Files
psxrecomp/tools/duck_query4.py
T
Matthew Stanley 685687f36f Restructure duckstation as submodule + patch; salvage TCP docs + debug_client
Recovery + restructure after rm -rf destroyed duckstation/build/ earlier this
session. Adopts the nesrecomp pattern (see F:/Projects/nesrecomp): pristine
upstream as submodule, our changes as a patch file that gets auto-applied by a
setup script.

Submodule:
- duckstation/ now pins stenzek/duckstation@ffb33c281 (release-20260328 era)
- .gitmodules records the pin; .gitignore stops ignoring the submodule path but
  still ignores build/ and dep/prebuilt/ (the submodule's own .gitignore also
  handles these)

Patch + setup:
- tools/duckstation/psxrecomp_oracle.patch (1187 lines, 7 files) captures our
  TCP debug-server on port 4371 plus the unfinished pc_break family of commands
  (with the VirtualMemoryAddress compile fix)
- tools/duckstation/setup.sh clones submodule, fetches + verifies + extracts
  prebuilt Windows deps, rewrites stale absolute paths baked into the prebuilt
  CMake metadata, applies the oracle patch. Idempotent.
- tools/duckstation/build.sh configures CMake (VS 17 2022) + runs MSBuild, then
  provisions bin/ with portable marker, BIOS copy, and settings.ini post-fixes
- tools/duckstation/README.md documents the layout, the regeneration flow, and
  the known headless-boot configuration issue

TCP documentation (salvaged from v3):
- TCP_COMMANDS.md: full command table with native (4370) / duckstation (4371)
  / both columns, reflecting actual v4 implementation including wtrace_* and
  pc_break/pc_hit_last families
- tools/debug_client.py: unified CLI from v3 (ports 4370/4371 match v4)
- DEBUG.md: merged v3's END-TO-END COMPLETION RULE, Stale Hypothesis Rule,
  TOOLING RULE, and TOOL LIFECYCLE RULE sections into v4's existing loop

Phase 4 diagnostic artefacts from this session:
- generated/relocation_proofs/vblank_registrar/ — corrected VBlank-stall
  diagnosis. Prior handoff claimed the shell VBlank handler was never installed;
  live TCP inspection of both runtime and DuckStation oracle proved handler IS
  installed at 0x800DFEE0. Real gap is one level up in the kernel IRQ chain at
  *(0xA000E014).
- tools/duck_query*.py, duck_search.py, disasm_ram.py, scan_*.py — focused
  probes used to establish the above; reusable against either server

CLAUDE.md §2 and new §15 document the submodule-based oracle setup and the
"never edit submodule, regenerate patch instead" rule.

Known issues (tracked in tools/duckstation/README.md):
- Fresh settings.ini doesn't complete BIOS boot under -nogui; one-time launch
  with GUI is required to warm up the settings before headless mode works

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 01:34:27 -07:00

80 lines
2.5 KiB
Python

"""Dump runtime A0/B0/C0 tables from DuckStation and search for VSync/registrar/init in each."""
import socket, json, time
HOST='127.0.0.1'; PORT=4371
def send(cmd, timeout=3.0):
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
s.connect((HOST,PORT))
s.sendall((json.dumps(cmd)+'\n').encode())
buf=b''
deadline = time.time()+timeout
while time.time()<deadline:
try: chunk=s.recv(65536)
except socket.timeout: break
if not chunk: break
buf+=chunk
if b'\n' in buf: break
s.close()
line = buf.split(b'\n',1)[0].decode()
if not line: return None
try: return json.loads(line)
except: return line
def read_ram(addr, length):
# Chunked
out = b''
off = 0
while off < length:
n = min(4096, length-off)
r = send({"cmd":"read_ram","addr":f"0x{addr+off:08X}","len":n})
if not r or not r.get('ok'): return None
out += bytes.fromhex(r['hex'])
off += n
return out
TARGETS = {
0x8005A5BC: 'handler',
0x8005A540: 'registrar',
0x8005A160: 'init_1FC42160',
0x8005A5FC: 'SetVSync/CRCNT',
0x8005A380: 'chain-install',
0x8005A424: 'cleanup',
0x80059C80: 'VSync(1FC41C80)',
0x80059FC0: 'InitRCnt(1FC41FC0)',
0x80059DA4: 'VSync-spin(1FC41DA4)',
0x8005A600: '0xBFC42600',
0x8005A640: '0xBFC42640',
0x8005A70C: '0xBFC4270C',
0x8005A090: 'jal-target(1FC42090)',
0x8005A910: 'jal-target(1FC42910)',
0x8005A980: 'jal-target(1FC42980)',
0x8005AC00: 'jal-target(1FC42C00)',
}
def table_dump(name, base, length):
d = read_ram(base, length)
if not d: print(f'{name}: read failed'); return
print(f'\n=== {name} @ 0x{base|0x80000000:08X} ({length} bytes) ===')
for i in range(0, len(d), 4):
if i+4 > len(d): break
w = int.from_bytes(d[i:i+4],'little')
annot = TARGETS.get(w, '')
if not annot and w != 0 and (w & 0xFFFFFFF0) in {t & 0xFFFFFFF0 for t in TARGETS}:
for t,n in TARGETS.items():
if (w & 0xFFFFFFF0) == (t & 0xFFFFFFF0):
annot = f'{n}+{w-t:+d}'
break
print(f' +0x{i:03X}: 0x{w:08X}' + (f' <-- {annot}' if annot else ''))
send({"cmd":"pause"})
time.sleep(0.3)
# A0 table = {ptr=0x00008648, size=0x2C0 = 704 bytes = 176 entries}
table_dump('A0 TABLE', 0x00008648, 0x2C0)
# B0 table = {ptr=0x00006EE0, size=0x320 = 800 bytes = 200 entries}
table_dump('B0 TABLE', 0x00006EE0, 0x320)
send({"cmd":"continue"})