea, 0x8cf2,
// 20 21 22 23 24 25 26 27
   .DW 0x8cfa, 0x8d2b, 0x8d31, 0x8d73, 0x8d79, 0x8d91, 0x8d7f, 0x8da3,
// 28 29 2a 2b 2c 2d 2e 2f
   .DW 0x8dad, 0x8db7, 0x8d37, 0x8d44, 0x8d51, 0x8d85, 0x8d8b, 0x8dd4,
// 30 31 32 33 34 35 36 37
   .DW 0x8dec, 0x8de4, 0x8ddc, 0x8dbe, 0x8dcc, 0x8df4, 0x8e15, 0x8e3c,
// 38 39 3a 3b 3c 3d 3e 3f
   .DW 0x8fda, 0x8eb6, 0x8ee7, 0x8ebf, 0x8f5c, 0x8ef0, 0x8f0b, 0x8f44,
// 40 41 42 43 44 45 46 47
   .DW 0x9057, 0x8f66, 0x9043, 0x9030, 0x904a, 0x8e4e, 0x8e56, 0x8e5e,
// 48 49 4a 4b 4c 4d 4e 4f
   .DW 0x8e64, 0x8e6a, 0x8e70, 0x8e78, 0x8e80, 0x8e86, 0x8e8c, 0x8e92,
// 50 51 52 53 54 55 56 57
   .DW 0x8e98, 0x8e9e, 0x8e1e, 0x8e2b, 0x9075, 0x907f, 0x90a0, 0x90d8,
// 58 59 5a 5b 5c 5d 5e 5f
   .DW 0x9110, 0x90ae, 0x90e6, 0x911e, 0x90bc, 0x90f4, 0x912c, 0x90ca,
// 60 61 62 63 64 65 66 67
   .DW 0x9102, 0x913a, 0x9148, 0x9154, 0x9163, 0x9171, 0x91a4, 0x9187,
// 68 69 6a 6b 6c 6d
   .DW 0x9195, 0x91b2, 0x8e42, 0x8e48, 0x908b, 0x9095
// 函数指令 ===========================================================================
// 80 81 82 83 84 85 86 87
8:9228:    .DW 0x927d, 0x927f, 0x9281, 0x9283, 0x9285, 0x9287, 0x9289, 0x928b,
// 88 89 8a 8b 8c 8d 8e 8f
   .DW 0x928d, 0x928f, 0x9291, 0x9293, 0x9295, 0x9297, 0x9299, 0x929b,
// 90 91 92 93 94 95 96 97
   .DW 0x929d, 0x929f, 0x92a1, 0x92a3, 0x92a5, 0x92a7, 0x92a9, 0x92ab,
// 98 99 9a 9b 9c 9d 9e 9f
   .DW 0x92ad, 0x92af, 0x92b1, 0x92b3, 0x92b5, 0x92b7, 0x92b9, 0x92bb,
// a0 a1 a2 a3 a4 a5 a6 a7
   .DW 0x92bd, 0x92bf, 0x92c1, 0x92c3, 0x92c5, 0x92c7, 0x92c9, 0x92cb,
// a8 a9 aa ab ac ad ae af
   .DW 0x92cd, 0x92cf, 0x92d1, 0x92d3, 0x92d5, 0x92d7, 0x92d9, 0x92db,
// b0 b1 b2 b3 b4 b5 b6 b7
   .DW 0x92dd, 0x92df, 0x92e1, 0x92e3, 0x92e5, 0x92e7, 0x92e9, 0x92eb,
// b8 b9 ba bb bc bd be bf
   .DW 0x92ed, 0x92ef, 0x92f1, 0x92f3, 0x92f5, 0x92f7, 0x92f9, 0x92fb,
// c0 c1 c2 c3 c4 c5 c6 c7
   .DW 0x92fd, 0x92ff, 0x9301, 0x9303, 0x9305, 0x9307, 0x9309, 0x930b,
// c8 c9 ca cb cc cd ce cf
   .DW 0x930d, 0x930f, 0x9311, 0x9318, 0x931a, 0x931c, 0x931e, 0x9320,
// d0 d1 d2 d3 d4
   .DW 0x0000, 0x9322, 0x9324, 0x9326, 0x9328

8:927d: fe89 e51a GOTO 9:e51a //putchar
8:927f: fe89 2a93 GOTO 9:2a93 //getchar
8:9281: fe89 e59b GOTO 9:e59b //printf
8:9283: fe89 fd43 GOTO 9:fd43 //strcpy
8:9285: fe89 fd4d GOTO 9:fd4d //strlen
8:9287: fe89 e4d4 GOTO 9:e4d4 //SetScreen
8:9289: fe89 e514 GOTO 9:e514 //UpdataLCD
8:928b: fe89 2bdb GOTO 9:2bdb //Delay
8:928d: fe88 253b GOTO 8:253b //WriteBlock
8:928f: fe88 22af GOTO 8:22af //Refresh
8:9291: fe88 246b GOTO 8:246b //TextOut
8:9293: fe88 21a8 GOTO 8:21a8 //Block
8:9295: fe88 21ac GOTO 8:21ac //Rectangle
8:9297: fe88 9057 GOTO 8:9057 //exit
8:9299: fe88 229f GOTO 8:229f //ClearScreen
8:929b: fe8a  780 GOTO 10:780 //abs
8:929d: fe8a  789 GOTO 10:789 //rand
8:929f: fe8a  7a6 GOTO 10:7a6 //srand
8:92a1: fe89 e4ed GOTO 9:e4ed //Locate
8:92a3: fe89 2ab8 GOTO 9:2ab8 //Inkey
8:92a5: fe88 1ea9 GOTO 8:1ea9 //Point
8:92a7: fe88 1f1f GOTO 8:1f1f //GetPoint
8:92a9: fe88 1f85 GOTO 8:1f85 //Line
8:92ab: fe88 21b0 GOTO 8:21b0 //Box
8:92ad: fe88 1fff GOTO 8:1fff //Circle
8:92af: fe88 20a0 GOTO 8:20a0 //Ellipse
8:92b1: fe89 2a90 GOTO 9:2a90 //Beep
8:92b3: fe89 fdd4 GOTO 9:fdd4 //isalnum
8:92b5: fe89 fdce GOTO 9:fdce //isalpha
8:92b7: fe89 fde1 GOTO 9:fde1 //iscntrl
8:92b9: fe89 fdc8 GOTO 9:fdc8 //isdigit
8:92bb: fe89 fdee GOTO 9:fdee //isgraph
8:92bd: fe89 fdc2 GOTO 9:fdc2 //islower
8:92bf: fe89 fde7 GOTO 9:fde7 //isprint
8:92c1: fe89 fdb0 GOTO 9:fdb0 //ispunct
8:92c3: fe89 fdf7 GOTO 9:fdf7 //isspace
8:92c5: fe89 fdb6 GOTO 9:fdb6 //isupper
8:92c7: fe89 fdda GOTO 9:fdda //isxdigit
8:92c9: fe89 fd59 GOTO 9:fd59 //strcat
8:92cb: fe89 fd66 GOTO 9:fd66 //strchr
8:92cd: fe89 fd7c GOTO 9:fd7c //strcmp
8:92cf: fe89 fd95 GOTO 9:fd95 //strstr
8:92d1: fe89 fe11 GOTO 9:fe11 //tolower
8:92d3: fe89 fe24 GOTO 9:fe24 //toupper
8:92d5: fe89 fe38 GOTO 9:fe38 //memset
8:92d7: fe89 fe4a GOTO 9:fe4a //memcpy
8:92d9: fe89 9dc9 GOTO 9:9dc9 //fopen
8:92db: fe89 9e1e GOTO 9:9e1e //fclose
8:92dd: fe89 9f34 GOTO 9:9f34 //fread
8:92df: fe89 9f0c GOTO 9:9f0c //fwrite
8:92e1: fe89 9e44 GOTO 9:9e44 //fseek
8:92e3: fe89 9e9a GOTO 9:9e9a //ftell
8:92e5: fe89 9e30 GOTO 9:9e30 //feof
8:92e7: fe89 9ef8 GOTO 9:9ef8 //rewind
8:92e9: fe89 9eaa GOTO 9:9eaa //getc
8:92eb: fe89 9ecd GOTO 9:9ecd //putc
8:92ed: fe89 e642 GOTO 9:e642 //sprintf
8:92ef: fe89 9da2 GOTO 9:9da2 //MakeDir
8:92f1: fe89 9db1 GOTO 9:9db1 //DeleteFile
8:92f3: fe89 2bd4 GOTO 9:2bd4 //Getms
8:92f5: fe89 2b03 GOTO 9:2b03 //CheckKey
8:92f7: fe89 fe5b GOTO 9:fe5b //memmove
8:92f9: fe89 dc26 GOTO 9:dc26 //Crc16
8:92fb: fe89 dc4a GOTO 9:dc4a //Secret
8:92fd: fe89 9d82 GOTO 9:9d82 //ChDir
8:92ff: fe89 9d8c GOTO 9:9d8c //FileList
8:9301: fe8a  fb8 GOTO 10:fb8 //GetTime
8:9303: fe8a  fe9 GOTO 10:fe9 //SetTime
8:9305: fe89 2a91 GOTO 9:2a91 //GetWord
8:9307: fe88 256a GOTO 8:256a //XDraw
8:9309: fe89 2add GOTO 9:2add //ReleaseKey
8:930b: fe88 27bc GOTO 8:27bc //GetBlock
8:930d: fe8a  819 GOTO 10:819 //Sin
8:930f: fe8a  83c GOTO 10:83c //Cos
8:9311: f048 8fce CALL 8:8fce //FillArea
8:9313: f048 8fce CALL 8:8fce
8:9315: f048 8fce CALL 8:8fce
8:9317: 9a90    POP PC, SR from [SP]
8:9318: fe89 2bfe GOTO 9:2bfe //SetGraphMode
8:931a: fe89 2c29 GOTO 9:2c29 //SetBgColor
8:931c: fe89 2c30 GOTO 9:2c30 //SetFgColor
8:931e: fe8a  b1b GOTO 10:b1b //SetList
8:9320: fe88 283c GOTO 8:283c //Fade
8:9322: fe8a  b2a GOTO 10:b2a //FindFile
8:9324: fe8a  b62 GOTO 10:b62 //GetFileNum
8:9326: fe89 2c8f GOTO 9:2c8f //System
8:9328: fe8a 7bb1 GOTO 10:7bb1 //Math

[ 本帖最后由 yan 于 2008-1-1 15:22 编辑 ]

yan · 发表于 2007-12-31 23:25:25

TC800的硬件结构：
CPU具有访问4M字的能力，即有22条地址线，由页码和偏移量组成。每页64K字（即128KB）
0x00页被cpu占用，0x0000～0x2000为cpu ram，0x7000～0x7fff为IO端口，0x8000～0xffff为32K字的rom
0x01～0x11页为外部nor。
0x12页文件系统占用。
0x13～0x14为外部ram（共256KB）。
我会一直更新的。

附件是00页到0f页的反汇编代码。

[ 本帖最后由 yan 于 2008-1-1 15:33 编辑 ]

yan · 发表于 2007-12-31 23:39:17

贴出一段代码看看：

//==================================================
// lvmcode 8e ClearScreen
8:229e: f SP = SP + [BP+0xf]
8:229f: 970b 210 R3 = 0x210
8:22a1: 9240 R1 = 0x0
8:22a2: 9512 236 R2 = [0x236]
8:22a4: 4441 CMP R2 , 0x1
8:22a5: 4e06 JNE_NZ 0x822ac
8:22a6: 950a 320 R2 = 0x320
8:22a8: d2f3 DS:[R3++] = R1
8:22a9: 2441 R2 = R2 - 0x1
8:22aa: 4e43 JNE_NZ 0x822a8
8:22ab: 9a90 POP PC, SR from [SP]
8:22ac: 950a c80 R2 = 0xc80
8:22ae: ee47 JMP 0x822a8
//==================================================
// lvmcode 89 Refresh
8:22af: 970b 210 R3 = 0x210
8:22b1: 990c 8000 R4 = 0x8000
8:22b3: 9512 236 R2 = [0x236]
8:22b5: 4441 CMP R2 , 0x1
8:22b6: 4e0e JNE_NZ 0x822c5
8:22b7: 9b0d 50 BP = 0x50
8:22b9: 9449 R2 = 0x9
8:22ba: 92f3 R1 = DS:[R3++]
8:22bb: b309 7fff R1 = R1 & 0x7fff
8:22bd: d2f4 DS:[R4++] = R1
8:22be: 92f3 R1 = DS:[R3++]
8:22bf: d2f4 DS:[R4++] = R1
8:22c0: 2441 R2 = R2 - 0x1
8:22c1: 4e44 JNE_NZ 0x822be
8:22c2: 2a41 BP = BP - 0x1
8:22c3: 4e4b JNE_NZ 0x822b9
8:22c4: 9a90 POP PC, SR from [SP]
8:22c5: 9b0d 50 BP = 0x50
8:22c7: 9467 R2 = 0x27
8:22c8: 92f3 R1 = DS:[R3++]
8:22c9: b309 fff R1 = R1 & 0xfff
8:22cb: d2f4 DS:[R4++] = R1
8:22cc: 92f3 R1 = DS:[R3++]
8:22cd: d2f4 DS:[R4++] = R1
8:22ce: 2441 R2 = R2 - 0x1
8:22cf: 4e44 JNE_NZ 0x822cc
8:22d0: 2a41 BP = BP - 0x1
8:22d1: 4e4b JNE_NZ 0x822c7
8:22d2: 9a90 POP PC, SR from [SP]

复制代码

萧竹 · 发表于 2007-12-31 23:45:02

嗯,好东西,虽然现在TC800的时代过去了...

BY THE WAY,新年快乐!!!

MetalMax · 发表于 2007-12-31 23:47:03

嘿嘿````赞一个

顺便问一下>>>YAN难不成要搞TC800的LAVA的嵌入式汇编???

[ 本帖最后由 MetalMax 于 2007-12-31 23:48 编辑 ]

yan · 发表于 2007-12-31 23:53:59

自己写的反汇编器，呵呵，很乱。里面的nor.bin是TC800.bin加上00~02页的数据合成的。（00～02页的数据用System.RamRead读取）纠正一个错误:call和goto跳转地址中的页是16进制的。

[ 本帖最后由 yan 于 2008-1-4 12:05 编辑 ]

yan · 发表于 2007-12-31 23:58:04

原帖由 MetalMax 于 2007-12-31 23:47 发表
嘿嘿````赞一个
顺便问一下>>>YAN难不成要搞TC800的LAVA的嵌入式汇编???

有这个想法。

yan · 发表于 2007-12-31 23:58:30

新年快乐!!

wxx001 · 发表于 2008-1-1 09:38:25

我的tc800屏幕坏了～

116205035 · 发表于 2008-1-1 10:26:30

顶一个！~

tangbob · 发表于 2008-1-1 10:39:27

新年快乐！
支持下TC800汇编

Eastsun · 发表于 2008-1-1 11:59:17

很好,很强大!

萧竹 · 发表于 2008-1-1 12:11:35

嗯,不知道这个对以后TC800会有多大影响
PS: LS貌似好久没见啦~~新年快乐!

dragonflying · 发表于 2008-1-1 12:16:31

唔，是啊是啊，以后汇编区会出现16位单片机的。

czy10 · 发表于 2008-1-1 13:33:06

我想知道，这个东东有什么用途？

西湖绿雨 · 发表于 2008-1-1 13:47:28

加亮了,支持个

520madi · 发表于 2008-1-1 14:28:12

支持

yan · 发表于 2008-1-1 19:48:12

TC800 CPU的频率是假的。用了两个延时函数就把我们忽悠了。
请看以下代码：

6:c64d: .DW "TC800 CPU TEST...", 0x0
6:c657: .DW "51.6096MHz", 0x0
6:c65d: .DW "CPU TEST OK", 0x0
//==================================================
// 主频测试
6:c664: da88 PUSH BP, BP to [SP]
6:c665: 204a SP = SP - 0xa
6:c666: b08 1 BP = SP + 0x1
6:c668: d001 [BP+0x1] = SP
6:c669: 9309 4f R1 = 0x4f //79
6:c66b: d2c8 [SP--] = R1
6:c66c: 950a 9f R2 = 0x7f //159
6:c66e: d4c8 [SP--] = R2
6:c66f: 9240 R1 = 0x0
6:c670: d2c8 [SP--] = R1
6:c671: d2c8 [SP--] = R1
6:c672: f04a 7def CALL a:7def//清屏
6:c674: 44 SP = SP + 0x4
6:c675: 950a c64d R2 = 0xc64d
6:c677: 9246 R1 = 0x6
6:c678: d404 [BP+0x4] = R2
6:c679: d205 [BP+0x5] = R1
6:c67a: 9204 R1 = [BP+0x4]
6:c67b: 9405 R2 = [BP+0x5]
6:c67c: d490 PUSH R1, R2 to [SP]
6:c67d: 9440 R2 = 0x0
6:c67e: d4c8 [SP--] = R2
6:c67f: d4c8 [SP--] = R2
6:c680: f049 f826 CALL 9:f826//打印TC800 CPU TEST...
6:c682: 44 SP = SP + 0x4
6:c683: 950a c657 R2 = 0xc657
6:c685: 9246 R1 = 0x6
6:c686: d406 [BP+0x6] = R2
6:c687: d207 [BP+0x7] = R1
6:c688: 9206 R1 = [BP+0x6]
6:c689: 9407 R2 = [BP+0x7]
6:c68a: d490 PUSH R1, R2 to [SP]
6:c68b: 9450 R2 = 0x10
6:c68c: d4c8 [SP--] = R2
6:c68d: 9240 R1 = 0x0
6:c68e: d2c8 [SP--] = R1
6:c68f: f049 f826 CALL 9:f826//打印51.6096MHz
6:c691: 9441 R2 = 0x1
6:c692: d4c8 [SP--] = R2
6:c693: f046 c146 CALL 6:c146//延时
6:c695: 9241 R1 = 0x1
6:c696: d2c8 [SP--] = R1
6:c697: f046 c146 CALL 6:c146//延时
6:c699: 46 SP = SP + 0x6
6:c69a: 950a c65d R2 = 0xc65d
6:c69c: 9246 R1 = 0x6
6:c69d: d408 [BP+0x8] = R2
6:c69e: d209 [BP+0x9] = R1
6:c69f: 9208 R1 = [BP+0x8]
6:c6a0: 9409 R2 = [BP+0x9]
6:c6a1: d490 PUSH R1, R2 to [SP]
6:c6a2: 9460 R2 = 0x20
6:c6a3: d4c8 [SP--] = R2
6:c6a4: 9240 R1 = 0x0
6:c6a5: d2c8 [SP--] = R1
6:c6a6: f049 f826 CALL 9:f826//打印CPU TEST OK
6:c6a8: 9441 R2 = 0x1
6:c6a9: d4c8 [SP--] = R2
6:c6aa: f046 c146 CALL 6:c146//延时
6:c6ac: 45 SP = SP + 0x5
6:c6ad: 4a SP = SP + 0xa
6:c6ae: 9888 POP BP, BP from [SP]
6:c6af: 9a90 POP PC, SR from [SP]

复制代码

leesoft · 发表于 2008-1-1 19:54:04

说的不对
频率接近实测，显示程序在糊弄人
真佩服写这段代码的coder

116205035 · 发表于 2008-1-1 21:35:39

汗，用延迟来糊弄人，这CODER恶心！

		自动登录	找回密码
密码			加入易码