"""From-scratch full-frame geometry from the micro-code. Hook the coefficient-copy; each time a SEND(addr,size) pair is written, read that payload block RIGHT THEN (before the double-buffer is overwritten), dedup by content, and extract the fixed-point screen coordinates it carries (words < 0x10000 whose value/256 lands in screen range). Plot all of them = the frame's geometry reconstructed from the compiled stream, terrain + object.""" import sys, time, struct, pickle, hashlib sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp') import emu860, dis860, emu_main emu860.Mem.log = lambda self, *a, **k: None S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad' snap = pickle.load(open(S + r'\snapv2.pkl', 'rb')) r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000) cpu = r.cpu cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()} cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl']) cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc'] cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes() cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe']) cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t'] cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap']) COPY = 0xf0411cd4 def rw(a): try: return cpu.mem.r32(a & 0xffffffff) except Exception: return 0 prims = {} # content-hash -> {'addr':, 'coords':[...], 'floats':[...]} pend = [] # pending copy words to pair up orig = emu860.Mem.w32 def read_payload(addr, size): ws = [rw(addr + 4 * i) for i in range(min(size, 80))] h = hashlib.md5(bytes(str(ws), 'ascii')).hexdigest()[:10] if h in prims: return coords = [] for w in ws: if 0 < w < 0x10000: v = w / 256.0 if 12.0 <= v <= 600.0: coords.append(round(v, 1)) prims[h] = {'addr': addr, 'coords': coords, 'nwords': len(ws)} def w32(self, addr, val): if cpu.pc == COPY: pend.append(val & 0xffffffff) if len(pend) >= 2: a, op = pend[-2], pend[-1] code = (op >> 28) & 0xf if code in (0x1, 0x9) and 0x08000000 <= a < 0x08100000: # SEND/SENDE read_payload(a, op & 0x7f) return orig(self, addr, val) emu860.Mem.w32 = w32 t0 = time.time() while time.time() - t0 < 200: if len(prims) >= 400: break h = r.hooks.get(cpu.pc) if h: if h(cpu) == 'done': break continue if not cpu.step(): break # stop once the draw's copy activity has clearly ended if len(prims) and (time.time() - t0) > 12 and r.qi > snap['qi'] + 1 and cpu.pc != COPY and len(pend) > 4 and (len(pend) & 1) == 0: pass emu860.Mem.w32 = orig allc = [c for p in prims.values() for c in p['coords']] print("distinct primitive payloads captured: %d (ran to cmd %d)" % (len(prims), r.qi)) print("total fixed-point screen coords extracted: %d" % len(allc)) if allc: print("coord range: [%.0f .. %.0f]" % (min(allc), max(allc))) # save + a 1D histogram of coords to see spread pickle.dump({'prims': prims}, open(S + r'\frame_geo.pkl', 'wb')) import collections hist = collections.Counter(int(c // 40) * 40 for c in allc) print("\ncoord spread (bucketed by 40):") for b in sorted(hist): print(" %3d-%3d: %s" % (b, b + 39, '#' * min(60, hist[b]))) # per-primitive summary print("\nfirst 12 primitives:") for i, (h, p) in enumerate(list(prims.items())[:12]): print(" %-10s @%#010x %2d coords: %s" % (h, p['addr'], len(p['coords']), p['coords'][:10]))