diff --git a/emulator/RIO-NOTES.md b/emulator/RIO-NOTES.md index 909bd4a..c123aaa 100644 --- a/emulator/RIO-NOTES.md +++ b/emulator/RIO-NOTES.md @@ -210,6 +210,16 @@ No firmware source or image exists in the archive (searched sda4 + CODE for *.HEX/*.A51/*.S19/*.ROM and for the protocol constant names — only PCSPAK.ASM, the game side, matches). +**UPDATE 2026-07-04: steps 1-2 DONE.** The board's MCU is a **Toshiba +TMP68HC11** (read off the chip) and the user dumped the EPROM: +`emulator/rio-firmware/RIOv4_2.bin` (v4.2, 64KB image, code in +$C000-$FFFF). First-look analysis in `emulator/rio-firmware/README.md` — +reset vector $C000, **SCI serial interrupt vector → $D630** (the protocol +state machine's entry point for step 3's disassembly). Also new evidence +for the wedge shape: a button press revives a mute board (event path +alive, reply path dead), so step 4 should look for a reply-path-only dead +state reachable from the SCI handler. + ## Crash-on-advance fixed: arena terrain shadows With the RIO in sync the sim advances and the game crashed dereferencing the diff --git a/emulator/rio-firmware/README.md b/emulator/rio-firmware/README.md new file mode 100644 index 0000000..75bfb5b --- /dev/null +++ b/emulator/rio-firmware/README.md @@ -0,0 +1,38 @@ +# RIO board firmware + +- **`RIOv4_2.bin`** — RIO cockpit I/O board firmware **v4.2**, dumped + 2026-07-04 from one of our own boards' EPROM (64KB / 27C512-class image). + sha256 `60a88718835c654b6135dbec7721c40ef99dca07df2ad4b57eedeb24037a5f73`. + +## First-look analysis (from the image alone, confirmed on hardware) + +- MCU: **Toshiba TMP68HC11** (read off the chip; the code fingerprint + agrees — 6800-family opcodes with writes into the 68HC11 internal + register block at `$10xx`). +- Memory map: image is FF up to **0xC000**; 16KB of code occupies + `$C000-$FFFF` (EPROM mapped at the top of the HC11 address space). +- Startup at `$C000`: `SEI; LDS #$8000; STAA $1024 (TMSK2); + STAA $1022 (TMSK1); ...` then a long `JSR` init chain — textbook HC11 + bring-up. +- Vector table (`$FFD6-$FFFF`, big-endian): + - `$FFFE` RESET → `$C000` + - **`$FFD6` SCI (serial) → `$D630`** — the entry point of the board's + receive/protocol interrupt handler. The suspected board-side + DISABLE_AND_DIE-style wedge (see RIO-NOTES.md: the board mirrors the + game's PCSPAK state machine, and mash-stress leaves the reply path + dead while the button/event path stays alive) is reachable from here. + - `$FFE4` → `$C1B2`, `$FFE6` → `$C18E` (timer output-compares); most + other vectors → `$DB07..$DB3D` stubs. + +## Why this exists + +The remaining RIO reliability issue is board-side: under button-mash +stress the board's reply/analog state machine wedges (RX dead, TX alive; +a button press or power cycle revives it), reproduced identically on two +different USB serial adapters. The game-side half of the protocol was +binary-patched for tolerance (BTL4OPT patches v2-v4); the board firmware +is the other half. Plan (RIO-NOTES.md "Board firmware patch plan"): +disassemble as 68HC11 from `$C000` with the vector entries as roots, find +the SCI state machine (protocol constants FC=ACK FD=NAK FE=RESTART +FF=IDLE, idle-reload-4 patterns), patch the early-ACK/error wedge path or +widen its window, burn a new EPROM, keep this original safe. diff --git a/emulator/rio-firmware/RIOv4_2.bin b/emulator/rio-firmware/RIOv4_2.bin new file mode 100644 index 0000000..19c5fe1 --- /dev/null +++ b/emulator/rio-firmware/RIOv4_2.bin @@ -0,0 +1,38 @@ +$"f qFLiÐÙƽôýâë,ʽ5ӽ$$ J K M 4 7  N$ɽ|$!$B$C$G$E$I$F$J$$K$$H$1111% %!%"Ty1y~y˽y~<<67̽4hɜ$F$E32889}$I'|$J$J&$!'м$J$I9̭#""9    =  =   @#""9 #""9^ q9oZ&J&9í$E#; @&    @ @#; $I#;%;<<76 %;% +&~8 & +&G ~8& +&6 &0~$') +&  &&~8$!˧A%523889~;&F(;'~O& ̽;'~^& ;'u~o& 4;'d~€ & h;'S~‘& ɜ;'B~¢&%ұB;'\~¹&ҽJ;'H~Ё&*p;'4~˧; '~A|,$!9&ν~;'~~%~ÐÙi M9 K~S J91Ԣ%9 P۰d< 1 18Z&9" + 32< 1 18Z&z 3&9`!b>9H#ν>9H!½>9$>9H$T>9H$>9$Ļ3U9%08 (9 >9 >9oZ&9   Π)Π!Π#Π%Π' 9 Π) 9 Π! 9 Π# 9 Π% 9 Π' 9 + '>9$"91D1X 9i&$"1''X' +''9~~ƿâë$$!J1Ѱ$ɽ1S~bNJǵ$!99˽ 9~ƾi&1'~ƏLiÐÙƽôýâë,$$ J K M 4 7  N$ɽ|$!$B$C$G$E$I$F$J$$K$$H$1111% %!%"~ƾ&z~ƾ&Ċ~ƾ&Ě~ƾ&Ī~ƾ&ĺ9i&1$Gi&1$K$GH$?967<<-A-B;8832967<<-A-B$!;8832967<<-A-B%%;8832967<<-A-B%%;8832967<<-A-B1;8832967<<-A-B1;8832967<<-A-B1;8832967<<$!'0 '% +%-B -A<%%8z%&;88329$!'-A$ -B 7;9$!'#%-A$ -B% J;9$!'#%-A$ -B% K;99 LΠ( Π8 !ʗ #ʰ &   + 9 LΠ Π0 !ʗ #ʰ &    9 LΠ" Π2 !ʗ  #ʰ &     9 LΠ$ Π4 !ʗ  #ʰ &     9 LΠ& Π6 !ʗ  #ʰ &     9 ' L&#  H$ H~ʖ H~ʖ&#  H$ H~ʖ H~ʖ&#  H$ H~ʖ H~ʖ &#  H$ H~ʖ H~ʖ&  H$ H ~ʖ H 9  & ! %9< 89O_ % & #'|   ҽ9<6$!& 8  H  H 6I289<6$!& 8 % H & H 6I289 HDDDD9O L H 9 8962962962962962967<<  N P !̲8832967<<  N : P2: :!̲88329  4 4&~&O~&̀~ͱ "Z& 5 +< 1 18Z&z 5&z 4&9  + + 9 + +  9 + +   9 + + 9  6 5 NZ'D~&r~| z 5&z 6&967<< !:&7< 1 1 : N& J8~d K8$ Ȝ~l$ o8832967<< !:'@< 1 1 : N& J8~κ K8$ Ȝ~Ȇ$ J%o88329<6$!& 8 K H O L6I289 M& +$ ~$ # M& +$ +~0$ +967<< 7$B N$!P϶| NV!P϶| N܈!P϶ܺ!P϶| N!P϶!P϶P!P϶| N| N| N݂!P϶| Nݴ!P϶883299D967<<!R!PZ& 6 +< 1 18Z&z 6&8832967<