From 345f5ecce666beee113003e93396a770605a261c Mon Sep 17 00:00:00 2001 From: Christopher Williams Date: Thu, 24 Sep 2026 00:50:56 -0400 Subject: [PATCH] =?UTF-8?q?phase9:=20coordinator=20absorption=20=E2=80=94?= =?UTF-8?q?=202=20more=20regions=20(308=20regions=20/=20299=20distinct=20b?= =?UTF-8?q?odies)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coordinator absorbed partition B directly: 0x800F5AF8 (four pointer-slots stored from constants — the globals at 0x8011A9E4 are POINTER VALUES read by lw rt,sym then stored through, not direct symbol stores) and 0x80021FA8 (six 16-byte records, four fields zeroed via symbol+index, store-order fix). 0x800518BC recorded as a bounded return-merge negative. Gate MATCH whole-binary SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9. --- config/regions.tsv | 2 ++ src/func_80021FA8.c | 52 +++++++++++++++++++++++++++++++++++++++++++++ src/func_800F5AF8.c | 48 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+) create mode 100644 src/func_80021FA8.c create mode 100644 src/func_800F5AF8.c diff --git a/config/regions.tsv b/config/regions.tsv index 5e316ea..293ae8f 100644 --- a/config/regions.tsv +++ b/config/regions.tsv @@ -50,6 +50,7 @@ 0x80021F24 0x80021F50 src/func_80021F24.c 0x80021F50 0x80021F64 src/func_80021F50.c 0x80021F88 0x80021FA8 src/func_80021F88.c +0x80021FA8 0x80021FF4 src/func_80021FA8.c 0x80022A60 0x80022A98 src/func_80022A60.c 0x80022FB8 0x80022FCC src/func_80022FB8.c 0x80022FCC 0x80022FFC src/func_80022FCC.c @@ -227,6 +228,7 @@ 0x800F3A00 0x800F3A24 src/func_800F3A00.c 0x800F3E70 0x800F3E88 src/func_800F3E70.c 0x800F5200 0x800F521C src/func_800F5200.c +0x800F5AF8 0x800F5B40 src/func_800F5AF8.c 0x800F5B40 0x800F5B70 src/func_800F5B40.c 0x800F6570 0x800F6594 src/func_800F6570.c 0x800F75D0 0x800F760C src/func_800F75D0.c diff --git a/src/func_80021FA8.c b/src/func_80021FA8.c new file mode 100644 index 0000000..d673503 --- /dev/null +++ b/src/func_80021FA8.c @@ -0,0 +1,52 @@ +/* func_80021FA8 — 0x80021FA8..0x80021FF4 (76 bytes). + * + * Zeroes four fields of six 16-byte records starting at 0x8012627C. + * The base+index address is the symbol macro form (finding 1): the base is a + * symbol at 0x8012627C — `lui at,0x8012` / `addu at,at,v1` / `sw zero,%lo(at)` + * — and the four fields sit at offsets 0/4/8/12 relative to the record base. + * The walk is a bottom tested loop with the counter in v1. + * + * Original words (abridged): + * 0x00001821 move v1,zero + * loop: + * 0x3C018012 lui at,0x8012 + * 0x00230821 addu at,at,v1 + * 0xAC206280 sw zero,25216(at) ; field +0 + * 0x3C018012 lui at,0x8012 + * 0x00230821 addu at,at,v1 + * 0xAC20627C sw zero,25212(at) ; field -4 (record-relative) + * 0x3C018012 lui at,0x8012 + * 0x00230821 addu at,at,v1 + * 0xAC206284 sw zero,25220(at) ; field +8 + * 0x3C018012 lui at,0x8012 + * 0x00230821 addu at,at,v1 + * 0xAC206288 sw zero,25224(at) ; field +12 + * 0x24630010 addiu v1,v1,16 + * 0x28620060 slti v0,v1,96 + * 0x1440FFF1 bnez v0,loop + * 0x00000000 nop + * 0x03E00008 jr ra + * 0x00000000 nop + * + * The record base is 0x8012627C and 25212 = -4 relative to the highest + * displacement: the four fields are laid out as (base-4)..(base+12) with the + * record stride 16. The symbol is named D_8012627C from the offset arithmetic. + * + * LIMITS: the "records" reading (16-byte stride, 6 records) is derived from + * the loop geometry; the field meanings are unknown. Only the compiled bytes + * are evidence. + */ + +extern int D_8012627C; + +void func_80021FA8(void) +{ + int i; + + for (i = 0; i < 96; i += 16) { + *(int *)((char *)&D_8012627C + i + 4) = 0; + *(int *)((char *)&D_8012627C + i + 0) = 0; + *(int *)((char *)&D_8012627C + i + 8) = 0; + *(int *)((char *)&D_8012627C + i + 12) = 0; + } +} \ No newline at end of file diff --git a/src/func_800F5AF8.c b/src/func_800F5AF8.c new file mode 100644 index 0000000..50b1e32 --- /dev/null +++ b/src/func_800F5AF8.c @@ -0,0 +1,48 @@ +/* func_800F5AF8 — 0x800F5AF8..0x800F5B40 (72 bytes). + * + * Stores four constants into four fixed globals at 0x8011A9E4..0x8011A9F0. + * The globals are loaded ABSOLUTELY (finding 2's same-register `lw rt,sym` + * macro: `lui v0,0x8012` / `lw v0,-22044(v0)`), so the symbols are named + * from their effective addresses and resolve implicitly. + * + * Original words: + * 0x3C030400 lui v1,0x400 + * 0x3C028012 lui v0,0x8012 + * 0x8C42A9E4 lw v0,-22044(v0) ; v0 = D_8011A9E4 + * 0x34630002 ori v1,v1,0x2 + * 0xAC430000 sw v1,0(v0) ; D_8011A9E4 = 0x4000002 + * 0x3C028012 lui v0,0x8012 + * 0x8C42A9E8 lw v0,-22040(v0) ; v0 = D_8011A9E8 + * 0x00000000 nop + * 0xAC440000 sw a0,0(v0) ; D_8011A9E8 = a0 + * 0x3C028012 lui v0,0x8012 + * 0x8C42A9EC lw v0,-22036(v0) ; v0 = D_8011A9EC + * 0x3C030100 lui v1,0x100 + * 0xAC400000 sw zero,0(v0) ; D_8011A9EC = 0 + * 0x3C028012 lui v0,0x8012 + * 0x8C42A9F0 lw v0,-22032(v0) ; v0 = D_8011A9F0 + * 0x34630401 ori v1,v1,0x401 + * 0x03E00008 jr ra + * 0xAC430000 sw v1,0(v0) ; D_8011A9F0 = 0x1000401 (jr slot) + * + * The constants interleave with the symbol loads in cc1's order: the 0x4000002 + * is materialised before its store, 0x1000401 after. Writing the stores in the + * byte order of the original reproduces that. + * + * LIMITS: the globals are named D_8011A9E4..F0 from the absolute addresses; + * their meaning is unknown. The argument is stored raw (a0). Only the + * compiled bytes are evidence. + */ + +extern int D_8011A9E4; +extern int D_8011A9E8; +extern int D_8011A9EC; +extern int D_8011A9F0; + +void func_800F5AF8(int value) +{ + *(int *)D_8011A9E4 = 0x4000002; + *(int *)D_8011A9E8 = value; + *(int *)D_8011A9EC = 0; + *(int *)D_8011A9F0 = 0x1000401; +} \ No newline at end of file