"""Dump what the coefficient-copy (0xf0411cd4, fst.d f16) writes into the region queues during the death-cam draw. If the payload is recognisable float coefficients (edge/plane A,B,C in a sane range) we can reconstruct terrain triangles WITHOUT decoding micro-code. If it's integer micro-code words, that confirms the hard path.""" import sys, time, struct, pickle sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp') import emu860, dis860, emu_main emu860.Mem.log = lambda self, *a, **k: None S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad' snap = pickle.load(open(S + r'\snapv2.pkl', 'rb')) r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000) cpu = r.cpu cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()} cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl']) cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc'] cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes() cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe']) cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t'] cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap']) COPY = 0xf0411cd4 # fst.d f16, per session 6e: coefficient/command copy writes = [] orig_w32 = emu860.Mem.w32 def w32(self, addr, val): if cpu.pc == COPY: writes.append((addr & 0xffffffff, val & 0xffffffff)) return orig_w32(self, addr, val) emu860.Mem.w32 = w32 t0 = time.time() target = r.qi + 1 while time.time() - t0 < 90: if len(writes) >= 400: break h = r.hooks.get(cpu.pc) if h: if h(cpu) == 'done': break continue if not cpu.step(): break emu860.Mem.w32 = orig_w32 print("captured %d word-writes at the coefficient copy" % len(writes)) # group into 8-byte doubles (fst.d = two 32-bit stores, addr and addr+4) i = 0; n = 0 while i < len(writes) - 1 and n < 60: a0, w0 = writes[i]; a1, w1 = writes[i + 1] if a1 == a0 + 4: dv = struct.unpack(' 1e-9 or w0 == 0): note = "dbl=%.5g" % dv print(" @%08x: %08x %08x %-16s f=(%.4g, %.4g)" % (a0, w0, w1, note, f0, f1)) i += 2; n += 1 else: print(" @%08x: %08x (single)" % (a0, w0)) i += 1; n += 1